@astram/engine 0.5.3 → 0.7.0

package/dist/adapters/mariadb-unit-of-work.d.ts

@@ -17,6 +17,14 @@ export interface EngineDbConfig {
     readonly database: string;
     /** ADR-0018 budgeted connection cap for this pool. */
     readonly connectionLimit: number;
+    /**
+     * The driver's TLS option (Phase 16): built by the composition root from `APP_DB_TLS` with
+     * guard's `mariadbSslOption` (the engine never reads env or imports guard). Absent ⇒ no TLS.
+     */
+    readonly ssl?: {
+        readonly ca?: string;
+        readonly rejectUnauthorized: boolean;
+    };
 }
 export declare class MariaDbUnitOfWork implements UnitOfWork {
     private readonly pool;

package/dist/adapters/mariadb-unit-of-work.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-unit-of-work.d.ts","sourceRoot":"","sources":["../../src/adapters/mariadb-unit-of-work.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,qBAAa,iBAAkB,YAAW,UAAU;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;gBAEhB,MAAM,EAAE,cAAc;IAc5B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAqBxD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}
+{"version":3,"file":"mariadb-unit-of-work.d.ts","sourceRoot":"","sources":["../../src/adapters/mariadb-unit-of-work.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/E;AAED,qBAAa,iBAAkB,YAAW,UAAU;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;gBAEhB,MAAM,EAAE,cAAc;IAe5B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAqBxD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/adapters/mariadb-unit-of-work.js

@@ -27,6 +27,7 @@ class MariaDbUnitOfWork {
             connectTimeout: 10_000,
             timezone: 'Z',
             multipleStatements: false,
+            ...(config.ssl ? { ssl: config.ssl } : {}),
         });
     }
     async run(body) {

package/dist/decorators/object-type.decorator.d.ts

@@ -51,6 +51,16 @@ export interface ObjectTypeOptions {
      * omit-when-absent discipline as `junctions`/`extensible`. See {@link ReadScope}.
      */
     readonly readScope?: ReadScope;
+    /**
+     * OPTIONAL extra actions beyond CRUD (ADR-0038). Reflected AS-IS, omit-when-absent; the
+     * REGISTRY validates them at boot. See {@link ObjectTypeContract.actions}.
+     */
+    readonly actions?: readonly string[];
+    /**
+     * OPTIONAL CRUD opt-out (default `true`; `false` for authority-only types, ADR-0038).
+     * Reflected AS-IS, omit-when-absent (a defined `false` is kept).
+     */
+    readonly crudActions?: boolean;
 }
 /** Per-member options for `@Field` (the field's `key` is read from the member name). */
 export interface FieldOptions {

package/dist/decorators/object-type.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"object-type.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/object-type.decorator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EACV,iBAAiB,EAEjB,SAAS,EACT,YAAY,EACZ,YAAY,EAKZ,UAAU,IAAI,kBAAkB,EAChC,UAAU,EACV,SAAS,EACT,aAAa,EACd,MAAM,aAAa,CAAC;AAarB;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAI3C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAIlE;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAW,SAAQ,kBAAkB;CAAG;AAEzD;;;;;;;;;GASG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,iBAAiB,CAO3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAIlE;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,GAAG,kBAAkB,CA+BnE"}
+{"version":3,"file":"object-type.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/object-type.decorator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EACV,iBAAiB,EAEjB,SAAS,EACT,YAAY,EACZ,YAAY,EAKZ,UAAU,IAAI,kBAAkB,EAChC,UAAU,EACV,SAAS,EACT,aAAa,EACd,MAAM,aAAa,CAAC;AAarB;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAI3C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAIlE;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAW,SAAQ,kBAAkB;CAAG;AAEzD;;;;;;;;;GASG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,iBAAiB,CAO3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAIlE;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,GAAG,kBAAkB,CAkCnE"}

package/dist/decorators/object-type.decorator.js

@@ -149,5 +149,10 @@ function reflectObjectType(cls) {
     // type without it omits the key (matching the literal), so `deepStrictEqual` holds.
     if (opts.readScope !== undefined)
         out.readScope = opts.readScope;
+    // `actions` / `crudActions` (ADR-0038): same omit-when-absent rule; a defined `false` is kept.
+    if (opts.actions !== undefined)
+        out.actions = opts.actions;
+    if (opts.crudActions !== undefined)
+        out.crudActions = opts.crudActions;
     return out;
 }

package/dist/index.d.ts

@@ -17,14 +17,14 @@
  *  - The raw unit of work (`MariaDbUnitOfWork`, it owns a pool) is NOT here: it is on
  *    `@astram/engine/internal`, which only the composition root may import.
  */
-export type { RecordEngine, AccessDeclaration, FieldSpec, FieldType, TrustedSource, IdentityRole, PkStrategy, JunctionSpec, RecordInput, RecordId, RecordView, ListQuery, RecordPage, Principal, ReadScope, ReadScopeCreateMode, } from './types.js';
+export type { RecordEngine, AccessDeclaration, FieldSpec, FieldType, TrustedSource, IdentityRole, PkStrategy, JunctionSpec, RecordInput, RecordId, RecordView, ListQuery, FilterOperator, FilterValue, WhereClause, SearchQuery, RecordPage, AggregateFn, AggregateMeasure, AggregateQuery, AggregateGroup, AggregateResult, Principal, ReadScope, ReadScopeCreateMode, } from './types.js';
 export { READ_SCOPE_NODES_TOKEN } from './types.js';
 export { canonicalUuid } from './uuid.js';
 export { EngineError, CapabilityNotSupportedError, RegistrationError, AuthorizationDeniedError, ValidationError, EngineUnavailableError, } from './errors.js';
 export { ObjectType, Field, PrimaryKey, reflectObjectType, type ObjectTypeOptions, type FieldOptions, type PrimaryKeyOptions, } from './decorators/object-type.decorator.js';
 export { AccessBundle, reflectAccessBundle, type AccessBundleOptions, type AccessBundlePermission, type AccessBundleSpec, } from './decorators/access-bundle.decorator.js';
 export { EngineModule, RECORD_ENGINE, ENGINE_ALL_REGISTRATIONS, ENGINE_ALL_ACCESS_BUNDLES, type EngineModuleOptions, type ObjectTypeInput, } from './module/engine.module.js';
-export { TableRegistry, columnOf, uuidPkColumn, isOwned, ownerColumn, tenantColumnOf, columnForRole, requireRole, } from './registry.js';
+export { TableRegistry, columnOf, uuidPkColumn, isOwned, ownerColumn, tenantColumnOf, columnForRole, requireRole, effectiveActions, } from './registry.js';
 export { RecordEngineImpl, type RecordEngineDeps } from './pipe/record-engine.js';
 export { RecordsService, BoundRecords, type ServiceAccountResolver, SERVICE_ACCOUNT_RESOLVER, } from './pipe/records-service.js';
 export type { EngineDbConfig } from './adapters/mariadb-unit-of-work.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,SAAS,EACT,aAAa,EACb,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,UAAU,EACV,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAKpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAKpD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAiBrB,OAAO,EACL,UAAU,EACV,KAAK,EACL,UAAU,EACV,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,uCAAuC,CAAC;AAO/C,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,OAAO,EACP,WAAW,EACX,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,KAAK,sBAAsB,EAC3B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAC1F,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC/E,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,SAAS,EACT,aAAa,EACb,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,UAAU,EACV,SAAS,EACT,cAAc,EACd,WAAW,EACX,WAAW,EACX,WAAW,EACX,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,eAAe,EACf,SAAS,EACT,SAAS,EACT,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAKpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAKpD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAiBrB,OAAO,EACL,UAAU,EACV,KAAK,EACL,UAAU,EACV,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,uCAAuC,CAAC;AAO/C,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,OAAO,EACP,WAAW,EACX,cAAc,EACd,aAAa,EACb,WAAW,EACX,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,KAAK,sBAAsB,EAC3B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAC1F,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC/E,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -19,7 +19,7 @@
  *    `@astram/engine/internal`, which only the composition root may import.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MariaDbAuditSink = exports.SERVICE_ACCOUNT_RESOLVER = exports.BoundRecords = exports.RecordsService = exports.RecordEngineImpl = exports.requireRole = exports.columnForRole = exports.tenantColumnOf = exports.ownerColumn = exports.isOwned = exports.uuidPkColumn = exports.columnOf = exports.TableRegistry = exports.ENGINE_ALL_ACCESS_BUNDLES = exports.ENGINE_ALL_REGISTRATIONS = exports.RECORD_ENGINE = exports.EngineModule = exports.reflectAccessBundle = exports.AccessBundle = exports.reflectObjectType = exports.PrimaryKey = exports.Field = exports.ObjectType = exports.EngineUnavailableError = exports.ValidationError = exports.AuthorizationDeniedError = exports.RegistrationError = exports.CapabilityNotSupportedError = exports.EngineError = exports.canonicalUuid = exports.READ_SCOPE_NODES_TOKEN = void 0;
+exports.MariaDbAuditSink = exports.SERVICE_ACCOUNT_RESOLVER = exports.BoundRecords = exports.RecordsService = exports.RecordEngineImpl = exports.effectiveActions = exports.requireRole = exports.columnForRole = exports.tenantColumnOf = exports.ownerColumn = exports.isOwned = exports.uuidPkColumn = exports.columnOf = exports.TableRegistry = exports.ENGINE_ALL_ACCESS_BUNDLES = exports.ENGINE_ALL_REGISTRATIONS = exports.RECORD_ENGINE = exports.EngineModule = exports.reflectAccessBundle = exports.AccessBundle = exports.reflectObjectType = exports.PrimaryKey = exports.Field = exports.ObjectType = exports.EngineUnavailableError = exports.ValidationError = exports.AuthorizationDeniedError = exports.RegistrationError = exports.CapabilityNotSupportedError = exports.EngineError = exports.canonicalUuid = exports.READ_SCOPE_NODES_TOKEN = void 0;
 // The read-scope subtree-id placeholder token (ADR-0027) — a `subtreeSubquery` template
 // uses it; the engine expands it to a `?`-list. Exported so per-type declarations can
 // reference the canonical token (rather than a stringly-typed duplicate).
@@ -80,6 +80,7 @@ Object.defineProperty(exports, "ownerColumn", { enumerable: true, get: function
 Object.defineProperty(exports, "tenantColumnOf", { enumerable: true, get: function () { return registry_js_1.tenantColumnOf; } });
 Object.defineProperty(exports, "columnForRole", { enumerable: true, get: function () { return registry_js_1.columnForRole; } });
 Object.defineProperty(exports, "requireRole", { enumerable: true, get: function () { return registry_js_1.requireRole; } });
+Object.defineProperty(exports, "effectiveActions", { enumerable: true, get: function () { return registry_js_1.effectiveActions; } });
 var record_engine_js_1 = require("./pipe/record-engine.js");
 Object.defineProperty(exports, "RecordEngineImpl", { enumerable: true, get: function () { return record_engine_js_1.RecordEngineImpl; } });
 var records_service_js_1 = require("./pipe/records-service.js");

package/dist/pipe/context.d.ts

@@ -54,6 +54,14 @@ export interface WriteContext extends PipeBase {
      * falls back to the actor's tenant. NEVER set for create.
      */
     recordTenantId?: string;
+    /**
+     * Set only for a row of a `createMany()` call: the call's one `batchId` and this row's 0-based
+     * index. Changes nothing but the audit attributes; single-row writes never carry it.
+     */
+    batch?: {
+        readonly id: string;
+        readonly index: number;
+    };
 }
 /** A stage: a small, ordered, independently-testable unit of the pipe. */
 export interface Stage {

package/dist/pipe/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/pipe/context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,gDAAgD;AAChD,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErD,6DAA6D;AAC7D,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAC5C,+CAA+C;IAC/C,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd,8CAA8C;IAC9C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,0EAA0E;AAC1E,MAAM,WAAW,KAAK;IACpB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAO5F"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/pipe/context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,gDAAgD;AAChD,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErD,6DAA6D;AAC7D,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAC5C,+CAA+C;IAC/C,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd,8CAA8C;IAC9C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED,0EAA0E;AAC1E,MAAM,WAAW,KAAK;IACpB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAO5F"}

package/dist/pipe/filter-sql.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Pure SQL-fragment helpers for list reads (list-query-operators, SPEC v2 §5.B).
+ *
+ * `resolveColumn` is the ONE whitelisted field-key → column lookup the list read uses for
+ * filter, search and sort keys (later group and measure keys). The column is always the type's
+ * own registered column; an unknown key throws before any SQL is built.
+ */
+import type { AggregateFn, AggregateMeasure, FieldSpec, FilterOperator, ObjectType, WhereClause } from '../types.js';
+/** What a list key is used for; names the key in the unknown-field error. */
+export type ColumnUse = 'filter' | 'search' | 'sort' | 'groupBy' | 'measure';
+/**
+ * Resolve a registered field key to its field and physical column, or throw
+ * `RegistrationError("list '<typeKey>': unknown <what> field '<key>'")`.
+ */
+export declare function resolveColumn(reg: ObjectType, fieldKey: string, typeKey: string, what: ColumnUse): {
+    field: FieldSpec;
+    column: string;
+};
+/** The `where` operators (SPEC v2 §10), exactly these keys. */
+export declare const FILTER_OPERATORS: ReadonlySet<FilterOperator>;
+/** Maximum number of values in one `in` operand (SPEC v2 §10). */
+export declare const IN_CAP = 1000;
+/**
+ * Build the `where` clauses of a list read (SPEC v2 §5.A). Pure and deterministic: one clause
+ * per entry in object key order, ANDed by the caller.
+ *
+ * - Identifiers come only from `resolveColumn` (registered field → its column); unknown key ⇒
+ *   `RegistrationError`.
+ * - Every operand passes through `coerce` (a bad one ⇒ `ValidationError(fieldKey)`) and is a
+ *   `?` param; no value is ever interpolated.
+ * - A scalar is equality (`null` ⇒ `IS NULL`); an object holds exactly one §10 operator.
+ *   Anything malformed or not allowed for the field type throws `RegistrationError`; it never
+ *   degrades to "no filter" (Shield #1).
+ */
+export declare function buildFilterClauses(reg: ObjectType, where: WhereClause | undefined, typeKey: string): {
+    clauses: string[];
+    params: unknown[];
+};
+/** Aggregate caps (SPEC v2 §10). */
+export declare const GROUP_BY_CAP = 3;
+export declare const MEASURE_CAP = 10;
+/** How the engine converts one measure's driver value (SPEC v2 §11). */
+export interface AggregateColumn {
+    readonly alias: string;
+    /** `count`/`sum`/`avg`, or `min`/`max` on a `number` field: BigInt/DECIMAL ⇒ `number`. */
+    readonly numeric: boolean;
+    readonly fn: AggregateFn;
+}
+/**
+ * Build the SELECT list, GROUP BY and ORDER BY of an aggregate (SPEC v2 §5.C). Pure.
+ *
+ * - `select`: group columns first as `` `col` AS `k_<n>` ``, then each measure
+ *   `` FN(`col`|*) AS `alias` ``. `groupBy`/`orderBy` are the group columns in order, WITHOUT the
+ *   keyword (empty strings when ungrouped). `keyMap` maps `k_<n>` back to the group field key.
+ * - Identifiers come only from `resolveColumn` (registered field → its column) or from an alias
+ *   that passed `ALIAS_RE` (no backquote possible) before it is backquoted. Anything malformed
+ *   throws `RegistrationError` before any SQL is built.
+ */
+export declare function buildAggregateSelect(reg: ObjectType, groupBy: readonly string[] | undefined, measures: readonly AggregateMeasure[], typeKey: string): {
+    select: string;
+    groupBy: string;
+    orderBy: string;
+    keyMap: Record<string, string>;
+    columns: readonly AggregateColumn[];
+};
+//# sourceMappingURL=filter-sql.d.ts.map

package/dist/pipe/filter-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter-sql.d.ts","sourceRoot":"","sources":["../../src/pipe/filter-sql.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,EAChB,SAAS,EAET,cAAc,EACd,UAAU,EACV,WAAW,EACZ,MAAM,aAAa,CAAC;AAErB,6EAA6E;AAC7E,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7E;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,GACd;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAMtC;AAED,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,cAAc,CAUvD,CAAC;AAEH,kEAAkE;AAClE,eAAO,MAAM,MAAM,OAAO,CAAC;AAmB3B;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,WAAW,GAAG,SAAS,EAC9B,OAAO,EAAE,MAAM,GACd;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAwF1C;AAED,oCAAoC;AACpC,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,WAAW,KAAK,CAAC;AAgB9B,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0FAA0F;IAC1F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACtC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EACrC,OAAO,EAAE,MAAM,GACd;IACD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;CACrC,CA4EA"}

package/dist/pipe/filter-sql.js

@@ -0,0 +1,266 @@
+"use strict";
+/**
+ * Pure SQL-fragment helpers for list reads (list-query-operators, SPEC v2 §5.B).
+ *
+ * `resolveColumn` is the ONE whitelisted field-key → column lookup the list read uses for
+ * filter, search and sort keys (later group and measure keys). The column is always the type's
+ * own registered column; an unknown key throws before any SQL is built.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MEASURE_CAP = exports.GROUP_BY_CAP = exports.IN_CAP = exports.FILTER_OPERATORS = void 0;
+exports.resolveColumn = resolveColumn;
+exports.buildFilterClauses = buildFilterClauses;
+exports.buildAggregateSelect = buildAggregateSelect;
+const errors_js_1 = require("../errors.js");
+const registry_js_1 = require("../registry.js");
+const validate_js_1 = require("./stages/validate.js");
+/**
+ * Resolve a registered field key to its field and physical column, or throw
+ * `RegistrationError("list '<typeKey>': unknown <what> field '<key>'")`.
+ */
+function resolveColumn(reg, fieldKey, typeKey, what) {
+    const field = reg.fields.find((f) => f.key === fieldKey);
+    if (!field) {
+        throw new errors_js_1.RegistrationError(`list '${typeKey}': unknown ${what} field '${fieldKey}'`);
+    }
+    return { field, column: (0, registry_js_1.columnOf)(field) };
+}
+/** The `where` operators (SPEC v2 §10), exactly these keys. */
+exports.FILTER_OPERATORS = new Set([
+    'eq',
+    'in',
+    'gt',
+    'gte',
+    'lt',
+    'lte',
+    'between',
+    'isNull',
+    'isNotNull',
+]);
+/** Maximum number of values in one `in` operand (SPEC v2 §10). */
+exports.IN_CAP = 1000;
+/** Field types the range operators (`gt|gte|lt|lte|between`) accept (SPEC v2 §10). */
+const RANGE_TYPES = new Set([
+    'string',
+    'number',
+    'uuid',
+    'timestamp',
+]);
+const RANGE_SQL = { gt: '>', gte: '>=', lt: '<', lte: '<=' };
+/** A plain operator object: not `null`, not a `Date`, not an array. */
+function isOperatorObject(value) {
+    return (typeof value === 'object' && value !== null && !(value instanceof Date) && !Array.isArray(value));
+}
+/**
+ * Build the `where` clauses of a list read (SPEC v2 §5.A). Pure and deterministic: one clause
+ * per entry in object key order, ANDed by the caller.
+ *
+ * - Identifiers come only from `resolveColumn` (registered field → its column); unknown key ⇒
+ *   `RegistrationError`.
+ * - Every operand passes through `coerce` (a bad one ⇒ `ValidationError(fieldKey)`) and is a
+ *   `?` param; no value is ever interpolated.
+ * - A scalar is equality (`null` ⇒ `IS NULL`); an object holds exactly one §10 operator.
+ *   Anything malformed or not allowed for the field type throws `RegistrationError`; it never
+ *   degrades to "no filter" (Shield #1).
+ */
+function buildFilterClauses(reg, where, typeKey) {
+    const clauses = [];
+    const params = [];
+    for (const [fieldKey, value] of Object.entries(where ?? {})) {
+        const { field, column } = resolveColumn(reg, fieldKey, typeKey, 'filter');
+        const col = `\`${column}\``;
+        const reject = (detail) => {
+            throw new errors_js_1.RegistrationError(`list '${typeKey}': filter on '${fieldKey}': ${detail}`);
+        };
+        // Scalar form: `null` ⇒ IS NULL (business rule §11); otherwise equality.
+        if (value === null) {
+            clauses.push(`${col} IS NULL`);
+            continue;
+        }
+        if (Array.isArray(value))
+            reject('an array value needs the `in` operator');
+        if (!isOperatorObject(value)) {
+            if (field.type === 'json')
+                reject("operator 'eq' is not allowed on a json field");
+            clauses.push(`${col} = ?`);
+            params.push((0, validate_js_1.coerce)(field, value));
+            continue;
+        }
+        // Operator form: exactly one known operator key.
+        const opObject = value;
+        const keys = Object.keys(opObject);
+        if (keys.length !== 1)
+            reject(`expected exactly one operator, got ${keys.length}`);
+        const op = keys[0];
+        if (!exports.FILTER_OPERATORS.has(op))
+            reject(`unknown operator '${keys[0]}'`);
+        const operand = opObject[op];
+        switch (op) {
+            case 'isNull':
+            case 'isNotNull':
+                if (operand !== true)
+                    reject(`operator '${op}' only accepts true`);
+                clauses.push(op === 'isNull' ? `${col} IS NULL` : `${col} IS NOT NULL`);
+                break;
+            case 'eq':
+                if (field.type === 'json')
+                    reject("operator 'eq' is not allowed on a json field");
+                clauses.push(`${col} = ?`);
+                params.push((0, validate_js_1.coerce)(field, operand));
+                break;
+            case 'in': {
+                if (field.type === 'json')
+                    reject("operator 'in' is not allowed on a json field");
+                if (!Array.isArray(operand))
+                    reject("operator 'in' needs an array");
+                const values = operand;
+                if (values.length > exports.IN_CAP)
+                    reject(`operator 'in' accepts at most ${exports.IN_CAP} values`);
+                if (values.length === 0) {
+                    clauses.push('FALSE');
+                    break;
+                }
+                const coerced = values.map((v) => (0, validate_js_1.coerce)(field, v));
+                clauses.push(`${col} IN (${coerced.map(() => '?').join(', ')})`);
+                params.push(...coerced);
+                break;
+            }
+            case 'gt':
+            case 'gte':
+            case 'lt':
+            case 'lte':
+                if (!RANGE_TYPES.has(field.type)) {
+                    reject(`operator '${op}' is not allowed on a ${field.type} field`);
+                }
+                clauses.push(`${col} ${RANGE_SQL[op]} ?`);
+                params.push((0, validate_js_1.coerce)(field, operand));
+                break;
+            case 'between': {
+                if (!RANGE_TYPES.has(field.type)) {
+                    reject(`operator 'between' is not allowed on a ${field.type} field`);
+                }
+                if (!Array.isArray(operand) || operand.length !== 2) {
+                    reject("operator 'between' needs a 2-element array");
+                }
+                const [lo, hi] = operand;
+                const coercedLo = (0, validate_js_1.coerce)(field, lo);
+                const coercedHi = (0, validate_js_1.coerce)(field, hi);
+                clauses.push(`${col} BETWEEN ? AND ?`);
+                params.push(coercedLo, coercedHi);
+                break;
+            }
+            default:
+                // Unreachable (FILTER_OPERATORS checked above); fail closed regardless.
+                reject(`unknown operator '${String(op)}'`);
+        }
+    }
+    return { clauses, params };
+}
+/** Aggregate caps (SPEC v2 §10). */
+exports.GROUP_BY_CAP = 3;
+exports.MEASURE_CAP = 10;
+/** A measure alias: lower-case identifier, ≤ 64 chars (SPEC v2 §10). */
+const ALIAS_RE = /^[a-z_][a-z0-9_]{0,63}$/;
+const AGGREGATE_SQL = {
+    count: 'COUNT',
+    sum: 'SUM',
+    avg: 'AVG',
+    min: 'MIN',
+    max: 'MAX',
+};
+/** Field types `min`/`max` accept (SPEC v2 §10); `sum`/`avg` accept `number` only. */
+const MIN_MAX_TYPES = RANGE_TYPES;
+/**
+ * Build the SELECT list, GROUP BY and ORDER BY of an aggregate (SPEC v2 §5.C). Pure.
+ *
+ * - `select`: group columns first as `` `col` AS `k_<n>` ``, then each measure
+ *   `` FN(`col`|*) AS `alias` ``. `groupBy`/`orderBy` are the group columns in order, WITHOUT the
+ *   keyword (empty strings when ungrouped). `keyMap` maps `k_<n>` back to the group field key.
+ * - Identifiers come only from `resolveColumn` (registered field → its column) or from an alias
+ *   that passed `ALIAS_RE` (no backquote possible) before it is backquoted. Anything malformed
+ *   throws `RegistrationError` before any SQL is built.
+ */
+function buildAggregateSelect(reg, groupBy, measures, typeKey) {
+    const reject = (detail) => {
+        throw new errors_js_1.RegistrationError(`aggregate '${typeKey}': ${detail}`);
+    };
+    const groups = groupBy ?? [];
+    if (!Array.isArray(groups))
+        reject('groupBy must be an array of field keys');
+    if (groups.length > exports.GROUP_BY_CAP)
+        reject(`groupBy accepts at most ${exports.GROUP_BY_CAP} keys`);
+    const groupCols = [];
+    const selectParts = [];
+    const keyMap = {};
+    groups.forEach((key, i) => {
+        if (groups.indexOf(key) !== i)
+            reject(`duplicate groupBy key '${key}'`);
+        const { field, column } = resolveColumn(reg, key, typeKey, 'groupBy');
+        if (field.type === 'json')
+            reject(`groupBy on json field '${key}' is not allowed`);
+        const alias = `k_${i}`;
+        groupCols.push(`\`${column}\``);
+        selectParts.push(`\`${column}\` AS \`${alias}\``);
+        keyMap[alias] = key;
+    });
+    if (!Array.isArray(measures) || measures.length === 0)
+        reject('at least one measure is required');
+    if (measures.length > exports.MEASURE_CAP)
+        reject(`at most ${exports.MEASURE_CAP} measures are allowed`);
+    const aliases = new Set();
+    const columns = [];
+    for (const raw of measures) {
+        if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+            reject('each measure must be an object');
+        }
+        const m = raw;
+        const alias = m.as;
+        if (typeof alias !== 'string' || !ALIAS_RE.test(alias)) {
+            reject(`measure alias '${String(alias)}' must match ${String(ALIAS_RE)}`);
+        }
+        // `__proto__` matches ALIAS_RE but is the one name that, assigned on a plain object, would set
+        // the prototype of the shaped result instead of creating a key: reject it outright.
+        if (alias === '__proto__')
+            reject(`measure alias '${alias}' is reserved`);
+        if (aliases.has(alias))
+            reject(`duplicate measure alias '${alias}'`);
+        // A measure alias may not shadow a group key or a generated `k_<n>` group column. Own-property
+        // check only: `in` walks the prototype chain and would reject `constructor`, `toString`, ….
+        if (groups.includes(alias) || Object.prototype.hasOwnProperty.call(keyMap, alias)) {
+            reject(`measure alias '${alias}' collides with a groupBy key`);
+        }
+        aliases.add(alias);
+        const fn = m.fn;
+        if (!Object.prototype.hasOwnProperty.call(AGGREGATE_SQL, fn)) {
+            reject(`unknown aggregate function '${String(fn)}'`);
+        }
+        let arg = '*';
+        let numeric = fn === 'count' || fn === 'sum' || fn === 'avg';
+        if (m.field === undefined) {
+            if (fn !== 'count')
+                reject(`'${fn}' needs a field`);
+        }
+        else {
+            const { field, column } = resolveColumn(reg, m.field, typeKey, 'measure');
+            if ((fn === 'sum' || fn === 'avg') && field.type !== 'number') {
+                reject(`'${fn}' is not allowed on ${field.type} field '${m.field}'`);
+            }
+            if ((fn === 'min' || fn === 'max') && !MIN_MAX_TYPES.has(field.type)) {
+                reject(`'${fn}' is not allowed on ${field.type} field '${m.field}'`);
+            }
+            if (field.type === 'number')
+                numeric = true;
+            arg = `\`${column}\``;
+        }
+        selectParts.push(`${AGGREGATE_SQL[fn]}(${arg}) AS \`${alias}\``);
+        columns.push({ alias, numeric, fn });
+    }
+    const groupList = groupCols.join(', ');
+    return {
+        select: selectParts.join(', '),
+        groupBy: groupList,
+        orderBy: groupCols.map((c) => `${c} ASC`).join(', '),
+        keyMap,
+        columns,
+    };
+}

package/dist/pipe/record-engine.d.ts

@@ -17,7 +17,7 @@
  */
 import type { TableRegistry } from '../registry.js';
 import type { AuditPort, DecisionPort, UnitOfWork, QueryFn } from '../ports.js';
-import type { ListQuery, Principal, RecordEngine, RecordId, RecordInput, RecordPage, RecordView, ObjectType } from '../types.js';
+import type { AggregateQuery, AggregateResult, ListQuery, Principal, RecordEngine, RecordId, RecordInput, RecordPage, RecordView, ObjectType } from '../types.js';
 export interface RecordEngineDeps {
     readonly registry: TableRegistry;
     readonly uow: UnitOfWork;
@@ -98,6 +98,14 @@ export declare class RecordEngineImpl implements RecordEngine {
      */
     lockForUpdate(typeKey: string, id: RecordId, actor: Principal): Promise<void>;
     private lockIn;
+    /** Record-level decision for one declared action, no write (see `RecordEngine.authorize`). */
+    authorize(typeKey: string, id: RecordId, action: string, actor: Principal): Promise<void>;
+    /**
+     * The write path's gates without the write (SPEC §5 E): declared action → type pre-gate (no
+     * SQL) → `whereById` fetch → record-level decide on the row's facts and tenant. Read-only unit,
+     * so a deny never makes an open transaction rollback-only. No audit, no list scope.
+     */
+    private authorizeIn;
     /**
      * Run one op's body in the right unit of work: the bound/ambient transaction when there is
      * one, else a fresh `uow.run` (the original per-op transaction). A WRITE failure inside a
@@ -108,7 +116,16 @@ export declare class RecordEngineImpl implements RecordEngine {
     create(typeKey: string, input: RecordInput, actor: Principal): Promise<RecordId>;
     update(typeKey: string, id: RecordId, input: RecordInput, actor: Principal): Promise<void>;
     delete(typeKey: string, id: RecordId, actor: Principal): Promise<void>;
+    createMany(typeKey: string, inputs: readonly RecordInput[], actor: Principal): Promise<RecordId[]>;
     private createIn;
+    /**
+     * Bulk = single (Shield #7, SPEC v2 §5.G): every row runs the unchanged single-row create pipe,
+     * in order, in ONE unit of work (joins an outer transaction). No batched INSERT, no decision
+     * shared across rows. The first failing row throws and rollback-only state discards the whole
+     * batch, its audit rows included. Inputs are checked before the type lookup and before any
+     * transaction opens, so a bad call neither touches the DB nor poisons an outer transaction.
+     */
+    private createManyIn;
     private updateIn;
     private deleteIn;
     private gateRead;
@@ -118,7 +135,23 @@ export declare class RecordEngineImpl implements RecordEngine {
     get(typeKey: string, id: RecordId, actor: Principal): Promise<RecordView | null>;
     list(typeKey: string, query: ListQuery, actor: Principal): Promise<RecordPage>;
     private getIn;
+    /**
+     * The ONE read WHERE of a list (SPEC v2 §5.D): list-scope fragment resolved first, tenant
+     * clause, readScope wall, equality `where`, search, list-scope fragment. Shared by the data
+     * SELECT and the COUNT (and later `aggregate`), so they cannot diverge. Async because it
+     * awaits the list-scope seam; takes no `q` (no DB read of its own). Callers run `gateRead`
+     * first.
+     */
+    private buildReadWhere;
     private listIn;
+    aggregate(typeKey: string, query: AggregateQuery, actor: Principal): Promise<AggregateResult>;
+    /**
+     * Aggregate over exactly the rows `list()` returns (SPEC v2 §5.F, Shield #8): the SAME gate
+     * (object-type `read`, first) and the SAME `buildReadWhere`, then ONE
+     * `SELECT … FROM <table> <where> [GROUP BY … ORDER BY …] LIMIT ?`. No table alias, so a
+     * list-scope fragment's bare columns resolve. Read-only: no audit row, no write.
+     */
+    private aggregateIn;
     /** The physical column of a `tenantId`-trusted field, if the table has one. */
     private tenantColumn;
     /**

package/dist/pipe/record-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-engine.d.ts","sourceRoot":"","sources":["../../src/pipe/record-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,KAAK,EACV,SAAS,EACT,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACX,MAAM,aAAa,CAAC;AAsCrB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAElB;IACd,OAAO,CAAC,QAAQ,CAAC,SAAS,CAMZ;IACd,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,wFAAwF;IACxF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;gBAEjD,IAAI,EAAE,gBAAgB;IA8BlC;;;;;;;OAOG;IACG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAIxD,aAAa;IA8B3B,uEAAuE;IACvE,OAAO,CAAC,SAAS;IAYjB;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;YAIrE,MAAM;IAsBpB;;;;OAIG;YACW,MAAM;YAgBN,QAAQ;IAuChB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIhF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;YAI9D,QAAQ;YAWR,QAAQ;YAUR,QAAQ;YAWR,QAAQ;IAkCtB,OAAO,CAAC,SAAS;IAIjB,mEAAmE;IACnE,OAAO,CAAC,OAAO;IAiBT,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIhF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;YAItE,KAAK;YA2EL,MAAM;IAuIpB,+EAA+E;IAC/E,OAAO,CAAC,YAAY;IAKpB;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IAKxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,eAAe;CAmBxB"}
+{"version":3,"file":"record-engine.d.ts","sourceRoot":"","sources":["../../src/pipe/record-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,KAAK,EAEV,cAAc,EACd,eAAe,EACf,SAAS,EACT,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACX,MAAM,aAAa,CAAC;AA+CrB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAElB;IACd,OAAO,CAAC,QAAQ,CAAC,SAAS,CAMZ;IACd,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,wFAAwF;IACxF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;gBAEjD,IAAI,EAAE,gBAAgB;IA8BlC;;;;;;;OAOG;IACG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAIxD,aAAa;IA8B3B,uEAAuE;IACvE,OAAO,CAAC,SAAS;IAgBjB;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;YAIrE,MAAM;IAsBpB,8FAA8F;IACxF,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/F;;;;OAIG;YACW,WAAW;IAuCzB;;;;OAIG;YACW,MAAM;YAgBN,QAAQ;IA+ChB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIhF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAItE,UAAU,CACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,QAAQ,EAAE,CAAC;YAIR,QAAQ;IAWtB;;;;;;OAMG;YACW,YAAY;YA2BZ,QAAQ;YAUR,QAAQ;YAWR,QAAQ;IAkCtB,OAAO,CAAC,SAAS;IAIjB,mEAAmE;IACnE,OAAO,CAAC,OAAO;IAiBT,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIhF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;YAItE,KAAK;IA2EnB;;;;;;OAMG;YACW,cAAc;YA0Fd,MAAM;IAgDd,SAAS,CACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,eAAe,CAAC;IAI3B;;;;;OAKG;YACW,WAAW;IAoDzB,+EAA+E;IAC/E,OAAO,CAAC,YAAY;IAKpB;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IAKxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,eAAe;CAmBxB"}