@memberjunction/core 5.50.0 → 6.1.0-edge.0

package/dist/generic/securityInfo.d.ts

@@ -42,6 +42,54 @@ export interface MagicLinkScope {
     /** ResourceType name/id of the shared resource. */
     ResourceType?: string;
 }
+/**
+ * Per-request acting context for an API-key session, carried on {@link UserInfo}.
+ * Consumed by API-key-scoped RLS filters via the `{{Acting*}}` tokens in
+ * {@link RowLevelSecurityFilterInfo.MarkupFilterText}.
+ *
+ * TRUST BOUNDARY: these values MUST be derived server-side from an authenticated
+ * identity. The engine binds what it is given and cannot validate provenance —
+ * never populate from a client-supplied header, argument, or GraphQL variable,
+ * and never expose via a resolver. A client-settable acting context is a total
+ * bypass of API-key row filtering.
+ *
+ * Cardinality is a one-way door, decided per token at registration: the three
+ * scalar tokens are scalar forever (moving to a set later changes the token's
+ * shape and breaks every filter authored against it), and ActingCompanyIDs is
+ * list-capable from day one for exactly that reason.
+ */
+export interface APIKeyActingContext {
+    /** Organization / tenant the caller is acting on behalf of (GUID, scalar forever). */
+    ActingOrganizationID?: string;
+    /** Person / contact the caller is acting on behalf of (GUID, scalar forever). */
+    ActingPersonID?: string;
+    /** Opaque per-integration scope value (bounded identifier, scalar forever). */
+    ActingScopeID?: string;
+    /**
+     * Companies the caller is acting for — LIST-capable. Renders inside
+     * `Col IN ({{ActingCompanyIDs}})` as a sorted, per-element-validated,
+     * quoted and escaped list; an empty or absent set resolves the whole
+     * filter to `(1=0)` (match nothing), same as any unresolved token.
+     */
+    ActingCompanyIDs?: string[];
+}
+/**
+ * One API-key row-filter binding carried on {@link UserInfo}: for the named
+ * entity and permission type, the referenced Row Level Security Filter applies
+ * IN ADDITION TO (AND-composed with) role RLS — and independently of the
+ * role-RLS exemption, because a key ceiling exists precisely to bind
+ * principals whose roles are unrestricted. Resolved server-side per request
+ * from the validated API key's scope rules; plain data so MJCore can consume
+ * it without depending on the APIKeys packages.
+ */
+export interface APIKeyRowFilterBinding {
+    /** ID of the entity the filtered scope rule targets (exact entity — patterns are rejected at rule save). */
+    EntityID: string;
+    /** Which operation the binding constrains, resolved from the rule's scope path at stamp time. */
+    PermissionType: 'Read' | 'Create' | 'Update' | 'Delete';
+    /** FK into the RowLevelSecurityFilter catalog (same catalog role RLS uses). */
+    FilterID: string;
+}
 /**
  * Returning-visitor context carried on {@link UserInfo} for a public web-widget guest session,
  * sourced from the verified session token's claims. Lets a server-created conversation (the voice
@@ -180,6 +228,31 @@ export declare class UserInfo extends BaseInfo {
      */
     get MagicLinkScope(): MagicLinkScope | undefined;
     set MagicLinkScope(value: MagicLinkScope | undefined);
+    private _APIKeyActingContext?;
+    /**
+     * Per-request acting context for an API-key session. Set server-side in the
+     * API-key auth path from an authenticated identity, ON A CLONED UserInfo
+     * (the resolved userRecord may be the shared UserCache instance — stamping
+     * it in place leaks one session's scope to every concurrent session of the
+     * same user). Consumed by API-key row filters via the {{Acting*}} tokens.
+     * Same getter/setter (non-enumerable accessor) rationale as TenantContext —
+     * not a DB/GraphQL field, and it must NEVER be exposed via a resolver.
+     */
+    get APIKeyActingContext(): APIKeyActingContext | undefined;
+    set APIKeyActingContext(value: APIKeyActingContext | undefined);
+    private _APIKeyRowFilters?;
+    /**
+     * Row-filter bindings for the API key this session authenticated with,
+     * resolved per request from the key's scope rules and stamped on the CLONED
+     * per-request UserInfo. Consumed by
+     * {@link EntityInfo.GetEffectiveRowFilterWhereClause}, which AND-composes
+     * each matching binding's filter with role RLS — outside the role-RLS
+     * exemption. Plain data on purpose: MJCore cannot depend on the APIKeys
+     * packages, so the bridge is this carrier. Never a DB/GraphQL field; never
+     * exposed to or settable by a client.
+     */
+    get APIKeyRowFilters(): APIKeyRowFilterBinding[] | undefined;
+    set APIKeyRowFilters(value: APIKeyRowFilterBinding[] | undefined);
     private _ReturningVisitorContext?;
     /**
      * Returning-visitor context for a public web-widget guest session. Set at request time from the
@@ -342,7 +415,32 @@ export declare class RowLevelSecurityFilterInfo extends BaseInfo {
      * @param {UserInfo} user - The user whose properties will be substituted into the filter text
      * @returns {string} The filter text with all user tokens replaced with actual values
      */
-    MarkupFilterText(user: UserInfo): string;
+    MarkupFilterText(user: UserInfo, options?: MarkupFilterOptions): string;
+    /**
+     * Resolves the `{{Acting*}}` token family from {@link UserInfo.APIKeyActingContext}.
+     * Scalars substitute escaped; the list token renders as a canonical (sorted),
+     * per-element-escaped, quoted list for use inside `IN (...)`. Sorting is not
+     * cosmetic: the resolved clause participates in the RunView cache fingerprint,
+     * so the same set must always produce the same clause bytes (INV-2). An absent
+     * context or empty list leaves tokens unresolved, which the caller's
+     * unresolved-token handling turns into a match-nothing filter for key filters.
+     */
+    private resolveActingTokens;
+}
+/**
+ * Options for {@link RowLevelSecurityFilterInfo.MarkupFilterText}.
+ */
+export interface MarkupFilterOptions {
+    /**
+     * How an unresolved token is handled after markup:
+     * - `'legacy'` (default): log the error and return the text with the token in
+     *   place — the resulting SQL fails to match/parse, which is fail-closed but
+     *   produces an unexplainable result. Role-RLS behavior, unchanged.
+     * - `'match-nothing'`: the entire filter resolves to `(1=0)` — required for
+     *   API-key row filters, where an unresolved token must deny regardless of the
+     *   expression's operator shapes.
+     */
+    unresolvedBehavior?: 'legacy' | 'match-nothing';
 }
 /**
  * Stores the fundamental permissions and access rights that can be granted to users and roles throughout the system.

package/dist/generic/securityInfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"securityInfo.d.ts","sourceRoot":"","sources":["../../src/generic/securityInfo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AASjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,aAAa;IAC1B,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,MAAM,EAAE,QAAQ,GAAG,cAAc,GAAG,QAAQ,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC3B,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACpC,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qJAAqJ;IACrJ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qJAAqJ;IACrJ,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAC/B,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,QAAS,SAAQ,QAAQ;IAClC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAQ;IAElB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAO;IAExB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAO;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAO;IAEpB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAO;IAEpB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAO;IAExB;;OAEG;IACH,gBAAgB,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAO;IAEtD;;OAEG;IACH,UAAU,EAAE,MAAM,CAAO;IAEzB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAO;IAE7B;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAO;IAEnC;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAG3B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAO;IAExB;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAO;IAEhC;;OAEG;IACH,aAAa,EAAE,MAAM,CAAO;IAE5B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAO;IAE5B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAO;IAEjC;;OAEG;IACH,uBAAuB,EAAE,MAAM,CAAO;IAEtC,OAAO,CAAC,cAAc,CAAC,CAA4B;IAEnD;;;;;;;;OAQG;IACH,IAAW,aAAa,IAAI,aAAa,GAAG,SAAS,CAEpD;IACD,IAAW,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,EAExD;IAED,OAAO,CAAC,eAAe,CAAC,CAA6B;IAErD;;;;;;;;OAQG;IACH,IAAW,cAAc,IAAI,cAAc,GAAG,SAAS,CAEtD;IACD,IAAW,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,EAE1D;IAED,OAAO,CAAC,wBAAwB,CAAC,CAAsC;IAEvE;;;;;;OAMG;IACH,IAAW,uBAAuB,IAAI,uBAAuB,GAAG,SAAS,CAExE;IACD,IAAW,uBAAuB,CAAC,KAAK,EAAE,uBAAuB,GAAG,SAAS,EAE5E;IAED,OAAO,CAAC,mBAAmB,CAAC,CAAiC;IAE7D;;;;;OAKG;IACH,IAAW,kBAAkB,IAAI,kBAAkB,GAAG,SAAS,CAE9D;IACD,IAAW,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,SAAS,EAElE;IAED,OAAO,CAAC,qBAAqB,CAAkB;IAE/C;;;;;;;OAOG;IACH,IAAW,oBAAoB,IAAI,OAAO,CAEzC;IACD,IAAW,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAE7C;IAED,OAAO,CAAC,UAAU,CAAqB;IACvC;;;OAGG;IACH,IAAW,SAAS,IAAI,YAAY,EAAE,CAErC;IAED;;;;;;OAMG;gBACU,EAAE,GAAE,iBAAwB,EAAE,QAAQ,GAAE,GAAU;CAOlE;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,QAAQ;IACtC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAO;IAErB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAO;IAErB;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAG3B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;gBAEN,QAAQ,EAAE,GAAG;CAI7B;AAED;;;GAGG;AACH,qBAAa,QAAS,SAAQ,QAAQ;IAClC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAO;IAEjB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAO;IAE1B;;OAEG;IACH,WAAW,EAAE,MAAM,CAAO;IAE1B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAO;IAEtB;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;gBAEd,QAAQ,EAAE,GAAG;CAI7B;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,QAAQ;IACpD;;OAEG;IACH,EAAE,EAAE,MAAM,CAAO;IAEjB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAO;IAE1B;;OAEG;IACH,UAAU,EAAE,MAAM,CAAO;IACzB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAO;IAEtC;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;gBAEd,QAAQ,EAAE,GAAG;IAK1B,OAAO,CAAC,eAAe,CAAsD;IAC7E;;OAEG;IACH,OAAO,KAAK,cAAc,GAKzB;IAED;;;;;OAKG;IACI,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM;IAKhE;;;;;OAKG;IACI,gBAAgB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM;CAwBlD;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ;IAC3C;;OAEG;IACH,EAAE,EAAE,MAAM,CAAO;IAEjB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAO;IAEvB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAO;IAExB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAO;IAE3B;;OAEG;IACH,WAAW,EAAE,MAAM,CAAO;IAE1B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAG3B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;;;;;;OAOG;IACH,IAAW,KAAK,IAAI,qBAAqB,EAAE,CAI1C;IAED;;;;;;OAMG;gBACU,QAAQ,GAAE,GAAU,EAAE,GAAG,CAAC,EAAE,iBAAiB;IAK1D;;;;;;;;;OASG;IACI,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO;IAa9C;;;;;;;OAOG;IACI,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO;CAWjD;AAED,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAGrG;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,QAAQ;IAC/C;;OAEG;IACH,EAAE,EAAE,MAAM,CAAO;IAEjB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAO;IAE9B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAO;IAErB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAG3B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;IAErB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IAEZ,OAAO,CAAC,SAAS,CAAiB;IAClC,IAAW,QAAQ,IAAI,QAAQ,CAE9B;IAEM,iBAAiB,IAAI,qBAAqB;IAIjD,QAAQ,CAAC,IAAI,EAAE,QAAQ;gBAIV,QAAQ,EAAE,GAAG;CAI7B;AAGD;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ;IAC1C;;OAEG;IACH,EAAE,EAAE,MAAM,CAAO;IAEjB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAO;IAEvB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAO;IAE1B;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAO;IAEhC;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAG3B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;gBAED,QAAQ,EAAE,GAAG;CAI7B"}
+{"version":3,"file":"securityInfo.d.ts","sourceRoot":"","sources":["../../src/generic/securityInfo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AASjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,aAAa;IAC1B,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,MAAM,EAAE,QAAQ,GAAG,cAAc,GAAG,QAAQ,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC3B,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAChC,sFAAsF;IACtF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACnC,4GAA4G;IAC5G,QAAQ,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,cAAc,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACxD,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACpC,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qJAAqJ;IACrJ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qJAAqJ;IACrJ,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAC/B,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,QAAS,SAAQ,QAAQ;IAClC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAQ;IAElB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAO;IAExB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAO;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAO;IAEpB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAO;IAEpB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAO;IAExB;;OAEG;IACH,gBAAgB,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAO;IAEtD;;OAEG;IACH,UAAU,EAAE,MAAM,CAAO;IAEzB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAO;IAE7B;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAO;IAEnC;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAG3B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAO;IAExB;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAO;IAEhC;;OAEG;IACH,aAAa,EAAE,MAAM,CAAO;IAE5B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAO;IAE5B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAO;IAEjC;;OAEG;IACH,uBAAuB,EAAE,MAAM,CAAO;IAEtC,OAAO,CAAC,cAAc,CAAC,CAA4B;IAEnD;;;;;;;;OAQG;IACH,IAAW,aAAa,IAAI,aAAa,GAAG,SAAS,CAEpD;IACD,IAAW,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,EAExD;IAED,OAAO,CAAC,eAAe,CAAC,CAA6B;IAErD;;;;;;;;OAQG;IACH,IAAW,cAAc,IAAI,cAAc,GAAG,SAAS,CAEtD;IACD,IAAW,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,EAE1D;IAED,OAAO,CAAC,oBAAoB,CAAC,CAAkC;IAE/D;;;;;;;;OAQG;IACH,IAAW,mBAAmB,IAAI,mBAAmB,GAAG,SAAS,CAEhE;IACD,IAAW,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,SAAS,EAEpE;IAED,OAAO,CAAC,iBAAiB,CAAC,CAAuC;IAEjE;;;;;;;;;OASG;IACH,IAAW,gBAAgB,IAAI,sBAAsB,EAAE,GAAG,SAAS,CAElE;IACD,IAAW,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,GAAG,SAAS,EAEtE;IAED,OAAO,CAAC,wBAAwB,CAAC,CAAsC;IAEvE;;;;;;OAMG;IACH,IAAW,uBAAuB,IAAI,uBAAuB,GAAG,SAAS,CAExE;IACD,IAAW,uBAAuB,CAAC,KAAK,EAAE,uBAAuB,GAAG,SAAS,EAE5E;IAED,OAAO,CAAC,mBAAmB,CAAC,CAAiC;IAE7D;;;;;OAKG;IACH,IAAW,kBAAkB,IAAI,kBAAkB,GAAG,SAAS,CAE9D;IACD,IAAW,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,SAAS,EAElE;IAED,OAAO,CAAC,qBAAqB,CAAkB;IAE/C;;;;;;;OAOG;IACH,IAAW,oBAAoB,IAAI,OAAO,CAEzC;IACD,IAAW,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAE7C;IAED,OAAO,CAAC,UAAU,CAAqB;IACvC;;;OAGG;IACH,IAAW,SAAS,IAAI,YAAY,EAAE,CAErC;IAED;;;;;;OAMG;gBACU,EAAE,GAAE,iBAAwB,EAAE,QAAQ,GAAE,GAAU;CAOlE;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,QAAQ;IACtC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAO;IAErB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAO;IAErB;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAG3B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;gBAEN,QAAQ,EAAE,GAAG;CAI7B;AAED;;;GAGG;AACH,qBAAa,QAAS,SAAQ,QAAQ;IAClC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAO;IAEjB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAO;IAE1B;;OAEG;IACH,WAAW,EAAE,MAAM,CAAO;IAE1B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAO;IAEtB;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;gBAEd,QAAQ,EAAE,GAAG;CAI7B;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,QAAQ;IACpD;;OAEG;IACH,EAAE,EAAE,MAAM,CAAO;IAEjB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAO;IAE1B;;OAEG;IACH,UAAU,EAAE,MAAM,CAAO;IACzB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAO;IAEtC;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;gBAEd,QAAQ,EAAE,GAAG;IAK1B,OAAO,CAAC,eAAe,CAAsD;IAC7E;;OAEG;IACH,OAAO,KAAK,cAAc,GAKzB;IAED;;;;;OAKG;IACI,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM;IAKhE;;;;;OAKG;IACI,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,MAAM;IA2C9E;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;CAuB9B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,QAAQ,GAAG,eAAe,CAAC;CACnD;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ;IAC3C;;OAEG;IACH,EAAE,EAAE,MAAM,CAAO;IAEjB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAO;IAEvB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAO;IAExB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAO;IAE3B;;OAEG;IACH,WAAW,EAAE,MAAM,CAAO;IAE1B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAG3B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;;;;;;OAOG;IACH,IAAW,KAAK,IAAI,qBAAqB,EAAE,CAI1C;IAED;;;;;;OAMG;gBACU,QAAQ,GAAE,GAAU,EAAE,GAAG,CAAC,EAAE,iBAAiB;IAK1D;;;;;;;;;OASG;IACI,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO;IAa9C;;;;;;;OAOG;IACI,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO;CAWjD;AAED,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAGrG;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,QAAQ;IAC/C;;OAEG;IACH,EAAE,EAAE,MAAM,CAAO;IAEjB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAO;IAE9B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAO;IAErB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAG3B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;IAErB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IAEZ,OAAO,CAAC,SAAS,CAAiB;IAClC,IAAW,QAAQ,IAAI,QAAQ,CAE9B;IAEM,iBAAiB,IAAI,qBAAqB;IAIjD,QAAQ,CAAC,IAAI,EAAE,QAAQ;gBAIV,QAAQ,EAAE,GAAG;CAI7B;AAGD;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ;IAC1C;;OAEG;IACH,EAAE,EAAE,MAAM,CAAO;IAEjB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAO;IAEvB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAO;IAEnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAO;IAE1B;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAO;IAEhC;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAE3B;;OAEG;IACH,cAAc,EAAE,IAAI,CAAO;IAG3B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;gBAED,QAAQ,EAAE,GAAG;CAI7B"}

package/dist/generic/securityInfo.js

@@ -44,6 +44,37 @@ export class UserInfo extends BaseInfo {
     set MagicLinkScope(value) {
         this._MagicLinkScope = value;
     }
+    /**
+     * Per-request acting context for an API-key session. Set server-side in the
+     * API-key auth path from an authenticated identity, ON A CLONED UserInfo
+     * (the resolved userRecord may be the shared UserCache instance — stamping
+     * it in place leaks one session's scope to every concurrent session of the
+     * same user). Consumed by API-key row filters via the {{Acting*}} tokens.
+     * Same getter/setter (non-enumerable accessor) rationale as TenantContext —
+     * not a DB/GraphQL field, and it must NEVER be exposed via a resolver.
+     */
+    get APIKeyActingContext() {
+        return this._APIKeyActingContext;
+    }
+    set APIKeyActingContext(value) {
+        this._APIKeyActingContext = value;
+    }
+    /**
+     * Row-filter bindings for the API key this session authenticated with,
+     * resolved per request from the key's scope rules and stamped on the CLONED
+     * per-request UserInfo. Consumed by
+     * {@link EntityInfo.GetEffectiveRowFilterWhereClause}, which AND-composes
+     * each matching binding's filter with role RLS — outside the role-RLS
+     * exemption. Plain data on purpose: MJCore cannot depend on the APIKeys
+     * packages, so the bridge is this carrier. Never a DB/GraphQL field; never
+     * exposed to or settable by a client.
+     */
+    get APIKeyRowFilters() {
+        return this._APIKeyRowFilters;
+    }
+    set APIKeyRowFilters(value) {
+        this._APIKeyRowFilters = value;
+    }
     /**
      * Returning-visitor context for a public web-widget guest session. Set at request time from the
      * verified session token's claims (the widget mint embeds the resolved VisitorKey / prior
@@ -182,6 +213,8 @@ export class UserInfo extends BaseInfo {
         this.EmployeeSupervisorEmail = null;
         this._TenantContext = undefined;
         this._MagicLinkScope = undefined;
+        this._APIKeyActingContext = undefined;
+        this._APIKeyRowFilters = undefined;
         this._ReturningVisitorContext = undefined;
         this._WidgetGuestContext = undefined;
         this._IsMagicLinkAnonymous = false;
@@ -327,30 +360,79 @@ export class RowLevelSecurityFilterInfo extends BaseInfo {
      * @param {UserInfo} user - The user whose properties will be substituted into the filter text
      * @returns {string} The filter text with all user tokens replaced with actual values
      */
-    MarkupFilterText(user) {
+    MarkupFilterText(user, options) {
         let ret = this.FilterText;
         if (user) {
             const keys = Object.keys(user);
             for (let i = 0; i < keys.length; i++) {
                 const key = keys[i];
                 const val = user[key];
-                if (val !== null && typeof val !== 'object') {
-                    ret = ret.replace(new RegExp(`{{User${key}}}`, 'g'), String(val));
+                // `val != null` deliberately excludes BOTH null and undefined. The old
+                // `val !== null` guard let `undefined` through, substituting the literal
+                // string "undefined" — which made negation-shaped filters
+                // (Col <> '{{UserX}}') match every row. Undefined is unresolved, period.
+                if (val != null && typeof val !== 'object') {
+                    // Escape embedded quotes in the substituted value: a user-sourced value
+                    // containing an apostrophe must not break (or rewrite) the predicate —
+                    // the same defect class as the tenant-header injection, in the engine
+                    // every RLS filter depends on.
+                    ret = ret.replace(new RegExp(`{{User${key}}}`, 'g'), String(val).replace(/'/g, "''"));
                 }
             }
             // Per-session magic-link resource scope. Fail-closed: an absent scope resolves
             // to '' so a resource-pinned predicate (e.g. ID = '{{ScopeResourceID}}') matches
             // NO rows rather than leaking — a session without the scope sees nothing.
             const scope = user.MagicLinkScope;
-            ret = ret.replace(/\{\{ScopeResourceID\}\}/g, scope?.ResourceID ?? '');
-            ret = ret.replace(/\{\{ScopeResourceType\}\}/g, scope?.ResourceType ?? '');
+            ret = ret.replace(/\{\{ScopeResourceID\}\}/g, (scope?.ResourceID ?? '').replace(/'/g, "''"));
+            ret = ret.replace(/\{\{ScopeResourceType\}\}/g, (scope?.ResourceType ?? '').replace(/'/g, "''"));
+            ret = this.resolveActingTokens(ret, user);
         }
-        const unresolvedMatch = ret.match(/\{\{User\w+\}\}/);
+        const unresolvedMatch = ret.match(/\{\{(?:User|Acting)\w+\}\}/);
         if (unresolvedMatch) {
+            if (options?.unresolvedBehavior === 'match-nothing') {
+                // API-key row filters fail closed AND diagnosably: '' substitution is only
+                // safe for equality shapes (Col <> '' or LIKE '%%' match everything), so an
+                // unresolved token collapses the ENTIRE filter to a predicate that matches
+                // nothing regardless of the expression's operators.
+                LogError('Row filter has unresolved token after markup — resolving filter to (1=0): ' + unresolvedMatch[0] + ' in filter: ' + this.FilterText);
+                return '(1=0)';
+            }
             LogError('RLS filter has unresolved token after markup: ' + unresolvedMatch[0] + ' in filter: ' + this.FilterText);
         }
         return ret;
     }
+    /**
+     * Resolves the `{{Acting*}}` token family from {@link UserInfo.APIKeyActingContext}.
+     * Scalars substitute escaped; the list token renders as a canonical (sorted),
+     * per-element-escaped, quoted list for use inside `IN (...)`. Sorting is not
+     * cosmetic: the resolved clause participates in the RunView cache fingerprint,
+     * so the same set must always produce the same clause bytes (INV-2). An absent
+     * context or empty list leaves tokens unresolved, which the caller's
+     * unresolved-token handling turns into a match-nothing filter for key filters.
+     */
+    resolveActingTokens(text, user) {
+        const acting = user.APIKeyActingContext;
+        let ret = text;
+        const scalars = [
+            ['ActingOrganizationID', acting?.ActingOrganizationID],
+            ['ActingPersonID', acting?.ActingPersonID],
+            ['ActingScopeID', acting?.ActingScopeID],
+        ];
+        for (const [token, value] of scalars) {
+            if (value != null && value.length > 0) {
+                ret = ret.replace(new RegExp(`\\{\\{${token}\\}\\}`, 'g'), value.replace(/'/g, "''"));
+            }
+        }
+        const companies = acting?.ActingCompanyIDs;
+        if (companies && companies.length > 0) {
+            const rendered = [...companies]
+                .sort()
+                .map(c => `'${c.replace(/'/g, "''")}'`)
+                .join(',');
+            ret = ret.replace(/\{\{ActingCompanyIDs\}\}/g, rendered);
+        }
+        return ret;
+    }
 }
 /**
  * Stores the fundamental permissions and access rights that can be granted to users and roles throughout the system.

package/dist/generic/securityInfo.js.map

@@ -1 +1 @@
-{"version":3,"file":"securityInfo.js","sourceRoot":"","sources":["../../src/generic/securityInfo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,kEAAkE;AAClE,mEAAmE;AACnE,iEAAiE;AACjE,6DAA6D;AAC7D,4DAA4D;AAC5D,sDAAsD;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,EAAE,qBAAqB,EAAwB,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACzG,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AA4EpD;;;GAGG;AACH,MAAM,OAAO,QAAS,SAAQ,QAAQ;IAwGlC;;;;;;;;OAQG;IACH,IAAW,aAAa;QACpB,OAAO,IAAI,CAAC,cAAc,CAAC;IAC/B,CAAC;IACD,IAAW,aAAa,CAAC,KAAgC;QACrD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;IAChC,CAAC;IAID;;;;;;;;OAQG;IACH,IAAW,cAAc;QACrB,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;IACD,IAAW,cAAc,CAAC,KAAiC;QACvD,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;IACjC,CAAC;IAID;;;;;;OAMG;IACH,IAAW,uBAAuB;QAC9B,OAAO,IAAI,CAAC,wBAAwB,CAAC;IACzC,CAAC;IACD,IAAW,uBAAuB,CAAC,KAA0C;QACzE,IAAI,CAAC,wBAAwB,GAAG,KAAK,CAAC;IAC1C,CAAC;IAID;;;;;OAKG;IACH,IAAW,kBAAkB;QACzB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IACpC,CAAC;IACD,IAAW,kBAAkB,CAAC,KAAqC;QAC/D,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;IACrC,CAAC;IAID;;;;;;;OAOG;IACH,IAAW,oBAAoB;QAC3B,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACtC,CAAC;IACD,IAAW,oBAAoB,CAAC,KAAc;QAC1C,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAC;IACvC,CAAC;IAGD;;;OAGG;IACH,IAAW,SAAS;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,YAAa,KAAwB,IAAI,EAAE,WAAgB,IAAI;QAC3D,KAAK,EAAE,CAAC;QA1MZ;;WAEG;QACH,OAAE,GAAW,IAAI,CAAC;QAElB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,cAAS,GAAW,IAAI,CAAA;QAExB;;WAEG;QACH,aAAQ,GAAW,IAAI,CAAA;QAEvB;;WAEG;QACH,UAAK,GAAW,IAAI,CAAA;QAEpB;;WAEG;QACH,UAAK,GAAW,IAAI,CAAA;QAEpB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,aAAQ,GAAY,IAAI,CAAA;QAExB;;WAEG;QACH,qBAAgB,GAAkC,IAAI,CAAA;QAEtD;;WAEG;QACH,eAAU,GAAW,IAAI,CAAA;QAEzB;;WAEG;QACH,mBAAc,GAAW,IAAI,CAAA;QAE7B;;WAEG;QACH,yBAAoB,GAAW,IAAI,CAAA;QAEnC;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B,iDAAiD;QACjD;;WAEG;QACH,cAAS,GAAW,IAAI,CAAA;QAExB;;WAEG;QACH,sBAAiB,GAAW,IAAI,CAAA;QAEhC;;WAEG;QACH,kBAAa,GAAW,IAAI,CAAA;QAE5B;;WAEG;QACH,kBAAa,GAAW,IAAI,CAAA;QAE5B;;WAEG;QACH,uBAAkB,GAAW,IAAI,CAAA;QAEjC;;WAEG;QACH,4BAAuB,GAAW,IAAI,CAAA;QAE9B,mBAAc,GAAmB,SAAS,CAAC;QAkB3C,oBAAe,GAAoB,SAAS,CAAC;QAkB7C,6BAAwB,GAA6B,SAAS,CAAC;QAgB/D,wBAAmB,GAAwB,SAAS,CAAC;QAerD,0BAAqB,GAAY,KAAK,CAAC;QAiBvC,eAAU,GAAmB,EAAE,CAAA;QAkBnC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,QAAQ,EAAC,CAAC;YACV,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,UAAU,CAAC;QAChE,CAAC;IACL,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,YAAa,SAAQ,QAAQ;IAgCtC,YAAa,QAAa;QACtB,KAAK,EAAE,CAAC;QAhCZ;;WAEG;QACH,WAAM,GAAW,IAAI,CAAA;QAErB;;WAEG;QACH,WAAM,GAAW,IAAI,CAAA;QAErB;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B,iDAAiD;QACjD;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAIf,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,OAAO,QAAS,SAAQ,QAAQ;IAoClC,YAAa,QAAa;QACtB,KAAK,EAAE,CAAC;QApCZ;;WAEG;QACH,OAAE,GAAW,IAAI,CAAA;QAEjB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,gBAAW,GAAW,IAAI,CAAA;QAE1B;;WAEG;QACH,gBAAW,GAAW,IAAI,CAAA;QAE1B;;WAEG;QACH,YAAO,GAAW,IAAI,CAAA;QAEtB;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAIvB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IAoCpD,YAAa,QAAa;QACtB,KAAK,EAAE,CAAC;QApCZ;;WAEG;QACH,OAAE,GAAW,IAAI,CAAA;QAEjB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,gBAAW,GAAW,IAAI,CAAA;QAE1B;;WAEG;QACH,eAAU,GAAW,IAAI,CAAA;QACzB;;;WAGG;QACH,qBAAgB,GAAkB,IAAI,CAAA;QAEtC;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAOnB,oBAAe,GAA4C,SAAS,CAAC;QAHzE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAGD;;OAEG;IACH,IAAY,cAAc;QACtB,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,eAAe,GAAG,qBAAqB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACI,qBAAqB,CAAC,QAA0B;QACnD,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpF,OAAO,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACI,gBAAgB,CAAC,IAAc;QAClC,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,CAAA;QACzB,IAAI,IAAI,EAAE,CAAC;YACP,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,MAAM,GAAG,GAAI,IAA2C,CAAC,GAAG,CAAC,CAAA;gBAC7D,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC1C,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;gBACrE,CAAC;YACL,CAAC;YACD,+EAA+E;YAC/E,iFAAiF;YACjF,0EAA0E;YAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC;YAClC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,0BAA0B,EAAE,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;YACvE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,KAAK,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,eAAe,EAAE,CAAC;YAClB,QAAQ,CAAC,gDAAgD,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QACvH,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IA+C3C;;;;;;;OAOG;IACH,IAAW,KAAK;QACZ,OAAO,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,EAAE,MAAM,CAAE,+HAA+H;QACjL,AADkD,+HAA+H;QACjL,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,CAChD,IAAI,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;OAMG;IACH,YAAa,WAAgB,IAAI,EAAE,GAAuB;QACtD,KAAK,EAAE,CAAA;QApEX;;WAEG;QACH,OAAE,GAAW,IAAI,CAAA;QAEjB;;WAEG;QACH,aAAQ,GAAW,IAAI,CAAA;QAEvB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,aAAQ,GAAY,IAAI,CAAA;QAExB;;WAEG;QACH,gBAAW,GAAY,IAAI,CAAA;QAE3B;;WAEG;QACH,gBAAW,GAAW,IAAI,CAAA;QAE1B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QA+BvB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC/B,CAAC;IAED;;;;;;;;;OASG;IACI,cAAc,CAAC,IAAc;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7D,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACxF,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;gBACjC,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,qBAAqB,CAAC,IAAI;oBAAE,OAAO,KAAK,CAAC,CAAC,qBAAqB;gBAC9F,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,qBAAqB,CAAC,KAAK;oBAAE,QAAQ,GAAG,IAAI,CAAC;YAChF,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED;;;;;;;OAOG;IACI,cAAc,CAAC,IAAc;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;YACjC,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,qBAAqB,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACxE,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,qBAAqB,CAAC,KAAK;gBAAE,QAAQ,GAAG,IAAI,CAAC;QAChF,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;CACJ;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACjC,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;CACN,CAAC;AAKX;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;IA2C/C,IAAW,QAAQ;QACf,OAAO,IAAI,CAAC,SAAS,CAAA;IACzB,CAAC;IAEM,iBAAiB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAA;IAChH,CAAC;IAED,QAAQ,CAAC,IAAc;QACnB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;IACzB,CAAC;IAED,YAAa,QAAa;QACtB,KAAK,EAAE,CAAC;QAvDZ;;WAEG;QACH,OAAE,GAAW,IAAI,CAAA;QAEjB;;WAEG;QACH,oBAAe,GAAW,IAAI,CAAA;QAE9B;;WAEG;QACH,WAAM,GAAW,IAAI,CAAA;QAErB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAanB,cAAS,GAAa,IAAI,CAAA;QAe9B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACJ;AAGD;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IA0C1C,YAAa,QAAa;QACtB,KAAK,EAAE,CAAC;QA1CZ;;WAEG;QACH,OAAE,GAAW,IAAI,CAAA;QAEjB;;WAEG;QACH,aAAQ,GAAW,IAAI,CAAA;QAEvB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,gBAAW,GAAW,IAAI,CAAA;QAE1B;;WAEG;QACH,sBAAiB,GAAW,IAAI,CAAA;QAEhC;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAUvB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACJ"}
+{"version":3,"file":"securityInfo.js","sourceRoot":"","sources":["../../src/generic/securityInfo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,kEAAkE;AAClE,mEAAmE;AACnE,iEAAiE;AACjE,6DAA6D;AAC7D,4DAA4D;AAC5D,sDAAsD;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,EAAE,qBAAqB,EAAwB,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACzG,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AA8HpD;;;GAGG;AACH,MAAM,OAAO,QAAS,SAAQ,QAAQ;IAwGlC;;;;;;;;OAQG;IACH,IAAW,aAAa;QACpB,OAAO,IAAI,CAAC,cAAc,CAAC;IAC/B,CAAC;IACD,IAAW,aAAa,CAAC,KAAgC;QACrD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;IAChC,CAAC;IAID;;;;;;;;OAQG;IACH,IAAW,cAAc;QACrB,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;IACD,IAAW,cAAc,CAAC,KAAiC;QACvD,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;IACjC,CAAC;IAID;;;;;;;;OAQG;IACH,IAAW,mBAAmB;QAC1B,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACrC,CAAC;IACD,IAAW,mBAAmB,CAAC,KAAsC;QACjE,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC;IACtC,CAAC;IAID;;;;;;;;;OASG;IACH,IAAW,gBAAgB;QACvB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAClC,CAAC;IACD,IAAW,gBAAgB,CAAC,KAA2C;QACnE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;IACnC,CAAC;IAID;;;;;;OAMG;IACH,IAAW,uBAAuB;QAC9B,OAAO,IAAI,CAAC,wBAAwB,CAAC;IACzC,CAAC;IACD,IAAW,uBAAuB,CAAC,KAA0C;QACzE,IAAI,CAAC,wBAAwB,GAAG,KAAK,CAAC;IAC1C,CAAC;IAID;;;;;OAKG;IACH,IAAW,kBAAkB;QACzB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IACpC,CAAC;IACD,IAAW,kBAAkB,CAAC,KAAqC;QAC/D,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;IACrC,CAAC;IAID;;;;;;;OAOG;IACH,IAAW,oBAAoB;QAC3B,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACtC,CAAC;IACD,IAAW,oBAAoB,CAAC,KAAc;QAC1C,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAC;IACvC,CAAC;IAGD;;;OAGG;IACH,IAAW,SAAS;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,YAAa,KAAwB,IAAI,EAAE,WAAgB,IAAI;QAC3D,KAAK,EAAE,CAAC;QA/OZ;;WAEG;QACH,OAAE,GAAW,IAAI,CAAC;QAElB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,cAAS,GAAW,IAAI,CAAA;QAExB;;WAEG;QACH,aAAQ,GAAW,IAAI,CAAA;QAEvB;;WAEG;QACH,UAAK,GAAW,IAAI,CAAA;QAEpB;;WAEG;QACH,UAAK,GAAW,IAAI,CAAA;QAEpB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,aAAQ,GAAY,IAAI,CAAA;QAExB;;WAEG;QACH,qBAAgB,GAAkC,IAAI,CAAA;QAEtD;;WAEG;QACH,eAAU,GAAW,IAAI,CAAA;QAEzB;;WAEG;QACH,mBAAc,GAAW,IAAI,CAAA;QAE7B;;WAEG;QACH,yBAAoB,GAAW,IAAI,CAAA;QAEnC;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B,iDAAiD;QACjD;;WAEG;QACH,cAAS,GAAW,IAAI,CAAA;QAExB;;WAEG;QACH,sBAAiB,GAAW,IAAI,CAAA;QAEhC;;WAEG;QACH,kBAAa,GAAW,IAAI,CAAA;QAE5B;;WAEG;QACH,kBAAa,GAAW,IAAI,CAAA;QAE5B;;WAEG;QACH,uBAAkB,GAAW,IAAI,CAAA;QAEjC;;WAEG;QACH,4BAAuB,GAAW,IAAI,CAAA;QAE9B,mBAAc,GAAmB,SAAS,CAAC;QAkB3C,oBAAe,GAAoB,SAAS,CAAC;QAkB7C,yBAAoB,GAAyB,SAAS,CAAC;QAkBvD,sBAAiB,GAA8B,SAAS,CAAC;QAmBzD,6BAAwB,GAA6B,SAAS,CAAC;QAgB/D,wBAAmB,GAAwB,SAAS,CAAC;QAerD,0BAAqB,GAAY,KAAK,CAAC;QAiBvC,eAAU,GAAmB,EAAE,CAAA;QAkBnC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,QAAQ,EAAC,CAAC;YACV,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,UAAU,CAAC;QAChE,CAAC;IACL,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,YAAa,SAAQ,QAAQ;IAgCtC,YAAa,QAAa;QACtB,KAAK,EAAE,CAAC;QAhCZ;;WAEG;QACH,WAAM,GAAW,IAAI,CAAA;QAErB;;WAEG;QACH,WAAM,GAAW,IAAI,CAAA;QAErB;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B,iDAAiD;QACjD;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAIf,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,OAAO,QAAS,SAAQ,QAAQ;IAoClC,YAAa,QAAa;QACtB,KAAK,EAAE,CAAC;QApCZ;;WAEG;QACH,OAAE,GAAW,IAAI,CAAA;QAEjB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,gBAAW,GAAW,IAAI,CAAA;QAE1B;;WAEG;QACH,gBAAW,GAAW,IAAI,CAAA;QAE1B;;WAEG;QACH,YAAO,GAAW,IAAI,CAAA;QAEtB;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAIvB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IAoCpD,YAAa,QAAa;QACtB,KAAK,EAAE,CAAC;QApCZ;;WAEG;QACH,OAAE,GAAW,IAAI,CAAA;QAEjB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,gBAAW,GAAW,IAAI,CAAA;QAE1B;;WAEG;QACH,eAAU,GAAW,IAAI,CAAA;QACzB;;;WAGG;QACH,qBAAgB,GAAkB,IAAI,CAAA;QAEtC;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAOnB,oBAAe,GAA4C,SAAS,CAAC;QAHzE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAGD;;OAEG;IACH,IAAY,cAAc;QACtB,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,eAAe,GAAG,qBAAqB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACI,qBAAqB,CAAC,QAA0B;QACnD,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpF,OAAO,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACI,gBAAgB,CAAC,IAAc,EAAE,OAA6B;QACjE,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,CAAA;QACzB,IAAI,IAAI,EAAE,CAAC;YACP,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,MAAM,GAAG,GAAI,IAA2C,CAAC,GAAG,CAAC,CAAA;gBAC7D,uEAAuE;gBACvE,yEAAyE;gBACzE,0DAA0D;gBAC1D,yEAAyE;gBACzE,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACzC,wEAAwE;oBACxE,uEAAuE;oBACvE,sEAAsE;oBACtE,+BAA+B;oBAC/B,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;gBACzF,CAAC;YACL,CAAC;YACD,+EAA+E;YAC/E,iFAAiF;YACjF,0EAA0E;YAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC;YAClC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,0BAA0B,EAAE,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7F,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,KAAK,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAEjG,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChE,IAAI,eAAe,EAAE,CAAC;YAClB,IAAI,OAAO,EAAE,kBAAkB,KAAK,eAAe,EAAE,CAAC;gBAClD,2EAA2E;gBAC3E,4EAA4E;gBAC5E,2EAA2E;gBAC3E,oDAAoD;gBACpD,QAAQ,CAAC,4EAA4E,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC/I,OAAO,OAAO,CAAC;YACnB,CAAC;YACD,QAAQ,CAAC,gDAAgD,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QACvH,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACK,mBAAmB,CAAC,IAAY,EAAE,IAAc;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC;QACxC,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,MAAM,OAAO,GAAwC;YACjD,CAAC,sBAAsB,EAAE,MAAM,EAAE,oBAAoB,CAAC;YACtD,CAAC,gBAAgB,EAAE,MAAM,EAAE,cAAc,CAAC;YAC1C,CAAC,eAAe,EAAE,MAAM,EAAE,aAAa,CAAC;SAC3C,CAAC;QACF,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1F,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,EAAE,gBAAgB,CAAC;QAC3C,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC;iBAC1B,IAAI,EAAE;iBACN,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;iBACtC,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,2BAA2B,EAAE,QAAQ,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;CACJ;AAkBD;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IA+C3C;;;;;;;OAOG;IACH,IAAW,KAAK;QACZ,OAAO,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,EAAE,MAAM,CAAE,+HAA+H;QACjL,AADkD,+HAA+H;QACjL,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,CAChD,IAAI,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;OAMG;IACH,YAAa,WAAgB,IAAI,EAAE,GAAuB;QACtD,KAAK,EAAE,CAAA;QApEX;;WAEG;QACH,OAAE,GAAW,IAAI,CAAA;QAEjB;;WAEG;QACH,aAAQ,GAAW,IAAI,CAAA;QAEvB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,aAAQ,GAAY,IAAI,CAAA;QAExB;;WAEG;QACH,gBAAW,GAAY,IAAI,CAAA;QAE3B;;WAEG;QACH,gBAAW,GAAW,IAAI,CAAA;QAE1B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QA+BvB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC/B,CAAC;IAED;;;;;;;;;OASG;IACI,cAAc,CAAC,IAAc;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7D,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACxF,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;gBACjC,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,qBAAqB,CAAC,IAAI;oBAAE,OAAO,KAAK,CAAC,CAAC,qBAAqB;gBAC9F,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,qBAAqB,CAAC,KAAK;oBAAE,QAAQ,GAAG,IAAI,CAAC;YAChF,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED;;;;;;;OAOG;IACI,cAAc,CAAC,IAAc;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;YACjC,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,qBAAqB,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACxE,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,qBAAqB,CAAC,KAAK;gBAAE,QAAQ,GAAG,IAAI,CAAC;QAChF,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;CACJ;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACjC,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;CACN,CAAC;AAKX;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;IA2C/C,IAAW,QAAQ;QACf,OAAO,IAAI,CAAC,SAAS,CAAA;IACzB,CAAC;IAEM,iBAAiB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAA;IAChH,CAAC;IAED,QAAQ,CAAC,IAAc;QACnB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;IACzB,CAAC;IAED,YAAa,QAAa;QACtB,KAAK,EAAE,CAAC;QAvDZ;;WAEG;QACH,OAAE,GAAW,IAAI,CAAA;QAEjB;;WAEG;QACH,oBAAe,GAAW,IAAI,CAAA;QAE9B;;WAEG;QACH,WAAM,GAAW,IAAI,CAAA;QAErB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAanB,cAAS,GAAa,IAAI,CAAA;QAe9B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACJ;AAGD;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IA0C1C,YAAa,QAAa;QACtB,KAAK,EAAE,CAAC;QA1CZ;;WAEG;QACH,OAAE,GAAW,IAAI,CAAA;QAEjB;;WAEG;QACH,aAAQ,GAAW,IAAI,CAAA;QAEvB;;WAEG;QACH,SAAI,GAAW,IAAI,CAAA;QAEnB;;WAEG;QACH,gBAAW,GAAW,IAAI,CAAA;QAE1B;;WAEG;QACH,sBAAiB,GAAW,IAAI,CAAA;QAEhC;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAE3B;;WAEG;QACH,mBAAc,GAAS,IAAI,CAAA;QAUvB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACJ"}

package/package.json

@@ -1,22 +1,13 @@
 {
   "name": "@memberjunction/core",
   "type": "module",
-  "version": "5.50.0",
+  "version": "6.1.0-edge.0",
   "description": "MemberJunction: Core Library including Metadata, Application, Entity Retrieval and Manipulation, and Utilities",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
     "/dist"
   ],
-  "scripts": {
-    "start": "ts-node-dev src/index.ts",
-    "build": "tsc && tsc-alias -f",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "test:refresh": "vitest run providerBase.refresh.test.ts",
-    "test:concurrency": "vitest run providerBase.concurrency.test.ts"
-  },
   "author": "MemberJunction.com",
   "license": "ISC",
   "devDependencies": {
@@ -26,8 +17,8 @@
     "vitest": "^3.1.1"
   },
   "dependencies": {
-    "@memberjunction/global": "5.50.0",
-    "@memberjunction/sql-dialect": "5.50.0",
+    "@memberjunction/global": "6.1.0-edge.0",
+    "@memberjunction/sql-dialect": "6.1.0-edge.0",
     "rxjs": "^7.8.2",
     "zod": "^3.25.0",
     "debug": "^4.4.3"
@@ -35,5 +26,14 @@
   "repository": {
     "type": "git",
     "url": "https://github.com/MemberJunction/MJ"
+  },
+  "scripts": {
+    "start": "ts-node-dev src/index.ts",
+    "build": "tsc && tsc-alias -f",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "test:refresh": "vitest run providerBase.refresh.test.ts",
+    "test:concurrency": "vitest run providerBase.concurrency.test.ts"
   }
-}
+}

package/readme.md

@@ -444,6 +444,29 @@ if (!result.Success) {
 }
 ```
 
+#### IS-A (Table-Per-Type) entities
+
+An entity may inherit from another — `Webinar` IS-A `Meeting` IS-A `Product` — with one primary key
+shared across every table. `BaseEntity` makes the chain invisible: set a field belonging to ANY
+ancestor directly on the child, and one `Save()` writes every level in a single transaction.
+
+```typescript
+const webinar = await md.GetEntityObject<WebinarEntity>('Webinars', contextUser);
+webinar.NewRecord();
+webinar.RecordingURL = '...';        // Webinar's own field
+webinar.StartTime    = startTime;    // Meeting's field
+webinar.Name         = 'Q1 Webinar'; // Product's field — same object
+await webinar.Save();                // writes Product, Meeting, Webinar
+```
+
+Two things catch people out. Do **not** create the parent separately and then attach a child to it —
+`NewRecord()` starts a new chain rather than adopting an existing row. And remember to set NOT NULL
+columns that live on ANCESTOR tables: the child can look complete while the parent insert is
+rejected, which fails the whole save.
+
+See [docs/isa-relationships.md](docs/isa-relationships.md) for the full model — discovery, disjoint
+vs overlapping subtypes, delete orchestration, and CodeGen integration.
+
 ### CompositeKey
 
 The `CompositeKey` class provides flexible primary key representation supporting both single and multi-field primary keys.
@@ -1640,6 +1663,14 @@ flowchart LR
 | `AllowUpdateAPI` | Configurable | Always `false` |
 | Stored procedures | Generated | None |
 
+> **Not the same thing as a custom base view.** A virtual entity has *no base table* and is read-only.
+> If you have a real table and only want to add computed columns to what its view exposes, you want a
+> **layered base view** instead — `GeneratedBaseViewName` keeps CodeGen generating an inner view while
+> your application owns and wraps `BaseView`, and the entity stays fully writable because
+> `spCreate`/`spUpdate`/`spDelete` still target `BaseView`. See
+> [Base Views: Generated, Custom, or Layered](../CodeGenLib/README.md#base-views-generated-custom-or-layered).
+> Layering is skipped entirely for virtual entities, which have no table to generate from.
+
 ### Read-Only Enforcement
 
 Virtual entities are enforced as read-only at multiple layers: