@memberjunction/core-entities-server 6.1.0-edge.6 → 6.1.0

package/dist/custom/MJAIBridgeProviderEntityServer.server.d.ts

@@ -4,11 +4,7 @@ import { MJAIBridgeProviderEntity } from '@memberjunction/core-entities';
  * The complete set of known `IBridgeProviderFeatures` keys (see the generated
  * `MJAIBridgeProviderEntity_IBridgeProviderFeatures` interface and
  * `metadata/entities/JSONType-interfaces/IBridgeProviderFeatures.ts`). `SupportedFeatures` is a
- * flat object of optional booleans, so the validation is: every present key must be in this set
- * and every value must be a boolean. Keeping the list here (rather than reflecting off a runtime
- * value) makes the validator a PURE, dependency-free, easily-unit-tested function and gives a
- * friendly "unknown feature flag" message that a free-form `additionalProperties:false` schema
- * would not.
+ * flat object of optional booleans, verified at compile-time to track the generated interface.
  */
 export declare const KNOWN_BRIDGE_PROVIDER_FEATURE_KEYS: ReadonlySet<string>;
 /**

package/dist/custom/MJAIBridgeProviderEntityServer.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MJAIBridgeProviderEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJAIBridgeProviderEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,mBAAmB,EAAuB,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE9G,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC,EAAE,WAAW,CAAC,MAAM,CAoBjE,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,8BAA+B,SAAQ,wBAAwB;IACxE,2EAA2E;IAC3E,IAAoB,0BAA0B,IAAI,OAAO,CAExD;IAEqB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;CA0BnE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,GAAG,IAAI,CAatG;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,EAAE,CA8BnG"}
+{"version":3,"file":"MJAIBridgeProviderEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJAIBridgeProviderEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,mBAAmB,EAAuB,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE9G,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAiCzE;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,EAAE,WAAW,CAAC,MAAM,CAAiC,CAAC;AAErG;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,8BAA+B,SAAQ,wBAAwB;IACxE,2EAA2E;IAC3E,IAAoB,0BAA0B,IAAI,OAAO,CAExD;IAEqB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;CA0BnE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,GAAG,IAAI,CAatG;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,EAAE,CA8BnG"}

package/dist/custom/MJAIBridgeProviderEntityServer.server.js

@@ -7,17 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 import { BaseEntity, ValidationErrorInfo, ValidationErrorType } from '@memberjunction/core';
 import { RegisterClass } from '@memberjunction/global';
 import { MJAIBridgeProviderEntity } from '@memberjunction/core-entities';
-/**
- * The complete set of known `IBridgeProviderFeatures` keys (see the generated
- * `MJAIBridgeProviderEntity_IBridgeProviderFeatures` interface and
- * `metadata/entities/JSONType-interfaces/IBridgeProviderFeatures.ts`). `SupportedFeatures` is a
- * flat object of optional booleans, so the validation is: every present key must be in this set
- * and every value must be a boolean. Keeping the list here (rather than reflecting off a runtime
- * value) makes the validator a PURE, dependency-free, easily-unit-tested function and gives a
- * friendly "unknown feature flag" message that a free-form `additionalProperties:false` schema
- * would not.
- */
-export const KNOWN_BRIDGE_PROVIDER_FEATURE_KEYS = new Set([
+const FEATURE_KEYS = [
     // Join methods
     'OnDemandJoin',
     'ScheduledJoin',
@@ -37,7 +27,18 @@ export const KNOWN_BRIDGE_PROVIDER_FEATURE_KEYS = new Set([
     'DTMF',
     'CallTransfer',
     'Recording',
-]);
+    'DetachedMediaPlane',
+];
+// Compile-time check: fails build if any key in MJAIBridgeProviderEntity_IBridgeProviderFeatures is omitted
+const _exhaustive = true;
+void _exhaustive;
+/**
+ * The complete set of known `IBridgeProviderFeatures` keys (see the generated
+ * `MJAIBridgeProviderEntity_IBridgeProviderFeatures` interface and
+ * `metadata/entities/JSONType-interfaces/IBridgeProviderFeatures.ts`). `SupportedFeatures` is a
+ * flat object of optional booleans, verified at compile-time to track the generated interface.
+ */
+export const KNOWN_BRIDGE_PROVIDER_FEATURE_KEYS = new Set(FEATURE_KEYS);
 /**
  * Server-side `MJ: AI Bridge Providers` entity enforcing the invariants the architecture documents
  * (see `/plans/realtime/realtime-bridges-architecture.md` §3): the engine GATES every optional

package/dist/custom/MJAIBridgeProviderEntityServer.server.js.map

@@ -1 +1 @@
-{"version":3,"file":"MJAIBridgeProviderEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJAIBridgeProviderEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,mBAAmB,EAAoB,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAwB,IAAI,GAAG,CAAS;IACnF,eAAe;IACf,cAAc;IACd,eAAe;IACf,YAAY;IACZ,cAAc;IACd,gBAAgB;IAChB,cAAc;IACd,6BAA6B;IAC7B,SAAS;IACT,UAAU;IACV,SAAS;IACT,UAAU;IACV,UAAU;IACV,WAAW;IACX,sBAAsB;IACtB,oBAAoB;IACpB,MAAM;IACN,cAAc;IACd,WAAW;CACd,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,8BAA8B,GAApC,MAAM,8BAA+B,SAAQ,wBAAwB;IACxE,2EAA2E;IAC3E,IAAoB,0BAA0B;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IAEe,KAAK,CAAC,aAAa;QAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAEnC,2EAA2E;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1D,IAAI,WAAW,EAAE,CAAC;gBACd,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAChC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,aAAa,GAAG,6BAA6B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC5E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;gBACrC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ,CAAA;AAhCY,8BAA8B;IAD1C,aAAa,CAAC,UAAU,EAAE,yBAAyB,CAAC;GACxC,8BAA8B,CAgC1C;;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAsC;IACtE,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,CAAC,oDAAoD;IACrE,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,mBAAmB,CAC1B,aAAa,EACb,wGAAwG,EACxG,WAAW,EACX,mBAAmB,CAAC,OAAO,CAC9B,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,GAA8B;IACxE,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC,CAAC,oDAAoD;IACnE,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,OAAO,CAAC,kBAAkB,CAAC,gEAAgE,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACzI,CAAC;IAED,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,oDAAoD,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAClG,SAAS;QACb,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CACP,kBAAkB,CAAC,2BAA2B,GAAG,4BAA4B,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CACpH,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,OAAe,EAAE,KAAa;IACtD,OAAO,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACrG,CAAC;AAED,6DAA6D;AAC7D,SAAS,gBAAgB,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,OAAO,KAAK,CAAC;AACxB,CAAC"}
+{"version":3,"file":"MJAIBridgeProviderEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJAIBridgeProviderEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,mBAAmB,EAAoB,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAKzE,MAAM,YAAY,GAAG;IACjB,eAAe;IACf,cAAc;IACd,eAAe;IACf,YAAY;IACZ,cAAc;IACd,gBAAgB;IAChB,cAAc;IACd,6BAA6B;IAC7B,SAAS;IACT,UAAU;IACV,SAAS;IACT,UAAU;IACV,UAAU;IACV,WAAW;IACX,sBAAsB;IACtB,oBAAoB;IACpB,MAAM;IACN,cAAc;IACd,WAAW;IACX,oBAAoB;CACkB,CAAC;AAG3C,4GAA4G;AAC5G,MAAM,WAAW,GAAoE,IAAI,CAAC;AAC1F,KAAK,WAAW,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAwB,IAAI,GAAG,CAAS,YAAY,CAAC,CAAC;AAErG;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,8BAA8B,GAApC,MAAM,8BAA+B,SAAQ,wBAAwB;IACxE,2EAA2E;IAC3E,IAAoB,0BAA0B;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IAEe,KAAK,CAAC,aAAa;QAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAEnC,2EAA2E;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1D,IAAI,WAAW,EAAE,CAAC;gBACd,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAChC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,aAAa,GAAG,6BAA6B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC5E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;gBACrC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ,CAAA;AAhCY,8BAA8B;IAD1C,aAAa,CAAC,UAAU,EAAE,yBAAyB,CAAC;GACxC,8BAA8B,CAgC1C;;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAsC;IACtE,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,CAAC,oDAAoD;IACrE,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,mBAAmB,CAC1B,aAAa,EACb,wGAAwG,EACxG,WAAW,EACX,mBAAmB,CAAC,OAAO,CAC9B,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,GAA8B;IACxE,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC,CAAC,oDAAoD;IACnE,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,OAAO,CAAC,kBAAkB,CAAC,gEAAgE,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACzI,CAAC;IAED,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,oDAAoD,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAClG,SAAS;QACb,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CACP,kBAAkB,CAAC,2BAA2B,GAAG,4BAA4B,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CACpH,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,OAAe,EAAE,KAAa;IACtD,OAAO,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACrG,CAAC;AAED,6DAA6D;AAC7D,SAAS,gBAAgB,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,OAAO,KAAK,CAAC;AACxB,CAAC"}

package/dist/custom/MJAIRemoteBrowserProviderEntityServer.server.d.ts

@@ -4,14 +4,10 @@ import { MJAIRemoteBrowserProviderEntity } from '@memberjunction/core-entities';
  * The complete set of known `IRemoteBrowserProviderFeatures` keys (see the generated
  * `MJAIRemoteBrowserProviderEntity_IRemoteBrowserProviderFeatures` interface and
  * `metadata/entities/JSONType-interfaces/IRemoteBrowserProviderFeatures.ts`). `SupportedFeatures`
- * is a flat object of optional booleans, so the validation is: every present key must be in this
- * set and every value must be a boolean. Keeping the list here (rather than reflecting off a
- * runtime value) makes the validator a PURE, dependency-free, easily-unit-tested function and
- * gives a friendly "unknown feature flag" message that a free-form `additionalProperties:false`
- * schema would not. Mirrors `KNOWN_BRIDGE_PROVIDER_FEATURE_KEYS`.
+ * is a flat object of optional booleans, verified at compile time against the generated interface.
  */
 export declare const KNOWN_REMOTE_BROWSER_PROVIDER_FEATURE_KEYS: ReadonlySet<string>;
-/** The valid `DefaultControlMode` values (mirrors the `RemoteBrowserControlMode` union + the DB CHECK). */
+/** The valid `DefaultControlMode` values (derived from entity type + verified at compile time). */
 export declare const REMOTE_BROWSER_CONTROL_MODES: ReadonlySet<string>;
 /**
  * Server-side `MJ: AI Remote Browser Providers` entity enforcing the invariants the Remote Browser

package/dist/custom/MJAIRemoteBrowserProviderEntityServer.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MJAIRemoteBrowserProviderEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJAIRemoteBrowserProviderEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,mBAAmB,EAAuB,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAEhF;;;;;;;;;GASG;AACH,eAAO,MAAM,0CAA0C,EAAE,WAAW,CAAC,MAAM,CAgBzE,CAAC;AAEH,2GAA2G;AAC3G,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAA+D,CAAC;AAE7H;;;;;;;;;;;;;;;;GAgBG;AACH,qBACa,qCAAsC,SAAQ,+BAA+B;IACtF,2EAA2E;IAC3E,IAAoB,0BAA0B,IAAI,OAAO,CAExD;IAEqB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;CAqCnE;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,GAAG,IAAI,CAanH;AAED;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,EAAE,CA8BhH;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAC9C,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,mBAAmB,GAAG,IAAI,CA2B5B"}
+{"version":3,"file":"MJAIRemoteBrowserProviderEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJAIRemoteBrowserProviderEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,mBAAmB,EAAuB,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AA2BhF;;;;;GAKG;AACH,eAAO,MAAM,0CAA0C,EAAE,WAAW,CAAC,MAAM,CAAgD,CAAC;AAQ5H,mGAAmG;AACnG,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAAkC,CAAC;AAEhG;;;;;;;;;;;;;;;;GAgBG;AACH,qBACa,qCAAsC,SAAQ,+BAA+B;IACtF,2EAA2E;IAC3E,IAAoB,0BAA0B,IAAI,OAAO,CAExD;IAEqB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;CAqCnE;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,GAAG,IAAI,CAanH;AAED;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,EAAE,CA8BhH;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAC9C,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,mBAAmB,GAAG,IAAI,CA2B5B"}

package/dist/custom/MJAIRemoteBrowserProviderEntityServer.server.js

@@ -7,17 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 import { BaseEntity, ValidationErrorInfo, ValidationErrorType } from '@memberjunction/core';
 import { RegisterClass } from '@memberjunction/global';
 import { MJAIRemoteBrowserProviderEntity } from '@memberjunction/core-entities';
-/**
- * The complete set of known `IRemoteBrowserProviderFeatures` keys (see the generated
- * `MJAIRemoteBrowserProviderEntity_IRemoteBrowserProviderFeatures` interface and
- * `metadata/entities/JSONType-interfaces/IRemoteBrowserProviderFeatures.ts`). `SupportedFeatures`
- * is a flat object of optional booleans, so the validation is: every present key must be in this
- * set and every value must be a boolean. Keeping the list here (rather than reflecting off a
- * runtime value) makes the validator a PURE, dependency-free, easily-unit-tested function and
- * gives a friendly "unknown feature flag" message that a free-form `additionalProperties:false`
- * schema would not. Mirrors `KNOWN_BRIDGE_PROVIDER_FEATURE_KEYS`.
- */
-export const KNOWN_REMOTE_BROWSER_PROVIDER_FEATURE_KEYS = new Set([
+const REMOTE_BROWSER_FEATURE_KEYS = [
     // Control substrate & strategies
     'RawCdpControl',
     'NativeAIControl',
@@ -33,9 +23,21 @@ export const KNOWN_REMOTE_BROWSER_PROVIDER_FEATURE_KEYS = new Set([
     'MultiTab',
     'FileDownloads',
     'CaptchaSolving',
-]);
-/** The valid `DefaultControlMode` values (mirrors the `RemoteBrowserControlMode` union + the DB CHECK). */
-export const REMOTE_BROWSER_CONTROL_MODES = new Set(['AgentOnly', 'ViewOnly', 'Collaborative']);
+];
+const _exhaustiveFeature = true;
+void _exhaustiveFeature;
+/**
+ * The complete set of known `IRemoteBrowserProviderFeatures` keys (see the generated
+ * `MJAIRemoteBrowserProviderEntity_IRemoteBrowserProviderFeatures` interface and
+ * `metadata/entities/JSONType-interfaces/IRemoteBrowserProviderFeatures.ts`). `SupportedFeatures`
+ * is a flat object of optional booleans, verified at compile time against the generated interface.
+ */
+export const KNOWN_REMOTE_BROWSER_PROVIDER_FEATURE_KEYS = new Set(REMOTE_BROWSER_FEATURE_KEYS);
+const CONTROL_MODES = ['AgentOnly', 'ViewOnly', 'Collaborative'];
+const _exhaustiveMode = true;
+void _exhaustiveMode;
+/** The valid `DefaultControlMode` values (derived from entity type + verified at compile time). */
+export const REMOTE_BROWSER_CONTROL_MODES = new Set(CONTROL_MODES);
 /**
  * Server-side `MJ: AI Remote Browser Providers` entity enforcing the invariants the Remote Browser
  * channel relies on (see `/plans/realtime/realtime-bridges-architecture.md` §4d-i). The engine GATES

package/dist/custom/MJAIRemoteBrowserProviderEntityServer.server.js.map

@@ -1 +1 @@
-{"version":3,"file":"MJAIRemoteBrowserProviderEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJAIRemoteBrowserProviderEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,mBAAmB,EAAoB,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAwB,IAAI,GAAG,CAAS;IAC3F,iCAAiC;IACjC,eAAe;IACf,iBAAiB;IACjB,0BAA0B;IAC1B,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,mBAAmB;IACnB,UAAU;IACV,eAAe;IACf,gBAAgB;CACnB,CAAC,CAAC;AAEH,2GAA2G;AAC3G,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAS,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;AAE7H;;;;;;;;;;;;;;;;GAgBG;AAEI,IAAM,qCAAqC,GAA3C,MAAM,qCAAsC,SAAQ,+BAA+B;IACtF,2EAA2E;IAC3E,IAAoB,0BAA0B;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IAEe,KAAK,CAAC,aAAa;QAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAEnC,2EAA2E;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,gCAAgC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACvE,IAAI,WAAW,EAAE,CAAC;gBACd,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAChC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,aAAa,GAAG,0CAA0C,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACzF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;gBACrC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,CAAC;QACL,CAAC;QAED,6FAA6F;QAC7F,8FAA8F;QAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,kCAAkC,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACtG,IAAI,SAAS,EAAE,CAAC;gBACZ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC9B,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ,CAAA;AA3CY,qCAAqC;IADjD,aAAa,CAAC,UAAU,EAAE,iCAAiC,CAAC;GAChD,qCAAqC,CA2CjD;;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAsC;IACnF,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,CAAC,oDAAoD;IACrE,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,mBAAmB,CAC1B,aAAa,EACb,wHAAwH,EACxH,WAAW,EACX,mBAAmB,CAAC,OAAO,CAC9B,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CAAC,GAA8B;IACrF,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC,CAAC,oDAAoD;IACnE,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,OAAO,CAAC,kBAAkB,CAAC,gEAAgE,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACzI,CAAC;IAED,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,0CAA0C,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,oDAAoD,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAClG,SAAS;QACb,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CACP,kBAAkB,CAAC,2BAA2B,GAAG,4BAA4B,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CACpH,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kCAAkC,CAC9C,IAA+B,EAC/B,WAAsC;IAEtC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,CAAC,kEAAkE;IACnF,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,CAAC,0BAA0B;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,gEAAgE;IAChE,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IACD,wEAAwE;IACxE,IAAI,IAAI,KAAK,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,mBAAmB,CAC1B,oBAAoB,EACpB,uBAAuB,IAAI,gCAAgC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EACpH,IAAI,EACJ,mBAAmB,CAAC,OAAO,CAC9B,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAA8B;IACrD,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,OAAO,MAAiC,CAAC;QAC7C,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,gGAAgG;IACpG,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,OAAe,EAAE,KAAa;IACtD,OAAO,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACrG,CAAC;AAED,6DAA6D;AAC7D,SAAS,gBAAgB,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,OAAO,KAAK,CAAC;AACxB,CAAC"}
+{"version":3,"file":"MJAIRemoteBrowserProviderEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJAIRemoteBrowserProviderEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,mBAAmB,EAAoB,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAKhF,MAAM,2BAA2B,GAAG;IAChC,iCAAiC;IACjC,eAAe;IACf,iBAAiB;IACjB,0BAA0B;IAC1B,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,mBAAmB;IACnB,UAAU;IACV,eAAe;IACf,gBAAgB;CACmC,CAAC;AAGxD,MAAM,kBAAkB,GAA0F,IAAI,CAAC;AACvH,KAAK,kBAAkB,CAAC;AAExB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAwB,IAAI,GAAG,CAAS,2BAA2B,CAAC,CAAC;AAG5H,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,CAA2C,CAAC;AAE3G,MAAM,eAAe,GAAqF,IAAI,CAAC;AAC/G,KAAK,eAAe,CAAC;AAErB,mGAAmG;AACnG,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAS,aAAa,CAAC,CAAC;AAEhG;;;;;;;;;;;;;;;;GAgBG;AAEI,IAAM,qCAAqC,GAA3C,MAAM,qCAAsC,SAAQ,+BAA+B;IACtF,2EAA2E;IAC3E,IAAoB,0BAA0B;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IAEe,KAAK,CAAC,aAAa;QAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAEnC,2EAA2E;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,gCAAgC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACvE,IAAI,WAAW,EAAE,CAAC;gBACd,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAChC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,aAAa,GAAG,0CAA0C,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACzF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;gBACrC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,CAAC;QACL,CAAC;QAED,6FAA6F;QAC7F,8FAA8F;QAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,kCAAkC,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACtG,IAAI,SAAS,EAAE,CAAC;gBACZ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC9B,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ,CAAA;AA3CY,qCAAqC;IADjD,aAAa,CAAC,UAAU,EAAE,iCAAiC,CAAC;GAChD,qCAAqC,CA2CjD;;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAsC;IACnF,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,CAAC,oDAAoD;IACrE,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,mBAAmB,CAC1B,aAAa,EACb,wHAAwH,EACxH,WAAW,EACX,mBAAmB,CAAC,OAAO,CAC9B,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CAAC,GAA8B;IACrF,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC,CAAC,oDAAoD;IACnE,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,OAAO,CAAC,kBAAkB,CAAC,gEAAgE,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACzI,CAAC;IAED,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,0CAA0C,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,oDAAoD,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAClG,SAAS;QACb,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CACP,kBAAkB,CAAC,2BAA2B,GAAG,4BAA4B,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CACpH,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kCAAkC,CAC9C,IAA+B,EAC/B,WAAsC;IAEtC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,CAAC,kEAAkE;IACnF,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,CAAC,0BAA0B;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,gEAAgE;IAChE,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IACD,wEAAwE;IACxE,IAAI,IAAI,KAAK,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,mBAAmB,CAC1B,oBAAoB,EACpB,uBAAuB,IAAI,gCAAgC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EACpH,IAAI,EACJ,mBAAmB,CAAC,OAAO,CAC9B,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAA8B;IACrD,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,OAAO,MAAiC,CAAC;QAC7C,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,gGAAgG;IACpG,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,OAAe,EAAE,KAAa;IACtD,OAAO,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACrG,CAAC;AAED,6DAA6D;AAC7D,SAAS,gBAAgB,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,OAAO,KAAK,CAAC;AACxB,CAAC"}

package/dist/custom/MJEntityEntityServer.server.d.ts

@@ -0,0 +1,36 @@
+import { EntitySaveOptions } from '@memberjunction/core';
+import { MJEntityEntityExtended } from '@memberjunction/core-entities';
+/**
+ * Server-side `MJ: Entities` entity — the runtime half of field-security lifecycle management.
+ *
+ * Turning `EnableFieldLevelSecurity` ON has to snapshot the entity's existing entity-level
+ * permissions into per-field rows, or the entity comes up with every field denied: on an
+ * enabled entity a field with no rows is denied, not open. The flag and its rows therefore have
+ * to land together — a committed flag with no rows locks every user out of every field until
+ * someone notices.
+ *
+ * Turning it OFF writes nothing. Rows are retained and simply stop being consulted, so
+ * re-enabling does not lose an administrator's configuration. Re-enabling runs the same
+ * reconciliation, which adds whatever the schema gained in the meantime and leaves existing
+ * rows alone.
+ */
+export declare class MJEntityEntityServer extends MJEntityEntityExtended {
+    Save(options?: EntitySaveOptions): Promise<boolean>;
+    /**
+     * True when this save switches field security from off to on.
+     *
+     * A new record with the flag already set counts — there is no prior state, so the rows
+     * still have to be created. On an existing record the field must be dirty, or every
+     * unrelated edit to an entity enabled months ago would re-run reconciliation.
+     */
+    private isTurningFieldSecurityOn;
+    /**
+     * Writes the snapshot rows for this entity, inside the caller's transaction.
+     *
+     * Resolves the `EntityInfo` from the provider rather than trusting a captured reference:
+     * the delta is computed from the entity's fields and entity-level permissions, and those
+     * live on metadata rather than on this record.
+     */
+    private snapshotFieldPermissions;
+}
+//# sourceMappingURL=MJEntityEntityServer.server.d.ts.map

package/dist/custom/MJEntityEntityServer.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJEntityEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJEntityEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,iBAAiB,EAAuD,MAAM,sBAAsB,CAAC;AAC1H,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE;;;;;;;;;;;;;GAaG;AACH,qBACa,oBAAqB,SAAQ,sBAAsB;IACtC,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBzE;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IAOhC;;;;;;OAMG;YACW,wBAAwB;CAWzC"}

package/dist/custom/MJEntityEntityServer.server.js

@@ -0,0 +1,77 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { BaseEntity, LogDebug, RunInEntityTransaction } from '@memberjunction/core';
+import { MJEntityEntityExtended } from '@memberjunction/core-entities';
+import { RegisterClass, UUIDsEqual } from '@memberjunction/global';
+import { ReconcileFieldPermissions } from './fieldPermissionReconciler.js';
+/**
+ * Server-side `MJ: Entities` entity — the runtime half of field-security lifecycle management.
+ *
+ * Turning `EnableFieldLevelSecurity` ON has to snapshot the entity's existing entity-level
+ * permissions into per-field rows, or the entity comes up with every field denied: on an
+ * enabled entity a field with no rows is denied, not open. The flag and its rows therefore have
+ * to land together — a committed flag with no rows locks every user out of every field until
+ * someone notices.
+ *
+ * Turning it OFF writes nothing. Rows are retained and simply stop being consulted, so
+ * re-enabling does not lose an administrator's configuration. Re-enabling runs the same
+ * reconciliation, which adds whatever the schema gained in the meantime and leaves existing
+ * rows alone.
+ */
+let MJEntityEntityServer = class MJEntityEntityServer extends MJEntityEntityExtended {
+    async Save(options) {
+        if (!this.isTurningFieldSecurityOn()) {
+            return super.Save(options);
+        }
+        const provider = this.ProviderToUse;
+        return RunInEntityTransaction(this.ProviderToUse, async () => {
+            // The flag has to persist BEFORE reconciliation: the rows it writes are only
+            // meaningful once the flag says they apply.
+            if (!(await super.Save(options))) {
+                return false;
+            }
+            await this.snapshotFieldPermissions(provider);
+            return true;
+        });
+    }
+    /**
+     * True when this save switches field security from off to on.
+     *
+     * A new record with the flag already set counts — there is no prior state, so the rows
+     * still have to be created. On an existing record the field must be dirty, or every
+     * unrelated edit to an entity enabled months ago would re-run reconciliation.
+     */
+    isTurningFieldSecurityOn() {
+        if (!this.EnableFieldLevelSecurity) {
+            return false;
+        }
+        return !this.IsSaved || this.GetFieldByName('EnableFieldLevelSecurity').Dirty;
+    }
+    /**
+     * Writes the snapshot rows for this entity, inside the caller's transaction.
+     *
+     * Resolves the `EntityInfo` from the provider rather than trusting a captured reference:
+     * the delta is computed from the entity's fields and entity-level permissions, and those
+     * live on metadata rather than on this record.
+     */
+    async snapshotFieldPermissions(provider) {
+        const entityInfo = provider.Entities?.find(e => UUIDsEqual(e.ID, this.ID));
+        if (!entityInfo) {
+            // Metadata has not caught up with a brand-new entity yet. CodeGen's manage-metadata
+            // pass reconciles it on its next run, which is the same path a schema change takes.
+            LogDebug(`[FieldSecurity] '${this.Name}' enabled before its metadata was available; deferring snapshot`);
+            return;
+        }
+        const result = await ReconcileFieldPermissions(entityInfo, provider, this.ContextCurrentUser);
+        LogDebug(`[FieldSecurity] '${this.Name}' enabled; snapshot wrote ${result.Inserted} row(s)`);
+    }
+};
+MJEntityEntityServer = __decorate([
+    RegisterClass(BaseEntity, 'MJ: Entities')
+], MJEntityEntityServer);
+export { MJEntityEntityServer };
+//# sourceMappingURL=MJEntityEntityServer.server.js.map

package/dist/custom/MJEntityEntityServer.server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJEntityEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJEntityEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAwC,QAAQ,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC1H,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE;;;;;;;;;;;;;GAaG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,sBAAsB;IAC5C,KAAK,CAAC,IAAI,CAAC,OAA2B;QAClD,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAA6C,CAAC;QACpE,OAAO,sBAAsB,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE;YACzD,6EAA6E;YAC7E,4CAA4C;YAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QAChB,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB;QAC5B,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,CAAC,KAAK,CAAC;IAClF,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,wBAAwB,CAAC,QAA2B;QAC9D,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,oFAAoF;YACpF,oFAAoF;YACpF,QAAQ,CAAC,oBAAoB,IAAI,CAAC,IAAI,iEAAiE,CAAC,CAAC;YACzG,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC9F,QAAQ,CAAC,oBAAoB,IAAI,CAAC,IAAI,6BAA6B,MAAM,CAAC,QAAQ,SAAS,CAAC,CAAC;IACjG,CAAC;CACJ,CAAA;AAlDY,oBAAoB;IADhC,aAAa,CAAC,UAAU,EAAE,cAAc,CAAC;GAC7B,oBAAoB,CAkDhC"}

package/dist/custom/MJEntityFieldPermissionEntityServer.server.d.ts

@@ -0,0 +1,167 @@
+import { EntityDeleteOptions, EntityFieldInfo, EntitySaveOptions, EntityInfo, FieldPermissionRuleVerbs, ValidationResult } from '@memberjunction/core';
+import { MJEntityFieldPermissionEntity } from '@memberjunction/core-entities';
+/**
+ * Server-side `MJ: Entity Field Permissions` entity — the save-time half of the
+ * unrestrictable-target guard for field-level security.
+ *
+ * The runtime aggregation (`EntityFieldInfo.GetUserFieldPermissions`) already forces access
+ * open for these targets, so this subclass is not what makes the system safe. It is what makes
+ * the system *diagnosable*: without it an administrator can save a row that silently does
+ * nothing, then reasonably conclude the feature is broken. Rejecting at save says why.
+ *
+ * Two categories are refused, matching the two runtime guards exactly:
+ *
+ * 1. **Primary keys and system columns.** Stripping a primary key from a result breaks entity
+ *    load, `CompositeKey` construction, relationship resolution, and cache fingerprinting —
+ *    failures that surface nowhere near the permission record that caused them.
+ * 2. **The security-configuration and identity surface** (see
+ *    {@link EntityFieldInfo.IsOnUnrestrictableEntity}). Restricting a column on the very
+ *    entities field security is administered through produces a configuration that cannot be
+ *    reversed through the product — recovery would mean direct SQL against the database.
+ *
+ * A third category is refused for a different reason: a **`Deny`** aimed at a role the MJ system
+ * user holds (see {@link SystemUserRoleRejectionReason}). That one is not about diagnosability —
+ * it is what lets the runtime aggregation have no exempt user at all. The server's own account
+ * gets its access from ordinary `Allow` rows like everyone else, and this guard is what stops
+ * those being revoked.
+ *
+ * Note what is deliberately NOT here: any notion of a user who is exempt from a Deny at
+ * RUNTIME. The guards are on which *targets* are restrictable and on what may be *configured*,
+ * never on whose access is evaluated. A feature whose purpose is compensation and donor-giving
+ * confidentiality cannot ship with a role that quietly reads everything.
+ */
+export declare class MJEntityFieldPermissionEntityServer extends MJEntityFieldPermissionEntity {
+    Validate(): ValidationResult;
+    /**
+     * Refuses an EDIT that would strip the MJ system user's last `Allow` on a field.
+     *
+     * Not in `Validate()` for two reasons. It needs the field's rules as they stand in the
+     * DATABASE — loaded metadata lags recent writes, and reading a stale sibling row as `Allow` is
+     * exactly how three individually-innocent `No Access` edits get through one at a time. And
+     * loading them is asynchronous, which `Validate()` is not.
+     *
+     * Inserts are deliberately not checked: adding a rule can only add access, never remove an
+     * existing `Allow`, so the `Deny` check in `Validate()` covers them completely. It has to —
+     * snapshot initialization writes its rows one at a time, and an aggregate check would refuse
+     * the half-built state.
+     */
+    Save(options?: EntitySaveOptions): Promise<boolean>;
+    /**
+     * Refuses a DELETE that would strip the MJ system user's last `Allow` on a field — the other
+     * way, besides editing one to `No Access`, to remove access without writing a `Deny`.
+     *
+     * Reconciliation's own orphan deletes are unaffected: it only removes rows whose role has lost
+     * entity-level read (so the system user is already denied one level up and the guard stands
+     * down) or whose field became unrestrictable (forced open regardless).
+     */
+    Delete(options?: EntityDeleteOptions): Promise<boolean>;
+    /**
+     * Records a refusal on the result history so `LatestResult.CompleteMessage` explains it, and
+     * returns false — the contract `Save()` and `Delete()` already have for a logical failure.
+     */
+    private refuse;
+    /**
+     * Why the pending change would leave the system user short of its entity-level access, or null.
+     *
+     * @param removing true when this row is being deleted rather than edited
+     */
+    private systemUserAccessLossReason;
+    /**
+     * Every rule currently stored against this field, straight from the database.
+     *
+     * `BypassCache` because this decides an access-control question: a cached result that predates
+     * a sibling row's edit would answer it with data the guard is specifically trying to catch up
+     * with. Inside a transaction this reads the scope's own uncommitted writes, which is what
+     * reconciliation needs.
+     */
+    private loadCurrentRules;
+    /**
+     * Why this rule may not target this role, or null when it may.
+     *
+     * Refuses a **restricting** rule aimed at a role the MJ **system user** holds. The system
+     * user is what the server runs background work as: it pre-warms the shared engine caches at
+     * startup, and in task mode (job and agent runners) whichever caller touches an engine first
+     * configures it for the whole process. Restricting that account does not just restrict it —
+     * engines cache their data process-wide, so a partially loaded engine would then serve
+     * incomplete records to every user afterward. The damage is silent and nowhere near the rule
+     * that caused it.
+     *
+     * **Only a `Deny` is refused.** Field security has no runtime exemption for any user, so the
+     * system user's own access comes from ordinary rows: snapshot initialization writes it
+     * `Allow` on every field its roles can read, and this guard is what stops that access being
+     * taken away again. `Allow` and `No Access` both save — `Allow` is the grant the server
+     * depends on, and `No Access` is neutral, unable to reduce access another role has granted.
+     * Refusing those would make it impossible to enable field security on any entity at all,
+     * since the standard roles (UI, Developer, Integration) carry entity permissions almost
+     * everywhere.
+     *
+     * This is a guard on CONFIGURATION, not a runtime exemption. What is refused is the
+     * arrangement that would make the server unable to do its own work. Take the role off the
+     * system user and the rule saves.
+     *
+     * The database tier already refuses the equivalent arrangement: CodeGen skips a column DENY
+     * for any role a service login belongs to, and warns. This is the same rule for the
+     * application tier.
+     *
+     * @param roleID the role the rule targets
+     * @param rule the rule's three verbs; omitted only by callers that are pre-checking a role
+     *             rather than a specific rule, which are answered as though the rule denied
+     */
+    static SystemUserRoleRejectionReason(roleID: string | null, rule?: FieldPermissionRuleVerbs): string | null;
+    /**
+     * Why this rule's Update/Create verbs may not target this field, or null when they may.
+     *
+     * A **read-only** field cannot be written through the API by anyone: it is excluded from the
+     * generated create input type and from the update SET list, and `BaseEntity` never marks it
+     * dirty. So an Update or Create verb on it is inert in both directions — a `Deny` prevents
+     * nothing that was possible, and an `Allow` grants nothing that was not. Left to save, it
+     * reads on screen as a working permission and silently is not one.
+     *
+     * **Read is untouched, deliberately.** Restricting READ on a read-only field is legitimate
+     * and is one of the main things administrators want: foreign-key display columns are
+     * read-only, and "hide which client this contract belongs to" is exactly a read restriction
+     * on one. Only the two write verbs are refused.
+     *
+     * Note `EntityFieldInfo.ReadOnly` is the right predicate here, not `IsVirtual`: IS-A parent
+     * fields are virtual but ARE writable through the child's save chain, and `ReadOnly` is
+     * defined off `AllowUpdateAPI` precisely to tell those apart from joined display columns.
+     */
+    static WriteVerbRejectionReason(field: EntityFieldInfo, rule: FieldPermissionRuleVerbs): string | null;
+    /**
+     * Why this field may not be secured, or null when it may be.
+     * Static + field-driven so the same wording can back a future admin-UI pre-check.
+     */
+    static RejectionReason(field: EntityFieldInfo): string | null;
+    /**
+     * Resolves `EntityFieldID` to its {@link EntityFieldInfo} from loaded metadata.
+     *
+     * Returns null when metadata cannot resolve it — for instance immediately after a schema
+     * change, before the metadata cache has refreshed. That case passes validation rather than
+     * blocking the administrator: the foreign key already guarantees the row points at a real
+     * field, and the runtime aggregation guards hold regardless of what is stored here. Failing
+     * closed would trade a real, recurring workflow block for no additional protection.
+     */
+    /**
+     * Why this role may not carry a field rule on this entity, or null when it may.
+     *
+     * A field permission REFINES an entity permission — the entity gate decides whether you reach
+     * the record at all, and field rules then decide which columns of it you see. A rule bound to a
+     * role that has no relationship to the entity is not a refinement of anything, and it is the
+     * configuration that made the reconciler's orphan test ambiguous: such a row is fully live at
+     * runtime (aggregation matches on role membership alone) while looking inert to any check that
+     * asks what the role can do on its own.
+     *
+     * Requires only that an entity-permission row EXISTS, not that it grants read. A role whose
+     * entity permission grants nothing is the ordinary way to express a deny-only carve-out —
+     * "these users are normal, minus this column" — and demanding a grant would force an
+     * administrator to hand out entity access in order to take a column away. Deleting the entity
+     * permission removes the relationship, and reconciliation then cleans up the field rules with
+     * it; see `computeOrphanRowIDs`, which tests exactly this condition.
+     *
+     * Attributed to `RoleID` because that is the value the administrator must change — either pick
+     * a role that has entity access, or grant this one an entity permission first.
+     */
+    static EntityPermissionRequiredRejectionReason(entity: EntityInfo, roleID: string | null): string | null;
+    private resolveTarget;
+}
+//# sourceMappingURL=MJEntityFieldPermissionEntityServer.server.d.ts.map

package/dist/custom/MJEntityFieldPermissionEntityServer.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJEntityFieldPermissionEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJEntityFieldPermissionEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,UAAU,EAGV,wBAAwB,EAOxB,gBAAgB,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAG9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBACa,mCAAoC,SAAQ,6BAA6B;IAClE,QAAQ,IAAI,gBAAgB;IAyC5C;;;;;;;;;;;;OAYG;IACmB,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAUzE;;;;;;;OAOG;IACmB,MAAM,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7E;;;OAGG;IACH,OAAO,CAAC,MAAM;IAWd;;;;OAIG;YACW,0BAA0B;IA6BxC;;;;;;;OAOG;YACW,gBAAgB;IAyB9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;WACW,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,wBAAwB,GAAG,MAAM,GAAG,IAAI;IA0BlH;;;;;;;;;;;;;;;;;OAiBG;WACW,wBAAwB,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,wBAAwB,GAAG,MAAM,GAAG,IAAI;IAkB7G;;;OAGG;WACW,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI;IAqBpE;;;;;;;;OAQG;IACH;;;;;;;;;;;;;;;;;;;OAmBG;WACW,uCAAuC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI;IAe/G,OAAO,CAAC,aAAa;CAaxB"}