@memberjunction/core 6.1.0-edge.6 → 6.1.0

package/dist/generic/recordChangeFieldSecurity.d.ts

@@ -0,0 +1,164 @@
+import { EntityInfo } from "./entityInfo.js";
+import { UserInfo } from "./securityInfo.js";
+/**
+ * The two metadata lookups this projector needs, and nothing else.
+ *
+ * Narrower than `IMetadataProvider` on purpose: both `ProviderBase` (which passes `this`) and
+ * `Metadata` (which the GraphQL resolvers fall back to) satisfy this, while only the first
+ * satisfies the full provider interface. Asking for exactly what is used keeps the resolver half
+ * from having to invent a provider it does not have.
+ */
+export interface RecordChangeMetadataSource {
+    readonly Entities: EntityInfo[];
+    EntityByID(entityID: string): EntityInfo | undefined;
+}
+/**
+ * The audit entity whose rows carry OTHER entities' field values. Matched by name rather than by
+ * ID because every other enforcement point in this feature keys off the entity name too, and a
+ * name is the thing a reader can check against metadata without a lookup.
+ */
+export declare const RecordChangesEntityName = "MJ: Record Changes";
+/**
+ * The Record Change column naming the entity a row is ABOUT. Everything in this module hangs off
+ * it: it is what makes the denied set per-ROW rather than per-result.
+ */
+export declare const RecordChangeEntityIDField = "EntityID";
+/**
+ * Payload columns holding a JSON object keyed by the target entity's field names — projected
+ * key by key against the denied set. `ChangesJSON` is `{ [field]: { field, oldValue, newValue } }`;
+ * `FullRecordJSON` is a flat whole-row snapshot. Both are top-level-keyed by field name, which is
+ * what lets one projection handle them.
+ */
+export declare const RecordChangeJSONPayloadFields: readonly ["ChangesJSON", "FullRecordJSON"];
+/**
+ * The human-prose payload column — withheld outright, never redacted. See
+ * {@link RecordChangeFieldSecurityProjector}.
+ */
+export declare const RecordChangeProsePayloadField = "ChangesDescription";
+/**
+ * Every payload column this module touches, for callers that need to act on the set as a whole —
+ * notably the write guard, which must refuse a narrowed value coming back in.
+ */
+export declare const RecordChangePayloadFields: readonly string[];
+/**
+ * Outcome of projecting one JSON payload column: either a value to write back, or a decision to
+ * withhold the column entirely because the payload could not be inspected.
+ *
+ * Deliberately an interface with an optional `Value` rather than a discriminated union — MJCore
+ * compiles without `strictNullChecks`, under which TypeScript does not narrow a union on a
+ * boolean discriminant, so the union shape would force a cast at every read.
+ */
+export interface RecordChangePayloadProjection {
+    /** When true the caller drops the column; `Value` carries nothing. */
+    Withhold: boolean;
+    /** The value to write back. Meaningful only when {@link Withhold} is false. */
+    Value?: unknown;
+}
+/**
+ * Narrows one Record Change JSON payload to the fields the caller may read.
+ *
+ * **Withholds rather than guesses.** A payload that is not a string, or is a string that does not
+ * parse, or parses to something other than a plain object, is a payload this cannot prove is
+ * clean — so the column is dropped instead of passed through. A null/undefined/empty value is
+ * kept as-is: there is nothing stored to leak, and `ChangesJSON` is legitimately `''` on rows
+ * whose diff produced nothing.
+ *
+ * @param raw the column's stored value
+ * @param deniedLowercase field names the caller may not read, already lowercased
+ */
+export declare function ProjectRecordChangePayloadJSON(raw: unknown, deniedLowercase: Set<string>): RecordChangePayloadProjection;
+/**
+ * Field-level security for the payload columns of `MJ: Record Changes`.
+ *
+ * ## Why this is not `ProviderBase.ApplyFieldSecurityProjection`
+ *
+ * Every other FLS enforcement point computes the denied set against **the entity being read**. A
+ * Record Change row is about a DIFFERENT entity — the one named by its own `EntityID` column —
+ * and `MJ: Record Changes` itself has field security switched off in every default deployment.
+ * The main projection therefore short-circuits on `EnableFieldLevelSecurity` and returns the row
+ * untouched, with a denied field's old and new values sitting in `ChangesJSON` in plain text.
+ * That is the leak this closes: a user with entity-level read on the audit trail could read a
+ * salary they were denied on `MJ: Employees` straight out of it, in the default configuration.
+ *
+ * ## What happens to each column
+ *
+ * | Column | Treatment |
+ * |---|---|
+ * | `ChangesJSON` | projected — denied field keys dropped |
+ * | `FullRecordJSON` | projected — same, it is a whole-row snapshot |
+ * | `ChangesDescription` | **withheld entirely** whenever the caller is denied anything on the target entity |
+ *
+ * `ChangesDescription` is human prose ("Salary changed from 100000 to 120000"). Redacting prose
+ * on the fly leaks on the first value that appears in an unexpected form, and regenerating it
+ * from the filtered JSON is a larger surface than this is worth. Withholding the whole column is
+ * coarse and it is safe, which is the right trade for a field whose only job is to be readable
+ * text — and callers already degrade, the record-changes UI falling back to 'Changes made'.
+ *
+ * ## Rows in one result span different entities
+ *
+ * `EntityID` varies row to row, and `EntityInfo.GetDeniedReadFields` walks every field on the
+ * entity — its documented performance contract is that it must not be called in a row loop. Every
+ * lookup here is memoized on the raw `EntityID` string for the projector's lifetime, which is one
+ * request. Construct one projector per request, never one per row.
+ */
+export declare class RecordChangeFieldSecurityProjector {
+    private readonly provider;
+    private readonly user;
+    private readonly deniedByEntityID;
+    private carriesDenials;
+    private payloadKeys;
+    constructor(provider: RecordChangeMetadataSource, user: UserInfo);
+    /**
+     * Whether an entity is the audit trail this projector guards. Callers gate on this before
+     * constructing a projector, so nothing is paid on the other 99% of reads.
+     */
+    static IsRecordChangesEntity(entity: EntityInfo | null | undefined): boolean;
+    /**
+     * Projects a whole result set. Returns the ORIGINAL array when nothing needed changing, so an
+     * unrestricted caller's rows are never rebuilt — and, on the cache-hit paths, so the cache's
+     * own frozen objects are handed back by reference exactly as they are today.
+     */
+    ProjectRows<T>(rows: T[]): T[];
+    /**
+     * Single-row form, for the GraphQL read boundary. Returns the original object untouched when
+     * there is nothing to project.
+     */
+    ProjectRow<T>(row: T): T;
+    /**
+     * Whether this caller is denied ANY field on ANY field-security-enabled entity.
+     *
+     * The whole projector is a no-op for everyone else, and this gate is what makes that true —
+     * including for the fail-closed branch in {@link deniedFieldsFor}, which would otherwise blank
+     * audit rows on deployments that never enabled field security at all. Cost is one pass over
+     * the entity list plus one denied-set walk per ENABLED entity, and the flag is off on every
+     * entity an administrator has not explicitly opted in.
+     *
+     * Public because the WRITE side needs the same question: a caller who could have been served a
+     * narrowed payload must not be allowed to write one back. See
+     * `ResolverBase.StripRecordChangePayloadFromClientInput`.
+     */
+    CallerCarriesAnyDenial(): boolean;
+    private callerCarriesDenials;
+    private projectOne;
+    /**
+     * The denied-read set for the entity a Record Change row is ABOUT, or `null` to fail closed.
+     *
+     * **`null` drops all three payload columns.** Two shapes reach it and both have to. The first
+     * is an `EntityID` that no longer resolves to a known entity. The second is the one that
+     * decides the policy: a row that does not carry `EntityID` at all. A caller can ask for
+     * `Fields: ['ChangesJSON']` and nothing else, and field narrowing runs BEFORE this projection
+     * — so failing open on a missing `EntityID` would be a one-parameter bypass of the entire
+     * control.
+     *
+     * The cost of failing closed is paid only by callers who already carry denials somewhere (see
+     * {@link callerCarriesDenials}), and lands on audit rows for entities that are gone from
+     * metadata — rows for which no caller can render an entity name either way.
+     */
+    private deniedFieldsFor;
+    /**
+     * Resolves the row's actual key casing once. Returns null — cached as null — when the rows
+     * carry no payload column at all, which makes every later row a single map read.
+     */
+    private resolvePayloadKeys;
+}
+//# sourceMappingURL=recordChangeFieldSecurity.d.ts.map

package/dist/generic/recordChangeFieldSecurity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recordChangeFieldSecurity.d.ts","sourceRoot":"","sources":["../../src/generic/recordChangeFieldSecurity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACvC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;IAChC,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;CACxD;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,yBAAyB,aAAa,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4CAA6C,CAAC;AAExF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,uBAAuB,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAGtD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC1C,sEAAsE;IACtE,QAAQ,EAAE,OAAO,CAAC;IAClB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,6BAA6B,CAiCxH;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,qBAAa,kCAAkC;IAMvC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IANzB,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAyC;IAC1E,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,WAAW,CAAyD;gBAGvD,QAAQ,EAAE,0BAA0B,EACpC,IAAI,EAAE,QAAQ;IAGnC;;;OAGG;WACW,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAInF;;;;OAIG;IACI,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE;IAerC;;;OAGG;IACI,UAAU,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC;IAO/B;;;;;;;;;;;;OAYG;IACI,sBAAsB,IAAI,OAAO;IAIxC,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,UAAU;IAiClB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAkBvB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;CAsB7B"}

package/dist/generic/recordChangeFieldSecurity.js

@@ -0,0 +1,279 @@
+/**
+ * The audit entity whose rows carry OTHER entities' field values. Matched by name rather than by
+ * ID because every other enforcement point in this feature keys off the entity name too, and a
+ * name is the thing a reader can check against metadata without a lookup.
+ */
+export const RecordChangesEntityName = 'MJ: Record Changes';
+/**
+ * The Record Change column naming the entity a row is ABOUT. Everything in this module hangs off
+ * it: it is what makes the denied set per-ROW rather than per-result.
+ */
+export const RecordChangeEntityIDField = 'EntityID';
+/**
+ * Payload columns holding a JSON object keyed by the target entity's field names — projected
+ * key by key against the denied set. `ChangesJSON` is `{ [field]: { field, oldValue, newValue } }`;
+ * `FullRecordJSON` is a flat whole-row snapshot. Both are top-level-keyed by field name, which is
+ * what lets one projection handle them.
+ */
+export const RecordChangeJSONPayloadFields = ['ChangesJSON', 'FullRecordJSON'];
+/**
+ * The human-prose payload column — withheld outright, never redacted. See
+ * {@link RecordChangeFieldSecurityProjector}.
+ */
+export const RecordChangeProsePayloadField = 'ChangesDescription';
+/**
+ * Every payload column this module touches, for callers that need to act on the set as a whole —
+ * notably the write guard, which must refuse a narrowed value coming back in.
+ */
+export const RecordChangePayloadFields = [
+    ...RecordChangeJSONPayloadFields,
+    RecordChangeProsePayloadField,
+];
+/**
+ * Narrows one Record Change JSON payload to the fields the caller may read.
+ *
+ * **Withholds rather than guesses.** A payload that is not a string, or is a string that does not
+ * parse, or parses to something other than a plain object, is a payload this cannot prove is
+ * clean — so the column is dropped instead of passed through. A null/undefined/empty value is
+ * kept as-is: there is nothing stored to leak, and `ChangesJSON` is legitimately `''` on rows
+ * whose diff produced nothing.
+ *
+ * @param raw the column's stored value
+ * @param deniedLowercase field names the caller may not read, already lowercased
+ */
+export function ProjectRecordChangePayloadJSON(raw, deniedLowercase) {
+    if (raw === null || raw === undefined) {
+        return { Withhold: false, Value: raw };
+    }
+    if (typeof raw !== 'string') {
+        return { Withhold: true };
+    }
+    if (raw.trim().length === 0) {
+        return { Withhold: false, Value: raw };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { Withhold: true };
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        return { Withhold: true };
+    }
+    const source = parsed;
+    const kept = {};
+    for (const key of Object.keys(source)) {
+        if (deniedLowercase.has(key.trim().toLowerCase())) {
+            continue;
+        }
+        if (isDeniedChangeEntry(source[key], deniedLowercase)) {
+            continue;
+        }
+        kept[key] = source[key];
+    }
+    return { Withhold: false, Value: JSON.stringify(kept) };
+}
+/**
+ * A `ChangesJSON` entry is `{ field, oldValue, newValue }` stored under a key that is that same
+ * field name, so the key check already catches it. This second check costs one property read and
+ * covers the case where the two disagree — a payload written by something other than
+ * `DatabaseProviderBase.DiffObjects`, or hand-edited. Where they disagree, the entry is dropped.
+ */
+function isDeniedChangeEntry(value, deniedLowercase) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const field = value['field'];
+    return typeof field === 'string' && deniedLowercase.has(field.trim().toLowerCase());
+}
+/**
+ * Field-level security for the payload columns of `MJ: Record Changes`.
+ *
+ * ## Why this is not `ProviderBase.ApplyFieldSecurityProjection`
+ *
+ * Every other FLS enforcement point computes the denied set against **the entity being read**. A
+ * Record Change row is about a DIFFERENT entity — the one named by its own `EntityID` column —
+ * and `MJ: Record Changes` itself has field security switched off in every default deployment.
+ * The main projection therefore short-circuits on `EnableFieldLevelSecurity` and returns the row
+ * untouched, with a denied field's old and new values sitting in `ChangesJSON` in plain text.
+ * That is the leak this closes: a user with entity-level read on the audit trail could read a
+ * salary they were denied on `MJ: Employees` straight out of it, in the default configuration.
+ *
+ * ## What happens to each column
+ *
+ * | Column | Treatment |
+ * |---|---|
+ * | `ChangesJSON` | projected — denied field keys dropped |
+ * | `FullRecordJSON` | projected — same, it is a whole-row snapshot |
+ * | `ChangesDescription` | **withheld entirely** whenever the caller is denied anything on the target entity |
+ *
+ * `ChangesDescription` is human prose ("Salary changed from 100000 to 120000"). Redacting prose
+ * on the fly leaks on the first value that appears in an unexpected form, and regenerating it
+ * from the filtered JSON is a larger surface than this is worth. Withholding the whole column is
+ * coarse and it is safe, which is the right trade for a field whose only job is to be readable
+ * text — and callers already degrade, the record-changes UI falling back to 'Changes made'.
+ *
+ * ## Rows in one result span different entities
+ *
+ * `EntityID` varies row to row, and `EntityInfo.GetDeniedReadFields` walks every field on the
+ * entity — its documented performance contract is that it must not be called in a row loop. Every
+ * lookup here is memoized on the raw `EntityID` string for the projector's lifetime, which is one
+ * request. Construct one projector per request, never one per row.
+ */
+export class RecordChangeFieldSecurityProjector {
+    constructor(provider, user) {
+        this.provider = provider;
+        this.user = user;
+        this.deniedByEntityID = new Map();
+        this.carriesDenials = null;
+        this.payloadKeys = undefined;
+    }
+    /**
+     * Whether an entity is the audit trail this projector guards. Callers gate on this before
+     * constructing a projector, so nothing is paid on the other 99% of reads.
+     */
+    static IsRecordChangesEntity(entity) {
+        return entity?.Name?.trim().toLowerCase() === RecordChangesEntityName.toLowerCase();
+    }
+    /**
+     * Projects a whole result set. Returns the ORIGINAL array when nothing needed changing, so an
+     * unrestricted caller's rows are never rebuilt — and, on the cache-hit paths, so the cache's
+     * own frozen objects are handed back by reference exactly as they are today.
+     */
+    ProjectRows(rows) {
+        if (!rows?.length || !this.callerCarriesDenials()) {
+            return rows;
+        }
+        let mutated = false;
+        const projected = rows.map((row) => {
+            const next = this.projectOne(row);
+            if (next !== row) {
+                mutated = true;
+            }
+            return next;
+        });
+        return mutated ? projected : rows;
+    }
+    /**
+     * Single-row form, for the GraphQL read boundary. Returns the original object untouched when
+     * there is nothing to project.
+     */
+    ProjectRow(row) {
+        if (!row || !this.callerCarriesDenials()) {
+            return row;
+        }
+        return this.projectOne(row);
+    }
+    /**
+     * Whether this caller is denied ANY field on ANY field-security-enabled entity.
+     *
+     * The whole projector is a no-op for everyone else, and this gate is what makes that true —
+     * including for the fail-closed branch in {@link deniedFieldsFor}, which would otherwise blank
+     * audit rows on deployments that never enabled field security at all. Cost is one pass over
+     * the entity list plus one denied-set walk per ENABLED entity, and the flag is off on every
+     * entity an administrator has not explicitly opted in.
+     *
+     * Public because the WRITE side needs the same question: a caller who could have been served a
+     * narrowed payload must not be allowed to write one back. See
+     * `ResolverBase.StripRecordChangePayloadFromClientInput`.
+     */
+    CallerCarriesAnyDenial() {
+        return this.callerCarriesDenials();
+    }
+    callerCarriesDenials() {
+        if (this.carriesDenials === null) {
+            this.carriesDenials = this.provider.Entities.some((e) => e.EnableFieldLevelSecurity && e.GetDeniedReadFields(this.user).size > 0);
+        }
+        return this.carriesDenials;
+    }
+    projectOne(row) {
+        const source = row;
+        if (!source || typeof source !== 'object') {
+            return row;
+        }
+        const keys = this.resolvePayloadKeys(source);
+        if (!keys) {
+            return row; // the caller selected none of the payload columns — nothing to protect
+        }
+        const denied = this.deniedFieldsFor(source, keys);
+        if (denied !== null && denied.size === 0) {
+            return row; // caller reads every field on the entity this row is about
+        }
+        const projected = { ...source };
+        if (keys.Prose) {
+            delete projected[keys.Prose];
+        }
+        for (const key of keys.JSON) {
+            if (denied === null) {
+                delete projected[key];
+                continue;
+            }
+            const result = ProjectRecordChangePayloadJSON(source[key], denied);
+            if (result.Withhold) {
+                delete projected[key];
+            }
+            else {
+                projected[key] = result.Value;
+            }
+        }
+        return projected;
+    }
+    /**
+     * The denied-read set for the entity a Record Change row is ABOUT, or `null` to fail closed.
+     *
+     * **`null` drops all three payload columns.** Two shapes reach it and both have to. The first
+     * is an `EntityID` that no longer resolves to a known entity. The second is the one that
+     * decides the policy: a row that does not carry `EntityID` at all. A caller can ask for
+     * `Fields: ['ChangesJSON']` and nothing else, and field narrowing runs BEFORE this projection
+     * — so failing open on a missing `EntityID` would be a one-parameter bypass of the entire
+     * control.
+     *
+     * The cost of failing closed is paid only by callers who already carry denials somewhere (see
+     * {@link callerCarriesDenials}), and lands on audit rows for entities that are gone from
+     * metadata — rows for which no caller can render an entity name either way.
+     */
+    deniedFieldsFor(source, keys) {
+        if (!keys.EntityID) {
+            return null;
+        }
+        const rawEntityID = source[keys.EntityID];
+        if (typeof rawEntityID !== 'string' || rawEntityID.trim().length === 0) {
+            return null;
+        }
+        const cached = this.deniedByEntityID.get(rawEntityID);
+        if (cached !== undefined) {
+            return cached;
+        }
+        const entity = this.provider.EntityByID(rawEntityID);
+        const denied = entity ? entity.GetDeniedReadFields(this.user) : null;
+        this.deniedByEntityID.set(rawEntityID, denied);
+        return denied;
+    }
+    /**
+     * Resolves the row's actual key casing once. Returns null — cached as null — when the rows
+     * carry no payload column at all, which makes every later row a single map read.
+     */
+    resolvePayloadKeys(source) {
+        if (this.payloadKeys !== undefined) {
+            return this.payloadKeys;
+        }
+        const byLowerName = new Map();
+        for (const key of Object.keys(source)) {
+            byLowerName.set(key.trim().toLowerCase(), key);
+        }
+        const jsonKeys = RecordChangeJSONPayloadFields
+            .map((name) => byLowerName.get(name.toLowerCase()))
+            .filter((key) => key !== undefined);
+        const proseKey = byLowerName.get(RecordChangeProsePayloadField.toLowerCase()) ?? null;
+        this.payloadKeys = (jsonKeys.length === 0 && proseKey === null)
+            ? null
+            : {
+                JSON: jsonKeys,
+                Prose: proseKey,
+                EntityID: byLowerName.get(RecordChangeEntityIDField.toLowerCase()) ?? null,
+            };
+        return this.payloadKeys;
+    }
+}
+//# sourceMappingURL=recordChangeFieldSecurity.js.map

package/dist/generic/recordChangeFieldSecurity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recordChangeFieldSecurity.js","sourceRoot":"","sources":["../../src/generic/recordChangeFieldSecurity.ts"],"names":[],"mappings":"AAgBA;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,UAAU,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,aAAa,EAAE,gBAAgB,CAAU,CAAC;AAExF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,oBAAoB,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IACxD,GAAG,6BAA6B;IAChC,6BAA6B;CAChC,CAAC;AAiBF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAY,EAAE,eAA4B;IACrF,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAChD,SAAS;QACb,CAAC;QACD,IAAI,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC;YACpD,SAAS;QACb,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,KAAc,EAAE,eAA4B;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAI,KAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACxF,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,OAAO,kCAAkC;IAK3C,YACqB,QAAoC,EACpC,IAAc;QADd,aAAQ,GAAR,QAAQ,CAA4B;QACpC,SAAI,GAAJ,IAAI,CAAU;QANlB,qBAAgB,GAAG,IAAI,GAAG,EAA8B,CAAC;QAClE,mBAAc,GAAmB,IAAI,CAAC;QACtC,gBAAW,GAA+C,SAAS,CAAC;IAKzE,CAAC;IAEJ;;;OAGG;IACI,MAAM,CAAC,qBAAqB,CAAC,MAAqC;QACrE,OAAO,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,uBAAuB,CAAC,WAAW,EAAE,CAAC;IACxF,CAAC;IAED;;;;OAIG;IACI,WAAW,CAAI,IAAS;QAC3B,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACf,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,OAAO,IAAI,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAED;;;OAGG;IACI,UAAU,CAAI,GAAM;QACvB,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YACvC,OAAO,GAAG,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,sBAAsB;QACzB,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;IACvC,CAAC;IAEO,oBAAoB;QACxB,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAC7C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB,IAAI,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CACjF,CAAC;QACN,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC/B,CAAC;IAEO,UAAU,CAAI,GAAM;QACxB,MAAM,MAAM,GAAG,GAA8B,CAAC;QAC9C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,GAAG,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,OAAO,GAAG,CAAC,CAAC,uEAAuE;QACvF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,CAAC,CAAC,2DAA2D;QAC3E,CAAC;QAED,MAAM,SAAS,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;QACzD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;gBACtB,SAAS;YACb,CAAC;YACD,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACJ,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;YAClC,CAAC;QACL,CAAC;QACD,OAAO,SAAc,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,eAAe,CAAC,MAA+B,EAAE,IAA6B;QAClF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;OAGG;IACK,kBAAkB,CAAC,MAA+B;QACtD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC;QAC5B,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,QAAQ,GAAG,6BAA6B;aACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;aAClD,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,6BAA6B,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;QAEtF,IAAI,CAAC,WAAW,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,IAAI,CAAC;YAC3D,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,yBAAyB,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI;aAC7E,CAAC;QACN,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;CACJ"}

package/dist/generic/saveEntityGraphOperation.d.ts

@@ -41,6 +41,7 @@
  *
  * @module @memberjunction/core
  */
+import { type SerializedValidationError } from '@memberjunction/global';
 import { BaseRemotableOperation } from './baseRemotableOperation.js';
 import type { RemoteOpServerContext } from './baseRemotableOperation.js';
 import type { EntityCompanionPayload } from './entityCompanion.js';
@@ -72,6 +73,15 @@ export type SaveEntityGraphOutput = {
     Success: boolean;
     /** Failure detail when `Success` is false. */
     ErrorMessage?: string;
+    /**
+     * The refusal's structured errors when `Success` is false and validation is what refused —
+     * `root.LatestResult.Errors` flattened by `SerializeValidationErrors`, one entry per offending
+     * field. `ErrorMessage` is the same refusal as prose; this is the version a form can paint from.
+     * A graph save reaches the client through the remote-operation transport, not `ResolverBase`, so
+     * without this field a `ValidateAsync()` refusal on an RRC / graph-saved entity would toast and
+     * never highlight — the parity the plain-save path gets from `extensions.validationErrors`.
+     */
+    ValidationErrors?: SerializedValidationError[];
     /**
      * The root record's field values **after** the save — server-assigned primary keys, computed
      * columns, sequence numbers, trigger-populated fields.

package/dist/generic/saveEntityGraphOperation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saveEntityGraphOperation.d.ts","sourceRoot":"","sources":["../../src/generic/saveEntityGraphOperation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,iEAAiE;AACjE,eAAO,MAAM,+BAA+B,uBAAuB,CAAC;AAEpE;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAC/B,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,mEAAmE;IACnE,UAAU,EAAE,sBAAsB,EAAE,CAAC;IACrC;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,2CAA2C;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;;;;OAOG;IACH,UAAU,EAAE,sBAAsB,EAAE,CAAC;CACxC,CAAC;AAEF;;;;;;GAMG;AACH,qBACa,wBAAyB,SAAQ,sBAAsB,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAC7G,kBAAkB;IAClB,SAAgB,YAAY,wBAAmC;IAE/D;;;;;OAKG;IACH,SAAyB,aAAa,mBAAmB;IAEzD;;;;;;;;;;;;;;;OAeG;cACsB,SAAS,CAAC,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlG;;;;;;;;OAQG;cACsB,eAAe,CACpC,KAAK,EAAE,oBAAoB,EAC3B,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,qBAAqB,GAChC,OAAO,CAAC,qBAAqB,CAAC;IAsBjC;;;;;;;;;;;OAWG;YACW,WAAW;CA0B5B"}
+{"version":3,"file":"saveEntityGraphOperation.d.ts","sourceRoot":"","sources":["../../src/generic/saveEntityGraphOperation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAA4C,KAAK,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,iEAAiE;AACjE,eAAO,MAAM,+BAA+B,uBAAuB,CAAC;AAEpE;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAC/B,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,mEAAmE;IACnE,UAAU,EAAE,sBAAsB,EAAE,CAAC;IACrC;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,2CAA2C;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,yBAAyB,EAAE,CAAC;IAC/C;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;;;;OAOG;IACH,UAAU,EAAE,sBAAsB,EAAE,CAAC;CACxC,CAAC;AAEF;;;;;;GAMG;AACH,qBACa,wBAAyB,SAAQ,sBAAsB,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAC7G,kBAAkB;IAClB,SAAgB,YAAY,wBAAmC;IAE/D;;;;;OAKG;IACH,SAAyB,aAAa,mBAAmB;IAEzD;;;;;;;;;;;;;;;OAeG;cACsB,SAAS,CAAC,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlG;;;;;;;;OAQG;cACsB,eAAe,CACpC,KAAK,EAAE,oBAAoB,EAC3B,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,qBAAqB,GAChC,OAAO,CAAC,qBAAqB,CAAC;IAuBjC;;;;;;;;;;;OAWG;YACW,WAAW;CA0B5B"}

package/dist/generic/saveEntityGraphOperation.js

@@ -47,7 +47,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-import { RegisterClass } from '@memberjunction/global';
+import { RegisterClass, SerializeValidationErrors } from '@memberjunction/global';
 import { BaseRemotableOperation } from './baseRemotableOperation.js';
 import { CompositeKey, KeyValuePair } from './compositeKey.js';
 import { LogError } from './logging.js';
@@ -110,6 +110,7 @@ let SaveEntityGraphOperation = class SaveEntityGraphOperation extends BaseRemota
             return {
                 Success: false,
                 ErrorMessage: detail,
+                ValidationErrors: SerializeValidationErrors(root.LatestResult?.Errors),
                 Fields: root.GetAll(),
                 Companions: await root.SerializeCompanions(),
             };

package/dist/generic/saveEntityGraphOperation.js.map

@@ -1 +1 @@
-{"version":3,"file":"saveEntityGraphOperation.js","sourceRoot":"","sources":["../../src/generic/saveEntityGraphOperation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;;;;;;;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG5D,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,iEAAiE;AACjE,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AA2CpE;;;;;;GAMG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,sBAAmE;IAA1G;;QACH,kBAAkB;QACF,iBAAY,GAAG,+BAA+B,CAAC;QAE/D;;;;;WAKG;QACsB,kBAAa,GAAG,eAAe,CAAC;IAgG7D,CAAC;IA9FG;;;;;;;;;;;;;;;OAeG;IACgB,KAAK,CAAC,SAAS,CAAC,KAA2B,EAAE,KAAe;QAC3E,OAAO,CAAC,CAAC,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IACjD,CAAC;IAED;;;;;;;;OAQG;IACgB,KAAK,CAAC,eAAe,CACpC,KAA2B,EAC3B,QAA2B,EAC3B,IAAc,EACd,QAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,CAAC;YACrE,QAAQ,CAAC,GAAG,+BAA+B,eAAe,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC,CAAC;YACzF,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,MAAM;gBACpB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;gBACrB,UAAU,EAAE,MAAM,IAAI,CAAC,mBAAmB,EAAE;aAC/C,CAAC;QACN,CAAC;QAED,OAAO;YACH,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;SACvD,CAAC;IACN,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,WAAW,CACrB,KAA2B,EAC3B,QAA2B,EAC3B,IAAc;QAEd,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAa,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAEhF,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,YAAY,CACxB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAC1F,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CACX,GAAG,+BAA+B,6BAA6B,KAAK,CAAC,UAAU,GAAG;oBAClF,oBAAoB,CACvB,CAAC;YACN,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,SAAS,EAAE,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ,CAAA;AA1GY,wBAAwB;IADpC,aAAa,CAAC,sBAAsB,EAAE,+BAA+B,CAAC;GAC1D,wBAAwB,CA0GpC"}
+{"version":3,"file":"saveEntityGraphOperation.js","sourceRoot":"","sources":["../../src/generic/saveEntityGraphOperation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;;;;;;;AAEH,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAkC,MAAM,wBAAwB,CAAC;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG5D,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,iEAAiE;AACjE,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAoDpE;;;;;;GAMG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,sBAAmE;IAA1G;;QACH,kBAAkB;QACF,iBAAY,GAAG,+BAA+B,CAAC;QAE/D;;;;;WAKG;QACsB,kBAAa,GAAG,eAAe,CAAC;IAiG7D,CAAC;IA/FG;;;;;;;;;;;;;;;OAeG;IACgB,KAAK,CAAC,SAAS,CAAC,KAA2B,EAAE,KAAe;QAC3E,OAAO,CAAC,CAAC,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IACjD,CAAC;IAED;;;;;;;;OAQG;IACgB,KAAK,CAAC,eAAe,CACpC,KAA2B,EAC3B,QAA2B,EAC3B,IAAc,EACd,QAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,CAAC;YACrE,QAAQ,CAAC,GAAG,+BAA+B,eAAe,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC,CAAC;YACzF,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,MAAM;gBACpB,gBAAgB,EAAE,yBAAyB,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC;gBACtE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;gBACrB,UAAU,EAAE,MAAM,IAAI,CAAC,mBAAmB,EAAE;aAC/C,CAAC;QACN,CAAC;QAED,OAAO;YACH,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;SACvD,CAAC;IACN,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,WAAW,CACrB,KAA2B,EAC3B,QAA2B,EAC3B,IAAc;QAEd,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAa,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAEhF,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,YAAY,CACxB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAC1F,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CACX,GAAG,+BAA+B,6BAA6B,KAAK,CAAC,UAAU,GAAG;oBAClF,oBAAoB,CACvB,CAAC;YACN,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,SAAS,EAAE,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ,CAAA;AA3GY,wBAAwB;IADpC,aAAa,CAAC,sBAAsB,EAAE,+BAA+B,CAAC;GAC1D,wBAAwB,CA2GpC"}

package/dist/generic/wellKnownUserSource.d.ts

@@ -0,0 +1,70 @@
+import type { IMetadataProvider } from "./interfaces.js";
+import type { UserInfo } from "./securityInfo.js";
+/**
+ * Supplies the platform's **well-known users** — the built-in, non-human accounts MJ itself
+ * acts as — and answers whether a given user is one of them.
+ *
+ * This is a plug-in point, not a service. The base implementation says "there are none": it
+ * returns null and false for everything. Server-side packages register a subclass with
+ * `@RegisterClassEx(WellKnownUserSource, …)` that answers properly, and consumers resolve it
+ * through the MJGlobal ClassFactory — so a process with no server-side implementation loaded
+ * (a browser, most obviously) transparently gets the base answers, which are correct there.
+ *
+ * **Why this exists as its own seam.** MJCore is shared by browsers and servers, and which
+ * account the platform runs its own work as is a server concern. Keeping the identity — and
+ * the account's ID — out of MJCore means a browser bundle carries no knowledge of the server's
+ * service account, and the answer travels with whichever data-provider package the process
+ * actually loaded rather than with a constant compiled into core.
+ *
+ * **Why it is NOT on `IMetadataProvider`.** A metadata provider's job is data access; platform
+ * identity is policy. Keeping it separate also keeps `CurrentUser` meaning what it means today
+ * — permanently null on the server — so the many `contextUser ?? provider.CurrentUser`
+ * fallbacks keep failing loudly instead of silently escalating to the most privileged account.
+ *
+ * Today the category has one member, the system user. It has visible future members — the
+ * active-Owner fallback that startup and the telephony routers hand-roll, and the
+ * scoped-anonymous identity used for widget-guest elevation — and those belong here as their
+ * own named methods rather than as variations smuggled into the existing ones.
+ */
+export declare class WellKnownUserSource {
+    private static _instance;
+    /**
+     * The registered source for this process, resolved once through the class factory.
+     *
+     * Cached because {@link IsSystemUser} sits behind permission checks that run per entity and
+     * per user; resolving (and allocating) on every call would be needless churn. Registrations
+     * happen as module-load side effects of importing a data-provider package, which always
+     * precedes any permission evaluation, so caching cannot capture a stale answer in practice.
+     * Tests that register a source after first use should call {@link ResetInstance}.
+     */
+    static get Instance(): WellKnownUserSource;
+    /**
+     * Drops the cached {@link Instance} so the next access re-resolves through the class
+     * factory. Intended for tests that register a source after the cache was populated.
+     */
+    static ResetInstance(): void;
+    /**
+     * True when `user` is the MJ system user — the server's own service account, not a person.
+     *
+     * Synchronous on purpose: this is consumed by permission checks that cannot await. The base
+     * returns false, which is the right answer anywhere no server-side source is registered —
+     * a browser has no system account, so no user it holds can be one.
+     *
+     * Implementations must be null/undefined-safe so callers can pass an optional user directly.
+     */
+    IsSystemUser(user: UserInfo | null | undefined): boolean;
+    /**
+     * The MJ system user for the given provider's connection, with `UserRoles` populated, or
+     * null when this process has no such identity to offer.
+     *
+     * Implementations MUST NOT throw — a missing user row, an unconfigured provider, or a
+     * failed lookup all resolve to null so callers can degrade rather than crash. Callers MUST
+     * treat null as "no elevated identity available" and fall back to their existing behavior.
+     *
+     * @param provider The provider whose connection the user is being resolved for. Passed
+     *   explicitly (rather than read from a global) so a process holding several connections
+     *   resolves the account belonging to the one actually in use.
+     */
+    GetSystemUser(provider: IMetadataProvider): Promise<UserInfo | null>;
+}
+//# sourceMappingURL=wellKnownUserSource.d.ts.map

package/dist/generic/wellKnownUserSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wellKnownUserSource.d.ts","sourceRoot":"","sources":["../../src/generic/wellKnownUserSource.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,mBAAmB;IAC5B,OAAO,CAAC,MAAM,CAAC,SAAS,CAAoC;IAE5D;;;;;;;;OAQG;IACH,WAAkB,QAAQ,IAAI,mBAAmB,CAOhD;IAED;;;OAGG;WACW,aAAa,IAAI,IAAI;IAInC;;;;;;;;OAQG;IACI,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAI/D;;;;;;;;;;;OAWG;IACU,aAAa,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;CAGpF"}