@memberjunction/core-entities-server 6.2.0-edge.4 → 6.2.0-edge.6

package/dist/custom/MJQueryEntityServer.server.js

@@ -5,13 +5,14 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 import { BaseEntity, LogError, } from "@memberjunction/core";
-import { MJQueryEntityExtended, QueryEngine } from "@memberjunction/core-entities";
-import { Float32VectorToBase64, RegisterClass, MJGlobal, UUIDsEqual } from "@memberjunction/global";
+import { ComputeQueryFingerprintAsync, MJQueryEntityExtended, QueryEngine, } from "@memberjunction/core-entities";
+import { EscapeSQLString, Float32VectorToBase64, RegisterClass, MJGlobal, UUIDsEqual } from "@memberjunction/global";
 import { EmbedTextLocalHelper } from "./util.js";
 import { RunExtractionPipeline, CleanupQueryData, ConvertTSQLToPostgreSQL, } from "./query-extraction/index.js";
 import { SQLParser } from "@memberjunction/sql-parser";
 import { GetDialect } from "@memberjunction/sql-dialect";
 import { resolveDbPlatformFromEnv } from "@memberjunction/generic-database-provider";
+import { ApplyApprovalRulesAsync, ApprovalRefusalResult } from "./approvalStamp.js";
 /**
  * Server-side query entity with embedding generation, SQL extraction pipeline,
  * and dialect auto-conversion. Extends `MJQueryEntityExtended` which provides
@@ -68,6 +69,15 @@ let MJQueryEntityServer = class MJQueryEntityServer extends MJQueryEntityExtende
     }
     // ─── Save / Delete Overrides ─────────────────────────────────────────────────
     async Save(options) {
+        let approving;
+        try {
+            // Approving is a server act; a ReplayOnly save writes nothing, so it has nothing to stamp.
+            approving = !options?.ReplayOnly && await ApplyApprovalRulesAsync(this, 'Status', this.Status);
+        }
+        catch (e) {
+            this.RegisterResultHistoryEntry(ApprovalRefusalResult(this, e));
+            return false;
+        }
         try {
             const sqlField = this.GetFieldByName('SQL');
             const nameField = this.GetFieldByName('Name');
@@ -91,13 +101,18 @@ let MJQueryEntityServer = class MJQueryEntityServer extends MJQueryEntityExtende
             }
             // Extract and sync parameters AFTER saving, outside of any transaction
             if (shouldExtractData && this.SQL && this.SQL.trim().length > 0) {
-                await this.extractAndSyncDataAsync();
+                await this.extractAndSyncDataAsync(options?.SkipEntityAIActions === true);
                 await this.autoConvertDialectsAsync();
             }
             else if (!this.SQL || this.SQL.trim().length === 0) {
                 this.UsesTemplate = false;
                 await this.cleanupEmptyQueryAsync();
             }
+            // The parameter and dialect rows are rewritten after the Query row, so the approved
+            // fingerprint is taken last, from the definition as stored.
+            if (approving) {
+                await this.stampApprovalFingerprintAsync(options);
+            }
             return true;
         }
         catch (e) {
@@ -106,6 +121,34 @@ let MJQueryEntityServer = class MJQueryEntityServer extends MJQueryEntityExtende
             return false;
         }
     }
+    /**
+     * Stores the fingerprint of the definition just approved: this row's SQL, template flag and
+     * external source, with its dialect and parameter rows read back from the database. Until this
+     * write lands the approval is not current, so a failure here fails closed.
+     */
+    async stampApprovalFingerprintAsync(options) {
+        try {
+            this.ApprovedFingerprint = await ComputeQueryFingerprintAsync(this, await this.loadDefinitionRowsAsync());
+            if (!await super.Save(options)) {
+                LogError(`[MJQueryEntityServer] Query "${this.Name}" was approved but its fingerprint was not saved: ${this.LatestResult?.CompleteMessage}`);
+            }
+        }
+        catch (e) {
+            LogError(`[MJQueryEntityServer] Query "${this.Name}" was approved but its fingerprint could not be computed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    /** This query's dialect and parameter rows as stored, bypassing every cache. */
+    async loadDefinitionRowsAsync() {
+        const filter = `QueryID='${EscapeSQLString(this.ID)}'`;
+        const [sqls, parameters] = await this.RunViewProviderToUse.RunViews([
+            { EntityName: 'MJ: Query SQLs', ExtraFilter: filter, Fields: ['SQLDialectID', 'SQL'], ResultType: 'simple', BypassCache: true },
+            { EntityName: 'MJ: Query Parameters', ExtraFilter: filter, Fields: ['Name', 'Type', 'IsRequired', 'ValidationFilters', 'IsServerSet'], ResultType: 'simple', BypassCache: true },
+        ], this.ContextCurrentUser);
+        if (!sqls?.Success || !parameters?.Success) {
+            throw new Error(`could not read the query's definition rows: ${sqls?.ErrorMessage || parameters?.ErrorMessage}`);
+        }
+        return { SQLs: sqls.Results, Parameters: parameters.Results };
+    }
     async Delete(options) {
         try {
             const deleteResult = await super.Delete(options);
@@ -179,7 +222,7 @@ let MJQueryEntityServer = class MJQueryEntityServer extends MJQueryEntityExtende
      * Builds the QuerySyncContext from this entity instance for use by the extraction pipeline.
      * Resolves the SQL to the appropriate dialect variant for the connected database.
      */
-    buildSyncContext() {
+    buildSyncContext(skipAIEnrichment = false) {
         return {
             queryID: this.ID,
             queryName: this.Name,
@@ -190,6 +233,7 @@ let MJQueryEntityServer = class MJQueryEntityServer extends MJQueryEntityExtende
             runViewProvider: this.RunViewProviderToUse,
             platform: this.currentPlatform,
             parameterHints: this.ParameterHints,
+            SkipAIEnrichment: skipAIEnrichment,
         };
     }
     /**
@@ -197,17 +241,21 @@ let MJQueryEntityServer = class MJQueryEntityServer extends MJQueryEntityExtende
      * when a dialect variant matching the current platform is saved — this handles
      * the timing issue where the parent Query is saved before its QuerySQL children
      * exist in the cache.
+     *
+     * @param skipAIEnrichment Skip the LLM enrichment stage, as `SkipEntityAIActions` does for Save.
      */
-    async RerunExtraction() {
-        await this.extractAndSyncDataAsync();
+    async RerunExtraction(skipAIEnrichment = false) {
+        await this.extractAndSyncDataAsync(skipAIEnrichment);
     }
     /**
      * Runs the extraction pipeline and saves the UsesTemplate flag.
      * On error, sets UsesTemplate=false and attempts to save so the query remains usable.
+     *
+     * @param skipAIEnrichment Skip the LLM enrichment stage (the save asked to skip AI actions).
      */
-    async extractAndSyncDataAsync() {
+    async extractAndSyncDataAsync(skipAIEnrichment) {
         try {
-            const ctx = this.buildSyncContext();
+            const ctx = this.buildSyncContext(skipAIEnrichment);
             const pipelineResult = await RunExtractionPipeline(ctx);
             this.UsesTemplate = pipelineResult.UsesTemplate;
             // Save the query again to persist UsesTemplate and any changes from AI processing

package/dist/custom/MJQueryEntityServer.server.js.map

@@ -1 +1 @@
-{"version":3,"file":"MJQueryEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJQueryEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EACH,UAAU,EAGV,QAAQ,GAGX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAoB,qBAAqB,EAAsB,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACzH,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACH,qBAAqB,EACrB,gBAAgB,EAChB,uBAAuB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAErF;;;;GAIG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,qBAAqB;IAO1D,gFAAgF;IAEhF;;OAEG;IACgB,KAAK,CAAC,cAAc,CAAC,WAAmB;QACvD,OAAO,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;OASG;IACO,KAAK,CAAC,0BAA0B;QACtC,MAAM,KAAK,GAAG;YACV,IAAI,CAAC,IAAI,IAAI,EAAE;YACf,IAAI,CAAC,YAAY,IAAI,EAAE;YACvB,IAAI,CAAC,WAAW,IAAI,EAAE;SACzB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,OAAO;QACX,CAAC;QAED,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACrD,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAClE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC;gBACvC,OAAO;YACX,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,QAAQ,CAAC,6DAA6D,IAAI,CAAC,IAAI,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnJ,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;IAC1B,CAAC;IAED,gFAAgF;IACxE,cAAc;QAClB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;IACjC,CAAC;IAED,gFAAgF;IAEvE,KAAK,CAAC,IAAI,CAAC,OAA2B;QAC3C,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;YAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YAC9D,MAAM,iBAAiB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC;YAC1D,MAAM,uBAAuB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,KAAK,IAAI,gBAAgB,CAAC,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAEtH,oEAAoE;YACpE,IAAI,uBAAuB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAC5C,CAAC;iBAAM,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC5B,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;gBAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YACjC,CAAC;YAED,6CAA6C;YAC7C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,uEAAuE;YACvE,IAAI,iBAAiB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBACrC,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC1C,CAAC;iBAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;gBAC1B,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACxC,CAAC;YAED,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAEQ,KAAK,CAAC,MAAM,CAAC,OAA2B;QAC7C,IAAI,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,OAAO,YAAY,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAED,gFAAgF;IAEhF;;;OAGG;IACH,IAAY,eAAe;QACvB,OAAO,wBAAwB,EAAE,IAAI,WAAW,CAAC;IACrD,CAAC;IAED;;;;;;;;;;OAUG;IACK,oBAAoB;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC;QAEtC,kDAAkD;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAElD,2EAA2E;QAC3E,MAAM,WAAW,GAAG,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC;QAE5C,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC;QACd,CAAC;QAED,iCAAiC;QACjC,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEzD,OAAO,WAAW,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACK,4BAA4B,CAAC,GAAW,EAAE,QAA0B;QACxE,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrC,0DAA0D;YAC1D,mEAAmE;YACnE,SAAS,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,YAAY,GAAG,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC;YACrF,OAAO,CAAC,IAAI,CACR,gCAAgC,IAAI,CAAC,IAAI,uCAAuC;gBAChF,8BAA8B,QAAQ,6BAA6B,YAAY,WAAW;gBAC1F,gEAAgE,CACnE,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,gBAAgB;QACpB,OAAO;YACH,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE;YAChC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,IAAI,CAAC,kBAAkB;YACpC,gBAAgB,EAAE,IAAI,CAAC,aAA6C;YACpE,eAAe,EAAE,IAAI,CAAC,oBAAoB;YAC1C,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,cAAc,EAAE,IAAI,CAAC,cAAc;SACtC,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,eAAe;QACxB,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;IACzC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB;QACjC,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACpC,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,YAAY,CAAC;YAEhD,kFAAkF;YAClF,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,QAAQ,CAAC,oDAAoD,CAAC,CAAC;YACnE,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC;gBACD,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACjB,QAAQ,CAAC,iDAAiD,EAAE,SAAS,CAAC,CAAC;YAC3E,CAAC;QACL,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB;QAChC,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACpC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAE5B,4DAA4D;YAC5D,MAAM,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAE3C,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,QAAQ,CAAC,oCAAoC,CAAC,CAAC;YACnD,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;QAC3C,CAAC;IACL,CAAC;IAED,gFAAgF;IAEhF;;;OAGG;IACK,KAAK,CAAC,wBAAwB;QAClC,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,CAAC,eAAe,CACE,CAAC;YAE5E,IAAI,CAAC,MAAM,EAAE,iBAAiB,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;gBAChE,OAAO;YACX,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5C,OAAO;YACX,CAAC;YAED,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC;YAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC;YAEhC,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY;gBACnC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBACzD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;YAExD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,+DAA+D,CAAC,CAAC;gBACjG,OAAO;YACX,CAAC;YAED,KAAK,MAAM,iBAAiB,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBACrD,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;YAClF,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,mCAAmC,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAChC,aAAiC,EACjC,iBAAyB,EACzB,QAA8B;QAE9B,IAAI,CAAC;YACD,IAAI,iBAAiB,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;gBAClD,OAAO;YACX,CAAC;YAED,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC;YAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,uBAAuB,iBAAiB,uBAAuB,CAAC,CAAC;gBACjG,OAAO;YACX,CAAC;YAED,IAAI,aAAa,CAAC,WAAW,KAAK,WAAW,IAAI,iBAAiB,KAAK,YAAY,EAAE,CAAC;gBAClF,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,wBAAwB,aAAa,CAAC,WAAW,SAAS,iBAAiB,qBAAqB,CAAC,CAAC;gBAClI,OAAO;YACX,CAAC;YAED,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,wBAAwB,iBAAiB,WAAW,EAAE,aAAa,CAAC,CAAC;QACzG,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,oBAAoB,CAC9B,aAAiC,EACjC,YAAoB;QAEpB,MAAM,EAAE,GAAG,IAAI,CAAC,aAA6C,CAAC;QAE9D,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAChD,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC,CACzF,CAAC;QAEF,IAAI,MAAwB,CAAC;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,GAAG,QAAQ,CAAC;QACtB,CAAC;aAAM,CAAC;YACJ,MAAM,GAAG,MAAM,EAAE,CAAC,eAAe,CAAmB,gBAAgB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC/F,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,YAAY,GAAG,aAAa,CAAC,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,CAAC,GAAG,GAAG,YAAY,CAAC;QAE1B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,mDAAmD,aAAa,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9G,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,6BAA6B;QACvC,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,OAAO;YAE1B,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CACjD,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CACxC,CAAC;YAEF,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACpD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACtC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,wCAAwC,EAAE,CAAC,CAAC,CAAC;QACjF,CAAC;IACL,CAAC;CACJ,CAAA;AAxXY,mBAAmB;IAD/B,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC;GAC5B,mBAAmB,CAwX/B"}
+{"version":3,"file":"MJQueryEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJQueryEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EACH,UAAU,EAGV,QAAQ,GAGX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACH,4BAA4B,EAG5B,qBAAqB,EAGrB,WAAW,GACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACrH,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACH,qBAAqB,EACrB,gBAAgB,EAChB,uBAAuB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAEjF;;;;GAIG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,qBAAqB;IAO1D,gFAAgF;IAEhF;;OAEG;IACgB,KAAK,CAAC,cAAc,CAAC,WAAmB;QACvD,OAAO,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;OASG;IACO,KAAK,CAAC,0BAA0B;QACtC,MAAM,KAAK,GAAG;YACV,IAAI,CAAC,IAAI,IAAI,EAAE;YACf,IAAI,CAAC,YAAY,IAAI,EAAE;YACvB,IAAI,CAAC,WAAW,IAAI,EAAE;SACzB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,OAAO;QACX,CAAC;QAED,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACrD,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAClE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC;gBACvC,OAAO;YACX,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,QAAQ,CAAC,6DAA6D,IAAI,CAAC,IAAI,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnJ,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;IAC1B,CAAC;IAED,gFAAgF;IACxE,cAAc;QAClB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;IACjC,CAAC;IAED,gFAAgF;IAEvE,KAAK,CAAC,IAAI,CAAC,OAA2B;QAC3C,IAAI,SAAkB,CAAC;QACvB,IAAI,CAAC;YACD,2FAA2F;YAC3F,SAAS,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,MAAM,uBAAuB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAChE,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;YAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YAC9D,MAAM,iBAAiB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC;YAC1D,MAAM,uBAAuB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,KAAK,IAAI,gBAAgB,CAAC,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAEtH,oEAAoE;YACpE,IAAI,uBAAuB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAC5C,CAAC;iBAAM,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC5B,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;gBAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YACjC,CAAC;YAED,6CAA6C;YAC7C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,uEAAuE;YACvE,IAAI,iBAAiB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC,CAAC;gBAC1E,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC1C,CAAC;iBAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;gBAC1B,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACxC,CAAC;YAED,oFAAoF;YACpF,4DAA4D;YAC5D,IAAI,SAAS,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;YACtD,CAAC;YAED,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,6BAA6B,CAAC,OAA2B;QACnE,IAAI,CAAC;YACD,IAAI,CAAC,mBAAmB,GAAG,MAAM,4BAA4B,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC;YAC1G,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,gCAAgC,IAAI,CAAC,IAAI,qDAAqD,IAAI,CAAC,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;YACjJ,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,gCAAgC,IAAI,CAAC,IAAI,6DAA6D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjK,CAAC;IACL,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,uBAAuB;QAGjC,MAAM,MAAM,GAAG,YAAY,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;QACvD,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAgB;YAC/E,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE;YAC/H,EAAE,UAAU,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE;SACnL,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,EAAE,YAAY,IAAI,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;IAClE,CAAC;IAEQ,KAAK,CAAC,MAAM,CAAC,OAA2B;QAC7C,IAAI,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,OAAO,YAAY,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAED,gFAAgF;IAEhF;;;OAGG;IACH,IAAY,eAAe;QACvB,OAAO,wBAAwB,EAAE,IAAI,WAAW,CAAC;IACrD,CAAC;IAED;;;;;;;;;;OAUG;IACK,oBAAoB;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC;QAEtC,kDAAkD;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAElD,2EAA2E;QAC3E,MAAM,WAAW,GAAG,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC;QAE5C,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC;QACd,CAAC;QAED,iCAAiC;QACjC,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEzD,OAAO,WAAW,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACK,4BAA4B,CAAC,GAAW,EAAE,QAA0B;QACxE,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrC,0DAA0D;YAC1D,mEAAmE;YACnE,SAAS,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,YAAY,GAAG,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC;YACrF,OAAO,CAAC,IAAI,CACR,gCAAgC,IAAI,CAAC,IAAI,uCAAuC;gBAChF,8BAA8B,QAAQ,6BAA6B,YAAY,WAAW;gBAC1F,gEAAgE,CACnE,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,gBAAgB,CAAC,gBAAgB,GAAG,KAAK;QAC7C,OAAO;YACH,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE;YAChC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,IAAI,CAAC,kBAAkB;YACpC,gBAAgB,EAAE,IAAI,CAAC,aAA6C;YACpE,eAAe,EAAE,IAAI,CAAC,oBAAoB;YAC1C,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,gBAAgB,EAAE,gBAAgB;SACrC,CAAC;IACN,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,eAAe,CAAC,gBAAgB,GAAG,KAAK;QACjD,MAAM,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,uBAAuB,CAAC,gBAAyB;QAC3D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YACpD,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,YAAY,CAAC;YAEhD,kFAAkF;YAClF,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,QAAQ,CAAC,oDAAoD,CAAC,CAAC;YACnE,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC;gBACD,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACjB,QAAQ,CAAC,iDAAiD,EAAE,SAAS,CAAC,CAAC;YAC3E,CAAC;QACL,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB;QAChC,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACpC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAE5B,4DAA4D;YAC5D,MAAM,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAE3C,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,QAAQ,CAAC,oCAAoC,CAAC,CAAC;YACnD,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;QAC3C,CAAC;IACL,CAAC;IAED,gFAAgF;IAEhF;;;OAGG;IACK,KAAK,CAAC,wBAAwB;QAClC,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,CAAC,eAAe,CACE,CAAC;YAE5E,IAAI,CAAC,MAAM,EAAE,iBAAiB,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;gBAChE,OAAO;YACX,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5C,OAAO;YACX,CAAC;YAED,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC;YAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC;YAEhC,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY;gBACnC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBACzD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;YAExD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,+DAA+D,CAAC,CAAC;gBACjG,OAAO;YACX,CAAC;YAED,KAAK,MAAM,iBAAiB,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBACrD,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;YAClF,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,mCAAmC,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAChC,aAAiC,EACjC,iBAAyB,EACzB,QAA8B;QAE9B,IAAI,CAAC;YACD,IAAI,iBAAiB,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;gBAClD,OAAO;YACX,CAAC;YAED,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC;YAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,uBAAuB,iBAAiB,uBAAuB,CAAC,CAAC;gBACjG,OAAO;YACX,CAAC;YAED,IAAI,aAAa,CAAC,WAAW,KAAK,WAAW,IAAI,iBAAiB,KAAK,YAAY,EAAE,CAAC;gBAClF,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,wBAAwB,aAAa,CAAC,WAAW,SAAS,iBAAiB,qBAAqB,CAAC,CAAC;gBAClI,OAAO;YACX,CAAC;YAED,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,wBAAwB,iBAAiB,WAAW,EAAE,aAAa,CAAC,CAAC;QACzG,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,oBAAoB,CAC9B,aAAiC,EACjC,YAAoB;QAEpB,MAAM,EAAE,GAAG,IAAI,CAAC,aAA6C,CAAC;QAE9D,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAChD,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC,CACzF,CAAC;QAEF,IAAI,MAAwB,CAAC;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,GAAG,QAAQ,CAAC;QACtB,CAAC;aAAM,CAAC;YACJ,MAAM,GAAG,MAAM,EAAE,CAAC,eAAe,CAAmB,gBAAgB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC/F,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,YAAY,GAAG,aAAa,CAAC,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,CAAC,GAAG,GAAG,YAAY,CAAC;QAE1B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,mDAAmD,aAAa,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9G,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,6BAA6B;QACvC,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,OAAO;YAE1B,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CACjD,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CACxC,CAAC;YAEF,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACpD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACtC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,wCAAwC,EAAE,CAAC,CAAC,CAAC;QACjF,CAAC;IACL,CAAC;CACJ,CAAA;AA1aY,mBAAmB;IAD/B,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC;GAC5B,mBAAmB,CA0a/B"}

package/dist/custom/MJQuerySQLEntityServer.server.js

@@ -30,7 +30,7 @@ let MJQuerySQLEntityServer = class MJQuerySQLEntityServer extends MJQuerySQLEnti
         // current environment's database platform. A SQL Server environment
         // receiving a PostgreSQL variant (or vice versa) should not re-extract.
         try {
-            await this.triggerParentExtractionIfDialectMatches();
+            await this.triggerParentExtractionIfDialectMatches(options?.SkipEntityAIActions === true);
         }
         catch (e) {
             // Non-fatal — the QuerySQL record saved successfully, extraction
@@ -49,7 +49,7 @@ let MJQuerySQLEntityServer = class MJQuerySQLEntityServer extends MJQuerySQLEnti
             await QueryEngine.Instance.Config(false, this.ContextCurrentUser);
         }
     }
-    async triggerParentExtractionIfDialectMatches() {
+    async triggerParentExtractionIfDialectMatches(skipAIEnrichment) {
         const currentPlatform = resolveDbPlatformFromEnv() ?? 'sqlserver';
         await this.ensureQueryEngineLoaded();
         if (!this.isDialectForPlatform(currentPlatform)) {
@@ -65,7 +65,7 @@ let MJQuerySQLEntityServer = class MJQuerySQLEntityServer extends MJQuerySQLEnti
         // will find the dialect variant via GetPlatformSQL().
         if (parentQuery.SQL && parentQuery.SQL.trim().length > 0) {
             LogStatus(`[MJQuerySQLEntityServer] Triggering re-extraction on "${parentQuery.Name}" — dialect variant saved for ${currentPlatform}`);
-            await parentQuery.RerunExtraction();
+            await parentQuery.RerunExtraction(skipAIEnrichment);
         }
     }
     /**

package/dist/custom/MJQuerySQLEntityServer.server.js.map

@@ -1 +1 @@
-{"version":3,"file":"MJQuerySQLEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJQuerySQLEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EACH,UAAU,EAGV,QAAQ,EACR,SAAS,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAGrF;;;;;;;;;;;GAWG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,gBAAgB;IAC/C,KAAK,CAAC,IAAI,CAAC,OAA2B;QAC3C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,iEAAiE;QACjE,oEAAoE;QACpE,wEAAwE;QACxE,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,uCAAuC,EAAE,CAAC;QACzD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,iEAAiE;YACjE,gEAAgE;YAChE,QAAQ,CAAC,qEAAqE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACjG,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,uBAAuB;QACjC,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACtE,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,uCAAuC;QACjD,MAAM,eAAe,GAAG,wBAAwB,EAAE,IAAI,WAAW,CAAC;QAElE,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAErC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9C,OAAO;QACX,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAO;QACX,CAAC;QAED,iEAAiE;QACjE,sEAAsE;QACtE,kEAAkE;QAClE,sDAAsD;QACtD,IAAI,WAAW,CAAC,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,SAAS,CAAC,yDAAyD,WAAW,CAAC,IAAI,iCAAiC,eAAe,EAAE,CAAC,CAAC;YACvI,MAAM,WAAW,CAAC,eAAe,EAAE,CAAC;QACxC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,oBAAoB,CAAC,QAA0B;QACnD,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CACjD,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAC3C,CAAC;QACF,OAAO,OAAO,EAAE,WAAW,KAAK,QAAQ,CAAC;IAC7C,CAAC;IAEO,eAAe;QACnB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,QAAQ,CAAC,yCAAyC,IAAI,CAAC,OAAO,iCAAiC,CAAC,CAAC;YACjG,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,KAA4B,CAAC;IACxC,CAAC;CACJ,CAAA;AA9EY,sBAAsB;IADlC,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC;GAC/B,sBAAsB,CA8ElC"}
+{"version":3,"file":"MJQuerySQLEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJQuerySQLEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EACH,UAAU,EAGV,QAAQ,EACR,SAAS,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAGrF;;;;;;;;;;;GAWG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,gBAAgB;IAC/C,KAAK,CAAC,IAAI,CAAC,OAA2B;QAC3C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,iEAAiE;QACjE,oEAAoE;QACpE,wEAAwE;QACxE,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,uCAAuC,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,iEAAiE;YACjE,gEAAgE;YAChE,QAAQ,CAAC,qEAAqE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACjG,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,uBAAuB;QACjC,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACtE,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,uCAAuC,CAAC,gBAAyB;QAC3E,MAAM,eAAe,GAAG,wBAAwB,EAAE,IAAI,WAAW,CAAC;QAElE,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAErC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9C,OAAO;QACX,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAO;QACX,CAAC;QAED,iEAAiE;QACjE,sEAAsE;QACtE,kEAAkE;QAClE,sDAAsD;QACtD,IAAI,WAAW,CAAC,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,SAAS,CAAC,yDAAyD,WAAW,CAAC,IAAI,iCAAiC,eAAe,EAAE,CAAC,CAAC;YACvI,MAAM,WAAW,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACxD,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,oBAAoB,CAAC,QAA0B;QACnD,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CACjD,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAC3C,CAAC;QACF,OAAO,OAAO,EAAE,WAAW,KAAK,QAAQ,CAAC;IAC7C,CAAC;IAEO,eAAe;QACnB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,QAAQ,CAAC,yCAAyC,IAAI,CAAC,OAAO,iCAAiC,CAAC,CAAC;YACjG,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,KAA4B,CAAC;IACxC,CAAC;CACJ,CAAA;AA9EY,sBAAsB;IADlC,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC;GAC/B,sBAAsB,CA8ElC"}

package/dist/custom/MJRowLevelSecurityFilterEntityServer.server.d.ts

@@ -7,25 +7,37 @@ import { MJRowLevelSecurityFilterEntity } from '@memberjunction/core-entities';
  * against the rule's entity when the RULE is saved; without an equivalent
  * check when the FILTER is saved, both are trivially bypassable: attach a
  * valid filter, then edit its text (or acquire a new, different-entity
- * referrer) to reference anything. On a `FilterText` change — or whenever
- * more than one referrer now exists — this subclass re-runs BOTH checks
- * against EVERY current referrer (EntityPermission rows via their four
- * `*RLSFilterID` columns, plus both API scope tables via `RowFilterID`) and
- * rejects if any fails — including referrers whose entity cannot be resolved
- * (fail closed). Check 6 has no single rule to anchor on here (a filter
- * record itself carries no entity binding — see plan §5.1), so it anchors on
- * the first referrer that DOES resolve to an entity and requires every other
- * referrer to agree with it; zero or one resolvable referrer trivially
- * satisfies the invariant.
+ * referrer) to reference anything. On a `FilterText` change this subclass
+ * re-validates the new text against EVERY current referrer (EntityPermission
+ * rows via their four `*RLSFilterID` columns, plus both API scope tables via
+ * `RowFilterID`) and rejects if any check fails — including referrers whose
+ * entity cannot be resolved (fail closed).
  *
- * Note this makes the filter edit path stricter than it historically was for
- * pure-EntityPermission filters, which had no such validation. That is a
- * deliberate tightening: an invalid RLS filter fails closed at query time with
- * an unexplainable SQL error; rejecting at save is the diagnosable version.
+ * Which checks apply depends on who references the filter:
+ * - **Any API-key or API-application scope rule** → the strict API-key rules
+ *   (checks 4 and 6): plain columns of the referrer's entity only, and every
+ *   referrer must agree on ONE entity. Check 6 has no single rule to anchor on
+ *   here (a filter record carries no entity binding — see plan §5.1), so it
+ *   anchors on the first referrer that resolves to an entity.
+ * - **Only role permission rows** → a role filter. Role filters legitimately use
+ *   subqueries (a user's tenant memberships) and are shared across every
+ *   tenant-scoped entity, so the new text is instead screened for dangerous SQL
+ *   and compiled against each referencing entity's base view.
+ *
+ * Either way an invalid filter is rejected at save, where it is diagnosable,
+ * rather than failing every read of the entities it scopes with an unexplained
+ * SQL error.
  */
 export declare class MJRowLevelSecurityFilterEntityServer extends MJRowLevelSecurityFilterEntity {
     /** Enable async validation so the referrer re-validation (which queries three tables) runs on Save. */
     get DefaultSkipAsyncValidation(): boolean;
     ValidateAsync(): Promise<ValidationResult>;
+    /**
+     * The strict API-key rules: check 4 (FilterText's columns must resolve against every
+     * referrer's entity) and check 6 (every referrer must agree on the same entity).
+     */
+    private validateAsApiKeyFilter;
+    /** A role filter: screened, then compiled against every referencing entity's base view. */
+    private validateAsRoleFilter;
 }
 //# sourceMappingURL=MJRowLevelSecurityFilterEntityServer.server.d.ts.map

package/dist/custom/MJRowLevelSecurityFilterEntityServer.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MJRowLevelSecurityFilterEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJRowLevelSecurityFilterEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEvF,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAG/E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBACa,oCAAqC,SAAQ,8BAA8B;IACpF,uGAAuG;IACvG,IAAoB,0BAA0B,IAAI,OAAO,CAExD;IAEqB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;CA+CnE"}
+{"version":3,"file":"MJRowLevelSecurityFilterEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJRowLevelSecurityFilterEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuD,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7G,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAW/E;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBACa,oCAAqC,SAAQ,8BAA8B;IACpF,uGAAuG;IACvG,IAAoB,0BAA0B,IAAI,OAAO,CAExD;IAEqB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAgChE;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAuB9B,2FAA2F;YAC7E,oBAAoB;CAOrC"}

package/dist/custom/MJRowLevelSecurityFilterEntityServer.server.js

@@ -4,10 +4,10 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-import { BaseEntity } from '@memberjunction/core';
+import { BaseEntity, DatabaseProviderBase } from '@memberjunction/core';
 import { RegisterClass } from '@memberjunction/global';
 import { MJRowLevelSecurityFilterEntity } from '@memberjunction/core-entities';
-import { BuildSameEntityErrors, CollectRowFilterReferrers, ToValidationErrors, ValidateRowFilterTextAgainstEntity } from './rowFilterValidation.js';
+import { BuildSameEntityErrors, CollectRowFilterReferrers, IsRoleOnlyReferrerSet, ToValidationErrors, ValidateRoleRowFilterText, ValidateRowFilterTextAgainstEntity } from './rowFilterValidation.js';
 /**
  * Server-side `MJ: Row Level Security Filters` entity — the SECOND enforcement
  * point of the row-filter validation (plan §5.3). The scope-rule subclasses
@@ -15,21 +15,26 @@ import { BuildSameEntityErrors, CollectRowFilterReferrers, ToValidationErrors, V
  * against the rule's entity when the RULE is saved; without an equivalent
  * check when the FILTER is saved, both are trivially bypassable: attach a
  * valid filter, then edit its text (or acquire a new, different-entity
- * referrer) to reference anything. On a `FilterText` change — or whenever
- * more than one referrer now exists — this subclass re-runs BOTH checks
- * against EVERY current referrer (EntityPermission rows via their four
- * `*RLSFilterID` columns, plus both API scope tables via `RowFilterID`) and
- * rejects if any fails — including referrers whose entity cannot be resolved
- * (fail closed). Check 6 has no single rule to anchor on here (a filter
- * record itself carries no entity binding — see plan §5.1), so it anchors on
- * the first referrer that DOES resolve to an entity and requires every other
- * referrer to agree with it; zero or one resolvable referrer trivially
- * satisfies the invariant.
+ * referrer) to reference anything. On a `FilterText` change this subclass
+ * re-validates the new text against EVERY current referrer (EntityPermission
+ * rows via their four `*RLSFilterID` columns, plus both API scope tables via
+ * `RowFilterID`) and rejects if any check fails — including referrers whose
+ * entity cannot be resolved (fail closed).
  *
- * Note this makes the filter edit path stricter than it historically was for
- * pure-EntityPermission filters, which had no such validation. That is a
- * deliberate tightening: an invalid RLS filter fails closed at query time with
- * an unexplainable SQL error; rejecting at save is the diagnosable version.
+ * Which checks apply depends on who references the filter:
+ * - **Any API-key or API-application scope rule** → the strict API-key rules
+ *   (checks 4 and 6): plain columns of the referrer's entity only, and every
+ *   referrer must agree on ONE entity. Check 6 has no single rule to anchor on
+ *   here (a filter record carries no entity binding — see plan §5.1), so it
+ *   anchors on the first referrer that resolves to an entity.
+ * - **Only role permission rows** → a role filter. Role filters legitimately use
+ *   subqueries (a user's tenant memberships) and are shared across every
+ *   tenant-scoped entity, so the new text is instead screened for dangerous SQL
+ *   and compiled against each referencing entity's base view.
+ *
+ * Either way an invalid filter is rejected at save, where it is diagnosable,
+ * rather than failing every read of the entities it scopes with an unexplained
+ * SQL error.
  */
 let MJRowLevelSecurityFilterEntityServer = class MJRowLevelSecurityFilterEntityServer extends MJRowLevelSecurityFilterEntity {
     /** Enable async validation so the referrer re-validation (which queries three tables) runs on Save. */
@@ -39,7 +44,7 @@ let MJRowLevelSecurityFilterEntityServer = class MJRowLevelSecurityFilterEntityS
     async ValidateAsync() {
         const result = await super.ValidateAsync();
         // Only re-validate when the text changes (or on create — a new filter has
-        // no referrers yet, so the loop below is a no-op there anyway).
+        // no referrers yet, so there is nothing to validate against).
         const filterTextDirty = this.GetFieldByName('FilterText')?.Dirty ?? false;
         if (this.IsSaved && !filterTextDirty) {
             return result;
@@ -49,22 +54,11 @@ let MJRowLevelSecurityFilterEntityServer = class MJRowLevelSecurityFilterEntityS
         const filterText = this.FilterText ?? '';
         try {
             const referrers = await CollectRowFilterReferrers(this.ID, md, this.ContextCurrentUser);
-            // Check 4 — FilterText's columns must resolve against every referrer's entity.
-            for (const referrer of referrers) {
-                if (!referrer.Entity) {
-                    errors.push(`${referrer.Description} references this filter but does not resolve to an entity — the new ` +
-                        `FilterText cannot be validated against it; rejecting (fail closed).`);
-                    continue;
-                }
-                const validation = ValidateRowFilterTextAgainstEntity(filterText, referrer.Entity);
-                errors.push(...validation.errors.map(e => `${referrer.Description}: ${e}`));
+            if (IsRoleOnlyReferrerSet(referrers)) {
+                errors.push(...await this.validateAsRoleFilter(filterText, referrers));
             }
-            // Check 6 — every referrer must agree on the same entity. No single referrer is
-            // "the rule" here (unlike the scope-rule save path), so anchor on the first
-            // referrer that resolves to an entity and require every other referrer to match it.
-            const anchor = referrers.find(r => r.Entity)?.Entity;
-            if (anchor) {
-                errors.push(...BuildSameEntityErrors(referrers, anchor));
+            else {
+                errors.push(...this.validateAsApiKeyFilter(filterText, referrers));
             }
         }
         catch (e) {
@@ -76,6 +70,37 @@ let MJRowLevelSecurityFilterEntityServer = class MJRowLevelSecurityFilterEntityS
         }
         return result;
     }
+    /**
+     * The strict API-key rules: check 4 (FilterText's columns must resolve against every
+     * referrer's entity) and check 6 (every referrer must agree on the same entity).
+     */
+    validateAsApiKeyFilter(filterText, referrers) {
+        const errors = [];
+        for (const referrer of referrers) {
+            if (!referrer.Entity) {
+                errors.push(`${referrer.Description} references this filter but does not resolve to an entity — the new ` +
+                    `FilterText cannot be validated against it; rejecting (fail closed).`);
+                continue;
+            }
+            const validation = ValidateRowFilterTextAgainstEntity(filterText, referrer.Entity);
+            errors.push(...validation.errors.map(e => `${referrer.Description}: ${e}`));
+        }
+        // No single referrer is "the rule" here (unlike the scope-rule save path), so anchor on
+        // the first referrer that resolves to an entity and require every other referrer to match it.
+        const anchor = referrers.find(r => r.Entity)?.Entity;
+        if (anchor) {
+            errors.push(...BuildSameEntityErrors(referrers, anchor));
+        }
+        return errors;
+    }
+    /** A role filter: screened, then compiled against every referencing entity's base view. */
+    async validateAsRoleFilter(filterText, referrers) {
+        const provider = this.ProviderToUse;
+        if (!(provider instanceof DatabaseProviderBase)) {
+            return ['A role row-level-security filter can only be validated against a database provider; rejecting (fail closed).'];
+        }
+        return ValidateRoleRowFilterText(filterText, referrers, provider, this.ContextCurrentUser);
+    }
 };
 MJRowLevelSecurityFilterEntityServer = __decorate([
     RegisterClass(BaseEntity, 'MJ: Row Level Security Filters')

package/dist/custom/MJRowLevelSecurityFilterEntityServer.server.js.map

@@ -1 +1 @@
-{"version":3,"file":"MJRowLevelSecurityFilterEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJRowLevelSecurityFilterEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAuC,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAEjJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEI,IAAM,oCAAoC,GAA1C,MAAM,oCAAqC,SAAQ,8BAA8B;IACpF,uGAAuG;IACvG,IAAoB,0BAA0B;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IAEe,KAAK,CAAC,aAAa;QAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAE3C,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QAC1E,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,aAA6C,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QAEzC,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAExF,+EAA+E;YAC/E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CACP,GAAG,QAAQ,CAAC,WAAW,sEAAsE;wBAC7F,qEAAqE,CACxE,CAAC;oBACF,SAAS;gBACb,CAAC;gBACD,MAAM,UAAU,GAAG,kCAAkC,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnF,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAChF,CAAC;YAED,gFAAgF;YAChF,4EAA4E;YAC5E,oFAAoF;YACpF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YACrD,IAAI,MAAM,EAAE,CAAC;gBACT,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7D,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;YAChE,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ,CAAA;AArDY,oCAAoC;IADhD,aAAa,CAAC,UAAU,EAAE,gCAAgC,CAAC;GAC/C,oCAAoC,CAqDhD"}
+{"version":3,"file":"MJRowLevelSecurityFilterEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJRowLevelSecurityFilterEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAuC,MAAM,sBAAsB,CAAC;AAC7G,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EACH,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EAErB,kBAAkB,EAClB,yBAAyB,EACzB,kCAAkC,EACrC,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEI,IAAM,oCAAoC,GAA1C,MAAM,oCAAqC,SAAQ,8BAA8B;IACpF,uGAAuG;IACvG,IAAoB,0BAA0B;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IAEe,KAAK,CAAC,aAAa;QAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAE3C,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QAC1E,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,aAA6C,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QAEzC,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACxF,IAAI,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;YAC3E,CAAC;iBAAM,CAAC;gBACJ,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;YACvE,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;YAChE,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;OAGG;IACK,sBAAsB,CAAC,UAAkB,EAAE,SAA8B;QAC7E,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CACP,GAAG,QAAQ,CAAC,WAAW,sEAAsE;oBAC7F,qEAAqE,CACxE,CAAC;gBACF,SAAS;YACb,CAAC;YACD,MAAM,UAAU,GAAG,kCAAkC,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnF,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC;QAED,wFAAwF;QACxF,8FAA8F;QAC9F,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACrD,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,2FAA2F;IACnF,KAAK,CAAC,oBAAoB,CAAC,UAAkB,EAAE,SAA8B;QACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QACpC,IAAI,CAAC,CAAC,QAAQ,YAAY,oBAAoB,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,8GAA8G,CAAC,CAAC;QAC5H,CAAC;QACD,OAAO,yBAAyB,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC/F,CAAC;CACJ,CAAA;AAzEY,oCAAoC;IADhD,aAAa,CAAC,UAAU,EAAE,gCAAgC,CAAC;GAC/C,oCAAoC,CAyEhD"}

package/dist/custom/MJUserRoleEntityServer.server.d.ts

@@ -75,7 +75,7 @@ import { MJUserRoleEntity } from '@memberjunction/core-entities';
  * `CloneUserForSessionContext` carries it onto the per-session clone.)
  *
  * NOT COVERED, deliberately: a magic-link session's SYNTHESIZED roles (`context.ts`
- * `buildMagicLinkSessionUser`) count as roles held, so a scope-limited principal is measured by the
+ * `BuildMagicLinkSessionUser`) count as roles held, so a scope-limited principal is measured by the
  * same rule as any other caller. Narrowing scope-limited principals further is a magic-link concern,
  * not a role-elevation one — `IsScopeLimitedPrincipal` lives in MJServer, which this package cannot
  * import, and duplicating its predicate here would put one decision in two places. Such a session
@@ -110,6 +110,9 @@ import { MJUserRoleEntity } from '@memberjunction/core-entities';
  *   short of its entity-level access. Removal is the opposite shape: it drops rules OUT of the
  *   aggregate, so what matters is not what the departing role said but whether an `Allow` survives
  *   without it.
+ * - **Re-pointing** ({@link Save}) — an UPDATE that changes `UserID` or `RoleID` on an existing
+ *   row takes its OLD (user, role) pair apart exactly as a delete would, so the removal check runs
+ *   against the pair being vacated. `Validate()` already checks the new pair as an assignment.
  *
  * Why the system user must stay unrestricted: the server runs background work as that account.
  * It pre-warms the shared engine caches at startup, and in task mode — which job and agent
@@ -119,14 +122,20 @@ import { MJUserRoleEntity } from '@memberjunction/core-entities';
  * cache that everyone reads afterward, with nothing at the point of failure pointing back at
  * the role assignment that caused it.
  *
- * Unlike guard A, guard B reads cached metadata (`Metadata.Entities`, the provider, `UserCache`).
- * It still performs no database I/O, but it is not state-free, and it needs those caches populated
- * to have an opinion — a cold `UserCache` skips the check rather than blocking an administrator.
+ * Unlike guard A, guard B is not pure. `Validate()` checks an assignment against cached metadata
+ * so a form can show the reason early, but the deciding checks run in `Save()` and `Delete()` on
+ * the system user's role set and field rules as stored in the database (`systemUserGuardState`),
+ * because the caches lag a write made a moment before. They run for a `ReplayOnly` save too. A
+ * transaction group holding this and another guarded write that concerns the system user is
+ * refused, since neither check could see the other's change. A cold `UserCache` (no system user
+ * to identify) skips the check rather than blocking an administrator.
  *
  * This restricts CONFIGURATION only. There is no user who is exempt from a Deny at runtime —
  * not even the system user, whose access comes from the same rows as everyone else's.
  */
 export declare class MJUserRoleEntityServer extends MJUserRoleEntity {
+    /** This write's place in its transaction group, held from guard B's group check until the write enrols. */
+    private pendingGroupWrite;
     Validate(): ValidationResult;
     /**
      * Refuses a `ReplayOnly` save by a non-Owner caller — invariant 4. `ReplayOnly` force-passes
@@ -136,6 +145,51 @@ export declare class MJUserRoleEntityServer extends MJUserRoleEntity {
      * `MJUserEntityServer.Save()`, including its reasoning for refusing rather than re-validating.
      */
     Save(options?: EntitySaveOptions): Promise<boolean>;
+    /**
+     * Ends this write's hold on the group place guard B reserved: kept when the write enrolled,
+     * given back when it was refused, returned false or threw, so a retry is not counted twice.
+     */
+    private settleGroupWrite;
+    /**
+     * Guard B for a save, judged on the database rather than the caches: a transaction group
+     * holding this and another guarded write that concerns the system user is refused; an update
+     * that re-points the row is checked as a removal of the pair it leaves; and an assignment of
+     * a role to the system user is refused when that role carries a stored `Deny`. A read that
+     * fails refuses the save.
+     */
+    private systemUserSaveRejection;
+    /**
+     * Why assigning this row's role to the system user is refused on the rules as stored now, or
+     * null. Only a create or a re-point assigns; an update that keeps the pair assigns nothing new.
+     */
+    private storedAssignmentRejectionReason;
+    /** Whether this update moves the row to a different (user, role) pair. Unknown prior values count as a move. */
+    private isRepoint;
+    /** Names of the entities owning the given fields, from loaded metadata, each once. */
+    private static entityNamesForFieldIDs;
+    /** The refusal when the system user's field access cannot be checked because a read failed. */
+    private static unverifiableMessage;
+    /**
+     * Why re-pointing this assignment away from its stored (user, role) pair would cost the MJ
+     * system user field access, or null when it would not.
+     *
+     * Evaluated as a removal of the OLD pair with nothing added in its place. When `RoleID` moves
+     * between two roles on the system user that is conservative — the incoming role might hold the
+     * very `Allow` the outgoing one is taking away — but assigning the new role first and then
+     * deleting the old one reaches the same state through checks that can each see the whole
+     * picture.
+     *
+     * A re-pointed column whose prior value cannot be established fails CLOSED while there is a
+     * system user to protect: the vacated pair might be one of its roles.
+     */
+    private vacatedPairRemovalReason;
+    /**
+     * Why removing this row's STORED (user, role) pair would cost the system user field access,
+     * or null. Shared by the delete path and the re-point path, which take the same pair apart.
+     */
+    private storedPairRemovalReason;
+    /** A column's stored value; undefined when it is dirty and its old value is not a usable ID. */
+    private priorValue;
     /**
      * Enforces both guards on the delete path.
      *
@@ -159,6 +213,13 @@ export declare class MJUserRoleEntityServer extends MJUserRoleEntity {
      * Owner, so it is exempt from guard A and never sees that refusal on a default install.
      */
     Delete(options?: EntityDeleteOptions): Promise<boolean>;
+    /**
+     * Guard B's transaction-group rule for this write. When it passes, the write's place in the
+     * group is reserved in the same step, so a second guarded write in flight at once sees it.
+     */
+    private groupRefusal;
+    /** Guard B for a delete: the transaction-group rule, then the removal check on stored state. */
+    private systemUserDeleteRejection;
     /**
      * Invariants 1 and 2's forward half — the role being assigned must be one the caller holds.
      * Attributed to `RoleID` because that IS the field whose value is refused, so a form highlights
@@ -205,8 +266,11 @@ export declare class MJUserRoleEntityServer extends MJUserRoleEntity {
      */
     private callerIsOwner;
     /**
-     * Why this role may not be taken off this user, or null when it may.
-     * Only ever rejects for the system user; every other user is unaffected.
+     * Why taking `roleID` off `userID` would cost the system user field access, or null when it
+     * would not. Only ever rejects for the system user; every other user is unaffected.
+     *
+     * Parameterized because the delete path and the re-point path both ask about the pair as
+     * STORED, which on a re-point is only available from the dirty fields' old values.
      */
     private systemUserRoleRemovalReason;
     /**
@@ -214,9 +278,12 @@ export declare class MJUserRoleEntityServer extends MJUserRoleEntity {
      * Only ever rejects for the system user; every other user is unaffected.
      */
     static SystemUserRejectionReason(userID: string | null, roleID: string | null, provider?: IMetadataProvider): string | null;
+    /** The refusal for assigning the system user a role that denies a field on the named entities. */
+    private static assignmentRejectionMessage;
     /**
      * Names of entities where this role carries at least one RESTRICTING field rule — a `Deny`
-     * on any verb. Walks cached metadata only — no database access. Runs only when the system
+     * on any verb, under any spelling (the column's collation stores `'deny'` too, and enforcement
+     * honors it). Walks cached metadata only — no database access. Runs only when the system
      * user is the save target, which is rare.
      *
      * Grants and neutrals are ignored, and must be: the system user holds the standard roles

package/dist/custom/MJUserRoleEntityServer.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MJUserRoleEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJUserRoleEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,mBAAmB,EAEnB,iBAAiB,EACjB,iBAAiB,EAMjB,gBAAgB,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6HG;AACH,qBACa,sBAAuB,SAAQ,gBAAgB;IACxC,QAAQ,IAAI,gBAAgB;IAgC5C;;;;;;OAMG;IACmB,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAWzE;;;;;;;;;;;;;;;;;;;;;OAqBG;IACmB,MAAM,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB7E;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB;IAqB7B,4GAA4G;IAC5G,OAAO,CAAC,MAAM;IAWd;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,aAAa;IAQrB;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAqBnC;;;OAGG;WACW,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI;IAyBlI;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,MAAM,CAAC,wCAAwC;CAe1D;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}
+{"version":3,"file":"MJUserRoleEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJUserRoleEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,mBAAmB,EAEnB,iBAAiB,EACjB,iBAAiB,EAKjB,gBAAgB,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAkBjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoIG;AACH,qBACa,sBAAuB,SAAQ,gBAAgB;IACxD,2GAA2G;IAC3G,OAAO,CAAC,iBAAiB,CAAyC;IAElD,QAAQ,IAAI,gBAAgB;IAgC5C;;;;;;OAMG;IACmB,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBzE;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAQxB;;;;;;OAMG;YACW,uBAAuB;IAerC;;;OAGG;YACW,+BAA+B;IAS7C,gHAAgH;IAChH,OAAO,CAAC,SAAS;IASjB,sFAAsF;IACtF,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAYrC,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAKlC;;;;;;;;;;;;OAYG;YACW,wBAAwB;IAOtC;;;OAGG;YACW,uBAAuB;IASrC,gGAAgG;IAChG,OAAO,CAAC,UAAU;IASlB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACmB,MAAM,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAwB7E;;;OAGG;IACH,OAAO,CAAC,YAAY;IASpB,gGAAgG;YAClF,yBAAyB;IAcvC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB;IAqB7B,4GAA4G;IAC5G,OAAO,CAAC,MAAM;IAWd;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,aAAa;IAQrB;;;;;;OAMG;YACW,2BAA2B;IAsBzC;;;OAGG;WACW,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI;IAkBlI,kGAAkG;IAClG,OAAO,CAAC,MAAM,CAAC,0BAA0B;IAWzC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,MAAM,CAAC,wCAAwC;CAe1D;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}