@objectstack/plugin-approvals 17.0.0-rc.0 → 17.0.0-rc.1

package/src/lifecycle-hooks.ts

@@ -1,201 +0,0 @@
-// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
-
-/**
- * Lifecycle Hooks — node-era record lock (ADR-0019).
- *
- * Approval is now a flow node, so there is no per-object process registry to
- * bind auto-trigger hooks against — a flow decides *when* to open an approval.
- * What remains worth enforcing at the data layer is the **record lock**: while
- * a record has a pending `sys_approval_request`, block edits to it.
- *
- * A single global `beforeUpdate` hook handles every object (the target object
- * of an approval node is only known at flow-run time). For each update it:
- *
- *   1. Skips engine self-writes (status mirror) and `sys_approval_*` bookkeeping.
- *   2. Looks up a pending request for `(object, recordId)`.
- *   3. Reads the lock policy from that request's `node_config_json` snapshot:
- *      - `lockRecord === false` → allow.
- *      - otherwise block, EXCEPT when the only changed field is the configured
- *        `approvalStatusField` (so the status mirror is never blocked) or the
- *        caller is an `admin`.
- *
- * Registered under `packageId: 'plugin-approvals:lock'` so it can be cleanly
- * unbound on plugin stop.
- */
-
-export const APPROVALS_HOOK_PACKAGE = 'plugin-approvals:lock';
-
-interface MinimalEngine {
-  registerHook(event: string, handler: (ctx: any) => any | Promise<any>, options?: {
-    object?: string | string[];
-    priority?: number;
-    packageId?: string;
-  }): void;
-  unregisterHooksByPackage(packageId: string): number;
-  find<T = any>(object: string, args: any, opts?: any): Promise<T[]>;
-}
-
-interface MinimalLogger {
-  debug?: (msg: any, ...rest: any[]) => void;
-  info?: (msg: any, ...rest: any[]) => void;
-  warn?: (msg: any, ...rest: any[]) => void;
-  error?: (msg: any, ...rest: any[]) => void;
-}
-
-function parseJson<T = any>(raw: unknown, fallback: T): T {
-  if (raw == null || raw === '') return fallback;
-  if (typeof raw === 'string') {
-    try { return JSON.parse(raw) as T; } catch { return fallback; }
-  }
-  return raw as T;
-}
-
-/** The pending request gating a record, plus its snapshotted node config. */
-async function pendingRequestFor(
-  engine: MinimalEngine,
-  objectName: string,
-  recordId: string,
-): Promise<any | null> {
-  try {
-    const rows = await engine.find('sys_approval_request', {
-      where: { object_name: objectName, record_id: String(recordId), status: 'pending' },
-      limit: 1,
-    } as any);
-    return Array.isArray(rows) && rows[0] ? rows[0] : null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Bind the global record-lock hook. Caller is responsible for calling
- * {@link unbindAllHooks} first if re-binding.
- */
-export function bindApprovalLockHook(engine: MinimalEngine, logger?: MinimalLogger): void {
-  engine.registerHook('beforeUpdate', async (ctx: any) => {
-    const id = String((ctx?.input?.id ?? '') as string);
-    if (!id) return;
-    const object = (ctx?.object ?? ctx?.objectName) as string | undefined;
-    // No object name (shouldn't happen) or our own bookkeeping objects → skip.
-    if (!object || String(object).startsWith('sys_approval')) return;
-
-    const data = (ctx?.input?.data ?? {}) as Record<string, unknown>;
-    const changedFields = Object.keys(data).filter((k) => k !== 'id' && k !== 'updated_at');
-    if (changedFields.length === 0) return;
-
-    // Allow engine self-writes (status mirror from the approvals service, etc).
-    if ((ctx?.session as any)?.isSystem) return;
-
-    // Allow admin override.
-    const roles = (ctx?.session?.roles ?? []) as string[];
-    if (Array.isArray(roles) && roles.includes('admin')) return;
-
-    const pending = await pendingRequestFor(engine, object, id);
-    if (!pending) return;
-
-    // The run that OPENED this approval may still write its own target record
-    // (#3456). Without this the lock cannot tell "the run that owns this pending
-    // request" from "an unrelated user edit", so a flow that touches the record
-    // between opening the approval and the decision — or a manual `resume` with
-    // no decision — dies on its own `RECORD_LOCKED` and leaves the record locked
-    // behind it.
-    //
-    // Keyed on run identity, NOT on elevation: a `runAs:'user'` run must stay
-    // RLS-scoped, so widening it to `isSystem` would be the wrong tool. The
-    // automation engine stamps `flowRunId` into the server-built ExecutionContext
-    // (never client-supplied, like `isSystem`) and it grants nothing by itself —
-    // the only write it permits is to the one record this very run already holds
-    // a pending request against.
-    //
-    // Read off `provenance`, not `session`: provenance says WHAT produced the
-    // write, and a run can own its writes while resolving no principal at all.
-    // A schedule-triggered run is exactly that — it reaches here with NO
-    // session, and that shape is the one that used to die on its own lock
-    // (#3712).
-    const writerRun = (ctx?.provenance as any)?.flowRunId;
-    if (writerRun && pending.flow_run_id && String(writerRun) === String(pending.flow_run_id)) return;
-
-    const config = parseJson<any>(pending.node_config_json, {});
-    if (config?.lockRecord === false) return;
-
-    // Allow when every changed field is the approval status mirror.
-    const mirror = config?.approvalStatusField;
-    if (typeof mirror === 'string' && mirror && changedFields.every((f) => f === mirror)) return;
-
-    const err: any = new Error('RECORD_LOCKED: record is locked while an approval is in progress');
-    err.code = 'RECORD_LOCKED';
-    err.statusCode = 409;
-    throw err;
-  }, { packageId: APPROVALS_HOOK_PACKAGE, priority: 50 });
-
-  logger?.info?.('[approvals] record-lock hook bound');
-}
-
-/** The self-service out-of-office delegation object (#1322). */
-export const DELEGATION_OBJECT = 'sys_approval_delegation';
-
-/**
- * Self-service write guard for `sys_approval_delegation` (#1322 follow-up).
- *
- * The object is `apiEnabled` CRUD so a user can declare their own out-of-office
- * delegation. But it is a system object: it gets no auto `owner_id` anchor and
- * (with no `sharingModel`) defaults to a `public` sharing model, so an
- * unguarded member could **forge a delegation for someone else**
- * (`delegator_id = victim`) and reroute the victim's individually-routed
- * approvals to themselves. This guard forces a normal user's writes to name
- * themselves as the delegator:
- *
- *   - **system** context (service / seed / import) → bypass;
- *   - **admin** (`roles` includes `'admin'`) → may set `delegator_id` to anyone;
- *   - otherwise `delegator_id` must equal the acting user — an absent delegator
- *     on insert is stamped to the caller, a foreign delegator is rejected.
- *
- * Row-level ownership on update/delete (you can only touch a delegation you
- * created) is already enforced by `member_default`'s wildcard
- * `created_by == current_user.id` RLS; this guard adds the delegator-identity
- * check that RLS alone can't express. Mirrors the ADR-0092 identity write-guard
- * shape and the security plugin's `owner_id` anchor guard, scoped to this one
- * object.
- */
-export function bindDelegationWriteGuard(engine: MinimalEngine, logger?: MinimalLogger): void {
-  const makeGuard = (isInsert: boolean) => async (ctx: any) => {
-    const session = (ctx?.session ?? {}) as any;
-    if (session.isSystem) return;                                    // service / seed / import
-    const roles = (session.roles ?? []) as unknown[];
-    if (Array.isArray(roles) && roles.includes('admin')) return;     // admin may act for anyone
-    const userId = session.userId != null ? String(session.userId) : '';
-    const data = ctx?.input?.data;
-    const rows = Array.isArray(data) ? data : (data && typeof data === 'object' ? [data] : []);
-    const deny = (): never => {
-      const err: any = new Error(
-        'FORBIDDEN: you may only manage out-of-office delegations where you are the delegator'
-        + (userId ? ` ('${userId}')` : ''),
-      );
-      err.code = 'FORBIDDEN';
-      err.statusCode = 403;
-      throw err;
-    };
-    for (const row of rows) {
-      if (!row || typeof row !== 'object' || Array.isArray(row)) continue;
-      const has = Object.prototype.hasOwnProperty.call(row, 'delegator_id');
-      const supplied = has ? String((row as any).delegator_id ?? '') : '';
-      if (isInsert && (!has || supplied === '')) {
-        // Self-service: stamp the caller as delegator when omitted (the schema's
-        // `required` is the fallback if the engine doesn't persist the stamp).
-        if (!userId) deny();
-        (row as any).delegator_id = userId;
-        continue;
-      }
-      // A foreign delegator on insert (forge) or update (relabel/hijack) → deny.
-      if (has && supplied !== userId) deny();
-    }
-  };
-  engine.registerHook('beforeInsert', makeGuard(true), { object: DELEGATION_OBJECT, packageId: APPROVALS_HOOK_PACKAGE, priority: 50 });
-  engine.registerHook('beforeUpdate', makeGuard(false), { object: DELEGATION_OBJECT, packageId: APPROVALS_HOOK_PACKAGE, priority: 50 });
-  logger?.info?.('[approvals] delegation write-guard bound');
-}
-
-/** Unregister every hook the lock module registered. */
-export function unbindAllHooks(engine: MinimalEngine): number {
-  return engine.unregisterHooksByPackage(APPROVALS_HOOK_PACKAGE);
-}

package/src/nav-contribution.test.ts

@@ -1,50 +0,0 @@
-// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
-
-import { describe, it, expect } from 'vitest';
-import { ApprovalsServicePlugin } from './approvals-plugin.js';
-
-/**
- * ADR-0029 K2.b / D7 — the approvals plugin owns sys_approval_request /
- * sys_approval_action and ships their Setup-app menu as a navigation
- * contribution (rather than the entries living statically in the
- * platform-objects Setup shell).
- */
-describe('ApprovalsServicePlugin schema + nav contribution (ADR-0029 K2.b)', () => {
-  it('registers the approval objects and contributes the group_approvals slot', async () => {
-    const registered: any[] = [];
-    const ctx: any = {
-      getService: (name: string) =>
-        name === 'manifest' ? { register: (m: any) => registered.push(m) } : undefined,
-      logger: { info: () => {}, warn: () => {} },
-    };
-
-    const plugin = new ApprovalsServicePlugin({ disableService: true });
-    await plugin.init(ctx);
-
-    expect(registered).toHaveLength(1);
-    const manifest = registered[0];
-
-    // Owns the approval objects (moved out of platform-objects).
-    expect(manifest.objects.map((o: any) => o.name).sort()).toEqual([
-      'sys_approval_action',
-      'sys_approval_approver',
-      'sys_approval_delegation',
-      'sys_approval_request',
-      'sys_approval_token',
-    ]);
-
-    // Contributes its menu into the Setup app's approvals slot.
-    expect(manifest.navigationContributions).toHaveLength(1);
-    const contribution = manifest.navigationContributions[0];
-    expect(contribution).toMatchObject({ app: 'setup', group: 'group_approvals' });
-    expect(contribution.items.map((i: any) => i.objectName).sort()).toEqual([
-      'sys_approval_action',
-      'sys_approval_delegation',
-      'sys_approval_request',
-    ]);
-    // Each entry is gated so the slot stays empty when the plugin is absent.
-    for (const item of contribution.items) {
-      expect(item.requiresObject).toBe(item.objectName);
-    }
-  });
-});

package/src/record-lock-schedule-run.integration.test.ts

@@ -1,206 +0,0 @@
-// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
-
-/**
- * #3703 / #3712 / #3760 — the run that opened a pending approval may write its
- * own locked record.
- *
- * #3703 exempted "the run that opened the pending request" from the approvals
- * record lock, keyed on `flowRunId`. #3712 extended that to the run that
- * resolved no identity — an effective `runAs:'user'` run with no trigger user —
- * by giving it a provenance-only ObjectQL context carrying just the run id.
- *
- * #3760 then closed the fail-open that path depended on: a run with no trigger
- * user may no longer perform a data operation at all, because presenting no
- * principal is precisely what made the write UNSCOPED. So the user-less variant
- * is now REFUSED rather than exempted, and a schedule reaches its own record the
- * explicit way — `runAs:'system'`, which the hook exempts on its own
- * `isSystem` branch. The `flowRunId` exemption remains live and load-bearing for
- * what it was built for: a `runAs:'user'` run that DOES have a user.
- *
- * The original miss was a HAND-OFF gap, not a logic gap: every hop worked in
- * isolation. So this test still refuses to stub any hop. It runs the real
- * `resolveRunDataContext` from the automation runtime, feeds its output to a
- * real {@link ObjectQL} engine, and lets the real lock hook decide — the same
- * three layers, in the same order, as a live deployment.
- */
-
-import { describe, it, expect, beforeEach } from 'vitest';
-import { ObjectQL } from '@objectstack/objectql';
-import { resolveRunDataContext } from '@objectstack/service-automation';
-import { bindApprovalLockHook } from './lifecycle-hooks.js';
-
-const opportunity = {
-  name: 'opportunity',
-  label: 'Opportunity',
-  fields: {
-    id: { name: 'id', type: 'text' as const, primaryKey: true },
-    name: { name: 'name', type: 'text' as const },
-    amount: { name: 'amount', type: 'number' as const },
-  },
-};
-
-/** The lock hook reads pending requests off this object. */
-const approvalRequest = {
-  name: 'sys_approval_request',
-  label: 'Approval Request',
-  fields: {
-    id: { name: 'id', type: 'text' as const, primaryKey: true },
-    object_name: { name: 'object_name', type: 'text' as const },
-    record_id: { name: 'record_id', type: 'text' as const },
-    status: { name: 'status', type: 'text' as const },
-    flow_run_id: { name: 'flow_run_id', type: 'text' as const },
-    node_config_json: { name: 'node_config_json', type: 'text' as const },
-  },
-};
-
-function makeMemoryDriver() {
-  const stores = new Map<string, Map<string, Record<string, unknown>>>();
-  const storeFor = (o: string) => {
-    let s = stores.get(o);
-    if (!s) { s = new Map(); stores.set(o, s); }
-    return s;
-  };
-  let nextId = 0;
-  const matches = (row: Record<string, unknown>, where: any): boolean => {
-    if (!where || typeof where !== 'object') return true;
-    for (const [k, v] of Object.entries(where)) {
-      if (k.startsWith('$')) continue;
-      const exp = (v && typeof v === 'object' && '$eq' in (v as any)) ? (v as any).$eq : v;
-      if ((row[k] ?? null) !== (exp ?? null)) return false;
-    }
-    return true;
-  };
-  const driver: any = {
-    name: 'memory', version: '0.0.0', supports: {},
-    async connect() {}, async disconnect() {}, async checkHealth() { return true; }, async execute() { return null; },
-    async find(o: string, ast: any) { return Array.from(storeFor(o).values()).filter((r) => matches(r, ast?.where)); },
-    findStream() { throw new Error('ns'); },
-    async findOne(o: string, ast: any) { for (const r of storeFor(o).values()) if (matches(r, ast?.where)) return r; return null; },
-    async create(o: string, data: Record<string, unknown>) {
-      nextId += 1;
-      const id = (data.id as string) ?? `r_${nextId}`;
-      const row = { ...data, id };
-      storeFor(o).set(id, row);
-      return row;
-    },
-    async update(o: string, id: string, data: Record<string, unknown>) {
-      const s = storeFor(o);
-      const cur = s.get(id);
-      if (!cur) throw new Error(`nf ${o}/${id}`);
-      const up = { ...cur, ...data, id };
-      s.set(id, up);
-      return up;
-    },
-    async upsert(o: string, data: Record<string, unknown>) {
-      const id = data.id as string | undefined;
-      return id && storeFor(o).has(id) ? this.update(o, id, data) : this.create(o, data);
-    },
-    async delete(o: string, id: string) { return storeFor(o).delete(id); },
-    async count(o: string, ast: any) { return (await this.find(o, ast)).length; },
-    async bulkCreate(o: string, rows: Record<string, unknown>[]) { return Promise.all(rows.map((r) => this.create(o, r))); },
-    async bulkUpdate() { return []; },
-    async bulkDelete() {},
-    async beginTransaction() { return { commit: async () => {}, rollback: async () => {} }; },
-    async commit() {}, async rollback() {},
-  };
-  return driver;
-}
-
-/**
- * A `runAs:'user'` run that HAS a trigger user — the live consumer of the
- * `flowRunId` exemption, and the shape #3703 built it for (a record-change or
- * screen flow that opened the approval and now writes its own target record).
- */
-const OWNING_RUN = (flowRunId: string) => ({ runAs: 'user' as const, userId: 'u1', flowRunId });
-
-/** What a schedule trigger produces: an event, and NO user. Refused since #3760. */
-const USER_LESS_RUN = (flowRunId: string) => ({ runAs: 'user' as const, flowRunId });
-
-/** The supported shape for a schedule that must write records (ADR-0049). */
-const SYSTEM_RUN = (flowRunId: string) => ({ runAs: 'system' as const, flowRunId });
-
-describe('an owning run and the approvals record lock (#3703 / #3712 / #3760)', () => {
-  let engine: ObjectQL;
-  let oppId: string;
-
-  beforeEach(async () => {
-    engine = new ObjectQL();
-    engine.registerDriver(makeMemoryDriver(), true);
-    await engine.init();
-    for (const o of [opportunity, approvalRequest]) engine.registry.registerObject(o as any);
-
-    const opp = await engine.insert('opportunity', { name: 'Deal', amount: 100 });
-    oppId = String(opp.id);
-    await engine.insert('sys_approval_request', {
-      object_name: 'opportunity',
-      record_id: oppId,
-      status: 'pending',
-      flow_run_id: 'run_1',
-      node_config_json: JSON.stringify({ lockRecord: true }),
-    });
-
-    bindApprovalLockHook(engine as any);
-  });
-
-  const writeAs = (context: unknown) =>
-    engine.update('opportunity', { id: oppId, amount: 200 }, { context } as any);
-
-  it('lets the OWNING run write its own target record', async () => {
-    // The full hand-off, unstubbed: the automation runtime resolves the run's
-    // ObjectQL context, the engine turns it into hook provenance, the lock hook
-    // matches it against the pending request it opened.
-    const dataCtx = resolveRunDataContext(OWNING_RUN('run_1'));
-    expect(dataCtx, 'nothing could carry the run id').toMatchObject({ flowRunId: 'run_1' });
-
-    await expect(writeAs(dataCtx)).resolves.toBeDefined();
-    const row = await engine.findOne('opportunity', { where: { id: oppId } });
-    expect(row.amount).toBe(200);
-  });
-
-  it('still blocks a DIFFERENT run', async () => {
-    await expect(writeAs(resolveRunDataContext(OWNING_RUN('run_other'))))
-      .rejects.toThrow(/RECORD_LOCKED/);
-  });
-
-  it('still blocks an ordinary user edit', async () => {
-    await expect(writeAs({ isSystem: false, userId: 'u1', positions: [], permissions: [] }))
-      .rejects.toThrow(/RECORD_LOCKED/);
-  });
-
-  it('still blocks a context-less write', async () => {
-    await expect(writeAs(undefined)).rejects.toThrow(/RECORD_LOCKED/);
-  });
-
-  it('the exemption is PROVENANCE, not privilege — the exempted write is not elevated', async () => {
-    // The exemption must not have been bought with elevation: the run that
-    // writes its own locked record is still a plain `runAs:'user'` principal,
-    // subject to the same RLS as the user who triggered it. Only `flowRunId`
-    // distinguishes it, and `flowRunId` grants nothing on its own.
-    const dataCtx = resolveRunDataContext(OWNING_RUN('run_1')) as Record<string, unknown>;
-    expect(dataCtx.isSystem, 'the exemption rode in on isSystem').toBe(false);
-    expect(dataCtx.flowRunId).toBe('run_1');
-    expect(dataCtx.userId).toBe('u1');
-  });
-
-  // #3760 — the case #3712 solved by handing the lock a provenance-only context
-  // is gone at the root: such a run may not perform a data operation at all,
-  // because presenting no principal is exactly what made the write unscoped. It
-  // is refused BEFORE the lock is ever consulted.
-  it('a USER-LESS run never reaches the lock — it cannot perform a data op at all', async () => {
-    expect(() => resolveRunDataContext(USER_LESS_RUN('run_1')))
-      .toThrow(/no trigger user could be resolved/);
-  });
-
-  // ...and the capability itself survives, via the explicit route: a schedule
-  // that must write records declares `runAs:'system'`, which the lock hook
-  // exempts on its own isSystem branch. Elevation is now declared rather than
-  // acquired by having no identity.
-  it("a schedule that declares runAs:'system' still writes its own target record", async () => {
-    const dataCtx = resolveRunDataContext(SYSTEM_RUN('run_1'));
-    expect(dataCtx).toMatchObject({ isSystem: true, flowRunId: 'run_1' });
-
-    await expect(writeAs(dataCtx)).resolves.toBeDefined();
-    const row = await engine.findOne('opportunity', { where: { id: oppId } });
-    expect(row.amount).toBe(200);
-  });
-});

package/src/status-mirror-cascade.integration.test.ts

@@ -1,224 +0,0 @@
-// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
-
-/**
- * #3783 — an approval decision cascades as the deciding user.
- *
- * "When the invoice is approved, do X" is the single most natural approvals
- * automation there is, and until now it could not be written the obvious way.
- * The status mirror — the write that puts `approved` on the business record, and
- * therefore the write that fires that object's record-change flows — presented a
- * bare `{ isSystem: true }` context with no `userId`. `isSystem` does not
- * suppress trigger dispatch, so the flow DID fire; it just fired with no trigger
- * user, and since #3760 a `runAs:'user'` run with no trigger user has its data
- * operations refused. Authors were pushed to declare `runAs:'system'` — blanket
- * elevation — for a case where a perfectly good scoped identity existed all
- * along, sitting right there at the call site.
- *
- * The seam is invisible in a unit test of any single hop, so this one refuses to
- * stub any of them: a real {@link ObjectKernel} with the real ObjectQL engine,
- * the real record-change trigger, the real automation engine, and the real
- * {@link ApprovalService}. The mirror is produced by an actual decision, not
- * hand-written.
- *
- * The negative case is load-bearing, not decoration. It fires the SAME flow off
- * the dead-run sweep's mirror, which has no human behind it and stays user-less
- * on purpose — and shows it is still refused. Without it, the positive case
- * would prove only that the flow runs, never that it runs *because* the identity
- * arrived.
- *
- * The record lock is deliberately not bound here: it is a separate concern with
- * its own end-to-end coverage (`record-lock-schedule-run.integration.test.ts`).
- */
-
-import { describe, it, expect, beforeEach } from 'vitest';
-import { ObjectKernel } from '@objectstack/core';
-import { ObjectQLPlugin } from '@objectstack/objectql';
-import { AutomationServicePlugin, type AutomationEngine } from '@objectstack/service-automation';
-import { RecordChangeTriggerPlugin } from '@objectstack/trigger-record-change';
-import { ApprovalService } from './approval-service.js';
-import { SysApprovalRequest } from './sys-approval-request.object.js';
-import { SysApprovalAction } from './sys-approval-action.object.js';
-import { SysApprovalApprover } from './sys-approval-approver.object.js';
-
-const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
-
-const SUBMITTER = { userId: 'submitter', positions: [], permissions: [] } as any;
-const APPROVER = { userId: 'approver', positions: [], permissions: [] } as any;
-
-/** Equality-WHERE in-memory driver — the same shape the trigger's own e2e uses. */
-function makeMemoryDriver(): any {
-  const stores = new Map<string, Map<string, Record<string, unknown>>>();
-  const storeFor = (obj: string) => {
-    let s = stores.get(obj);
-    if (!s) { s = new Map(); stores.set(obj, s); }
-    return s;
-  };
-  let nextId = 0;
-  const matches = (row: Record<string, unknown>, where: any): boolean => {
-    if (!where || typeof where !== 'object') return true;
-    if (Array.isArray(where.$and)) return where.$and.every((w: any) => matches(row, w));
-    if (Array.isArray(where.$or)) return where.$or.some((w: any) => matches(row, w));
-    for (const [k, v] of Object.entries(where)) {
-      if (k.startsWith('$')) continue;
-      const expected = v && typeof v === 'object' && '$eq' in (v as any) ? (v as any).$eq : v;
-      const a = row[k] === undefined ? null : row[k];
-      const b = expected === undefined ? null : expected;
-      if (a !== b) return false;
-    }
-    return true;
-  };
-  return {
-    name: 'memory', version: '0.0.0', supports: {},
-    async connect() {}, async disconnect() {}, async checkHealth() { return true; },
-    async execute() { return null; }, async syncSchema() {},
-    async find(object: string, ast: any) {
-      return Array.from(storeFor(object).values()).filter((r) => matches(r, ast?.where));
-    },
-    findStream() { throw new Error('not implemented'); },
-    async findOne(object: string, ast: any) {
-      for (const r of storeFor(object).values()) if (matches(r, ast?.where)) return r;
-      return null;
-    },
-    async create(object: string, data: Record<string, unknown>) {
-      nextId += 1;
-      const id = (data.id as string) ?? `r_${nextId}`;
-      const row = { ...data, id };
-      storeFor(object).set(id, row);
-      return row;
-    },
-    async update(object: string, id: string, data: Record<string, unknown>) {
-      const s = storeFor(object);
-      const cur = s.get(id);
-      if (!cur) throw new Error(`not found: ${object}/${id}`);
-      const updated = { ...cur, ...data, id };
-      s.set(id, updated);
-      return updated;
-    },
-    async upsert(object: string, data: Record<string, unknown>) {
-      const id = data.id as string | undefined;
-      if (id && storeFor(object).has(id)) return this.update(object, id, data);
-      return this.create(object, data);
-    },
-    async delete(object: string, id: string) { return storeFor(object).delete(id); },
-    async count(object: string, ast: any) { return (await this.find(object, ast)).length; },
-    async bulkCreate(object: string, rows: Record<string, unknown>[]) {
-      return Promise.all(rows.map((r) => this.create(object, r)));
-    },
-    async bulkUpdate() { return []; }, async bulkDelete() {},
-    async beginTransaction() { return { commit: async () => {}, rollback: async () => {} }; },
-    async commit() {}, async rollback() {},
-  };
-}
-
-const opportunity = {
-  name: 'opportunity',
-  label: 'Opportunity',
-  fields: {
-    amount: { name: 'amount', label: 'Amount', type: 'number' },
-    approval_status: { name: 'approval_status', label: 'Approval Status', type: 'text' },
-    cascaded: { name: 'cascaded', label: 'Cascaded', type: 'text' },
-  },
-};
-
-/**
- * The automation an author actually wants to write: react to the approval, no
- * `runAs` — the spec default `'user'`. That default is the whole point; a flow
- * forced to say `runAs:'system'` to work at all is the bug being fixed.
- */
-const onApprovedFlow = {
-  name: 'on_approved',
-  label: 'On Approved',
-  type: 'record_change',
-  nodes: [
-    {
-      id: 'start', type: 'start', label: 'Start',
-      config: {
-        objectName: 'opportunity',
-        triggerType: 'record-after-update',
-        // Fires on BOTH terminal mirrors, so the two cases below differ only in
-        // whether the mirror that fired it carried a user — nothing else.
-        condition: "approval_status == 'approved' || approval_status == 'recalled'",
-      },
-    },
-    {
-      id: 'stamp', type: 'update_record', label: 'Stamp',
-      config: { objectName: 'opportunity', filter: { id: '{record.id}' }, fields: { cascaded: 'yes' } },
-    },
-    { id: 'end', type: 'end', label: 'End' },
-  ],
-  edges: [
-    { id: 'e1', source: 'start', target: 'stamp' },
-    { id: 'e2', source: 'stamp', target: 'end' },
-  ],
-};
-
-const nodeConfig = {
-  approvers: [{ type: 'user' as const, value: 'approver' }],
-  behavior: 'first_response' as const,
-  lockRecord: false,
-  approvalStatusField: 'approval_status',
-};
-
-describe('an approval decision cascades as the deciding user (#3783)', () => {
-  let data: any;
-  let svc: ApprovalService;
-
-  beforeEach(async () => {
-    const kernel = new ObjectKernel({ logLevel: 'silent' });
-    await kernel.use(new ObjectQLPlugin());
-    await kernel.use(new AutomationServicePlugin());
-    await kernel.use(new RecordChangeTriggerPlugin());
-    await kernel.bootstrap();
-
-    const objectql = kernel.getService('objectql') as any;
-    data = kernel.getService('data') as any;
-    const automation = kernel.getService<AutomationEngine>('automation');
-
-    objectql.registerDriver(makeMemoryDriver(), true);
-    for (const def of [opportunity, SysApprovalRequest, SysApprovalAction, SysApprovalApprover]) {
-      objectql.registry.registerObject(def as any, 'approvals-test', 'approvals-test');
-    }
-    automation.registerFlow('on_approved', onApprovedFlow as any);
-
-    svc = new ApprovalService({ engine: objectql });
-    await data.insert('opportunity', { id: 'opp1', amount: 100 }, { context: { isSystem: true } });
-  });
-
-  const readBack = () => data.findOne('opportunity', { where: { id: 'opp1' } });
-
-  const openRequest = () => svc.openNodeRequest({
-    object: 'opportunity', recordId: 'opp1', runId: 'run_1', nodeId: 'approve_step',
-    flowName: 'deal_approval', config: nodeConfig, submitterId: 'submitter',
-    record: { id: 'opp1', amount: 100 },
-  }, SUBMITTER);
-
-  it('the approve mirror hands the flow a trigger user, so its data node runs', async () => {
-    const req = await openRequest();
-    await svc.decide(req.id as string, { decision: 'approve', actorId: 'approver' }, APPROVER);
-    await sleep(300);
-
-    const row = await readBack();
-    expect(row?.approval_status, 'the mirror itself must still land').toBe('approved');
-    // Before #3783 this stayed undefined: the run inherited no trigger user, so
-    // `resolveRunDataContext` refused its `update_record` outright.
-    expect(row?.cascaded).toBe('yes');
-    // ObjectQL's audit stamp is gated on the write context's `userId` alone —
-    // `isSystem` buys no exemption — so this is direct evidence the elevated
-    // mirror named a user rather than nobody.
-    expect(row?.updated_by).toBe('approver');
-  });
-
-  it('a dead-run release cascades user-less, and is still refused', async () => {
-    await openRequest();
-    svc.attachAutomation({ getRun: async () => ({ status: 'failed' }) } as any);
-    await svc.releaseDeadRunRequests();
-    await sleep(300);
-
-    const row = await readBack();
-    expect(row?.approval_status, 'the sweep must still release the record').toBe('recalled');
-    // No human abandoned this request — a sweep did. The cascade therefore has
-    // no identity to inherit and stays refused; an author who wants to react to
-    // a dead-run release declares `runAs:'system'` and means it.
-    expect(row?.cascaded).toBeFalsy();
-  });
-});