@party-stack/foundry-ontology 0.19.0 → 0.20.0

package/lib/platform.d.ts

@@ -0,0 +1,78 @@
+import { ConnectionEgress } from "@party-stack/connect";
+import { Effect } from "effect";
+import { Infer } from "@party-stack/ontology-spec";
+//#region src/platform.d.ts
+/** Account-visible inventory, separate from one selected ontology's type metadata. */
+export declare const foundryPlatformOntology: {
+  types: never[];
+  context: {
+    type: {
+      kind: "struct";
+      value: {
+        fields: {
+          name: "userId";
+          displayName: "User ID";
+          type: {
+            kind: "string";
+            value: {};
+          };
+        }[];
+      };
+    };
+    partition: string[][];
+  };
+  objectTypes: {
+    name: "Ontology";
+    displayName: "Ontology";
+    pluralDisplayName: "Ontologies";
+    primaryKey: "id";
+    title: "displayName";
+    properties: ({
+      name: "id";
+      displayName: "ID";
+      type: {
+        kind: "string";
+        value: {};
+      };
+    } | {
+      name: "rid";
+      displayName: "RID";
+      type: {
+        kind: "string";
+        value: {};
+      };
+    } | {
+      name: "apiName";
+      displayName: "API name";
+      type: {
+        kind: "string";
+        value: {};
+      };
+    } | {
+      name: "displayName";
+      displayName: "Name";
+      type: {
+        kind: "string";
+        value: {};
+      };
+    } | {
+      name: "description";
+      displayName: "Description";
+      type: {
+        kind: "string";
+        value: {};
+      };
+    })[];
+  }[];
+  linkTypes: never[];
+  actionTypes: never[];
+  queryFunctionTypes: never[];
+};
+export type FoundryPlatformOntology = Infer<typeof foundryPlatformOntology>;
+/** Uses the selected account's authenticated egress; it stores no credentials or rows. */
+export declare const makeFoundryPlatformBackend: (options: {
+  readonly baseUrl: string;
+  readonly egress: ConnectionEgress;
+}) => Effect.Effect<import("@party-stack/ontology-backend").OntologyBackendService, never, import("effect/Scope").Scope>;
+//#endregion
+//# sourceMappingURL=platform.d.ts.map

package/lib/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","names":[],"sources":["../src/platform.ts"],"mappings":";;;;;qBAaa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAwBD,0BAA0B,aAAa;;qBAuBtC,6BAA0B;WACjB;WACD,QAAA;MA8CnB,OAAA,+CAAA,sDAAA"}

package/lib/platform.js

@@ -0,0 +1,116 @@
+import { foundryContext } from "./context.js";
+import { toWebEgress } from "@party-stack/connect";
+import { createClient } from "@party-stack/foundry-client";
+import { Effect, Redacted, Schema } from "effect";
+import { OntologiesV2 } from "@osdk/foundry.ontologies";
+import { BackendError, classifyBackendFailure, makeOntologyBackend } from "@party-stack/ontology-backend";
+import { defineOntology, o } from "@party-stack/ontology-spec";
+import { compileObjectSubset, objectSubset } from "@party-stack/ontology-backend/subset";
+//#region src/platform.ts
+/** Account-visible inventory, separate from one selected ontology's type metadata. */
+const foundryPlatformOntology = defineOntology({
+	types: [],
+	context: foundryContext,
+	objectTypes: [{
+		name: "Ontology",
+		displayName: "Ontology",
+		pluralDisplayName: "Ontologies",
+		primaryKey: "id",
+		title: "displayName",
+		properties: [
+			{
+				name: "id",
+				displayName: "ID",
+				type: o.string({})
+			},
+			{
+				name: "rid",
+				displayName: "RID",
+				type: o.string({})
+			},
+			{
+				name: "apiName",
+				displayName: "API name",
+				type: o.string({})
+			},
+			{
+				name: "displayName",
+				displayName: "Name",
+				type: o.string({})
+			},
+			{
+				name: "description",
+				displayName: "Description",
+				type: o.string({})
+			}
+		]
+	}],
+	linkTypes: [],
+	actionTypes: [],
+	queryFunctionTypes: []
+});
+const inventory = Schema.Struct({ data: Schema.Array(Schema.Struct({
+	rid: Schema.NonEmptyString,
+	apiName: Schema.NonEmptyString,
+	displayName: Schema.String,
+	description: Schema.String
+})) });
+const unsupported = (operation) => Effect.fail(new BackendError({
+	operation,
+	kind: "NotImplemented",
+	retryable: false,
+	message: "Foundry platform inventory is read-only."
+}));
+/** Uses the selected account's authenticated egress; it stores no credentials or rows. */
+const makeFoundryPlatformBackend = Effect.fnUntraced(function* (options) {
+	const web = yield* toWebEgress(options.egress);
+	const client = createClient({
+		baseUrl: options.baseUrl,
+		fetch: web.fetch
+	});
+	return makeOntologyBackend({
+		ir: foundryPlatformOntology,
+		name: "foundry-platform",
+		sourceId: `foundry-platform:${client.baseUrl}`,
+		supportsIdempotency: false,
+		refresh: () => ({ pollIntervalMs: false }),
+		applyAction: () => unsupported("foundry.platform.applyAction"),
+		queryFunction: () => unsupported("foundry.platform.queryFunction"),
+		loadSubset: Effect.fn("FoundryPlatform.loadSubset")(function* (request) {
+			yield* compileObjectSubset(foundryPlatformOntology, request);
+			const response = yield* Effect.tryPromise({
+				try: (signal) => OntologiesV2.list({
+					...client,
+					fetch: (input, init) => client.fetch(input, {
+						...init,
+						signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal
+					})
+				}),
+				catch: (cause) => classifyBackendFailure("foundry.platform.listOntologies", cause)
+			});
+			const { data: values } = yield* Schema.decodeUnknownEffect(inventory)(response).pipe(Effect.mapError((cause) => new BackendError({
+				operation: "foundry.platform.decode",
+				kind: "InvalidResponse",
+				retryable: false,
+				message: "Foundry returned invalid ontology inventory.",
+				cause: Redacted.make(cause)
+			})));
+			return {
+				rows: values.map((value) => ({
+					key: value.rid,
+					value: {
+						id: value.rid,
+						...value
+					}
+				})),
+				complete: true,
+				fulfilledSubset: objectSubset("Ontology"),
+				fetchedRows: values.length
+			};
+		})
+	});
+});
+//#endregion
+export { foundryPlatformOntology, makeFoundryPlatformBackend };
+
+//# sourceMappingURL=platform.js.map

package/lib/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","names":[],"sources":["../src/platform.ts"],"sourcesContent":["import { OntologiesV2 } from \"@osdk/foundry.ontologies\";\nimport { toWebEgress } from \"@party-stack/connect\";\nimport { createClient } from \"@party-stack/foundry-client\";\nimport { BackendError, classifyBackendFailure, makeOntologyBackend } from \"@party-stack/ontology-backend\";\nimport { compileObjectSubset, objectSubset } from \"@party-stack/ontology-backend/subset\";\nimport { defineOntology, o } from \"@party-stack/ontology-spec\";\nimport { Effect, Redacted, Schema } from \"effect\";\nimport { foundryContext } from \"./context.js\";\nimport type { ConnectionEgress } from \"@party-stack/connect\";\nimport type { Infer } from \"@party-stack/ontology-spec\";\nimport type { ObjectSubset } from \"@party-stack/ontology-spec/query\";\n\n/** Account-visible inventory, separate from one selected ontology's type metadata. */\nexport const foundryPlatformOntology = defineOntology({\n    types: [],\n    context: foundryContext,\n    objectTypes: [\n        {\n            name: \"Ontology\",\n            displayName: \"Ontology\",\n            pluralDisplayName: \"Ontologies\",\n            primaryKey: \"id\",\n            title: \"displayName\",\n            properties: [\n                { name: \"id\", displayName: \"ID\", type: o.string({}) },\n                { name: \"rid\", displayName: \"RID\", type: o.string({}) },\n                { name: \"apiName\", displayName: \"API name\", type: o.string({}) },\n                { name: \"displayName\", displayName: \"Name\", type: o.string({}) },\n                { name: \"description\", displayName: \"Description\", type: o.string({}) },\n            ],\n        },\n    ],\n    linkTypes: [],\n    actionTypes: [],\n    queryFunctionTypes: [],\n});\n\nexport type FoundryPlatformOntology = Infer<typeof foundryPlatformOntology>;\n\nconst inventory = Schema.Struct({\n    data: Schema.Array(\n        Schema.Struct({\n            rid: Schema.NonEmptyString,\n            apiName: Schema.NonEmptyString,\n            displayName: Schema.String,\n            description: Schema.String,\n        })\n    ),\n});\nconst unsupported = (operation: string) =>\n    Effect.fail(\n        new BackendError({\n            operation,\n            kind: \"NotImplemented\",\n            retryable: false,\n            message: \"Foundry platform inventory is read-only.\",\n        })\n    );\n\n/** Uses the selected account's authenticated egress; it stores no credentials or rows. */\nexport const makeFoundryPlatformBackend = Effect.fnUntraced(function* (options: {\n    readonly baseUrl: string;\n    readonly egress: ConnectionEgress;\n}) {\n    const web = yield* toWebEgress(options.egress);\n    const client = createClient({ baseUrl: options.baseUrl, fetch: web.fetch });\n    return makeOntologyBackend({\n        ir: foundryPlatformOntology,\n        name: \"foundry-platform\",\n        sourceId: `foundry-platform:${client.baseUrl}`,\n        supportsIdempotency: false,\n        refresh: () => ({ pollIntervalMs: false }),\n        applyAction: () => unsupported(\"foundry.platform.applyAction\"),\n        queryFunction: () => unsupported(\"foundry.platform.queryFunction\"),\n        loadSubset: Effect.fn(\"FoundryPlatform.loadSubset\")(function* (request: ObjectSubset) {\n            yield* compileObjectSubset(foundryPlatformOntology, request);\n            const response = yield* Effect.tryPromise({\n                try: (signal) =>\n                    OntologiesV2.list({\n                        ...client,\n                        fetch: (input, init) =>\n                            client.fetch(input, {\n                                ...init,\n                                signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal,\n                            }),\n                    }),\n                catch: (cause) => classifyBackendFailure(\"foundry.platform.listOntologies\", cause),\n            });\n            const { data: values } = yield* Schema.decodeUnknownEffect(inventory)(response).pipe(\n                Effect.mapError(\n                    (cause) =>\n                        new BackendError({\n                            operation: \"foundry.platform.decode\",\n                            kind: \"InvalidResponse\",\n                            retryable: false,\n                            message: \"Foundry returned invalid ontology inventory.\",\n                            cause: Redacted.make(cause),\n                        })\n                )\n            );\n            return {\n                rows: values.map((value) => ({ key: value.rid, value: { id: value.rid, ...value } })),\n                complete: true,\n                fulfilledSubset: objectSubset(\"Ontology\"),\n                fetchedRows: values.length,\n            };\n        }),\n    });\n});\n"],"mappings":";;;;;;;;;;AAaA,MAAa,0BAA0B,eAAe;CAClD,OAAO,CAAC;CACR,SAAS;CACT,aAAa,CACT;EACI,MAAM;EACN,aAAa;EACb,mBAAmB;EACnB,YAAY;EACZ,OAAO;EACP,YAAY;GACR;IAAE,MAAM;IAAM,aAAa;IAAM,MAAM,EAAE,OAAO,CAAC,CAAC;GAAE;GACpD;IAAE,MAAM;IAAO,aAAa;IAAO,MAAM,EAAE,OAAO,CAAC,CAAC;GAAE;GACtD;IAAE,MAAM;IAAW,aAAa;IAAY,MAAM,EAAE,OAAO,CAAC,CAAC;GAAE;GAC/D;IAAE,MAAM;IAAe,aAAa;IAAQ,MAAM,EAAE,OAAO,CAAC,CAAC;GAAE;GAC/D;IAAE,MAAM;IAAe,aAAa;IAAe,MAAM,EAAE,OAAO,CAAC,CAAC;GAAE;EAC1E;CACJ,CACJ;CACA,WAAW,CAAC;CACZ,aAAa,CAAC;CACd,oBAAoB,CAAC;AACzB,CAAC;AAID,MAAM,YAAY,OAAO,OAAO,EAC5B,MAAM,OAAO,MACT,OAAO,OAAO;CACV,KAAK,OAAO;CACZ,SAAS,OAAO;CAChB,aAAa,OAAO;CACpB,aAAa,OAAO;AACxB,CAAC,CACL,EACJ,CAAC;AACD,MAAM,eAAe,cACjB,OAAO,KACH,IAAI,aAAa;CACb;CACA,MAAM;CACN,WAAW;CACX,SAAS;AACb,CAAC,CACL;;AAGJ,MAAa,6BAA6B,OAAO,WAAW,WAAW,SAGpE;CACC,MAAM,MAAM,OAAO,YAAY,QAAQ,MAAM;CAC7C,MAAM,SAAS,aAAa;EAAE,SAAS,QAAQ;EAAS,OAAO,IAAI;CAAM,CAAC;CAC1E,OAAO,oBAAoB;EACvB,IAAI;EACJ,MAAM;EACN,UAAU,oBAAoB,OAAO;EACrC,qBAAqB;EACrB,gBAAgB,EAAE,gBAAgB,MAAM;EACxC,mBAAmB,YAAY,8BAA8B;EAC7D,qBAAqB,YAAY,gCAAgC;EACjE,YAAY,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,SAAuB;GAClF,OAAO,oBAAoB,yBAAyB,OAAO;GAC3D,MAAM,WAAW,OAAO,OAAO,WAAW;IACtC,MAAM,WACF,aAAa,KAAK;KACd,GAAG;KACH,QAAQ,OAAO,SACX,OAAO,MAAM,OAAO;MAChB,GAAG;MACH,QAAQ,MAAM,SAAS,YAAY,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI;KACpE,CAAC;IACT,CAAC;IACL,QAAQ,UAAU,uBAAuB,mCAAmC,KAAK;GACrF,CAAC;GACD,MAAM,EAAE,MAAM,WAAW,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC5E,OAAO,UACF,UACG,IAAI,aAAa;IACb,WAAW;IACX,MAAM;IACN,WAAW;IACX,SAAS;IACT,OAAO,SAAS,KAAK,KAAK;GAC9B,CAAC,CACT,CACJ;GACA,OAAO;IACH,MAAM,OAAO,KAAK,WAAW;KAAE,KAAK,MAAM;KAAK,OAAO;MAAE,IAAI,MAAM;MAAK,GAAG;KAAM;IAAE,EAAE;IACpF,UAAU;IACV,iBAAiB,aAAa,UAAU;IACxC,aAAa,OAAO;GACxB;EACJ,CAAC;CACL,CAAC;AACL,CAAC"}

package/lib/platformCollections.d.ts

@@ -0,0 +1,68 @@
+//#region src/platformCollections.d.ts
+export declare const foundryPlatformObjects: import("@party-stack/ontology").OntologyCollectionDescriptors<import("@party-stack/ontology-spec").InferOntology<{
+  types: never[];
+  context: {
+    type: {
+      kind: "struct";
+      value: {
+        fields: {
+          name: "userId";
+          displayName: "User ID";
+          type: {
+            kind: "string";
+            value: {};
+          };
+        }[];
+      };
+    };
+    partition: string[][];
+  };
+  objectTypes: {
+    name: "Ontology";
+    displayName: "Ontology";
+    pluralDisplayName: "Ontologies";
+    primaryKey: "id";
+    title: "displayName";
+    properties: ({
+      name: "id";
+      displayName: "ID";
+      type: {
+        kind: "string";
+        value: {};
+      };
+    } | {
+      name: "rid";
+      displayName: "RID";
+      type: {
+        kind: "string";
+        value: {};
+      };
+    } | {
+      name: "apiName";
+      displayName: "API name";
+      type: {
+        kind: "string";
+        value: {};
+      };
+    } | {
+      name: "displayName";
+      displayName: "Name";
+      type: {
+        kind: "string";
+        value: {};
+      };
+    } | {
+      name: "description";
+      displayName: "Description";
+      type: {
+        kind: "string";
+        value: {};
+      };
+    })[];
+  }[];
+  linkTypes: never[];
+  actionTypes: never[];
+  queryFunctionTypes: never[];
+}>, Record<never, never>>;
+//#endregion
+//# sourceMappingURL=platformCollections.d.ts.map

package/lib/platformCollections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platformCollections.d.ts","names":[],"sources":["../src/platformCollections.ts"],"mappings":";qBAGwB,wDAAsB,mEAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAE5C"}

package/lib/platformCollections.js

@@ -0,0 +1,7 @@
+import { ontologyCollections } from "@party-stack/ontology";
+//#region src/platformCollections.ts
+const { objects: foundryPlatformObjects } = ontologyCollections({ Ontology: "id" });
+//#endregion
+export { foundryPlatformObjects };
+
+//# sourceMappingURL=platformCollections.js.map

package/lib/platformCollections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platformCollections.js","names":[],"sources":["../src/platformCollections.ts"],"sourcesContent":["import { ontologyCollections } from \"@party-stack/ontology\";\nimport type { FoundryPlatformOntology } from \"./platform.js\";\n\nexport const { objects: foundryPlatformObjects } = ontologyCollections<FoundryPlatformOntology>({\n    Ontology: \"id\",\n});\n"],"mappings":";;AAGA,MAAa,EAAE,SAAS,2BAA2B,oBAA6C,EAC5F,UAAU,KACd,CAAC"}

package/lib/serviceConnector.d.ts

@@ -0,0 +1,8 @@
+import { ServiceConnector } from "@party-stack/connect";
+//#region src/serviceConnector.d.ts
+/** Reusable integration; the saved ServiceInstance supplies the Foundry stack URL. */
+export declare function makeFoundryServiceConnector(options?: {
+  readonly fetch?: typeof globalThis.fetch;
+}): ServiceConnector;
+//#endregion
+//# sourceMappingURL=serviceConnector.d.ts.map

package/lib/serviceConnector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceConnector.d.ts","names":[],"sources":["../src/serviceConnector.ts"],"mappings":";;;wBAagB,4BACZ;WACa,eAAe,WAAW;IAExC"}

package/lib/serviceConnector.js

@@ -0,0 +1,105 @@
+import { ConnectError, makeOAuthService, toWebEgress, withHttpAuthenticationErrors } from "@party-stack/connect";
+import { createFoundryFetch, createFoundryWebSocket, getTokenDetails } from "@party-stack/foundry-client";
+import { Effect, Fiber, Schema } from "effect";
+import { BackendError, classifyBackendFailure } from "@party-stack/ontology-backend";
+import { Temporal } from "temporal-polyfill";
+//#region src/serviceConnector.ts
+/** Reusable integration; the saved ServiceInstance supplies the Foundry stack URL. */
+function makeFoundryServiceConnector(options = {}) {
+	const defaultScopes = [
+		"api:use-ontologies-read",
+		"api:use-ontologies-write",
+		"api:use-mediasets-read",
+		"api:use-mediasets-write",
+		"offline_access"
+	];
+	const identity = (token) => Effect.try({
+		try: () => getTokenDetails(token),
+		catch: () => new ConnectError({
+			kind: "NeedsAuthentication",
+			retryable: false,
+			message: "Foundry credentials are invalid."
+		})
+	});
+	return {
+		service: "foundry",
+		displayName: "Foundry",
+		defaultOAuthScopes: defaultScopes,
+		oauth: Effect.fnUntraced(function* ({ application, serviceInstance, values }) {
+			const base = serviceInstance.instanceUrl.replace(/\/$/, "");
+			const secret = application.clientSecret ? yield* values.decrypt(Schema.String, application.clientSecret).pipe(Effect.mapError(() => new ConnectError({
+				kind: "Storage",
+				retryable: false,
+				message: "OAuth client secret is unavailable."
+			}))) : void 0;
+			return makeOAuthService({
+				issuer: `${base}/multipass/`,
+				authorizationEndpoint: `${base}/multipass/api/oauth2/authorize`,
+				tokenEndpoint: `${base}/multipass/api/oauth2/token`,
+				revocationEndpoint: `${base}/multipass/api/oauth2/revoke_token`,
+				clientId: application.clientId,
+				clientAuthentication: secret ? {
+					method: "client_secret_basic",
+					secret
+				} : { method: "none" },
+				scopes: application.scopes ?? defaultScopes,
+				fetch: options.fetch,
+				resolveSubject: (token) => identity(token).pipe(Effect.map((value) => value.userId))
+			});
+		}),
+		apiKey: ({ apiKey }) => identity(apiKey).pipe(Effect.map(({ userId, expiresAt }) => ({
+			userId,
+			expiresAt: expiresAt === void 0 ? void 0 : Temporal.Instant.fromEpochMilliseconds(expiresAt)
+		}))),
+		acquire: Effect.fnUntraced(function* ({ connection, serviceInstance, credential, handlers }) {
+			if (connection.objectType === "ExternalSessionConnection") return yield* new BackendError({
+				operation: "foundry.acquire",
+				kind: "InvalidConfiguration",
+				retryable: false,
+				message: "Foundry requires an OAuth or API-key connection."
+			});
+			const scope = yield* Effect.scope;
+			const web = yield* toWebEgress(handlers);
+			const run = Effect.runPromiseWith(yield* Effect.context());
+			const tokenProvider = () => run(Effect.acquireUseRelease(Effect.forkIn(credential, scope, { startImmediately: true }), Fiber.join, Fiber.interrupt));
+			const fetch = createFoundryFetch({
+				baseUrl: serviceInstance.instanceUrl,
+				tokenProvider,
+				fetch: web.fetch
+			});
+			const createWebSocket = createFoundryWebSocket({
+				baseUrl: serviceInstance.instanceUrl,
+				tokenProvider,
+				createWebSocket: web.createWebSocket
+			});
+			const checkTarget = (target) => Effect.try({
+				try: () => {
+					const url = new URL(target);
+					if (url.protocol === "wss:") url.protocol = "https:";
+					if (url.protocol === "ws:") url.protocol = "http:";
+					if (url.origin !== new URL(serviceInstance.instanceUrl).origin) throw new BackendError({
+						operation: "foundry.egress",
+						kind: "Forbidden",
+						retryable: false,
+						message: "Foundry egress target is outside the configured instance."
+					});
+				},
+				catch: (cause) => classifyBackendFailure("foundry.egress", cause)
+			});
+			return withHttpAuthenticationErrors({
+				fetch: (request) => checkTarget(request.url).pipe(Effect.andThen(Effect.tryPromise({
+					try: (signal) => fetch(new Request(request, { signal: AbortSignal.any([request.signal, signal]) })),
+					catch: (cause) => classifyBackendFailure("foundry.egress", cause)
+				}))),
+				createWebSocket: (url, protocols) => checkTarget(url).pipe(Effect.andThen(Effect.tryPromise({
+					try: () => createWebSocket(url, protocols),
+					catch: (cause) => classifyBackendFailure("foundry.egress", cause)
+				})))
+			});
+		})
+	};
+}
+//#endregion
+export { makeFoundryServiceConnector };
+
+//# sourceMappingURL=serviceConnector.js.map

package/lib/serviceConnector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceConnector.js","names":[],"sources":["../src/serviceConnector.ts"],"sourcesContent":["import {\n    ConnectError,\n    makeOAuthService,\n    toWebEgress,\n    withHttpAuthenticationErrors,\n    type ServiceConnector,\n} from \"@party-stack/connect\";\nimport { createFoundryFetch, createFoundryWebSocket, getTokenDetails } from \"@party-stack/foundry-client\";\nimport { BackendError, classifyBackendFailure } from \"@party-stack/ontology-backend\";\nimport { Effect, Fiber, Schema } from \"effect\";\nimport { Temporal } from \"temporal-polyfill\";\n\n/** Reusable integration; the saved ServiceInstance supplies the Foundry stack URL. */\nexport function makeFoundryServiceConnector(\n    options: {\n        readonly fetch?: typeof globalThis.fetch;\n    } = {}\n): ServiceConnector {\n    const defaultScopes = [\n        \"api:use-ontologies-read\",\n        \"api:use-ontologies-write\",\n        \"api:use-mediasets-read\",\n        \"api:use-mediasets-write\",\n        \"offline_access\",\n    ];\n    const identity = (token: string) =>\n        Effect.try({\n            try: () => getTokenDetails(token),\n            catch: () =>\n                new ConnectError({\n                    kind: \"NeedsAuthentication\",\n                    retryable: false,\n                    message: \"Foundry credentials are invalid.\",\n                }),\n        });\n    return {\n        service: \"foundry\",\n        displayName: \"Foundry\",\n        defaultOAuthScopes: defaultScopes,\n        oauth: Effect.fnUntraced(function* ({ application, serviceInstance, values }) {\n            const base = serviceInstance.instanceUrl.replace(/\\/$/, \"\");\n            const secret = application.clientSecret\n                ? yield* values.decrypt(Schema.String, application.clientSecret).pipe(\n                      Effect.mapError(\n                          () =>\n                              new ConnectError({\n                                  kind: \"Storage\",\n                                  retryable: false,\n                                  message: \"OAuth client secret is unavailable.\",\n                              })\n                      )\n                  )\n                : undefined;\n            return makeOAuthService({\n                issuer: `${base}/multipass/`,\n                authorizationEndpoint: `${base}/multipass/api/oauth2/authorize`,\n                tokenEndpoint: `${base}/multipass/api/oauth2/token`,\n                revocationEndpoint: `${base}/multipass/api/oauth2/revoke_token`,\n                clientId: application.clientId,\n                clientAuthentication: secret ? { method: \"client_secret_basic\", secret } : { method: \"none\" },\n                scopes: application.scopes ?? defaultScopes,\n                fetch: options.fetch,\n                resolveSubject: (token) => identity(token).pipe(Effect.map((value) => value.userId)),\n            });\n        }),\n        apiKey: ({ apiKey }) =>\n            identity(apiKey).pipe(\n                Effect.map(({ userId, expiresAt }) => ({\n                    userId,\n                    expiresAt:\n                        expiresAt === undefined\n                            ? undefined\n                            : Temporal.Instant.fromEpochMilliseconds(expiresAt),\n                }))\n            ),\n        acquire: Effect.fnUntraced(function* ({ connection, serviceInstance, credential, handlers }) {\n            if (connection.objectType === \"ExternalSessionConnection\")\n                return yield* new BackendError({\n                    operation: \"foundry.acquire\",\n                    kind: \"InvalidConfiguration\",\n                    retryable: false,\n                    message: \"Foundry requires an OAuth or API-key connection.\",\n                });\n            const scope = yield* Effect.scope;\n            const web = yield* toWebEgress(handlers);\n            const run = Effect.runPromiseWith(yield* Effect.context<never>());\n            const tokenProvider = () =>\n                run(\n                    Effect.acquireUseRelease(\n                        Effect.forkIn(credential, scope, { startImmediately: true }),\n                        Fiber.join,\n                        Fiber.interrupt\n                    )\n                );\n            const fetch = createFoundryFetch({\n                baseUrl: serviceInstance.instanceUrl,\n                tokenProvider,\n                fetch: web.fetch,\n            });\n            const createWebSocket = createFoundryWebSocket({\n                baseUrl: serviceInstance.instanceUrl,\n                tokenProvider,\n                createWebSocket: web.createWebSocket,\n            });\n            const checkTarget = (target: string | URL) =>\n                Effect.try({\n                    try: () => {\n                        const url = new URL(target);\n                        if (url.protocol === \"wss:\") url.protocol = \"https:\";\n                        if (url.protocol === \"ws:\") url.protocol = \"http:\";\n                        if (url.origin !== new URL(serviceInstance.instanceUrl).origin)\n                            throw new BackendError({\n                                operation: \"foundry.egress\",\n                                kind: \"Forbidden\",\n                                retryable: false,\n                                message: \"Foundry egress target is outside the configured instance.\",\n                            });\n                    },\n                    catch: (cause) => classifyBackendFailure(\"foundry.egress\", cause),\n                });\n            return withHttpAuthenticationErrors({\n                fetch: (request) =>\n                    checkTarget(request.url).pipe(\n                        Effect.andThen(\n                            Effect.tryPromise({\n                                try: (signal) =>\n                                    fetch(\n                                        new Request(request, {\n                                            signal: AbortSignal.any([request.signal, signal]),\n                                        })\n                                    ),\n                                catch: (cause) => classifyBackendFailure(\"foundry.egress\", cause),\n                            })\n                        )\n                    ),\n                createWebSocket: (url, protocols) =>\n                    checkTarget(url).pipe(\n                        Effect.andThen(\n                            Effect.tryPromise({\n                                try: () => createWebSocket(url, protocols),\n                                catch: (cause) => classifyBackendFailure(\"foundry.egress\", cause),\n                            })\n                        )\n                    ),\n            });\n        }),\n    };\n}\n"],"mappings":";;;;;;;AAaA,SAAgB,4BACZ,UAEI,CAAC,GACW;CAChB,MAAM,gBAAgB;EAClB;EACA;EACA;EACA;EACA;CACJ;CACA,MAAM,YAAY,UACd,OAAO,IAAI;EACP,WAAW,gBAAgB,KAAK;EAChC,aACI,IAAI,aAAa;GACb,MAAM;GACN,WAAW;GACX,SAAS;EACb,CAAC;CACT,CAAC;CACL,OAAO;EACH,SAAS;EACT,aAAa;EACb,oBAAoB;EACpB,OAAO,OAAO,WAAW,WAAW,EAAE,aAAa,iBAAiB,UAAU;GAC1E,MAAM,OAAO,gBAAgB,YAAY,QAAQ,OAAO,EAAE;GAC1D,MAAM,SAAS,YAAY,eACrB,OAAO,OAAO,QAAQ,OAAO,QAAQ,YAAY,YAAY,CAAC,CAAC,KAC3D,OAAO,eAEC,IAAI,aAAa;IACb,MAAM;IACN,WAAW;IACX,SAAS;GACb,CAAC,CACT,CACJ,IACA,KAAA;GACN,OAAO,iBAAiB;IACpB,QAAQ,GAAG,KAAK;IAChB,uBAAuB,GAAG,KAAK;IAC/B,eAAe,GAAG,KAAK;IACvB,oBAAoB,GAAG,KAAK;IAC5B,UAAU,YAAY;IACtB,sBAAsB,SAAS;KAAE,QAAQ;KAAuB;IAAO,IAAI,EAAE,QAAQ,OAAO;IAC5F,QAAQ,YAAY,UAAU;IAC9B,OAAO,QAAQ;IACf,iBAAiB,UAAU,SAAS,KAAK,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU,MAAM,MAAM,CAAC;GACvF,CAAC;EACL,CAAC;EACD,SAAS,EAAE,aACP,SAAS,MAAM,CAAC,CAAC,KACb,OAAO,KAAK,EAAE,QAAQ,iBAAiB;GACnC;GACA,WACI,cAAc,KAAA,IACR,KAAA,IACA,SAAS,QAAQ,sBAAsB,SAAS;EAC9D,EAAE,CACN;EACJ,SAAS,OAAO,WAAW,WAAW,EAAE,YAAY,iBAAiB,YAAY,YAAY;GACzF,IAAI,WAAW,eAAe,6BAC1B,OAAO,OAAO,IAAI,aAAa;IAC3B,WAAW;IACX,MAAM;IACN,WAAW;IACX,SAAS;GACb,CAAC;GACL,MAAM,QAAQ,OAAO,OAAO;GAC5B,MAAM,MAAM,OAAO,YAAY,QAAQ;GACvC,MAAM,MAAM,OAAO,eAAe,OAAO,OAAO,QAAe,CAAC;GAChE,MAAM,sBACF,IACI,OAAO,kBACH,OAAO,OAAO,YAAY,OAAO,EAAE,kBAAkB,KAAK,CAAC,GAC3D,MAAM,MACN,MAAM,SACV,CACJ;GACJ,MAAM,QAAQ,mBAAmB;IAC7B,SAAS,gBAAgB;IACzB;IACA,OAAO,IAAI;GACf,CAAC;GACD,MAAM,kBAAkB,uBAAuB;IAC3C,SAAS,gBAAgB;IACzB;IACA,iBAAiB,IAAI;GACzB,CAAC;GACD,MAAM,eAAe,WACjB,OAAO,IAAI;IACP,WAAW;KACP,MAAM,MAAM,IAAI,IAAI,MAAM;KAC1B,IAAI,IAAI,aAAa,QAAQ,IAAI,WAAW;KAC5C,IAAI,IAAI,aAAa,OAAO,IAAI,WAAW;KAC3C,IAAI,IAAI,WAAW,IAAI,IAAI,gBAAgB,WAAW,CAAC,CAAC,QACpD,MAAM,IAAI,aAAa;MACnB,WAAW;MACX,MAAM;MACN,WAAW;MACX,SAAS;KACb,CAAC;IACT;IACA,QAAQ,UAAU,uBAAuB,kBAAkB,KAAK;GACpE,CAAC;GACL,OAAO,6BAA6B;IAChC,QAAQ,YACJ,YAAY,QAAQ,GAAG,CAAC,CAAC,KACrB,OAAO,QACH,OAAO,WAAW;KACd,MAAM,WACF,MACI,IAAI,QAAQ,SAAS,EACjB,QAAQ,YAAY,IAAI,CAAC,QAAQ,QAAQ,MAAM,CAAC,EACpD,CAAC,CACL;KACJ,QAAQ,UAAU,uBAAuB,kBAAkB,KAAK;IACpE,CAAC,CACL,CACJ;IACJ,kBAAkB,KAAK,cACnB,YAAY,GAAG,CAAC,CAAC,KACb,OAAO,QACH,OAAO,WAAW;KACd,WAAW,gBAAgB,KAAK,SAAS;KACzC,QAAQ,UAAU,uBAAuB,kBAAkB,KAAK;IACpE,CAAC,CACL,CACJ;GACR,CAAC;EACL,CAAC;CACL;AACJ"}

package/lib/stagedWrites.d.ts

@@ -1,5 +1,5 @@
-import { InitialQueryBuilder } from "@tanstack/db";
 import { OntologyIR, OntologyMutator, OntologyMutatorObjects, OntologyMutatorTx } from "@party-stack/ontology";
+import { InitialQueryBuilder } from "@tanstack/db";
 //#region src/stagedWrites.d.ts
 /**
  * Structural subset of Foundry's staged-write `WriteableClient`.
@@ -18,6 +18,7 @@ export interface FoundryStagedWriteClient {
   query?<T>(build: (query: InitialQueryBuilder, objects: OntologyMutatorObjects) => unknown): Promise<T>;
 }
 export interface CreateFoundryStagedWriteMutatorTxOptions {
+  ir: OntologyIR;
   client: FoundryStagedWriteClient;
   /**
    * Generated OSDK object type tokens, keyed by ontology API name. Required
@@ -37,6 +38,6 @@ export declare function runFoundryOntologyMutator(options: {
   args: Record<string, unknown>;
   context?: Record<string, unknown>;
   objectTypes?: Record<string, unknown>;
-}): Promise<void>;
+}): Promise<unknown>;
 //#endregion
 //# sourceMappingURL=stagedWrites.d.ts.map

package/lib/stagedWrites.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stagedWrites.d.ts","names":[],"sources":["../src/stagedWrites.ts"],"mappings":";;;;;;;iBAaiB;EACb,OAAO,qBAAqB,QAAQ,0BAA0B;EAC9D,OACI;IACI;IACA;KAEJ,SAAS,0BACV;EACH,OAAO;IAAU;IAAkB;MAAiC;EACpE,OAAO,GAAG,QAAQ,OAAO,qBAAqB,SAAS,qCAAqC,QAAQ;;iBAGvF;EACb,QAAQ;;;;;EAKR,cAAc;;wBA0BF,kCACZ,SAAS,2CACV;;;;;wBAuDmB,0BAA0B;EAC5C,IAAI;EACJ,QAAQ;EACR,SAAS;EACT,MAAM;EACN,UAAU;EACV,cAAc;IACd"}
+{"version":3,"file":"stagedWrites.d.ts","names":[],"sources":["../src/stagedWrites.ts"],"mappings":";;;;;;;iBAeiB;EACb,OAAO,qBAAqB,QAAQ,0BAA0B;EAC9D,OACI;IACI;IACA;KAEJ,SAAS,0BACV;EACH,OAAO;IAAU;IAAkB;MAAiC;EACpE,OAAO,GAAG,QAAQ,OAAO,qBAAqB,SAAS,qCAAqC,QAAQ;;iBAGvF;EACb,IAAI;EACJ,QAAQ;;;;;EAKR,cAAc;;wBAgEF,kCACZ,SAAS,2CACV;;;;;wBAuDmB,0BAA0B;EAC5C,IAAI;EACJ,QAAQ;EACR,SAAS;EACT,MAAM;EACN,UAAU;EACV,cAAc;IACd"}

package/lib/stagedWrites.js

@@ -1,3 +1,5 @@
+import { Predicate, Schema } from "effect";
+import { resolveType } from "@party-stack/ontology-spec/utils";
 //#region src/stagedWrites.ts
 function setPath(object, path, value) {
 	let target = object;
@@ -14,6 +16,30 @@ function changesToRecord(changes) {
 	for (const change of changes) setPath(record, change.path, change.value);
 	return record;
 }
+const CiphertextHandle = Schema.Struct({ ciphertext: Schema.String.check(Schema.isPattern(/^CIPHER::[^:]+::.+::CIPHER$/u)) });
+/** Foundry v2 accepts {plaintext} for new secrets and {ciphertext} for a copied value.
+* Encryption happens in the ambient Foundry transaction, never in the wrapper's query path.
+*/
+function writeProperties(ir, objectType, values) {
+	const definition = ir.objectTypes.find((object) => object.name === objectType);
+	const result = { ...values };
+	for (const property of definition?.properties ?? []) {
+		if (!Object.hasOwn(values, property.name)) continue;
+		let type = resolveType(ir, property.type);
+		while (type.kind === "optional") type = resolveType(ir, type.value.type);
+		if (type.kind !== "encrypted") continue;
+		const value = values[property.name];
+		if (value === void 0) continue;
+		if (typeof value === "string") result[property.name] = { plaintext: value };
+		else if (Predicate.hasProperty(value, "decrypt") && Predicate.isFunction(value.decrypt)) result[property.name] = value;
+		else {
+			const parsed = Schema.decodeUnknownOption(CiphertextHandle)(value);
+			if (parsed._tag === "Some") result[property.name] = { ciphertext: parsed.value.ciphertext };
+			else throw new TypeError("Expected plaintext or a Foundry encrypted handle for an encrypted property.");
+		}
+	}
+	return result;
+}
 function createFoundryStagedWriteMutatorTx(options) {
 	return {
 		query: async (build) => {
@@ -24,13 +50,13 @@ function createFoundryStagedWriteMutatorTx(options) {
 			if (typeof objectType !== "string") return;
 			return {
 				create: async (object) => {
-					await options.client.create(options.objectTypes?.[objectType] ?? { $apiName: objectType }, object);
+					await options.client.create(options.objectTypes?.[objectType] ?? { $apiName: objectType }, writeProperties(options.ir, objectType, object));
 				},
 				update: async (key, changes) => {
 					await options.client.update({
 						$apiName: objectType,
 						$primaryKey: key
-					}, changesToRecord(changes));
+					}, writeProperties(options.ir, objectType, changesToRecord(changes)));
 				},
 				delete: async (key) => {
 					await options.client.delete({
@@ -48,10 +74,11 @@ function createFoundryStagedWriteMutatorTx(options) {
 */
 async function runFoundryOntologyMutator(options) {
 	const tx = createFoundryStagedWriteMutatorTx({
+		ir: options.ir,
 		client: options.client,
 		objectTypes: options.objectTypes
 	});
-	await options.mutator({
+	return options.mutator({
 		tx,
 		args: options.args,
 		context: options.context ?? {}

package/lib/stagedWrites.js.map

@@ -1 +1 @@
-{"version":3,"file":"stagedWrites.js","names":[],"sources":["../src/stagedWrites.ts"],"sourcesContent":["import type {\n    OntologyIR,\n    OntologyMutator,\n    OntologyMutatorObjects,\n    OntologyMutatorTx,\n    OntologyPropertyChange,\n} from \"@party-stack/ontology\";\nimport type { InitialQueryBuilder } from \"@tanstack/db\";\n\n/**\n * Structural subset of Foundry's staged-write `WriteableClient`.\n * Generated Foundry clients can be passed directly.\n */\nexport interface FoundryStagedWriteClient {\n    create(objectType: unknown, object: Record<string, unknown>): Promise<unknown>;\n    update(\n        object: {\n            $apiName: string;\n            $primaryKey: string | number;\n        },\n        changes: Record<string, unknown>\n    ): Promise<unknown>;\n    delete(object: { $apiName: string; $primaryKey: string | number }): Promise<unknown>;\n    query?<T>(build: (query: InitialQueryBuilder, objects: OntologyMutatorObjects) => unknown): Promise<T>;\n}\n\nexport interface CreateFoundryStagedWriteMutatorTxOptions {\n    client: FoundryStagedWriteClient;\n    /**\n     * Generated OSDK object type tokens, keyed by ontology API name. Required\n     * for creates when the client cannot accept an `$apiName` placeholder.\n     */\n    objectTypes?: Record<string, unknown>;\n}\n\nfunction setPath(object: Record<string, unknown>, path: string[], value: unknown): void {\n    let target = object;\n    for (const segment of path.slice(0, -1)) {\n        const existing = target[segment];\n        if (typeof existing !== \"object\" || existing === null || Array.isArray(existing)) {\n            target[segment] = {};\n        }\n        target = target[segment] as Record<string, unknown>;\n    }\n    target[path.at(-1)!] = value;\n}\n\nfunction changesToRecord(\n    changes: Record<string, unknown> | OntologyPropertyChange[]\n): Record<string, unknown> {\n    if (!Array.isArray(changes)) return changes;\n    const record: Record<string, unknown> = {};\n    for (const change of changes) {\n        setPath(record, change.path, change.value);\n    }\n    return record;\n}\n\nexport function createFoundryStagedWriteMutatorTx(\n    options: CreateFoundryStagedWriteMutatorTxOptions\n): OntologyMutatorTx {\n    return {\n        query: async (build) => {\n            if (!options.client.query) {\n                throw new Error(\n                    \"Foundry staged-write mutator queries require a query adapter backed by the ambient staged-write client.\"\n                );\n            }\n            return options.client.query(build);\n        },\n        mutate: new Proxy(\n            {},\n            {\n                get: (_target, objectType) => {\n                    if (typeof objectType !== \"string\") {\n                        return undefined;\n                    }\n                    return {\n                        create: async (object: Record<string, unknown>) => {\n                            await options.client.create(\n                                options.objectTypes?.[objectType] ?? {\n                                    $apiName: objectType,\n                                },\n                                object\n                            );\n                        },\n                        update: async (\n                            key: string | number,\n                            changes: Record<string, unknown> | OntologyPropertyChange[]\n                        ) => {\n                            await options.client.update(\n                                {\n                                    $apiName: objectType,\n                                    $primaryKey: key,\n                                },\n                                changesToRecord(changes)\n                            );\n                        },\n                        delete: async (key: string | number) => {\n                            await options.client.delete({\n                                $apiName: objectType,\n                                $primaryKey: key,\n                            });\n                        },\n                    };\n                },\n            }\n        ),\n    };\n}\n\n/**\n * Run a Party Stack ontology mutator inside Foundry's ambient staged-write\n * transaction. Foundry provides atomic commit/rollback and read-after-write.\n */\nexport async function runFoundryOntologyMutator(options: {\n    ir: OntologyIR;\n    client: FoundryStagedWriteClient;\n    mutator: OntologyMutator;\n    args: Record<string, unknown>;\n    context?: Record<string, unknown>;\n    objectTypes?: Record<string, unknown>;\n}): Promise<void> {\n    const tx = createFoundryStagedWriteMutatorTx({\n        client: options.client,\n        objectTypes: options.objectTypes,\n    });\n    await options.mutator({\n        tx,\n        args: options.args,\n        context: options.context ?? {},\n    });\n}\n"],"mappings":";AAmCA,SAAS,QAAQ,QAAiC,MAAgB,OAAsB;CACpF,IAAI,SAAS;CACb,KAAK,MAAM,WAAW,KAAK,MAAM,GAAG,EAAE,GAAG;EACrC,MAAM,WAAW,OAAO;EACxB,IAAI,OAAO,aAAa,YAAY,aAAa,QAAQ,MAAM,QAAQ,QAAQ,GAC3E,OAAO,WAAW,CAAC;EAEvB,SAAS,OAAO;CACpB;CACA,OAAO,KAAK,GAAG,EAAE,KAAM;AAC3B;AAEA,SAAS,gBACL,SACuB;CACvB,IAAI,CAAC,MAAM,QAAQ,OAAO,GAAG,OAAO;CACpC,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,UAAU,SACjB,QAAQ,QAAQ,OAAO,MAAM,OAAO,KAAK;CAE7C,OAAO;AACX;AAEA,SAAgB,kCACZ,SACiB;CACjB,OAAO;EACH,OAAO,OAAO,UAAU;GACpB,IAAI,CAAC,QAAQ,OAAO,OAChB,MAAM,IAAI,MACN,yGACJ;GAEJ,OAAO,QAAQ,OAAO,MAAM,KAAK;EACrC;EACA,QAAQ,IAAI,MACR,CAAC,GACD,EACI,MAAM,SAAS,eAAe;GAC1B,IAAI,OAAO,eAAe,UACtB;GAEJ,OAAO;IACH,QAAQ,OAAO,WAAoC;KAC/C,MAAM,QAAQ,OAAO,OACjB,QAAQ,cAAc,eAAe,EACjC,UAAU,WACd,GACA,MACJ;IACJ;IACA,QAAQ,OACJ,KACA,YACC;KACD,MAAM,QAAQ,OAAO,OACjB;MACI,UAAU;MACV,aAAa;KACjB,GACA,gBAAgB,OAAO,CAC3B;IACJ;IACA,QAAQ,OAAO,QAAyB;KACpC,MAAM,QAAQ,OAAO,OAAO;MACxB,UAAU;MACV,aAAa;KACjB,CAAC;IACL;GACJ;EACJ,EACJ,CACJ;CACJ;AACJ;;;;;AAMA,eAAsB,0BAA0B,SAO9B;CACd,MAAM,KAAK,kCAAkC;EACzC,QAAQ,QAAQ;EAChB,aAAa,QAAQ;CACzB,CAAC;CACD,MAAM,QAAQ,QAAQ;EAClB;EACA,MAAM,QAAQ;EACd,SAAS,QAAQ,WAAW,CAAC;CACjC,CAAC;AACL"}
+{"version":3,"file":"stagedWrites.js","names":[],"sources":["../src/stagedWrites.ts"],"sourcesContent":["import { resolveType } from \"@party-stack/ontology-spec/utils\";\nimport { Predicate, Schema } from \"effect\";\nimport type {\n    OntologyIR,\n    OntologyMutator,\n    OntologyMutatorObjects,\n    OntologyMutatorTx,\n    OntologyPropertyChange,\n} from \"@party-stack/ontology\";\nimport type { InitialQueryBuilder } from \"@tanstack/db\";\n\n/**\n * Structural subset of Foundry's staged-write `WriteableClient`.\n * Generated Foundry clients can be passed directly.\n */\nexport interface FoundryStagedWriteClient {\n    create(objectType: unknown, object: Record<string, unknown>): Promise<unknown>;\n    update(\n        object: {\n            $apiName: string;\n            $primaryKey: string | number;\n        },\n        changes: Record<string, unknown>\n    ): Promise<unknown>;\n    delete(object: { $apiName: string; $primaryKey: string | number }): Promise<unknown>;\n    query?<T>(build: (query: InitialQueryBuilder, objects: OntologyMutatorObjects) => unknown): Promise<T>;\n}\n\nexport interface CreateFoundryStagedWriteMutatorTxOptions {\n    ir: OntologyIR;\n    client: FoundryStagedWriteClient;\n    /**\n     * Generated OSDK object type tokens, keyed by ontology API name. Required\n     * for creates when the client cannot accept an `$apiName` placeholder.\n     */\n    objectTypes?: Record<string, unknown>;\n}\n\nfunction setPath(object: Record<string, unknown>, path: string[], value: unknown): void {\n    let target = object;\n    for (const segment of path.slice(0, -1)) {\n        const existing = target[segment];\n        if (typeof existing !== \"object\" || existing === null || Array.isArray(existing)) {\n            target[segment] = {};\n        }\n        target = target[segment] as Record<string, unknown>;\n    }\n    target[path.at(-1)!] = value;\n}\n\nfunction changesToRecord(\n    changes: Record<string, unknown> | OntologyPropertyChange[]\n): Record<string, unknown> {\n    if (!Array.isArray(changes)) return changes;\n    const record: Record<string, unknown> = {};\n    for (const change of changes) {\n        setPath(record, change.path, change.value);\n    }\n    return record;\n}\n\nconst CiphertextHandle = Schema.Struct({\n    ciphertext: Schema.String.check(Schema.isPattern(/^CIPHER::[^:]+::.+::CIPHER$/u)),\n});\n\n/** Foundry v2 accepts {plaintext} for new secrets and {ciphertext} for a copied value.\n * Encryption happens in the ambient Foundry transaction, never in the wrapper's query path.\n */\nfunction writeProperties(\n    ir: OntologyIR,\n    objectType: string,\n    values: Record<string, unknown>\n): Record<string, unknown> {\n    const definition = ir.objectTypes.find((object) => object.name === objectType);\n    const result = { ...values };\n    for (const property of definition?.properties ?? []) {\n        if (!Object.hasOwn(values, property.name)) continue;\n        let type = resolveType(ir, property.type);\n        while (type.kind === \"optional\") type = resolveType(ir, type.value.type);\n        if (type.kind !== \"encrypted\") continue;\n        const value = values[property.name];\n        if (value === undefined) continue;\n        if (typeof value === \"string\") result[property.name] = { plaintext: value };\n        else if (Predicate.hasProperty(value, \"decrypt\") && Predicate.isFunction(value.decrypt)) {\n            // Real OSDK CipherText objects are normalized by WriteableClient itself; never applyAction decrypt.\n            result[property.name] = value;\n        } else {\n            // Portable handles are not OSDK CipherText instances; convert them explicitly.\n            const parsed = Schema.decodeUnknownOption(CiphertextHandle)(value);\n            if (parsed._tag === \"Some\") result[property.name] = { ciphertext: parsed.value.ciphertext };\n            else\n                throw new TypeError(\n                    \"Expected plaintext or a Foundry encrypted handle for an encrypted property.\"\n                );\n        }\n    }\n    return result;\n}\n\nexport function createFoundryStagedWriteMutatorTx(\n    options: CreateFoundryStagedWriteMutatorTxOptions\n): OntologyMutatorTx {\n    return {\n        query: async (build) => {\n            if (!options.client.query) {\n                throw new Error(\n                    \"Foundry staged-write mutator queries require a query adapter backed by the ambient staged-write client.\"\n                );\n            }\n            return options.client.query(build);\n        },\n        mutate: new Proxy(\n            {},\n            {\n                get: (_target, objectType) => {\n                    if (typeof objectType !== \"string\") {\n                        return undefined;\n                    }\n                    return {\n                        create: async (object: Record<string, unknown>) => {\n                            await options.client.create(\n                                options.objectTypes?.[objectType] ?? {\n                                    $apiName: objectType,\n                                },\n                                writeProperties(options.ir, objectType, object)\n                            );\n                        },\n                        update: async (\n                            key: string | number,\n                            changes: Record<string, unknown> | OntologyPropertyChange[]\n                        ) => {\n                            await options.client.update(\n                                {\n                                    $apiName: objectType,\n                                    $primaryKey: key,\n                                },\n                                writeProperties(options.ir, objectType, changesToRecord(changes))\n                            );\n                        },\n                        delete: async (key: string | number) => {\n                            await options.client.delete({\n                                $apiName: objectType,\n                                $primaryKey: key,\n                            });\n                        },\n                    };\n                },\n            }\n        ),\n    };\n}\n\n/**\n * Run a Party Stack ontology mutator inside Foundry's ambient staged-write\n * transaction. Foundry provides atomic commit/rollback and read-after-write.\n */\nexport async function runFoundryOntologyMutator(options: {\n    ir: OntologyIR;\n    client: FoundryStagedWriteClient;\n    mutator: OntologyMutator;\n    args: Record<string, unknown>;\n    context?: Record<string, unknown>;\n    objectTypes?: Record<string, unknown>;\n}): Promise<unknown> {\n    const tx = createFoundryStagedWriteMutatorTx({\n        ir: options.ir,\n        client: options.client,\n        objectTypes: options.objectTypes,\n    });\n    return options.mutator({\n        tx,\n        args: options.args,\n        context: options.context ?? {},\n    });\n}\n"],"mappings":";;;AAsCA,SAAS,QAAQ,QAAiC,MAAgB,OAAsB;CACpF,IAAI,SAAS;CACb,KAAK,MAAM,WAAW,KAAK,MAAM,GAAG,EAAE,GAAG;EACrC,MAAM,WAAW,OAAO;EACxB,IAAI,OAAO,aAAa,YAAY,aAAa,QAAQ,MAAM,QAAQ,QAAQ,GAC3E,OAAO,WAAW,CAAC;EAEvB,SAAS,OAAO;CACpB;CACA,OAAO,KAAK,GAAG,EAAE,KAAM;AAC3B;AAEA,SAAS,gBACL,SACuB;CACvB,IAAI,CAAC,MAAM,QAAQ,OAAO,GAAG,OAAO;CACpC,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,UAAU,SACjB,QAAQ,QAAQ,OAAO,MAAM,OAAO,KAAK;CAE7C,OAAO;AACX;AAEA,MAAM,mBAAmB,OAAO,OAAO,EACnC,YAAY,OAAO,OAAO,MAAM,OAAO,UAAU,8BAA8B,CAAC,EACpF,CAAC;;;;AAKD,SAAS,gBACL,IACA,YACA,QACuB;CACvB,MAAM,aAAa,GAAG,YAAY,MAAM,WAAW,OAAO,SAAS,UAAU;CAC7E,MAAM,SAAS,EAAE,GAAG,OAAO;CAC3B,KAAK,MAAM,YAAY,YAAY,cAAc,CAAC,GAAG;EACjD,IAAI,CAAC,OAAO,OAAO,QAAQ,SAAS,IAAI,GAAG;EAC3C,IAAI,OAAO,YAAY,IAAI,SAAS,IAAI;EACxC,OAAO,KAAK,SAAS,YAAY,OAAO,YAAY,IAAI,KAAK,MAAM,IAAI;EACvE,IAAI,KAAK,SAAS,aAAa;EAC/B,MAAM,QAAQ,OAAO,SAAS;EAC9B,IAAI,UAAU,KAAA,GAAW;EACzB,IAAI,OAAO,UAAU,UAAU,OAAO,SAAS,QAAQ,EAAE,WAAW,MAAM;OACrE,IAAI,UAAU,YAAY,OAAO,SAAS,KAAK,UAAU,WAAW,MAAM,OAAO,GAElF,OAAO,SAAS,QAAQ;OACrB;GAEH,MAAM,SAAS,OAAO,oBAAoB,gBAAgB,CAAC,CAAC,KAAK;GACjE,IAAI,OAAO,SAAS,QAAQ,OAAO,SAAS,QAAQ,EAAE,YAAY,OAAO,MAAM,WAAW;QAEtF,MAAM,IAAI,UACN,6EACJ;EACR;CACJ;CACA,OAAO;AACX;AAEA,SAAgB,kCACZ,SACiB;CACjB,OAAO;EACH,OAAO,OAAO,UAAU;GACpB,IAAI,CAAC,QAAQ,OAAO,OAChB,MAAM,IAAI,MACN,yGACJ;GAEJ,OAAO,QAAQ,OAAO,MAAM,KAAK;EACrC;EACA,QAAQ,IAAI,MACR,CAAC,GACD,EACI,MAAM,SAAS,eAAe;GAC1B,IAAI,OAAO,eAAe,UACtB;GAEJ,OAAO;IACH,QAAQ,OAAO,WAAoC;KAC/C,MAAM,QAAQ,OAAO,OACjB,QAAQ,cAAc,eAAe,EACjC,UAAU,WACd,GACA,gBAAgB,QAAQ,IAAI,YAAY,MAAM,CAClD;IACJ;IACA,QAAQ,OACJ,KACA,YACC;KACD,MAAM,QAAQ,OAAO,OACjB;MACI,UAAU;MACV,aAAa;KACjB,GACA,gBAAgB,QAAQ,IAAI,YAAY,gBAAgB,OAAO,CAAC,CACpE;IACJ;IACA,QAAQ,OAAO,QAAyB;KACpC,MAAM,QAAQ,OAAO,OAAO;MACxB,UAAU;MACV,aAAa;KACjB,CAAC;IACL;GACJ;EACJ,EACJ,CACJ;CACJ;AACJ;;;;;AAMA,eAAsB,0BAA0B,SAO3B;CACjB,MAAM,KAAK,kCAAkC;EACzC,IAAI,QAAQ;EACZ,QAAQ,QAAQ;EAChB,aAAa,QAAQ;CACzB,CAAC;CACD,OAAO,QAAQ,QAAQ;EACnB;EACA,MAAM,QAAQ;EACd,SAAS,QAAQ,WAAW,CAAC;CACjC,CAAC;AACL"}