@astram/engine 0.6.0 → 0.7.0

package/dist/pipe/stages/fetch-record.js

@@ -34,6 +34,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.recordFacts = recordFacts;
 exports.decisionAttributes = decisionAttributes;
 exports.recordNotReachable = recordNotReachable;
+exports.fetchRecordFacts = fetchRecordFacts;
 exports.fetchRecordStage = fetchRecordStage;
 const errors_js_1 = require("../../errors.js");
 const registry_js_1 = require("../../registry.js");
@@ -76,6 +77,20 @@ function decisionAttributes(reg, facts) {
 function recordNotReachable(reg) {
     return new errors_js_1.AuthorizationDeniedError('no_record_permit', `no reachable '${reg.typeKey}' record for this operation`);
 }
+/**
+ * Read one record's decision facts through `whereById` (pk + actor tenant + ADR-0030 write
+ * scope), `LIMIT 1`, with `FOR UPDATE` when `lock` is set. No row (missing ≡ foreign) ⇒
+ * `recordNotReachable`. Shared by `fetchRecordStage` (lock) and `RecordEngine.authorize`
+ * (lock only inside a transaction). The row itself is never returned, only its facts.
+ */
+async function fetchRecordFacts(reg, actor, id, query, opts) {
+    const where = (0, where_by_id_js_1.whereById)(reg, actor, id);
+    const rows = (await query(`SELECT * FROM ${(0, where_by_id_js_1.qualifiedTable)(reg)} WHERE ${where.sql} LIMIT 1${opts.lock ? ' FOR UPDATE' : ''}`, where.params));
+    const first = Array.isArray(rows) ? rows[0] : undefined;
+    if (first === undefined || first === null)
+        throw recordNotReachable(reg);
+    return recordFacts(reg, first);
+}
 function fetchRecordStage() {
     return {
         name: 'fetch-record',
@@ -84,15 +99,9 @@ function fetchRecordStage() {
                 return;
             if (ctx.id === undefined)
                 throw new errors_js_1.RegistrationError(`${ctx.op} requires an id`);
-            const reg = ctx.registration;
-            const where = (0, where_by_id_js_1.whereById)(reg, ctx.actor, ctx.id);
-            const rows = (await ctx.query(`SELECT * FROM ${(0, where_by_id_js_1.qualifiedTable)(reg)} WHERE ${where.sql} LIMIT 1 FOR UPDATE`, where.params));
-            const first = Array.isArray(rows)
-                ? rows[0]
-                : undefined;
-            if (first === undefined || first === null)
-                throw recordNotReachable(reg);
-            const facts = recordFacts(reg, first);
+            const facts = await fetchRecordFacts(ctx.registration, ctx.actor, ctx.id, ctx.query, {
+                lock: true,
+            });
             ctx.existing = facts.fields;
             if (facts.ownerId !== undefined)
                 ctx.ownerId = facts.ownerId;

package/dist/pipe/stages/permission-gate.d.ts

@@ -6,8 +6,16 @@
  * own allow/deny logic; it asks `decide()` and obeys.
  */
 import type { DecisionPort } from '../../ports.js';
+import type { Action, Resource, DecisionContext } from '../../ports.js';
+import type { Principal } from '../../types.js';
 import type { Stage } from '../context.js';
 export declare function permissionGateStage(decision: DecisionPort): Stage;
+/**
+ * Ask `decide()` once; throw on deny (AuthorizationDeniedError) or a throw (unavailable).
+ * Shared by the write stages and `RecordEngine.authorize` (custom object actions, D3); `label`
+ * names the operation in the `EngineUnavailableError` message only.
+ */
+export declare function decideOrThrow(decision: DecisionPort, actor: Principal, action: Action, resource: Resource, context: DecisionContext, label: string): Promise<void>;
 /**
  * Stage: type pre-gate (update/delete only; runs FIRST, before fetch-record's row lock).
  * Security-hardening Phase 8 #7.

package/dist/pipe/stages/permission-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-gate.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/permission-gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EAAE,KAAK,EAAyB,MAAM,eAAe,CAAC;AAQlE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,GAAG,KAAK,CAiCjE;AA2BD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,GAAG,KAAK,CAe9D"}
+{"version":3,"file":"permission-gate.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/permission-gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,KAAK,EAAyB,MAAM,eAAe,CAAC;AAQlE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,GAAG,KAAK,CAiCjE;AAOD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,GAAG,KAAK,CAoB9D"}

package/dist/pipe/stages/permission-gate.js

@@ -8,6 +8,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.permissionGateStage = permissionGateStage;
+exports.decideOrThrow = decideOrThrow;
 exports.typePreGateStage = typePreGateStage;
 const errors_js_1 = require("../../errors.js");
 const fetch_record_js_1 = require("./fetch-record.js");
@@ -44,21 +45,28 @@ function permissionGateStage(decision) {
                     }
                     : {}),
             };
-            await decideOrThrow(decision, ctx, action, resource, context);
+            await decideOrThrow(decision, ctx.actor, action, resource, context, gateLabel(ctx));
         },
     };
 }
-/** Ask `decide()` once; throw on deny (AuthorizationDeniedError) or a throw (unavailable). */
-async function decideOrThrow(decision, ctx, action, resource, context) {
+/** The `EngineUnavailableError` label of a pipe stage: `<op> <typeKey>`. */
+function gateLabel(ctx) {
+    return `${ctx.op} ${ctx.registration.typeKey}`;
+}
+/**
+ * Ask `decide()` once; throw on deny (AuthorizationDeniedError) or a throw (unavailable).
+ * Shared by the write stages and `RecordEngine.authorize` (custom object actions, D3); `label`
+ * names the operation in the `EngineUnavailableError` message only.
+ */
+async function decideOrThrow(decision, actor, action, resource, context, label) {
     let outcome;
     try {
-        outcome = await decision.decide(ctx.actor, action, resource, context);
+        outcome = await decision.decide(actor, action, resource, context);
     }
     catch (err) {
         // A thrown decision = transient/unavailable (ADR-0016). Fail-closed: do NOT
         // proceed; signal retryable.
-        throw new errors_js_1.EngineUnavailableError(`decision authority unavailable for ${ctx.op} ${ctx.registration.typeKey}: ` +
-            `${err.message}`);
+        throw new errors_js_1.EngineUnavailableError(`decision authority unavailable for ${label}: ${err.message}`);
     }
     if (outcome.effect !== 'allow') {
         throw new errors_js_1.AuthorizationDeniedError(outcome.reason, outcome.detail);
@@ -103,9 +111,7 @@ function typePreGateStage(decision) {
                 typeKey: ctx.registration.typeKey,
                 tenantId: ctx.actor.tenantId,
             };
-            await decideOrThrow(decision, ctx, { key: actionKey(ctx.op) }, resource, {
-                isAuthenticated: true,
-            });
+            await decideOrThrow(decision, ctx.actor, { key: actionKey(ctx.op) }, resource, { isAuthenticated: true }, gateLabel(ctx));
         },
     };
 }

package/dist/pipe/stages/validate.d.ts

@@ -7,5 +7,11 @@
  * Runs AFTER derive-write-context so trusted (server) values are validated too.
  */
 import type { Stage } from '../context.js';
+import type { FieldSpec } from '../../types.js';
+/**
+ * Validate + coerce one value against a field type. Returns the coerced value. Also used by
+ * the list filter builder (`buildFilterClauses`) for every `where` operand.
+ */
+export declare function coerce(field: FieldSpec, value: unknown): unknown;
 export declare function validateStage(): Stage;
 //# sourceMappingURL=validate.d.ts.map

package/dist/pipe/stages/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAiDzD,wBAAgB,aAAa,IAAI,KAAK,CAmCrC"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAa,MAAM,gBAAgB,CAAC;AAW3D;;;GAGG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CA6ChE;AAED,wBAAgB,aAAa,IAAI,KAAK,CAmCrC"}

package/dist/pipe/stages/validate.js

@@ -8,6 +8,7 @@
  * Runs AFTER derive-write-context so trusted (server) values are validated too.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.coerce = coerce;
 exports.validateStage = validateStage;
 const errors_js_1 = require("../../errors.js");
 const registry_js_1 = require("../../registry.js");
@@ -20,7 +21,10 @@ const SUPPORTED = new Set([
     'timestamp',
     'json',
 ]);
-/** Validate + coerce one value against a field type. Returns the coerced value. */
+/**
+ * Validate + coerce one value against a field type. Returns the coerced value. Also used by
+ * the list filter builder (`buildFilterClauses`) for every `where` operand.
+ */
 function coerce(field, value) {
     switch (field.type) {
         case 'string':
@@ -31,6 +35,10 @@ function coerce(field, value) {
             if (typeof value !== 'number' || Number.isNaN(value)) {
                 throw new errors_js_1.ValidationError(field.key, 'expected a number');
             }
+            // ±Infinity is not a storable column value and not a meaningful filter operand.
+            if (!Number.isFinite(value)) {
+                throw new errors_js_1.ValidationError(field.key, 'expected a finite number');
+            }
             return value;
         case 'boolean':
             if (typeof value === 'boolean')
@@ -44,14 +52,20 @@ function coerce(field, value) {
                 throw new errors_js_1.ValidationError(field.key, 'expected a uuid');
             return canonical;
         }
-        case 'timestamp':
+        case 'timestamp': {
+            // An invalid Date (NaN / ±Infinity epoch) is rejected here, never bound as a parameter.
+            let date = null;
             if (value instanceof Date)
-                return value;
-            if (typeof value === 'number')
-                return new Date(value);
-            if (typeof value === 'string' && !Number.isNaN(Date.parse(value)))
-                return new Date(value);
-            throw new errors_js_1.ValidationError(field.key, 'expected a timestamp (Date | epoch ms | ISO string)');
+                date = value;
+            else if (typeof value === 'number')
+                date = new Date(value);
+            else if (typeof value === 'string' && !Number.isNaN(Date.parse(value)))
+                date = new Date(value);
+            if (date === null || Number.isNaN(date.getTime())) {
+                throw new errors_js_1.ValidationError(field.key, 'expected a timestamp (Date | epoch ms | ISO string)');
+            }
+            return date;
+        }
         case 'json':
             return JSON.stringify(value);
         default:

package/dist/registry.d.ts

@@ -70,4 +70,17 @@ export declare function writeScopeClause(reg: ObjectType, actor: Principal): {
 export declare function isCreateWalled(reg: ObjectType): boolean;
 /** Boot-enforce that exactly-one field claims `role`; throw if none. */
 export declare function requireRole(reg: ObjectType, role: NonNullable<FieldSpec['role']>): void;
+/** What the action vocabulary reads from a registration (typeKey only names it in errors). */
+type ActionDeclaration = Pick<ObjectType, 'actions' | 'crudActions'> & {
+    readonly typeKey?: string;
+};
+/**
+ * The type's action vocabulary (ADR-0038): `read, create, update, delete` then the declared
+ * extras in declared order, or exactly the declared list when `crudActions === false`.
+ * Validates first (throws `RegistrationError`), so a registration read without
+ * `TableRegistry.register` (e.g. identity `extraObjects`) is held to the same rules.
+ * Framework-facing: the guard registry bridge, identity lookups and `authorize()` read it.
+ */
+export declare function effectiveActions(reg: ActionDeclaration): readonly string[];
+export {};
 //# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/E,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IAExD,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI;IAQ/B,uEAAuE;IACvE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU;IAWpC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAI7B,GAAG,IAAI,SAAS,UAAU,EAAE;CAG7B;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAEjD;AAED,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,EAAE,EAAE,UAAU,GAAG,MAAM,CAKnD;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEhD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAG1D;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAG7D;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAGrF;AAaD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,GACf;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,GAAG,IAAI,CAYpD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEvD;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAMvF"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/E,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IAExD,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI;IAQ/B,uEAAuE;IACvE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU;IAWpC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAI7B,GAAG,IAAI,SAAS,UAAU,EAAE;CAG7B;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAEjD;AAED,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,EAAE,EAAE,UAAU,GAAG,MAAM,CAKnD;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEhD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAG1D;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAG7D;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAGrF;AAaD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,GACf;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,GAAG,IAAI,CAYpD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEvD;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAMvF;AAmDD,8FAA8F;AAC9F,KAAK,iBAAiB,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,aAAa,CAAC,GAAG;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAgEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,SAAS,MAAM,EAAE,CAI1E"}

package/dist/registry.js

@@ -20,6 +20,8 @@ exports.columnForRole = columnForRole;
 exports.writeScopeClause = writeScopeClause;
 exports.isCreateWalled = isCreateWalled;
 exports.requireRole = requireRole;
+exports.effectiveActions = effectiveActions;
+const core_1 = require("@astram/core");
 const errors_js_1 = require("./errors.js");
 const types_js_1 = require("./types.js");
 class TableRegistry {
@@ -178,6 +180,70 @@ function validate(reg) {
         throw new errors_js_1.RegistrationError(`registration '${reg.typeKey}': composite primary key needs >= 2 columns`);
     }
     validateAccess(reg);
+    validateActions(reg);
+}
+/** The CRUD vocabulary, in the `IDENTITY_ACTIONS` order (guard `identity-actions.ts`). */
+const CRUD_ACTIONS = ['read', 'create', 'update', 'delete'];
+/** Names no type may declare: the wildcard and the bare `@Classified` default (ADR-0038). */
+const RESERVED_ACTIONS = new Set(['*', 'access']);
+/** The narrowest action column (`perm_action`, `rpr_action`, `rs_action`) is VARCHAR(64). */
+const MAX_ACTION_LENGTH = 64;
+/**
+ * Boot-time validation of the declared action vocabulary (ADR-0038). Pure, no IO. Every
+ * failure is a `RegistrationError` naming the type and the action, so a bad name fails boot
+ * instead of silently denying at request time (Shield #2).
+ */
+function validateActions(reg) {
+    const type = reg.typeKey ?? '(unnamed)';
+    const crud = reg.crudActions;
+    if (crud !== undefined && typeof crud !== 'boolean') {
+        throw new errors_js_1.RegistrationError(`registration '${type}': crudActions must be a boolean, got ${typeof crud} (${String(crud)}).`);
+    }
+    const actions = reg.actions;
+    if (actions !== undefined && !Array.isArray(actions)) {
+        throw new errors_js_1.RegistrationError(`registration '${type}': actions must be an array of action names, got ${typeof actions}.`);
+    }
+    const list = actions ?? [];
+    if (crud === false && list.length === 0) {
+        throw new errors_js_1.RegistrationError(`registration '${type}': crudActions:false requires a non-empty actions list ` +
+            `(a type with no actions could never be granted).`);
+    }
+    const seen = new Set();
+    for (const a of list) {
+        if (typeof a !== 'string') {
+            throw new errors_js_1.RegistrationError(`registration '${type}': action ${String(a)} must be a string, got ${typeof a}.`);
+        }
+        if (RESERVED_ACTIONS.has(a)) {
+            throw new errors_js_1.RegistrationError(`registration '${type}': action '${a}' is reserved ('*' is the wildcard, 'access' the ` +
+                `@Classified default).`);
+        }
+        if (a.length > MAX_ACTION_LENGTH) {
+            throw new errors_js_1.RegistrationError(`registration '${type}': action '${a}' is longer than ${MAX_ACTION_LENGTH} characters.`);
+        }
+        if (!core_1.SEGMENT_FORMAT.test(a)) {
+            throw new errors_js_1.RegistrationError(`registration '${type}': action '${a}' must be snake_case (${String(core_1.SEGMENT_FORMAT)}).`);
+        }
+        if (crud !== false && CRUD_ACTIONS.includes(a)) {
+            throw new errors_js_1.RegistrationError(`registration '${type}': action '${a}' is a CRUD verb, already granted by default; ` +
+                `list it only with crudActions:false.`);
+        }
+        if (seen.has(a)) {
+            throw new errors_js_1.RegistrationError(`registration '${type}': duplicate action '${a}'.`);
+        }
+        seen.add(a);
+    }
+}
+/**
+ * The type's action vocabulary (ADR-0038): `read, create, update, delete` then the declared
+ * extras in declared order, or exactly the declared list when `crudActions === false`.
+ * Validates first (throws `RegistrationError`), so a registration read without
+ * `TableRegistry.register` (e.g. identity `extraObjects`) is held to the same rules.
+ * Framework-facing: the guard registry bridge, identity lookups and `authorize()` read it.
+ */
+function effectiveActions(reg) {
+    validateActions(reg);
+    const declared = reg.actions ?? [];
+    return reg.crudActions === false ? [...declared] : [...CRUD_ACTIONS, ...declared];
 }
 /**
  * Chokepoint 1 (§4.1 of the framework-owns-data-layer design). Every registered

package/dist/types.d.ts

@@ -212,6 +212,19 @@ export interface ObjectType {
      * still applies).
      */
     readonly readScope?: ReadScope;
+    /**
+     * OPTIONAL extra actions beyond CRUD (ADR-0038), e.g. `['activate']`. Each is a
+     * permission-key segment (`SEGMENT_FORMAT`, at most 64 characters), unique, never `*` or
+     * `access`, and never a CRUD name unless `crudActions` is `false`. Validated at boot; read
+     * through `effectiveActions(reg)`.
+     */
+    readonly actions?: readonly string[];
+    /**
+     * OPTIONAL, default `true`: the type's vocabulary starts with `read, create, update, delete`.
+     * `false` is for authority-only types (never CRUD'd through the engine): the vocabulary is
+     * exactly `actions`, which must then be non-empty (ADR-0038).
+     */
+    readonly crudActions?: boolean;
 }
 /** Input to a create/update — field keys → values (+ optional junction refs). */
 export interface RecordInput {
@@ -244,6 +257,41 @@ export interface SearchQuery {
     /** The search term — bound as `%term%` per field (wildcards escaped). */
     readonly term: string;
 }
+/**
+ * The `list()` filter operators (list-query-operators SPEC v2 §10). Exactly these keys; no
+ * `ne`/`not_in`/`contains` (follow-up spec). Operator × type: `eq`/`in` on every type but
+ * `json`; `gt|gte|lt|lte|between` on `string`, `number`, `uuid`, `timestamp`; `isNull` /
+ * `isNotNull` on every type.
+ */
+export type FilterOperator = 'eq' | 'in' | 'gt' | 'gte' | 'lt' | 'lte' | 'between' | 'isNull' | 'isNotNull';
+/** A filter operand before coercion (coerced per field type like a write; `?`-bound). */
+export type FilterScalar = string | number | boolean | Date | null;
+/**
+ * One `where` entry: a scalar (equality; `null` ⇒ `IS NULL`) or exactly ONE operator object.
+ * An unknown operator, several operators in one object, or a malformed operand throws
+ * (never degrades to "no filter").
+ */
+export type FilterValue = FilterScalar | {
+    readonly eq: FilterScalar;
+} | {
+    readonly in: readonly FilterScalar[];
+} | {
+    readonly gt: FilterScalar;
+} | {
+    readonly gte: FilterScalar;
+} | {
+    readonly lt: FilterScalar;
+} | {
+    readonly lte: FilterScalar;
+} | {
+    readonly between: readonly [FilterScalar, FilterScalar];
+} | {
+    readonly isNull: true;
+} | {
+    readonly isNotNull: true;
+};
+/** A list `where`: registered field KEY → filter value, ANDed in object key order. */
+export type WhereClause = Readonly<Record<string, FilterValue>>;
 /**
  * A list query — tenant-scoped filtering + simple paging, plus optional search
  * (LIKE across fields) and sort (ORDER BY). All field references are registered
@@ -252,8 +300,8 @@ export interface SearchQuery {
 export interface ListQuery {
     readonly limit?: number;
     readonly offset?: number;
-    /** Equality filters on core field keys. */
-    readonly where?: Readonly<Record<string, unknown>>;
+    /** Filters on registered field keys: scalar equality or one operator (`FilterValue`). */
+    readonly where?: WhereClause;
     /** Free-text LIKE search across named field keys (ANDed with `where` + tenant). */
     readonly search?: SearchQuery;
     /**
@@ -270,6 +318,42 @@ export interface RecordPage {
     readonly rows: readonly RecordView[];
     readonly total: number;
 }
+/**
+ * An `aggregate()` function (list-query-operators SPEC v2 §10): `count` (no field ⇒ `COUNT(*)`),
+ * `sum`/`avg` on `number` fields, `min`/`max` on `string`, `number`, `uuid`, `timestamp`.
+ */
+export type AggregateFn = 'count' | 'sum' | 'min' | 'max' | 'avg';
+/** One measure: `fn` over a registered field KEY, returned under `as` (`^[a-z_][a-z0-9_]{0,63}$`). */
+export interface AggregateMeasure {
+    readonly fn: AggregateFn;
+    readonly field?: string;
+    readonly as: string;
+}
+/**
+ * An aggregate over exactly the rows `list()` would return for the same `where`/`search`
+ * (shared read WHERE, Shield #8). `groupBy` ≤ 3 non-json field keys; 1..10 `measures`;
+ * `limit` caps the number of groups (default 100, max 1000).
+ */
+export interface AggregateQuery {
+    readonly where?: WhereClause;
+    readonly search?: SearchQuery;
+    readonly groupBy?: readonly string[];
+    readonly measures: readonly AggregateMeasure[];
+    readonly limit?: number;
+}
+/**
+ * One group: `key` maps each `groupBy` field key to its value (`{}` when ungrouped); `values`
+ * maps each measure alias to its result. `count`/`sum`/`avg` are numbers (or `null`); `min`/`max`
+ * keep the column's value (`string` for string/uuid, `Date` for timestamp, `number`) or `null`.
+ */
+export interface AggregateGroup {
+    readonly key: Readonly<Record<string, unknown>>;
+    readonly values: Readonly<Record<string, number | string | Date | null>>;
+}
+/** Ungrouped ⇒ exactly one group; grouped with zero rows ⇒ `groups: []`. Ordered by group keys. */
+export interface AggregateResult {
+    readonly groups: readonly AggregateGroup[];
+}
 /**
  * The ONLY data-access surface a feature is given. Every method flows through the
  * full pipe (permission gate + audit are mandatory). No pool, query runner, or
@@ -306,6 +390,32 @@ export interface RecordEngine {
      * outside one it throws `EngineUnavailableError` (a lock released at once serialises nothing).
      */
     lockForUpdate(typeKey: string, id: RecordId, actor: Principal): Promise<void>;
+    /**
+     * Record-level decision for one declared action, with no write (custom object actions,
+     * ADR-0038). Resolves on allow, throws on deny; returns no row data and writes no audit row.
+     * An `action` outside the type's declared vocabulary throws `RegistrationError` before any SQL
+     * or decision. Then the type pre-gate, the tenant-scoped fetch (`whereById`; `FOR UPDATE` inside
+     * `transaction(fn)`, plain `SELECT` outside) and the record-level `decide()` on the row's facts
+     * and tenant. Missing and foreign rows give the same `AuthorizationDeniedError`
+     * (`no_record_permit`); a decision throw is `EngineUnavailableError`. A deny does not make an
+     * open transaction rollback-only.
+     */
+    authorize(typeKey: string, id: RecordId, action: string, actor: Principal): Promise<void>;
+    /**
+     * Aggregate (count/sum/avg/min/max, optional groupBy) over exactly the rows `list()` returns
+     * for the same `where`/`search`: gated as object-type `read` like `list`, then one SELECT with
+     * the list's read WHERE. Read-only; writes no audit row.
+     */
+    aggregate(typeKey: string, query: AggregateQuery, actor: Principal): Promise<AggregateResult>;
+    /**
+     * Create 1..500 records all-or-nothing in ONE transaction: each row runs the full single-row
+     * `create` pipe (gate, derive, validate, write, junction-sync, create wall, audit), in order.
+     * The first failing row throws and the whole batch rolls back; inside `transaction(fn)` it
+     * joins the outer one. Each row's audit event carries the call's `batchId` and its 0-based
+     * `batchIndex`. An empty, non-array or over-cap `inputs` throws `ValidationError('inputs')`
+     * before any transaction opens. Returns the ids in input order.
+     */
+    createMany(typeKey: string, inputs: readonly RecordInput[], actor: Principal): Promise<RecordId[]>;
 }
 export type { Principal };
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/D,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;AAExF,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,SAAS,CAAC;AAEnD;;iFAEiF;AACjF,MAAM,MAAM,YAAY,GACtB,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,eAAe,GAAG,gBAAgB,CAAC;AAEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CACvC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEN;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,UAAU,CAAC;AAExD,2FAA2F;AAC3F,eAAO,MAAM,sBAAsB,WAAW,CAAC;AAE/C,mDAAmD;AACnD,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAExE,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9D;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,mEAAmE;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED,qFAAqF;AACrF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACrC;AAED,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjF;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjE;;;;;;;OAOG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/E;AAED,YAAY,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/D,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;AAExF,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,SAAS,CAAC;AAEnD;;iFAEiF;AACjF,MAAM,MAAM,YAAY,GACtB,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,eAAe,GAAG,gBAAgB,CAAC;AAEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CACvC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEN;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,UAAU,CAAC;AAExD,2FAA2F;AAC3F,eAAO,MAAM,sBAAsB,WAAW,CAAC;AAE/C,mDAAmD;AACnD,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAExE,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9D;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,mEAAmE;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED,qFAAqF;AACrF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACxB,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEjF,yFAAyF;AACzF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnE;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ;IAAE,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,GACxC;IAAE,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC;AAEjC,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACrC;AAED,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAElE,sGAAsG;AACtG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;CAC1E;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;CAC5C;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjF;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjE;;;;;;;OAOG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;;;;;;OASG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9F;;;;;;;OAOG;IACH,UAAU,CACR,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;CACxB;AAED,YAAY,EAAE,SAAS,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/engine",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "license": "MIT",
   "description": "Astram framework — the paved road. ONE unbypassable write pipe (resolve-schema → permission gate → derive-write-context → validate → compute → write → junction-sync → audit → emit-event) over real physical tables, that every feature's CRUD flows through. Feature code receives ONLY the RecordEngine facade — never a raw pool/DataSource/QueryRunner (the physical wall). Security-gate + audit are mandatory stages. Missing capability → a typed CapabilityNotSupportedError (the gap-flag STOP). Builds on @astram/core (metadata contract, decide(), audit) + @astram/guard (decision authority).",
   "type": "commonjs",
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "mariadb": "^3.5.4",
-    "@astram/core": "1.5.0"
+    "@astram/core": "1.6.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",