@servicenow/sdk-build-plugins 3.0.2 → 4.0.0

package/dist/user-preference-plugin.d.ts

@@ -0,0 +1,15 @@
+import { Plugin } from '@servicenow/sdk-build-core';
+/**
+ * Creates a User Preference (sys_user_preference).
+ *
+ * @see https://docs.servicenow.com/csh?topicname=c_UserPreferences.html&version=latest
+ *
+ * @param config - an object containing the following properties:
+ *   * **$id** - unique id for the record, typically using `Now.ID["value"]`
+ *   * **name** - name of the feature or functionality
+ *   * **type** - the data type of entry accepted for the `value`
+ *   * **value** - current setting for this record
+ *   * **description**? - short description of the feature or functionality
+ *   * **system**? - whether this record indicates the system-wide default
+ */
+export declare const UserPreferencePlugin: Plugin;

package/dist/user-preference-plugin.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserPreferencePlugin = void 0;
+const sdk_build_core_1 = require("@servicenow/sdk-build-core");
+const now_id_plugin_1 = require("./now-id-plugin");
+/**
+ * Creates a User Preference (sys_user_preference).
+ *
+ * @see https://docs.servicenow.com/csh?topicname=c_UserPreferences.html&version=latest
+ *
+ * @param config - an object containing the following properties:
+ *   * **$id** - unique id for the record, typically using `Now.ID["value"]`
+ *   * **name** - name of the feature or functionality
+ *   * **type** - the data type of entry accepted for the `value`
+ *   * **value** - current setting for this record
+ *   * **description**? - short description of the feature or functionality
+ *   * **system**? - whether this record indicates the system-wide default
+ */
+exports.UserPreferencePlugin = sdk_build_core_1.Plugin.create({
+    name: 'UserPreferencePlugin',
+    records: {
+        sys_user_preference: {
+            toShape(record) {
+                return {
+                    success: true,
+                    value: new sdk_build_core_1.CallExpressionShape({
+                        source: record,
+                        callee: 'UserPreference',
+                        args: [
+                            record.transform(({ $, merge }) => ({
+                                $id: $.val(now_id_plugin_1.NowIdShape.from(record)),
+                                system: $.from('system').toBoolean(),
+                                [merge]: $,
+                            })),
+                        ],
+                    }),
+                };
+            },
+        },
+    },
+    shapes: [
+        {
+            shape: sdk_build_core_1.CallExpressionShape,
+            fileTypes: ['fluent'],
+            toRecord(callExpression, { factory }) {
+                if (callExpression.getCallee() !== 'UserPreference') {
+                    return { success: false };
+                }
+                const pref = callExpression.getArgument(0).asObject();
+                return {
+                    success: true,
+                    value: factory.createRecord({
+                        source: callExpression,
+                        table: 'sys_user_preference',
+                        explicitId: pref.get('$id'),
+                        properties: pref.pick(['name', 'type', 'value', 'description', 'system']),
+                    }),
+                };
+            },
+        },
+    ],
+});
+//# sourceMappingURL=user-preference-plugin.js.map

package/dist/user-preference-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-preference-plugin.js","sourceRoot":"","sources":["../src/user-preference-plugin.ts"],"names":[],"mappings":";;;AAAA,+DAAwE;AACxE,mDAA4C;AAE5C;;;;;;;;;;;;GAYG;AACU,QAAA,oBAAoB,GAAG,uBAAM,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,sBAAsB;IAC5B,OAAO,EAAE;QACL,mBAAmB,EAAE;YACjB,OAAO,CAAC,MAAM;gBACV,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,IAAI,oCAAmB,CAAC;wBAC3B,MAAM,EAAE,MAAM;wBACd,MAAM,EAAE,gBAAgB;wBACxB,IAAI,EAAE;4BACF,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;gCAChC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,0BAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gCACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE;gCACpC,CAAC,KAAK,CAAC,EAAE,CAAC;6BACb,CAAC,CAAC;yBACN;qBACJ,CAAC;iBACL,CAAA;YACL,CAAC;SACJ;KACJ;IACD,MAAM,EAAE;QACJ;YACI,KAAK,EAAE,oCAAmB;YAC1B,SAAS,EAAE,CAAC,QAAQ,CAAC;YACrB,QAAQ,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE;gBAChC,IAAI,cAAc,CAAC,SAAS,EAAE,KAAK,gBAAgB,EAAE,CAAC;oBAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;gBAC7B,CAAC;gBAED,MAAM,IAAI,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;gBAErD,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC;wBACxB,MAAM,EAAE,cAAc;wBACtB,KAAK,EAAE,qBAAqB;wBAC5B,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;wBAC3B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;qBAC5E,CAAC;iBACL,CAAA;YACL,CAAC;SACJ;KACJ;CACJ,CAAC,CAAA"}

package/dist/utils.d.ts

@@ -0,0 +1,17 @@
+import { ts, type Shape, type ObjectShape, type Diagnostics } from '@servicenow/sdk-build-core';
+export declare function toReference(shape: Shape): string | import("@servicenow/sdk-build-core").RecordId;
+/**
+ * Reverses an object, swapping keys and values. **reverseObject** should only be used
+ * where the key/values are all known ahead of time and the values are unique.
+ * @example
+ * reverseObject({ a: 'foo', b: 'bar' }) // { foo: 'a', bar: 'b' }
+ */
+export declare function reverseObject<K extends string, V extends string>(obj: Record<K, V>): Record<V, K>;
+export declare function noThrow<T>(action: () => T): T | Error;
+/**
+ * Regex taken from: https://github.com/oozcitak/xmlbuilder-js/blob/b20136cd1591d0f17ab2f184053c7150150428b2/src/XMLStringifier.coffee#L119C15-L119C127
+ */
+export declare const INVALID_XML_CHARACTERS: RegExp;
+export declare function applyPathMappings(path: string, mappings: Record<string, string>): string;
+export declare function getCallExpressionName(node: ts.CallExpression): string;
+export declare function generateDeprecatedDiagnostics(object: ObjectShape, diagnostics: Diagnostics): void;

package/dist/utils.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INVALID_XML_CHARACTERS = void 0;
+exports.toReference = toReference;
+exports.reverseObject = reverseObject;
+exports.noThrow = noThrow;
+exports.applyPathMappings = applyPathMappings;
+exports.getCallExpressionName = getCallExpressionName;
+exports.generateDeprecatedDiagnostics = generateDeprecatedDiagnostics;
+const sdk_build_core_1 = require("@servicenow/sdk-build-core");
+function toReference(shape) {
+    return shape.ifRecord()?.getId() ?? shape.ifString()?.getValue() ?? '';
+}
+/**
+ * Reverses an object, swapping keys and values. **reverseObject** should only be used
+ * where the key/values are all known ahead of time and the values are unique.
+ * @example
+ * reverseObject({ a: 'foo', b: 'bar' }) // { foo: 'a', bar: 'b' }
+ */
+function reverseObject(obj) {
+    const reversed = {};
+    for (const key in obj) {
+        const value = obj[key];
+        if (typeof value === 'string') {
+            reversed[value] = key;
+        }
+    }
+    return reversed;
+}
+function noThrow(action) {
+    try {
+        return action();
+    }
+    catch (error) {
+        return error;
+    }
+}
+/**
+ * Regex taken from: https://github.com/oozcitak/xmlbuilder-js/blob/b20136cd1591d0f17ab2f184053c7150150428b2/src/XMLStringifier.coffee#L119C15-L119C127
+ */
+exports.INVALID_XML_CHARACTERS = 
+// biome-ignore lint/suspicious/noControlCharactersInRegex: This is intentional
+/[\0-\x08\x0B\f\x0E-\x1F\uFFFE\uFFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF]/g;
+function applyPathMappings(path, mappings) {
+    if (!mappings) {
+        return path;
+    }
+    // TODO: Naive implementation for now that just supports simple patterns. We can explore supporting more complex patterns later.
+    for (const [source, target] of Object.entries(mappings)) {
+        const match = path.match(`${source.replace(/\./, '\\.').replace(/\*+/, '(.*)')}$`)?.[1];
+        if (match !== undefined) {
+            return target.replace(/\*+/, match);
+        }
+    }
+    return path;
+}
+function getCallExpressionName(node) {
+    const expression = node.getExpression();
+    if (sdk_build_core_1.ts.Node.isIdentifier(expression) || sdk_build_core_1.ts.Node.isPropertyAccessExpression(expression)) {
+        return expression.getText();
+    }
+    throw `CallExpression does not have a name: ${expression.getText()}`;
+}
+function generateDeprecatedDiagnostics(object, diagnostics) {
+    Object.keys(object.getAliasedKeys()).forEach((key) => {
+        const alias = object.findAliasUsed(key);
+        if (alias) {
+            diagnostics.hint(object.get(key), `The property '${alias}' is deprecated, use '${key}' instead.`);
+        }
+    });
+}
+//# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":";;;AAEA,kCAEC;AAQD,sCASC;AAED,0BAMC;AASD,8CAYC;AAED,sDAOC;AAED,sEAOC;AApED,+DAA+F;AAE/F,SAAgB,WAAW,CAAC,KAAY;IACpC,OAAO,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAqC,GAAiB;IAC/E,MAAM,QAAQ,GAAG,EAAkB,CAAA;IACnC,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAA;QACzB,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAA;AACnB,CAAC;AAED,SAAgB,OAAO,CAAI,MAAe;IACtC,IAAI,CAAC;QACD,OAAO,MAAM,EAAE,CAAA;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,KAAc,CAAA;IACzB,CAAC;AACL,CAAC;AAED;;GAEG;AACU,QAAA,sBAAsB;AAC/B,+EAA+E;AAC/E,gHAAgH,CAAA;AAEpH,SAAgB,iBAAiB,CAAC,IAAY,EAAE,QAAgC;IAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,IAAI,CAAA;IACf,CAAC;IACD,gIAAgI;IAChI,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACvF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAA;AACf,CAAC;AAED,SAAgB,qBAAqB,CAAC,IAAuB;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAA;IACvC,IAAI,mBAAE,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,mBAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,CAAC;QACrF,OAAO,UAAU,CAAC,OAAO,EAAE,CAAA;IAC/B,CAAC;IAED,MAAM,wCAAwC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAA;AACxE,CAAC;AAED,SAAgB,6BAA6B,CAAC,MAAmB,EAAE,WAAwB;IACvF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,KAAK,EAAE,CAAC;YACR,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,iBAAiB,KAAK,yBAAyB,GAAG,YAAY,CAAC,CAAA;QACrG,CAAC;IACL,CAAC,CAAC,CAAA;AACN,CAAC"}

package/dist/view-plugin.d.ts

@@ -0,0 +1,2 @@
+import { Plugin } from '@servicenow/sdk-build-core';
+export declare const ViewPlugin: Plugin;

package/dist/view-plugin.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ViewPlugin = void 0;
+const sdk_build_core_1 = require("@servicenow/sdk-build-core");
+exports.ViewPlugin = sdk_build_core_1.Plugin.create({
+    name: 'ViewPlugin',
+    records: {
+        sys_ui_view: {
+            coalesce: ['name'],
+        },
+    },
+    shapes: [
+        {
+            shape: sdk_build_core_1.Record,
+            inspect(record, { diagnostics }) {
+                if (record.getTable() !== 'sys_ui_view') {
+                    return;
+                }
+                if (record.get('title').equals('Default view')) {
+                    // The default view's name will be empty, so skip the validation
+                    return;
+                }
+                const viewName = record.get('name');
+                if (!viewName.isString() || !/^[a-zA-Z0-9_]+$/.test(viewName.getValue())) {
+                    diagnostics.error(viewName.getOriginalNode(), `View name can only contain alphanumeric characters`);
+                }
+            },
+        },
+        {
+            shape: sdk_build_core_1.RecordId,
+            async commit(id, target, { commit }) {
+                if (id.getTable() !== 'sys_ui_view') {
+                    return { success: false };
+                }
+                const viewName = id.getKey('name');
+                if (!viewName) {
+                    return { success: false };
+                }
+                await commit(sdk_build_core_1.Shape.from(id, viewName).asString(), target);
+                return { success: true };
+            },
+        },
+    ],
+});
+//# sourceMappingURL=view-plugin.js.map

package/dist/view-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-plugin.js","sourceRoot":"","sources":["../src/view-plugin.ts"],"names":[],"mappings":";;;AAAA,+DAA4E;AAE/D,QAAA,UAAU,GAAG,uBAAM,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE;QACL,WAAW,EAAE;YACT,QAAQ,EAAE,CAAC,MAAM,CAAC;SACrB;KACJ;IACD,MAAM,EAAE;QACJ;YACI,KAAK,EAAE,uBAAM;YACb,OAAO,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE;gBAC3B,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,aAAa,EAAE,CAAC;oBACtC,OAAM;gBACV,CAAC;gBAED,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC7C,gEAAgE;oBAChE,OAAM;gBACV,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;oBACvE,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,oDAAoD,CAAC,CAAA;gBACvG,CAAC;YACL,CAAC;SACJ;QACD;YACI,KAAK,EAAE,yBAAQ;YACf,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE;gBAC/B,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,aAAa,EAAE,CAAC;oBAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;gBAC7B,CAAC;gBAED,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;gBAC7B,CAAC;gBAED,MAAM,MAAM,CAAC,sBAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;gBACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YAC5B,CAAC;SACJ;KACJ;CACJ,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@servicenow/sdk-build-plugins",
-  "version": "3.0.2",
+  "version": "4.0.0",
   "description": "ServiceNow SDK Build System Plugins",
   "license": "MIT",
   "main": "./dist/index.js",
@@ -8,41 +8,45 @@
     "dist",
     "src"
   ],
+  "exports": {
+    ".": "./dist/index.js"
+  },
   "dependencies": {
+    "@cyclonedx/cyclonedx-library": "7.1.0",
     "@servicenow/glide": "26.0.1",
     "eslint": "8.50.0",
     "eslint-formatter-stylish": "8.40.0",
     "eslint-plugin-es-x": "7.2.0",
+    "fast-xml-parser": "4.4.1",
     "globals": "13.23.0",
     "lodash": "4.17.21",
+    "md5.js": "1.3.5",
+    "mime-types": "2.1.35",
     "moo": "0.5.2",
     "nearley": "2.20.1",
+    "packageurl-js": "2.0.1",
     "xmlbuilder2": "3.1.1",
     "zod": "3.22.4",
-    "md5.js": "1.3.5",
-    "@servicenow/eslint-plugin-sdk-app-plugin": "3.0.2",
-    "@servicenow/sdk-core": "3.0.2",
-    "@servicenow/sdk-build-core": "3.0.2",
-    "@servicenow/sdk-project": "3.0.2",
-    "@servicenow/sdk-repack": "3.0.2"
+    "@servicenow/sdk-build-core": "4.0.0",
+    "@servicenow/sdk-repack": "4.0.0",
+    "@servicenow/eslint-plugin-sdk-app-plugin": "4.0.0",
+    "@servicenow/sdk-core": "4.0.0"
   },
   "overrides": {
     "micromatch": "4.0.7"
   },
   "devDependencies": {
     "@types/eslint": "8.56.0",
-    "@types/lodash": "4.14.195"
+    "@types/lodash": "4.14.195",
+    "@types/mime-types": "2.1.4"
   },
   "engines": {
-    "node": ">=18.16.1",
-    "pnpm": ">=9.4.0"
+    "node": ">=20.18.0",
+    "pnpm": ">=10.8.0"
   },
   "scripts": {
     "build": "tsc -b",
     "clean": "tsc -b --clean",
-    "lint": "eslint . --ext .ts",
-    "prettier:check": "prettier --check --ignore-path=../../.prettierignore .",
-    "prettier:write": "prettier --write --ignore-path=../../.prettierignore .",
     "watch": "tsc -b -w"
   }
 }

package/src/acl-plugin.ts

@@ -0,0 +1,256 @@
+import { CallExpressionShape, isGUID, Plugin } from '@servicenow/sdk-build-core'
+import { AclTypes, AclOperations, AclAttributes, AclNamedTypes } from '@servicenow/sdk-core/runtime/app'
+import { ModuleFunctionShape } from './server-module-plugin'
+import { NowIdShape } from './now-id-plugin'
+import { generateDeprecatedDiagnostics } from './utils'
+
+const ExecuteOnlyTypes = new Set([
+    'client_callable_flow_object',
+    'client_callable_script_include',
+    'graphql',
+    'processor',
+    'rest_endpoint',
+])
+
+const aclAliases = {
+    adminOverrides: ['admin_overrides'],
+    decisionType: ['decision_type'],
+    localOrExisting: ['local_or_existing'],
+    securityAttribute: ['security_attribute'],
+    appliesTo: ['applies_to'],
+}
+
+/**
+ * @param config - an object containing the following properties:
+ *   * **$id** - unique id for the record, typically using `Now.ID["value"]`
+ *   * **operation** - the operation this ACL rule secure
+ *   * **active**? - whether the ACL is enabled
+ *   * **adminOverrides**? - indicates whether users with the admin role automatically pass the permissions check for this ACL rule
+ *   * **condition**? - a filter query that specifies the fields and values that must be true for users to access the object
+ *   * **decisionType**? - whether the ACL should allow or deny access
+ *   * **description**? - description of the object or permissions this ACL rule secures
+ *   * **localOrExisting**? - if `"Local"`: A security attribute based on the
+ *     condition property that is saved only for the ACL it is created in\
+ *     if `"Exisiting"`: An existing security attribute to reference in the `security_attribute` property
+ *   * **roles**? - `Role` objects or sys_ids of roles that a user must have to access the object
+ *   * **script**? - a function or inline script preceded by a `script` tagged
+ *     template literal. The script should define the permissions required to access the object
+ *   * **securityAttribute**? - pre-defined conditions to use. For example, whether a user is impersonating another user
+ */
+export const AclPlugin = Plugin.create({
+    name: 'AclPlugin',
+    records: {
+        sys_security_acl: {
+            relationships: {
+                sys_security_acl_role: {
+                    via: 'sys_security_acl',
+                    descendant: true,
+                    relationships: {
+                        sys_user_role: {
+                            via: 'sys_user_role',
+                            inverse: true,
+                        },
+                    },
+                },
+            },
+            toShape(record, { descendants }) {
+                const type = reverseLookup(AclTypes, record.get('type').getValue()) || record.get('type')
+                const roles = descendants.query('sys_security_acl_role').map((m2m) => m2m.get('sys_user_role'))
+
+                return {
+                    success: true,
+                    value: new CallExpressionShape({
+                        source: record,
+                        callee: 'Acl',
+                        args: [
+                            record
+                                .transform(({ $, merge }) => ({
+                                    $id: $.val(NowIdShape.from(record)),
+                                    condition: $.def(''),
+                                    description: $.def(''),
+                                    localOrExisting: $.from('local_or_existing').def('Local'),
+                                    active: $.toBoolean().def(true),
+                                    decisionType: $.from('decision_type').def('allow'),
+                                    adminOverrides: $.from('admin_overrides').toBoolean().def(true),
+                                    appliesTo: $.from('applies_to').def(''),
+                                    type: $.val(type),
+                                    securityAttribute: $.from('security_attribute')
+                                        .map((v) => reverseLookup(AclAttributes, v.getValue()) || v)
+                                        .def(''),
+                                    operation: $.map((v) => reverseLookup(AclOperations, v.getValue()) || v),
+                                    script: $.map((v) => v.ifString()?.getValue()).def(''),
+                                    roles: $.val(roles.length > 0 ? roles : undefined),
+                                    [merge]: $.from('type', 'name').map((type, name) =>
+                                        getTableOrName(
+                                            type.pipe((t) => reverseLookup(AclTypes, t.getValue())),
+                                            name.asString().getValue()
+                                        )
+                                    ),
+                                }))
+                                .withAliasedKeys(aclAliases),
+                        ],
+                    }),
+                }
+            },
+        },
+        sys_security_acl_role: {
+            coalesce: ['sys_security_acl', 'sys_user_role'],
+        },
+    },
+    shapes: [
+        {
+            shape: CallExpressionShape,
+            fileTypes: ['fluent'],
+            async toRecord(callExpression, { config, diagnostics, factory }) {
+                if (callExpression.getCallee() !== 'Acl') {
+                    return { success: false }
+                }
+
+                const arg = callExpression.getArgument(0).asObject().withAliasedKeys(aclAliases)
+                generateDeprecatedDiagnostics(arg, diagnostics)
+                const operation = arg.get('operation')
+                const type = arg.get('type').asString()
+                if (!operation.equals('execute') && ExecuteOnlyTypes.has(type.getValue())) {
+                    diagnostics.error(
+                        operation,
+                        `ACL must use operation 'execute', because it is of type '${type.getValue()}'`
+                    )
+                }
+
+                const script = arg.get('script')
+                const advanced = !script.isUndefined()
+                if (advanced && type.equals('graphql')) {
+                    diagnostics.error(script, `ACL does not support scripts, because it is of type graphql`)
+                }
+
+                const appliesTo = arg.get('appliesTo').ifString()
+                if (appliesTo && !type.equals('record')) {
+                    diagnostics.error(appliesTo, `ACL cannot set applies_to unless its type is 'record'`)
+                }
+
+                if (operation.equals('add_to_list')) {
+                    const condition = arg.get('condition').ifString()
+                    if (advanced) {
+                        diagnostics.error(script, `ACL cannot have a script due to its 'add_to_list' operation`)
+                    } else if (condition) {
+                        diagnostics.error(condition, `ACL cannot have a condition due to its 'add_to_list' operation`)
+                    }
+                }
+
+                if (arg.get('script').isUnresolved()) {
+                    diagnostics.error(
+                        arg.get('script').getOriginalNode(),
+                        `Unable to resolve the script reference, ensure the imported module is within the ${config.serverModulesDir} directory.`
+                    )
+                }
+
+                const acl = factory.createRecord({
+                    source: callExpression,
+                    table: 'sys_security_acl',
+                    explicitId: arg.get('$id'),
+                    properties: arg.transform(({ $ }) => ({
+                        active: $.def(true),
+                        decision_type: $.from('decisionType').def('allow'),
+                        description: $.def(''),
+                        local_or_existing: $.from('localOrExisting').def('Local'),
+                        admin_overrides: $.from('adminOverrides').def(true),
+                        condition: $.def(''),
+                        applies_to: $.from('appliesTo').def(''),
+                        name: $.from('name', 'table', 'field').map(
+                            (n, t, f) => n.ifString() ?? (f.ifString() ? `${t.getValue()}.${f.getValue()}` : t)
+                        ),
+                        type: $.map((type) => AclTypes[type.asString().getValue()] ?? type),
+                        operation: $.map((op) => AclOperations[op.asString().getValue()] ?? op),
+                        advanced: $.val(advanced),
+                        script: $.map(
+                            (v) =>
+                                v.if(ModuleFunctionShape)?.toString((n) => `answer = ${n}({{PARAMS}})`, ['current']) ??
+                                v
+                        ).toCdata(),
+                        security_attribute: $.from('securityAttribute').map(
+                            (v) => v.ifString()?.pipe((v) => AclAttributes[v.getValue()]) ?? v
+                        ),
+                    })),
+                })
+
+                const roles = arg.get('roles').ifArray()?.getElements() ?? []
+                const securityAttribute = arg.get('securityAttribute')
+                const attributeRecord = securityAttribute.ifRecord()
+                if (roles.length < 1) {
+                    if (!securityAttribute.getValue() && !advanced && !arg.get('condition').getValue()) {
+                        diagnostics.warn(
+                            callExpression,
+                            'ACLs must have at least one of the following: roles, security_attribute, condition, or script'
+                        )
+                    } else if (attributeRecord) {
+                        const localOrExisting = arg.get('localOrExisting').ifString()?.getValue()
+                        if (
+                            localOrExisting === 'Existing' &&
+                            (attributeRecord.get('type').getValue() !== 'compound' ||
+                                attributeRecord.get('is_localized').getValue())
+                        ) {
+                            diagnostics.error(
+                                arg,
+                                `Invalid ACL with 'Existing' security_attribute: Must have a security_attribute with a type of 'compound' and is_localized set to false.`
+                            )
+                        } else if (
+                            (!localOrExisting || localOrExisting === 'Local') &&
+                            !attributeRecord.get('is_localized').ifBoolean()?.getValue()
+                        ) {
+                            diagnostics.error(
+                                arg,
+                                `Invalid ACL with 'Local' security_attribute: security_attribute must have is_localized set to true`
+                            )
+                        }
+                    }
+                }
+
+                return {
+                    success: true,
+                    value: acl.with(
+                        ...roles.map((role) =>
+                            factory.createRecord({
+                                source: callExpression,
+                                table: 'sys_security_acl_role',
+                                properties: {
+                                    sys_security_acl: acl,
+                                    sys_user_role:
+                                        role.ifString()?.pipe((roleNameOrGuid) =>
+                                            isGUID(roleNameOrGuid.getValue())
+                                                ? factory.createReference({
+                                                      source: roleNameOrGuid,
+                                                      table: 'sys_user_role',
+                                                      guid: roleNameOrGuid.getValue(),
+                                                  })
+                                                : factory.createReference({
+                                                      source: roleNameOrGuid,
+                                                      table: 'sys_user_role',
+                                                      keys: { name: roleNameOrGuid },
+                                                  })
+                                        ) ?? role,
+                                },
+                            })
+                        )
+                    ),
+                }
+            },
+        },
+    ],
+})
+
+function getTableOrName(type: keyof typeof AclTypes, name: string) {
+    if (AclNamedTypes[type]) {
+        return { name }
+    }
+    const split = name.indexOf('.')
+    const table = split === -1 ? name : name.substring(0, split)
+    const field = split === -1 ? '' : name.substring(split + 1)
+
+    return { table, ...(field ? { field } : {}) }
+}
+
+function reverseLookup<T extends object>(obj: T, sysId): keyof T {
+    return (Object.entries(obj)
+        .filter(([_, id]) => id === sysId)
+        .map(([key]) => key)[0] || '') as keyof T
+}