@astram/engine 0.4.0 → 0.5.1

package/dist/index.d.ts

@@ -11,9 +11,11 @@
  *
  * FRAMEWORK-FACING (composition/tests; a FEATURE must NOT import these — the app's
  * architectural lint rule blocks raw DB access under src/features/**):
- *  - the adapters (`MariaDbUnitOfWork`, `MariaDbAuditSink`), the `RecordEngineImpl`,
- *    the `TableRegistry`, and the ports. Exported so the framework + integration
- *    tests can compose the engine directly; NOT for feature code.
+ *  - the `MariaDbAuditSink` adapter, the `RecordEngineImpl`, the `TableRegistry`, and the
+ *    ports. Exported so the framework + integration tests can compose the engine
+ *    directly; NOT for feature code.
+ *  - The raw unit of work (`MariaDbUnitOfWork`, it owns a pool) is NOT here: it is on
+ *    `@astram/engine/internal`, which only the composition root may import.
  */
 export type { RecordEngine, AccessDeclaration, FieldSpec, FieldType, TrustedSource, IdentityRole, PkStrategy, JunctionSpec, RecordInput, RecordId, RecordView, ListQuery, RecordPage, Principal, ReadScope, ReadScopeCreateMode, } from './types.js';
 export { READ_SCOPE_NODES_TOKEN } from './types.js';
@@ -24,7 +26,7 @@ export { EngineModule, RECORD_ENGINE, ENGINE_ALL_REGISTRATIONS, ENGINE_ALL_ACCES
 export { TableRegistry, columnOf, uuidPkColumn, isOwned, ownerColumn, tenantColumnOf, columnForRole, requireRole, } from './registry.js';
 export { RecordEngineImpl, type RecordEngineDeps } from './pipe/record-engine.js';
 export { RecordsService, BoundRecords, type ServiceAccountResolver, SERVICE_ACCOUNT_RESOLVER, } from './pipe/records-service.js';
-export { MariaDbUnitOfWork, type EngineDbConfig } from './adapters/mariadb-unit-of-work.js';
+export type { EngineDbConfig } from './adapters/mariadb-unit-of-work.js';
 export { MariaDbAuditSink, type AuditSinkConfig } from './adapters/mariadb-audit-sink.js';
 export type { QueryFn, UnitOfWork, DecisionPort, AuditPort } from './ports.js';
 export type { Stage, WriteContext, WriteOp, PipeBase } from './pipe/context.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,SAAS,EACT,aAAa,EACb,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,UAAU,EACV,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAKpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAiBrB,OAAO,EACL,UAAU,EACV,KAAK,EACL,UAAU,EACV,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,uCAAuC,CAAC;AAO/C,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,OAAO,EACP,WAAW,EACX,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,KAAK,sBAAsB,EAC3B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAC1F,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC/E,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,SAAS,EACT,aAAa,EACb,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,UAAU,EACV,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAKpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAiBrB,OAAO,EACL,UAAU,EACV,KAAK,EACL,UAAU,EACV,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,uCAAuC,CAAC;AAO/C,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,OAAO,EACP,WAAW,EACX,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,KAAK,sBAAsB,EAC3B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAC1F,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC/E,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -12,12 +12,14 @@
  *
  * FRAMEWORK-FACING (composition/tests; a FEATURE must NOT import these — the app's
  * architectural lint rule blocks raw DB access under src/features/**):
- *  - the adapters (`MariaDbUnitOfWork`, `MariaDbAuditSink`), the `RecordEngineImpl`,
- *    the `TableRegistry`, and the ports. Exported so the framework + integration
- *    tests can compose the engine directly; NOT for feature code.
+ *  - the `MariaDbAuditSink` adapter, the `RecordEngineImpl`, the `TableRegistry`, and the
+ *    ports. Exported so the framework + integration tests can compose the engine
+ *    directly; NOT for feature code.
+ *  - The raw unit of work (`MariaDbUnitOfWork`, it owns a pool) is NOT here: it is on
+ *    `@astram/engine/internal`, which only the composition root may import.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MariaDbAuditSink = exports.MariaDbUnitOfWork = exports.SERVICE_ACCOUNT_RESOLVER = exports.BoundRecords = exports.RecordsService = exports.RecordEngineImpl = exports.requireRole = exports.columnForRole = exports.tenantColumnOf = exports.ownerColumn = exports.isOwned = exports.uuidPkColumn = exports.columnOf = exports.TableRegistry = exports.ENGINE_ALL_ACCESS_BUNDLES = exports.ENGINE_ALL_REGISTRATIONS = exports.RECORD_ENGINE = exports.EngineModule = exports.reflectAccessBundle = exports.AccessBundle = exports.reflectObjectType = exports.PrimaryKey = exports.Field = exports.ObjectType = exports.EngineUnavailableError = exports.ValidationError = exports.AuthorizationDeniedError = exports.RegistrationError = exports.CapabilityNotSupportedError = exports.EngineError = exports.READ_SCOPE_NODES_TOKEN = void 0;
+exports.MariaDbAuditSink = exports.SERVICE_ACCOUNT_RESOLVER = exports.BoundRecords = exports.RecordsService = exports.RecordEngineImpl = exports.requireRole = exports.columnForRole = exports.tenantColumnOf = exports.ownerColumn = exports.isOwned = exports.uuidPkColumn = exports.columnOf = exports.TableRegistry = exports.ENGINE_ALL_ACCESS_BUNDLES = exports.ENGINE_ALL_REGISTRATIONS = exports.RECORD_ENGINE = exports.EngineModule = exports.reflectAccessBundle = exports.AccessBundle = exports.reflectObjectType = exports.PrimaryKey = exports.Field = exports.ObjectType = exports.EngineUnavailableError = exports.ValidationError = exports.AuthorizationDeniedError = exports.RegistrationError = exports.CapabilityNotSupportedError = exports.EngineError = exports.READ_SCOPE_NODES_TOKEN = void 0;
 // The read-scope subtree-id placeholder token (ADR-0027) — a `subtreeSubquery` template
 // uses it; the engine expands it to a `?`-list. Exported so per-type declarations can
 // reference the canonical token (rather than a stringly-typed duplicate).
@@ -79,7 +81,5 @@ var records_service_js_1 = require("./pipe/records-service.js");
 Object.defineProperty(exports, "RecordsService", { enumerable: true, get: function () { return records_service_js_1.RecordsService; } });
 Object.defineProperty(exports, "BoundRecords", { enumerable: true, get: function () { return records_service_js_1.BoundRecords; } });
 Object.defineProperty(exports, "SERVICE_ACCOUNT_RESOLVER", { enumerable: true, get: function () { return records_service_js_1.SERVICE_ACCOUNT_RESOLVER; } });
-var mariadb_unit_of_work_js_1 = require("./adapters/mariadb-unit-of-work.js");
-Object.defineProperty(exports, "MariaDbUnitOfWork", { enumerable: true, get: function () { return mariadb_unit_of_work_js_1.MariaDbUnitOfWork; } });
 var mariadb_audit_sink_js_1 = require("./adapters/mariadb-audit-sink.js");
 Object.defineProperty(exports, "MariaDbAuditSink", { enumerable: true, get: function () { return mariadb_audit_sink_js_1.MariaDbAuditSink; } });

package/dist/internal.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @astram/engine/internal — composition-root and framework-test surface (Phase 8 #5).
+ *
+ * The raw unit of work is NOT on the package entry point (`@astram/engine`): feature code gets
+ * only the RecordEngine facade (`RECORD_ENGINE` / `RecordsService`). Wiring code (an app's
+ * `src/app.module.ts` / `src/main.ts`, and framework tests) imports the unit of work from here;
+ * the scaffolded app's lint wall rejects this subpath everywhere else.
+ */
+export { MariaDbUnitOfWork, type EngineDbConfig } from './adapters/mariadb-unit-of-work.js';
+//# sourceMappingURL=internal.d.ts.map

package/dist/internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,oCAAoC,CAAC"}

package/dist/internal.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbUnitOfWork = void 0;
+/**
+ * @astram/engine/internal — composition-root and framework-test surface (Phase 8 #5).
+ *
+ * The raw unit of work is NOT on the package entry point (`@astram/engine`): feature code gets
+ * only the RecordEngine facade (`RECORD_ENGINE` / `RecordsService`). Wiring code (an app's
+ * `src/app.module.ts` / `src/main.ts`, and framework tests) imports the unit of work from here;
+ * the scaffolded app's lint wall rejects this subpath everywhere else.
+ */
+var mariadb_unit_of_work_js_1 = require("./adapters/mariadb-unit-of-work.js");
+Object.defineProperty(exports, "MariaDbUnitOfWork", { enumerable: true, get: function () { return mariadb_unit_of_work_js_1.MariaDbUnitOfWork; } });

package/dist/pipe/record-engine.d.ts

@@ -3,7 +3,8 @@
  *
  * Every write (create/update/delete) runs the FIXED, ordered stage sequence inside
  * ONE transaction:
- *   fetch-record (update/delete) → permission-gate (MANDATORY) → derive-write-context →
+ *   type-pre-gate (update/delete) → fetch-record (update/delete) → permission-gate (MANDATORY) →
+ *   derive-write-context →
  *   validate → compute (no-op Phase 1) → write → junction-sync → audit (MANDATORY) →
  *   emit-event (no-op).
  * A caller cannot reorder, add, or drop stages — the pipe shape is fixed here, so

package/dist/pipe/record-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-engine.d.ts","sourceRoot":"","sources":["../../src/pipe/record-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,KAAK,EACV,SAAS,EACT,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACX,MAAM,aAAa,CAAC;AAsCrB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAElB;IACd,OAAO,CAAC,QAAQ,CAAC,SAAS,CAMZ;IACd,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,wFAAwF;IACxF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;gBAEjD,IAAI,EAAE,gBAAgB;IA2BlC;;;;;;;OAOG;IACG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAIxD,aAAa;IA8B3B,uEAAuE;IACvE,OAAO,CAAC,SAAS;IAYjB;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;YAIrE,MAAM;IAsBpB;;;;OAIG;YACW,MAAM;YAgBN,QAAQ;IAuChB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIhF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;YAI9D,QAAQ;YAWR,QAAQ;YAUR,QAAQ;YAWR,QAAQ;IAkCtB,OAAO,CAAC,SAAS;IAIjB,mEAAmE;IACnE,OAAO,CAAC,OAAO;IAiBT,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIhF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;YAItE,KAAK;YA2EL,MAAM;IAuIpB,+EAA+E;IAC/E,OAAO,CAAC,YAAY;IAKpB;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IAKxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,eAAe;CAmBxB"}
+{"version":3,"file":"record-engine.d.ts","sourceRoot":"","sources":["../../src/pipe/record-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,KAAK,EACV,SAAS,EACT,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACX,MAAM,aAAa,CAAC;AAsCrB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAElB;IACd,OAAO,CAAC,QAAQ,CAAC,SAAS,CAMZ;IACd,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,wFAAwF;IACxF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;gBAEjD,IAAI,EAAE,gBAAgB;IA8BlC;;;;;;;OAOG;IACG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAIxD,aAAa;IA8B3B,uEAAuE;IACvE,OAAO,CAAC,SAAS;IAYjB;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;YAIrE,MAAM;IAsBpB;;;;OAIG;YACW,MAAM;YAgBN,QAAQ;IAuChB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIhF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;YAI9D,QAAQ;YAWR,QAAQ;YAUR,QAAQ;YAWR,QAAQ;IAkCtB,OAAO,CAAC,SAAS;IAIjB,mEAAmE;IACnE,OAAO,CAAC,OAAO;IAiBT,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIhF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;YAItE,KAAK;YA2EL,MAAM;IAuIpB,+EAA+E;IAC/E,OAAO,CAAC,YAAY;IAKpB;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IAKxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,eAAe;CAmBxB"}

package/dist/pipe/record-engine.js

@@ -4,7 +4,8 @@
  *
  * Every write (create/update/delete) runs the FIXED, ordered stage sequence inside
  * ONE transaction:
- *   fetch-record (update/delete) → permission-gate (MANDATORY) → derive-write-context →
+ *   type-pre-gate (update/delete) → fetch-record (update/delete) → permission-gate (MANDATORY) →
+ *   derive-write-context →
  *   validate → compute (no-op Phase 1) → write → junction-sync → audit (MANDATORY) →
  *   emit-event (no-op).
  * A caller cannot reorder, add, or drop stages — the pipe shape is fixed here, so
@@ -65,7 +66,10 @@ class RecordEngineImpl {
         // fetch-record runs FIRST (before the gate): for update/delete on EVERY type it row-locks
         // and reads the existing row through the shared whereById, so decide() sees the record's
         // fields, owner and tenant (block D, #10). A missing row throws there. No-op for create.
+        // type-pre-gate runs before it (Phase 8 #7): a coarse object-type decide() so an actor with
+        // no permission on the type is denied before it can take any row lock. No-op for create.
         this.writeStages = [
+            (0, permission_gate_js_1.typePreGateStage)(this.decision),
             (0, fetch_record_js_1.fetchRecordStage)(),
             (0, permission_gate_js_1.permissionGateStage)(this.decision),
             (0, derive_write_context_js_1.deriveWriteContextStage)(),

package/dist/pipe/stages/fetch-record.d.ts

@@ -1,6 +1,8 @@
 /**
  * Stage: fetch-record (update/delete on EVERY type — runs BEFORE the permission gate).
- * Security hardening block D (#10); replaces the owner-only `fetch-owner` stage.
+ * Security hardening block D (#10); replaces the owner-only `fetch-owner` stage. Since Phase 8
+ * #7 it runs AFTER `type-pre-gate` (permission-gate.ts), so an actor with no permission on the
+ * type is denied before this stage can take a row lock.
  *
  * Core's decision authority is zero-dep (no DB), so it cannot read the record it judges. This
  * stage reads the EXISTING row, inside the pipe's unit of work, with

package/dist/pipe/stages/fetch-record.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-record.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/fetch-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,wBAAwB,EAAqB,MAAM,iBAAiB,CAAC;AAE9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAGzD,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAetF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,SAAS,CAAC,GAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOzB;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,UAAU,GAAG,wBAAwB,CAK5E;AAED,wBAAgB,gBAAgB,IAAI,KAAK,CAwBxC"}
+{"version":3,"file":"fetch-record.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/fetch-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,wBAAwB,EAAqB,MAAM,iBAAiB,CAAC;AAE9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAGzD,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAetF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,SAAS,CAAC,GAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOzB;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,UAAU,GAAG,wBAAwB,CAK5E;AAED,wBAAgB,gBAAgB,IAAI,KAAK,CAwBxC"}

package/dist/pipe/stages/fetch-record.js

@@ -1,7 +1,9 @@
 "use strict";
 /**
  * Stage: fetch-record (update/delete on EVERY type — runs BEFORE the permission gate).
- * Security hardening block D (#10); replaces the owner-only `fetch-owner` stage.
+ * Security hardening block D (#10); replaces the owner-only `fetch-owner` stage. Since Phase 8
+ * #7 it runs AFTER `type-pre-gate` (permission-gate.ts), so an actor with no permission on the
+ * type is denied before this stage can take a row lock.
  *
  * Core's decision authority is zero-dep (no DB), so it cannot read the record it judges. This
  * stage reads the EXISTING row, inside the pipe's unit of work, with

package/dist/pipe/stages/permission-gate.d.ts

@@ -8,4 +8,33 @@
 import type { DecisionPort } from '../../ports.js';
 import type { Stage } from '../context.js';
 export declare function permissionGateStage(decision: DecisionPort): Stage;
+/**
+ * Stage: type pre-gate (update/delete only; runs FIRST, before fetch-record's row lock).
+ * Security-hardening Phase 8 #7.
+ *
+ * fetch-record takes `SELECT * … FOR UPDATE` so the gate judges the row the write changes; but
+ * run before any check, that let an actor with NO permission on the type take row locks. This
+ * stage asks the same `decide()` the coarse question first — `{ level: 'object_type', typeKey,
+ * tenantId: actor.tenantId }` for the op's action, no attributes — and stops the pipe on deny
+ * BEFORE any SQL. On allow, fetch-record locks and the record-level permission gate runs
+ * unchanged.
+ *
+ * ── It never denies what the record-level gate would allow. In core's one decision path the
+ *    record-level and object-type-level calls differ only after gate 5 (record ⇒ gate 6 runs;
+ *    object type ⇒ allow terminates), and every input gates 0–5 and 7 read is identical here:
+ *      - typeKey and action: identical;
+ *      - resource.tenantId: the record gate uses the row's tenant column, and `whereById`
+ *        pins that column to `actor.tenantId` (a type without one falls back to it) — so it is
+ *        always `actor.tenantId`, exactly what this stage sends (gates 3 and 5 agree);
+ *      - gate 5's coarse key and root-plane rule depend only on (typeKey, action, principal);
+ *      - gate 7 (delegation) reads only the `shield.delegation` attribute, which the engine
+ *        never supplies (the record gate's attributes are registered field values).
+ *    So a deny here is a deny at gate ≤ 5 (or 7) that the record-level call reaches too.
+ *
+ * ── Existence: it runs before any read, so its answer cannot depend on whether the id exists
+ *    (a missing and an existing id give the same error). It throws the decision's own reason,
+ *    as the record gate would for the same actor. `create` no-ops: the permission gate already
+ *    judges a create at object-type level, and a create takes no lock.
+ */
+export declare function typePreGateStage(decision: DecisionPort): Stage;
 //# sourceMappingURL=permission-gate.d.ts.map

package/dist/pipe/stages/permission-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-gate.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/permission-gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EAAE,KAAK,EAAyB,MAAM,eAAe,CAAC;AAQlE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,GAAG,KAAK,CA+CjE"}
+{"version":3,"file":"permission-gate.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/permission-gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EAAE,KAAK,EAAyB,MAAM,eAAe,CAAC;AAQlE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,GAAG,KAAK,CAiCjE;AA2BD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,GAAG,KAAK,CAe9D"}

package/dist/pipe/stages/permission-gate.js

@@ -8,6 +8,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.permissionGateStage = permissionGateStage;
+exports.typePreGateStage = typePreGateStage;
 const errors_js_1 = require("../../errors.js");
 const fetch_record_js_1 = require("./fetch-record.js");
 /** Map the pipe op to the stable authorization action key. */
@@ -43,19 +44,68 @@ function permissionGateStage(decision) {
                     }
                     : {}),
             };
-            let outcome;
-            try {
-                outcome = await decision.decide(ctx.actor, action, resource, context);
-            }
-            catch (err) {
-                // A thrown decision = transient/unavailable (ADR-0016). Fail-closed: do NOT
-                // proceed; signal retryable.
-                throw new errors_js_1.EngineUnavailableError(`decision authority unavailable for ${ctx.op} ${ctx.registration.typeKey}: ` +
-                    `${err.message}`);
-            }
-            if (outcome.effect !== 'allow') {
-                throw new errors_js_1.AuthorizationDeniedError(outcome.reason, outcome.detail);
-            }
+            await decideOrThrow(decision, ctx, action, resource, context);
+        },
+    };
+}
+/** Ask `decide()` once; throw on deny (AuthorizationDeniedError) or a throw (unavailable). */
+async function decideOrThrow(decision, ctx, action, resource, context) {
+    let outcome;
+    try {
+        outcome = await decision.decide(ctx.actor, action, resource, context);
+    }
+    catch (err) {
+        // A thrown decision = transient/unavailable (ADR-0016). Fail-closed: do NOT
+        // proceed; signal retryable.
+        throw new errors_js_1.EngineUnavailableError(`decision authority unavailable for ${ctx.op} ${ctx.registration.typeKey}: ` +
+            `${err.message}`);
+    }
+    if (outcome.effect !== 'allow') {
+        throw new errors_js_1.AuthorizationDeniedError(outcome.reason, outcome.detail);
+    }
+}
+/**
+ * Stage: type pre-gate (update/delete only; runs FIRST, before fetch-record's row lock).
+ * Security-hardening Phase 8 #7.
+ *
+ * fetch-record takes `SELECT * … FOR UPDATE` so the gate judges the row the write changes; but
+ * run before any check, that let an actor with NO permission on the type take row locks. This
+ * stage asks the same `decide()` the coarse question first — `{ level: 'object_type', typeKey,
+ * tenantId: actor.tenantId }` for the op's action, no attributes — and stops the pipe on deny
+ * BEFORE any SQL. On allow, fetch-record locks and the record-level permission gate runs
+ * unchanged.
+ *
+ * ── It never denies what the record-level gate would allow. In core's one decision path the
+ *    record-level and object-type-level calls differ only after gate 5 (record ⇒ gate 6 runs;
+ *    object type ⇒ allow terminates), and every input gates 0–5 and 7 read is identical here:
+ *      - typeKey and action: identical;
+ *      - resource.tenantId: the record gate uses the row's tenant column, and `whereById`
+ *        pins that column to `actor.tenantId` (a type without one falls back to it) — so it is
+ *        always `actor.tenantId`, exactly what this stage sends (gates 3 and 5 agree);
+ *      - gate 5's coarse key and root-plane rule depend only on (typeKey, action, principal);
+ *      - gate 7 (delegation) reads only the `shield.delegation` attribute, which the engine
+ *        never supplies (the record gate's attributes are registered field values).
+ *    So a deny here is a deny at gate ≤ 5 (or 7) that the record-level call reaches too.
+ *
+ * ── Existence: it runs before any read, so its answer cannot depend on whether the id exists
+ *    (a missing and an existing id give the same error). It throws the decision's own reason,
+ *    as the record gate would for the same actor. `create` no-ops: the permission gate already
+ *    judges a create at object-type level, and a create takes no lock.
+ */
+function typePreGateStage(decision) {
+    return {
+        name: 'type-pre-gate',
+        async run(ctx) {
+            if (ctx.op === 'create')
+                return;
+            const resource = {
+                level: 'object_type',
+                typeKey: ctx.registration.typeKey,
+                tenantId: ctx.actor.tenantId,
+            };
+            await decideOrThrow(decision, ctx, { key: actionKey(ctx.op) }, resource, {
+                isAuthenticated: true,
+            });
         },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/engine",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "license": "MIT",
   "description": "Astram framework — the paved road. ONE unbypassable write pipe (resolve-schema → permission gate → derive-write-context → validate → compute → write → junction-sync → audit → emit-event) over real physical tables, that every feature's CRUD flows through. Feature code receives ONLY the RecordEngine facade — never a raw pool/DataSource/QueryRunner (the physical wall). Security-gate + audit are mandatory stages. Missing capability → a typed CapabilityNotSupportedError (the gap-flag STOP). Builds on @astram/core (metadata contract, decide(), audit) + @astram/guard (decision authority).",
   "type": "commonjs",
@@ -10,6 +10,17 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./internal": {
+      "types": "./dist/internal.d.ts",
+      "default": "./dist/internal.js"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "internal": [
+        "dist/internal.d.ts"
+      ]
     }
   },
   "files": [
@@ -20,7 +31,7 @@
     "access": "public"
   },
   "dependencies": {
-    "mariadb": "^3.4.0",
+    "mariadb": "^3.5.4",
     "@astram/core": "1.4.0"
   },
   "peerDependencies": {