@aventara/core 1.0.0-rc.10 → 1.0.0-rc.12

package/dist/runtime/request-envelope.validator.js

@@ -1,10 +1,13 @@
+import { isRecord } from "./record.guard.js";
 const ORIGINS = ["application", "client", "agent"];
 const OPERATION_IDENTITY_MEMBERS = ["resource", "family", "variant"];
 export function validateOperationEnvelope(request) {
     if (!isRecord(request)) {
         return [issue([], "V1001", "Operation request must be an object.")];
     }
-    const issues = [...originAndIdentityIssues(request)];
+    const issues = [
+        ...originAndIdentityIssues(request, request.family === "find"),
+    ];
     for (const member of OPERATION_IDENTITY_MEMBERS) {
         const failure = requiredStringIssue(request, member);
         if (failure !== undefined) {
@@ -17,9 +20,9 @@ export function validateTransactionEnvelope(request) {
     if (!isRecord(request)) {
         return [issue([], "V1001", "Transaction request must be an object.")];
     }
-    return originAndIdentityIssues(request);
+    return originAndIdentityIssues(request, false);
 }
-function originAndIdentityIssues(request) {
+function originAndIdentityIssues(request, readable) {
     const issues = [];
     const origin = request.origin;
     if (origin === undefined) {
@@ -46,7 +49,7 @@ function originAndIdentityIssues(request) {
     if (origin === "client" || origin === "agent") {
         issues.push(...protocolIssues(request.protocol, origin));
         if (request.transport !== undefined) {
-            issues.push(...transportIssues(request.transport));
+            issues.push(...transportIssues(request.transport, readable));
         }
     }
     else if (origin === "application") {
@@ -84,15 +87,18 @@ function protocolIssues(protocol, origin) {
     }
     return issues;
 }
-function transportIssues(transport) {
+function transportIssues(transport, readable) {
     if (!isRecord(transport)) {
         return [
             issue(["transport"], "V1001", "Transport metadata must be an object."),
         ];
     }
     const issues = [];
-    if (transport.method !== "POST") {
-        issues.push(issue(["transport", "method"], "V1001", 'Transport method must be "POST".'));
+    if (transport.method !== "POST" &&
+        !(readable && transport.method === "GET")) {
+        issues.push(issue(["transport", "method"], "V1001", readable
+            ? 'Transport method must be "POST" or "GET".'
+            : 'Transport method must be "POST".'));
     }
     const headers = transport.headers;
     if (!isRecord(headers)) {
@@ -115,9 +121,6 @@ function requiredStringIssue(request, member) {
         ? undefined
         : issue([member], "V1001", `Property "${member}" must be a string.`);
 }
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function issue(path, code, message) {
     return { path, code, message };
 }

package/dist/runtime/scalar-runtime.d.ts

@@ -20,16 +20,6 @@ type ScalarValueNormalizationResult = {
     readonly issues: readonly AvValidationIssue[];
 };
 type Path = readonly (string | number)[];
-/**
- * The one discriminant between an argument OBJECT and a VALUE wherever a position
- * admits both — a filter position above all: a **plain** record is an operator object,
- * and anything else — a `Date`, a core `AvDecimal`, a `Uint8Array` — is a value, which
- * equality shorthand then holds to the field's scalar. The validator (`operation-
- * validator-core.ts`) reads a filter position through this same answer, and an
- * adapter's filter translation is expected to, so a position cannot be operators to
- * one reader and a value to another.
- */
-export declare function isPlainRecord(value: unknown): value is Readonly<Record<string, unknown>>;
 /** The `V1001` of an `undefined` the request reads with. */
 export declare function unsentReadValueIssue(path: Path): AvValidationIssue;
 /**

package/dist/runtime/scalar-runtime.js

@@ -6,6 +6,7 @@ import { decodeBase64, WIRE_SCALAR_PATTERNS, } from "../contracts/wire-scalar-fo
 import { routeTransactionReferenceCandidate, } from "../transactions/transaction-reference.js";
 import { AvDecimal, isAvDecimal } from "./decimal.js";
 import { fieldCheckIssues } from "./field-check.evaluator.js";
+import { isPlainRecord } from "./record.guard.js";
 const INT_MIN = -(2 ** 31);
 const INT_MAX = 2 ** 31 - 1;
 const BIGINT_MIN = -(2n ** 63n);
@@ -15,16 +16,6 @@ const NAMED_FORMATS = new Set(AVZ_FORMATS);
 function isNamedFormat(format) {
     return NAMED_FORMATS.has(format);
 }
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-export function isPlainRecord(value) {
-    if (!isRecord(value)) {
-        return false;
-    }
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === null;
-}
 function issue(code, path, message) {
     return { code, path, message };
 }

package/dist/runtime/thenable.guard.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Whether `value` is what `await` waits for rather than answers at once: an
+ * object or function whose `then` is a function. Reads `then` once; a `then`
+ * getter that throws throws here, so a caller reading an untrusted value guards
+ * the call.
+ */
+export declare function isThenable(value: unknown): value is PromiseLike<unknown>;

package/dist/runtime/thenable.guard.js

@@ -0,0 +1,5 @@
+export function isThenable(value) {
+    return (value !== null &&
+        (typeof value === "object" || typeof value === "function") &&
+        typeof value.then === "function");
+}

package/dist/runtime/unsent-value.normalizer.js

@@ -1,6 +1,7 @@
 import { lookupField, lookupResource } from "../contracts/contract-lookup.js";
-import { isPlainRecord, WRITE_KEYS } from "./field-stage.runtime.js";
+import { WRITE_KEYS } from "./field-stage.runtime.js";
 import { isRelationMutationDirective, RELATION_MUTATION_RECORD_SITES, } from "./mutation-planner.js";
+import { isPlainRecord } from "./record.guard.js";
 const REMOVE = Symbol("remove");
 const DEPTH_CEILING = 256;
 function rebuilt(record, changes) {

package/dist/transactions/operation-arguments-encoder.js

@@ -2,14 +2,8 @@ import { lookupField, lookupResource } from "../contracts/contract-lookup.js";
 import { encodeBase64 } from "../contracts/wire-scalar-format.js";
 import { isAvDecimal } from "../runtime/decimal.js";
 import { isRelationMutationDirective, RELATION_MUTATION_RECORD_SITES, } from "../runtime/mutation-planner.js";
+import { isPlainRecord } from "../runtime/record.guard.js";
 import { isTransactionReferenceCandidate } from "./transaction-reference.js";
-function isPlainRecord(value) {
-    if (value === null || typeof value !== "object" || Array.isArray(value)) {
-        return false;
-    }
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === null;
-}
 function cloneRecord(value) {
     return { ...value };
 }

package/dist/transactions/sql-statement.validator.js

@@ -5,7 +5,8 @@ import { isAvDecimal } from "../runtime/decimal.js";
 import { planStepPath } from "../runtime/error-boundary.js";
 import { operationFailure } from "../runtime/operation-response.js";
 import { mapValidationOutcome } from "../runtime/outcome-mapper.js";
-import { isPlainRecord, normalizeJsonValue, } from "../runtime/scalar-runtime.js";
+import { isPlainRecord } from "../runtime/record.guard.js";
+import { normalizeJsonValue } from "../runtime/scalar-runtime.js";
 import { inspectReferenceCandidate, invalidSourceIndexIssue, referenceSourceAt, referenceSourceField, } from "./transaction-reference-validator.js";
 import { transactionOperationFailure } from "./transaction-response.js";
 function refused(issue, index) {

package/dist/transactions/transaction-plan-assembler.js

@@ -3,6 +3,7 @@ import { AvCallerDataError, } from "../runtime/caller-data.copier.js";
 import { copyAtDoor, refuseCallerData } from "../runtime/caller-data.door.js";
 import { operationFailure } from "../runtime/operation-response.js";
 import { mapValidationOutcome } from "../runtime/outcome-mapper.js";
+import { isPlainRecord } from "../runtime/record.guard.js";
 import { withoutUnsentWriteValues } from "../runtime/unsent-value.normalizer.js";
 import { encodeOperationArgumentsForWire } from "./operation-arguments-encoder.js";
 import { computeOperationFingerprint } from "./operation-fingerprint.js";
@@ -10,13 +11,6 @@ import { readSqlTemplate } from "./sql-statement.js";
 import { routeTransactionReferenceCandidate } from "./transaction-reference.js";
 import { transactionOperationFailure } from "./transaction-response.js";
 const SQL_STEP_NODE = Object.freeze({ fingerprint: null });
-function isPlainRecord(value) {
-    if (value === null || typeof value !== "object" || Array.isArray(value)) {
-        return false;
-    }
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === null;
-}
 const KEEP = Symbol("keep");
 function rebuildArguments(root, leaf) {
     const pathOf = (parent, key) => () => {

package/dist/transactions/transaction-plan-validator.js

@@ -12,6 +12,7 @@ import { createMisuseReporter } from "../runtime/misuse-reporter.js";
 import { operationFailure } from "../runtime/operation-response.js";
 import { activeContract, validateOperationRequest, validateProtocolIdentity, } from "../runtime/operation-runtime.js";
 import { mapValidationOutcome, VALIDATION_OUTCOME_MESSAGES, } from "../runtime/outcome-mapper.js";
+import { isRecord } from "../runtime/record.guard.js";
 import { encodeOperationArgumentsForWire } from "./operation-arguments-encoder.js";
 import { computeOperationFingerprint, isOperationFingerprint, } from "./operation-fingerprint.js";
 import { validateSqlStatement } from "./sql-statement.validator.js";
@@ -104,9 +105,6 @@ const OPERATION_KEYS = [
     "args",
     "fingerprint",
 ];
-function isObject(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function operationKeyFailure(contract, step, operation) {
     const { resource, family, variant } = step;
     const issue = typeof family === "string" && typeof variant === "string"
@@ -199,7 +197,7 @@ function* relationTraversals(contract, resourceName, value, path) {
         }
         return;
     }
-    if (!isObject(value)) {
+    if (!isRecord(value)) {
         return;
     }
     for (const [key, entry] of Object.entries(value)) {
@@ -215,7 +213,7 @@ function* relationTraversals(contract, resourceName, value, path) {
     }
 }
 function* operationTraversals(contract, request, index) {
-    if (!isObject(request.arguments)) {
+    if (!isRecord(request.arguments)) {
         return;
     }
     const root = planOperationArgumentsPath(index);
@@ -229,7 +227,7 @@ function* operationTraversals(contract, request, index) {
 function deletedResources(contract, request, index) {
     const deleted = request.family === "delete" ? [request.resource] : [];
     for (const traversal of operationTraversals(contract, request, index)) {
-        if (isObject(traversal.value) &&
+        if (isRecord(traversal.value) &&
             Object.hasOwn(traversal.value, "$delete")) {
             deleted.push(traversal.field.target);
         }

package/dist/transactions/transaction-reference-collector.js

@@ -1,10 +1,8 @@
 import { lookupField, lookupOwn, lookupResource, } from "../contracts/contract-lookup.js";
 import { planOperationArgumentsPath } from "../runtime/error-boundary.js";
-import { isPlainRecord, referenceOperandShape, } from "../runtime/scalar-runtime.js";
+import { isPlainRecord, isRecord } from "../runtime/record.guard.js";
+import { referenceOperandShape } from "../runtime/scalar-runtime.js";
 import { routeTransactionReferenceCandidate, } from "./transaction-reference.js";
-function isObject(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function at(position, ...segments) {
     return { ...position, path: [...position.path, ...segments] };
 }
@@ -23,7 +21,7 @@ function collectValue(field, shape, value, path, candidates, written = false) {
     return true;
 }
 function collectKey(position, selector, candidates) {
-    if (!isObject(selector)) {
+    if (!isRecord(selector)) {
         return;
     }
     const resource = lookupResource(position.contract, position.resource);
@@ -61,7 +59,7 @@ function collectScalarFilter(field, filter, path, candidates) {
     }
 }
 function collectWhere(position, where, candidates) {
-    if (!isObject(where)) {
+    if (!isRecord(where)) {
         return;
     }
     const resource = lookupResource(position.contract, position.resource);
@@ -87,7 +85,7 @@ function collectWhere(position, where, candidates) {
             if (field.cardinality === "one") {
                 collectWhere(target, value, candidates);
             }
-            else if (isObject(value)) {
+            else if (isRecord(value)) {
                 for (const operator of ["some", "every", "none"]) {
                     if (Object.hasOwn(value, operator)) {
                         collectWhere(at(target, operator), value[operator], candidates);
@@ -107,7 +105,7 @@ function eachEntry(position, operand, visit) {
     visit(position, operand);
 }
 function collectRelationDirectives(position, edge, value, candidates) {
-    if (!isObject(value)) {
+    if (!isRecord(value)) {
         return;
     }
     const target = { ...position, resource: edge.target };
@@ -129,7 +127,7 @@ function collectRelationDirectives(position, edge, value, candidates) {
             case "$delete":
             case "$upsert":
                 eachEntry(directivePosition, operand, (entryPosition, entry) => {
-                    if (!isObject(entry)) {
+                    if (!isRecord(entry)) {
                         return;
                     }
                     const where = at(entryPosition, "where");
@@ -150,7 +148,7 @@ function collectRelationDirectives(position, edge, value, candidates) {
     }
 }
 function collectData(position, data, candidates) {
-    if (!isObject(data)) {
+    if (!isRecord(data)) {
         return;
     }
     const resource = lookupResource(position.contract, position.resource);

package/dist/transactions/transaction-reference-resolver.js

@@ -1,9 +1,7 @@
 import { validationIssue } from "../operations/validation-code.js";
+import { isRecord } from "../runtime/record.guard.js";
 import { copyScalarFieldValue } from "../runtime/scalar-runtime.js";
 import { replaceTransactionSlotValues } from "./transaction-slot-writer.js";
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function unresolvedIssue(path) {
     return validationIssue("V1018", [...path, "$ref", "path"], "Transaction reference resolved to no value.");
 }

package/dist/transactions/transaction-runtime.js

@@ -1,5 +1,5 @@
 import { transactionLevelsOf } from "../config/pipeline-tree.resolver.js";
-import { openRequestPolicy, } from "../policy/policy-request.js";
+import { derivePolicyCaller, holdFirstPrincipal, openRequestPolicy, } from "../policy/policy-request.js";
 import { AdapterBoundary, planOperationArgumentsPath, planStepPath, sanitizeOperationFailure, } from "../runtime/error-boundary.js";
 import { internalFailure, operationSuccess, } from "../runtime/operation-response.js";
 import { admitOperation, EVERY_FIELD, executeAdmittedOperation, prepareStep, STEP_PIPES, withRequestState, } from "../runtime/operation-runtime.js";
@@ -82,6 +82,35 @@ function standingReferences(core, operation, args, steps, subject) {
 }
 async function executeTransactionPlan(runtime, dependencies, request, plan, state, diagnostics, caller) {
     const { adapter } = runtime;
+    const callers = new Map();
+    if (caller !== undefined) {
+        for (const step of plan.operations) {
+            if (step.kind === "operation") {
+                holdFirstPrincipal(runtime.config.policy, {
+                    origin: step.request.origin,
+                    state,
+                });
+            }
+        }
+    }
+    else {
+        for (const step of plan.operations) {
+            if (step.kind === "sql" || callers.has(step.request.origin)) {
+                continue;
+            }
+            try {
+                const derived = derivePolicyCaller(runtime.config.policy, {
+                    origin: step.request.origin,
+                    state,
+                });
+                callers.set(step.request.origin, derived instanceof Promise ? await derived : derived);
+            }
+            catch (error) {
+                diagnostics.operation(step.request, step.index)(error, "A3000");
+                return transactionOperationFailure(internalFailure(), step.index);
+            }
+        }
+    }
     const steps = new Map();
     const stateful = (operation) => {
         const known = steps.get(operation);
@@ -95,7 +124,7 @@ async function executeTransactionPlan(runtime, dependencies, request, plan, stat
             steps.set(operation, step);
             return step;
         };
-        const policy = openRequestPolicy(runtime.config.policy, runtime.contracts.core, { origin: operation.request.origin, state }, caller, adapter);
+        const policy = openRequestPolicy(runtime.config.policy, runtime.contracts.core, { origin: operation.request.origin, state }, caller ?? callers.get(operation.request.origin), adapter);
         return policy instanceof Promise ? policy.then(settle) : settle(policy);
     };
     const admitted = [];

package/dist/transactions/transaction-stage.runtime.js

@@ -3,6 +3,7 @@ import { runLevelLifecycle, } from "../runtime/level-lifecycle.runtime.js";
 import { operationFailure } from "../runtime/operation-response.js";
 import { AvPipeOutputError, PIPE_OUTPUT_FAILURE_MESSAGE, } from "../runtime/pipe-output.validator.js";
 import { deepFreeze, frozenCopy } from "../runtime/readonly-value.js";
+import { isRecord } from "../runtime/record.guard.js";
 import { AvTransactionIntegrityError } from "./transaction-integrity-error.js";
 export const TRANSACTION_ABORT = Object.freeze({ reason: "aventara-transaction-abort" });
 export const TRANSACTION_PIPES = "Transaction pipes";
@@ -26,9 +27,6 @@ export function touchedTransactionLevels(plan, levelsOf) {
     }
     return [...touched].flatMap((resource) => levelsOf(resource));
 }
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function sameStructure(left, right) {
     if (Object.is(left, right)) {
         return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aventara/core",
-  "version": "1.0.0-rc.10",
+  "version": "1.0.0-rc.12",
   "license": "SEE LICENSE IN LICENSE",
   "description": "Core runtime, contract compiler, and extension APIs for Aventara.",
   "type": "module",