@kubun/service-graph-api 0.16.0 → 0.16.1

package/lib/handlers.js

@@ -72,8 +72,9 @@ export function createGraphHandlers(params) {
             if (ctx.param.mutations != null) {
                 // Pre-signed mode: client submitted JWT tokens keyed by GraphQL field alias
                 const mutations = ctx.param.mutations;
-                const keys = Object.keys(mutations);
-                const tokens = keys.map((k)=>mutations[k]);
+                const entries = Object.entries(mutations);
+                const keys = entries.map(([key])=>key);
+                const tokens = entries.map(([, token])=>token);
                 // Apply all mutations atomically via engine primitive. A
                 // capability-check failure throws `WriteAccessDeniedError` from the
                 // apply path; translate it into a GraphQL-shaped result so the wire
@@ -106,12 +107,12 @@ export function createGraphHandlers(params) {
                 // mode does not configure an accessGate, so every result here carries
                 // a non-null `document`.
                 const mutatedDocuments = {};
-                for(let i = 0; i < keys.length; i++){
-                    const doc = results[i].document;
+                for (const [i, key] of keys.entries()){
+                    const doc = results[i]?.document;
                     if (doc == null) {
                         throw new Error('Unexpected dropped mutation in pre-signed apply (no gate configured)');
                     }
-                    mutatedDocuments[keys[i]] = doc;
+                    mutatedDocuments[key] = doc;
                 }
                 // Execute GraphQL with overridden mutation executors that return pre-applied results.
                 // contextExtensions overrides the engine's default executors via shallow merge.
@@ -146,6 +147,12 @@ export function createGraphHandlers(params) {
                 throw new Error('Delegated mutations require a SigningIdentity on the engine');
             }
             const transactionID = ctx.param.transactionID ?? null;
+            // Client may request an explicit document owner distinct from the signed
+            // viewer (e.g. a controller root the device is delegated to write for).
+            // The engine's write-access check gates it: when owner != signer, apply
+            // requires a delegation from `owner` for `document/write`. Omitting owner
+            // preserves the historical owner = viewerDID behavior.
+            const owner = ctx.param.owner ?? viewerDID;
             // Non-transaction delegated: engine.mutateGraph() handles signing internally
             if (transactionID == null) {
                 const result = await engine.mutateGraph({
@@ -153,7 +160,7 @@ export function createGraphHandlers(params) {
                     text: ctx.param.text,
                     variables: ctx.param.variables ?? {},
                     viewerDID,
-                    owner: viewerDID
+                    owner
                 });
                 return toGraphResult(result);
             }
@@ -189,7 +196,7 @@ export function createGraphHandlers(params) {
                 issuer: signingIdentity.id,
                 hlc,
                 getRandomValues,
-                owner: viewerDID,
+                owner,
                 async processSetMutation (mutation) {
                     return await signAndBuffer(mutation);
                 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/service-graph-api",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,
@@ -22,7 +22,7 @@
     "@kubun/id": "^0.16.0",
     "@kubun/mutation": "^0.16.0",
     "@kubun/plugin-service-api": "^0.16.0",
-    "@kubun/protocol": "^0.16.0",
+    "@kubun/protocol": "^0.16.1",
     "@sozai/generator": "^0.2.0",
     "@sozai/runtime": "^0.1.0",
     "graphql": "^16.14.2"
@@ -47,8 +47,8 @@
   "scripts": {
     "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
     "build:clean": "del lib",
-    "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
-    "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
+    "build:js": "del 'lib/**/*.js' && swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
+    "build:types": "del 'lib/**/*.d.ts' 'lib/**/*.d.ts.map' && tsc --emitDeclarationOnly --skipLibCheck",
     "build:types:ci": "tsc --emitDeclarationOnly --declarationMap false",
     "test": "pnpm run test:types && pnpm run test:unit",
     "test:types": "tsc --noEmit -p tsconfig.test.json",