@venizia/ignis-kernel 0.4.1 → 0.4.2

package/dist/esm/helpers/inversion/common/types/model.d.ts

@@ -1,5 +1,5 @@
 import type { AbstractEntity } from '../../../../base/models/index.js';
-import type { ScopeFilters, TFilter, TScopeFilterMissingBehavior, TWhere } from '../../../../base/repositories/index.js';
+import type { ScopeFilters, TFilter, TScopeFilterMissingBehavior, TScopeWriteGuard, TWhere } from '../../../../base/repositories/index.js';
 import type { TClass, TNullable, TValueOrResolver } from '@venizia/ignis-helpers/common';
 import type { IArtifactRegistrationOptions } from './artifact.js';
 export interface IModelAuthorizeSettings {
@@ -8,12 +8,38 @@ export interface IModelAuthorizeSettings {
     /** Extensible - consumers can add any extra authorization metadata. */
     [extra: string | symbol]: any;
 }
+/** What a restricted caller may write to the scope columns (`@model` settings.access.write). */
+export interface IModelAccessWriteSettings {
+    /**
+     * What a create, createAll or an update payload that names a scope column does when its value
+     * disagrees with the resolved scope. `reject` (default) refuses the write and writes nothing - for
+     * `createAll` not even the valid rows. `assign` also fills a scope column that is ABSENT from a
+     * created row, when the scope is a single equality; a value that is present and disagrees is
+     * still refused.
+     *
+     * The scope's columns and allowed values are read from the resolved `where` (equality, `eq`, `inq`
+     * and arrays, `and`, and an `or` over one column). Any other shape cannot be checked, and the write
+     * is refused with its own message - never skipped. `ScopeFilters.UNRESTRICTED` bypasses the guard
+     * too, which is the deliberate way to write across scopes (system scope, an admin role).
+     *
+     * Not checked: an update that does not name the scope column (the row was already selected through
+     * the scoped `where`), and raw statements that bypass the repository.
+     */
+    mode?: TScopeWriteGuard;
+    /**
+     * `true` lets a restricted caller write `null` to a scope column, or leave it out on create: the
+     * row has no owner and is shared. Default `false`, so `null` is refused like any other value
+     * outside the scope, even when the resolved scope has a `null` branch (that branch lets the caller
+     * READ shared rows, a separate permission). Reads are scoped as before.
+     */
+    sharedRows?: boolean;
+}
 /**
- * Row-scope resolver for `@model` settings.scopeFilter - resolved per query, so it can depend on
- * the current request (tenant, org, membership). Framework-internal escape hatches aside, nothing
- * short of removing this setting from the model turns scoping off.
+ * Row access for `@model` settings.access - resolved per query, so it can depend on the current
+ * request (tenant, org, membership). Framework-internal escape hatches aside, nothing short of
+ * removing this setting from the model turns scoping off.
  */
-export interface IScopeFilterSettings {
+export interface IModelAccessSettings {
     /**
      * Returns the scope `where`; `ScopeFilters.UNRESTRICTED` to apply no scope for THIS call (an
      * internal operator, a caller the application has decided sees everything); or null/undefined
@@ -27,41 +53,87 @@ export interface IScopeFilterSettings {
      * per MODEL - it cannot express a per-USER bypass; use `ScopeFilters.UNRESTRICTED` for that.
      */
     onMissing?: TScopeFilterMissingBehavior;
+    /**
+     * The property names the write guard checks. Optional: with none declared the guard checks every
+     * column the resolved scope constrains. When declared, each name must exist on the model (checked
+     * at boot), and a resolved scope that constrains any other column is refused as unverifiable.
+     */
+    columns?: string[];
+    /** What a restricted caller may write to the scope columns. See {@link IModelAccessWriteSettings}. */
+    write?: IModelAccessWriteSettings;
+}
+/**
+ * The old, flat shape of {@link IModelAccessSettings}.
+ *
+ * @deprecated Use `settings.access` (`writeGuard` is `access.write.mode`, `sharedRows` is
+ * `access.write.sharedRows`). Removed in 0.4.3.
+ */
+export interface IScopeFilterSettings {
+    resolve: () => TNullable<TWhere> | typeof ScopeFilters.UNRESTRICTED;
+    onMissing?: TScopeFilterMissingBehavior;
+    writeGuard?: TScopeWriteGuard;
+    sharedRows?: boolean;
+    columns?: string[];
+}
+/** What a query runs with when it names nothing (`@model` settings.query). */
+export interface IModelQuerySettings {
+    /** Default filter auto-applied to all repository operations. Bypassable via shouldSkipDefaultFilter. */
+    filter?: TFilter;
+    limit?: {
+        /** Default row limit when a query omits `limit`. Must be a positive integer. Falls back to DEFAULT_LIMIT (10). */
+        default?: number;
+        /**
+         * Largest `limit` a CALLER may ask for. Must be a positive integer. Falls back to
+         * DEFAULT_MAX_LIMIT (1000).
+         *
+         * Policy, not capacity - the engine's own ceiling sits far above it. The number is chosen so
+         * that reaching it means the caller is doing something unusual, and raising it is how a model
+         * says so deliberately.
+         */
+        max?: number;
+    };
 }
 export interface IModelSettings {
     /** Properties excluded from all query results at SQL level. */
     hiddenProperties?: string[];
-    /** Default filter auto-applied to all repository operations. Bypassable via shouldSkipDefaultFilter. */
-    defaultFilter?: TFilter;
+    /** Default filter and limits of a query: `filter`, `limit.default`, `limit.max`. */
+    query?: IModelQuerySettings;
     /**
-     * Row scope: ANDed into every read and write whose scope is expressible as a filter clause, and
-     * NOT removable by `shouldSkipDefaultFilter`. Resolved per query, so it can depend on the current
-     * request. Ownership resolved per row or through a polymorphic reference is NOT expressible here -
-     * that check is still the application's to perform.
+     * Row access: the scope ANDed into every read and write whose scope is expressible as a filter
+     * clause, NOT removable by `shouldSkipDefaultFilter`, and the guard that holds writes to it.
+     * Ownership resolved per row or through a polymorphic reference is NOT expressible here - that
+     * check is still the application's to perform.
      *
      * Relational repositories only - a search-backed model (Typesense, Meilisearch) never reads
      * this setting, so mirroring a scoped entity into a search index needs its own query-time scope.
      */
+    access?: IModelAccessSettings;
+    /** Authorization settings for this model (principal name, etc.). */
+    authorize?: IModelAuthorizeSettings;
+    /** @deprecated Use `query.filter`. Removed in 0.4.3. */
+    defaultFilter?: TFilter;
+    /** @deprecated Use `access`. Removed in 0.4.3. */
     scopeFilter?: IScopeFilterSettings;
-    /** Default row limit when a query omits `limit`. Must be a positive integer. Falls back to DEFAULT_LIMIT (10). */
+    /** @deprecated Use `query.limit.default`. Removed in 0.4.3. */
     defaultLimit?: number;
-    /**
-     * Largest `limit` a CALLER may ask for. Must be a positive integer. Falls back to
-     * DEFAULT_MAX_LIMIT (1000).
-     *
-     * Policy, not capacity - the engine's own ceiling sits far above it. The number is chosen so
-     * that reaching it means the caller is doing something unusual, and raising it is how a model
-     * says so deliberately.
-     */
+    /** @deprecated Use `query.limit.max`. Removed in 0.4.3. */
     maxLimit?: number;
-    /** Authorization settings for this model (principal name, etc.). */
-    authorize?: IModelAuthorizeSettings;
+}
+/** One deprecated settings key a model still uses, and the key that replaces it. */
+export interface IDeprecatedModelSetting {
+    /** The old key, written as the model wrote it: `defaultFilter`, `scopeFilter.writeGuard`. */
+    key: string;
+    /** The key that replaces it: `query.filter`, `access.write.mode`. */
+    use: string;
 }
 export interface IModelMetadata extends IArtifactRegistrationOptions {
     type: 'entity' | 'view';
     tableName?: string;
     skipMigrate?: boolean;
+    /** As the `@model` decorator stores it: normalised to the new keys; the deprecated keys are gone. */
     settings?: IModelSettings;
+    /** Set by the decorator, read by the boot warning; not for application code. */
+    deprecatedSettings?: IDeprecatedModelSetting[];
 }
 export interface IEntityStatics {
     schema?: unknown;

package/dist/esm/helpers/inversion/common/types/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../../../../src/helpers/inversion/common/types/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,OAAO,EACP,2BAA2B,EAC3B,MAAM,EACP,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,EAAE,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC;IAEpE;;;;;OAKG;IACH,SAAS,CAAC,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,wGAAwG;IACxG,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;IAEnC,kHAAkH;IAClH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,oEAAoE;IACpE,SAAS,CAAC,EAAE,uBAAuB,CAAC;CACrC;AAED,MAAM,WAAW,cAAe,SAAQ,4BAA4B;IAClE,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,cAAc,GAAG,cAAc,IAAI,MAAM,CAAC,KAAK,CAAC,GACpF,cAAc,CAAC;AAEjB,qGAAqG;AACrG,MAAM,MAAM,qBAAqB,CAAC,KAAK,SAAS,cAAc,GAAG,cAAc,IAC3E,WAAW,CAAC,KAAK,CAAC,GAClB,CAAC,QAAQ,GAAG,cAAc,CAAC,CAAC;AAEhC,MAAM,WAAW,mBAAmB,CAAC,KAAK,SAAS,cAAc,GAAG,cAAc;IAChF,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAEhB,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAErD,mDAAmD;IACnD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../../../../src/helpers/inversion/common/types/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,OAAO,EACP,2BAA2B,EAC3B,gBAAgB,EAChB,MAAM,EACP,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,gGAAgG;AAChG,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;;;;;;;OAcG;IACH,IAAI,CAAC,EAAE,gBAAgB,CAAC;IAExB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,EAAE,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC;IAEpE;;;;;OAKG;IACH,SAAS,CAAC,EAAE,2BAA2B,CAAC;IAExC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB,sGAAsG;IACtG,KAAK,CAAC,EAAE,yBAAyB,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC;IACpE,SAAS,CAAC,EAAE,2BAA2B,CAAC;IACxC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,wGAAwG;IACxG,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,KAAK,CAAC,EAAE;QACN,kHAAkH;QAClH,OAAO,CAAC,EAAE,MAAM,CAAC;QAEjB;;;;;;;WAOG;QACH,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,oFAAoF;IACpF,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAE5B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAE9B,oEAAoE;IACpE,SAAS,CAAC,EAAE,uBAAuB,CAAC;IAEpC,wDAAwD;IACxD,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,kDAAkD;IAClD,WAAW,CAAC,EAAE,oBAAoB,CAAC;IAEnC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,MAAM,WAAW,uBAAuB;IACtC,6FAA6F;IAC7F,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,cAAe,SAAQ,4BAA4B;IAClE,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,qGAAqG;IACrG,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,uBAAuB,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,cAAc,GAAG,cAAc,IAAI,MAAM,CAAC,KAAK,CAAC,GACpF,cAAc,CAAC;AAEjB,qGAAqG;AACrG,MAAM,MAAM,qBAAqB,CAAC,KAAK,SAAS,cAAc,GAAG,cAAc,IAC3E,WAAW,CAAC,KAAK,CAAC,GAClB,CAAC,QAAQ,GAAG,cAAc,CAAC,CAAC;AAEhC,MAAM,WAAW,mBAAmB,CAAC,KAAK,SAAS,cAAc,GAAG,cAAc;IAChF,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAEhB,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAErD,mDAAmD;IACnD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B"}

package/dist/esm/helpers/inversion/common/types/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../../../../src/helpers/inversion/common/types/model.ts"],"names":[],"mappings":"","sourcesContent":["import type { AbstractEntity } from '@/base/models';\nimport type {\n  ScopeFilters,\n  TFilter,\n  TScopeFilterMissingBehavior,\n  TWhere,\n} from '@/base/repositories';\nimport type { TClass, TNullable, TValueOrResolver } from '@venizia/ignis-helpers/common';\nimport type { IArtifactRegistrationOptions } from './artifact';\n\nexport interface IModelAuthorizeSettings {\n  /** The authorization principal name (resource/subject) for this model. */\n  principal: string;\n  /** Extensible - consumers can add any extra authorization metadata. */\n  [extra: string | symbol]: any;\n}\n\n/**\n * Row-scope resolver for `@model` settings.scopeFilter - resolved per query, so it can depend on\n * the current request (tenant, org, membership). Framework-internal escape hatches aside, nothing\n * short of removing this setting from the model turns scoping off.\n */\nexport interface IScopeFilterSettings {\n  /**\n   * Returns the scope `where`; `ScopeFilters.UNRESTRICTED` to apply no scope for THIS call (an\n   * internal operator, a caller the application has decided sees everything); or null/undefined\n   * when this caller's scope cannot be determined at all.\n   */\n  resolve: () => TNullable<TWhere> | typeof ScopeFilters.UNRESTRICTED;\n\n  /**\n   * What `applyScopeFilter` does when `resolve()` returns null/undefined - no request context, no\n   * tenant, a background job. Defaults to `deny`: an unresolved scope matches zero rows, never\n   * every row. `allow` is an explicit, reviewed opt-out for migrations and background jobs, declared\n   * per MODEL - it cannot express a per-USER bypass; use `ScopeFilters.UNRESTRICTED` for that.\n   */\n  onMissing?: TScopeFilterMissingBehavior;\n}\n\nexport interface IModelSettings {\n  /** Properties excluded from all query results at SQL level. */\n  hiddenProperties?: string[];\n\n  /** Default filter auto-applied to all repository operations. Bypassable via shouldSkipDefaultFilter. */\n  defaultFilter?: TFilter;\n\n  /**\n   * Row scope: ANDed into every read and write whose scope is expressible as a filter clause, and\n   * NOT removable by `shouldSkipDefaultFilter`. Resolved per query, so it can depend on the current\n   * request. Ownership resolved per row or through a polymorphic reference is NOT expressible here -\n   * that check is still the application's to perform.\n   *\n   * Relational repositories only - a search-backed model (Typesense, Meilisearch) never reads\n   * this setting, so mirroring a scoped entity into a search index needs its own query-time scope.\n   */\n  scopeFilter?: IScopeFilterSettings;\n\n  /** Default row limit when a query omits `limit`. Must be a positive integer. Falls back to DEFAULT_LIMIT (10). */\n  defaultLimit?: number;\n\n  /**\n   * Largest `limit` a CALLER may ask for. Must be a positive integer. Falls back to\n   * DEFAULT_MAX_LIMIT (1000).\n   *\n   * Policy, not capacity - the engine's own ceiling sits far above it. The number is chosen so\n   * that reaching it means the caller is doing something unusual, and raising it is how a model\n   * says so deliberately.\n   */\n  maxLimit?: number;\n\n  /** Authorization settings for this model (principal name, etc.). */\n  authorize?: IModelAuthorizeSettings;\n}\n\nexport interface IModelMetadata extends IArtifactRegistrationOptions {\n  type: 'entity' | 'view';\n  tableName?: string;\n  skipMigrate?: boolean;\n  settings?: IModelSettings;\n}\n\nexport interface IEntityStatics {\n  schema?: unknown;\n  relations?: TValueOrResolver<Array<unknown>>;\n}\n\nexport type TModelClass<Model extends AbstractEntity = AbstractEntity> = TClass<Model> &\n  IEntityStatics;\n\n/** Decorator target for model classes (supports both strongly typed and ClassDecorator patterns). */\nexport type TDecoratorModelTarget<Model extends AbstractEntity = AbstractEntity> =\n  | TModelClass<Model>\n  | (Function & IEntityStatics);\n\nexport interface IModelRegistryEntry<Model extends AbstractEntity = AbstractEntity> {\n  target: TValueOrResolver<TClass<Model>>;\n  metadata: IModelMetadata;\n  schema: unknown;\n\n  /** Lazy resolver to avoid circular deps. Resolved when DataSource builds schema. */\n  relationsResolver?: TValueOrResolver<Array<unknown>>;\n\n  /** Cache populated on first buildSchema() call. */\n  _builtRelations?: unknown;\n}\n"]}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../../../../src/helpers/inversion/common/types/model.ts"],"names":[],"mappings":"","sourcesContent":["import type { AbstractEntity } from '@/base/models';\nimport type {\n  ScopeFilters,\n  TFilter,\n  TScopeFilterMissingBehavior,\n  TScopeWriteGuard,\n  TWhere,\n} from '@/base/repositories';\nimport type { TClass, TNullable, TValueOrResolver } from '@venizia/ignis-helpers/common';\nimport type { IArtifactRegistrationOptions } from './artifact';\n\nexport interface IModelAuthorizeSettings {\n  /** The authorization principal name (resource/subject) for this model. */\n  principal: string;\n  /** Extensible - consumers can add any extra authorization metadata. */\n  [extra: string | symbol]: any;\n}\n\n/** What a restricted caller may write to the scope columns (`@model` settings.access.write). */\nexport interface IModelAccessWriteSettings {\n  /**\n   * What a create, createAll or an update payload that names a scope column does when its value\n   * disagrees with the resolved scope. `reject` (default) refuses the write and writes nothing - for\n   * `createAll` not even the valid rows. `assign` also fills a scope column that is ABSENT from a\n   * created row, when the scope is a single equality; a value that is present and disagrees is\n   * still refused.\n   *\n   * The scope's columns and allowed values are read from the resolved `where` (equality, `eq`, `inq`\n   * and arrays, `and`, and an `or` over one column). Any other shape cannot be checked, and the write\n   * is refused with its own message - never skipped. `ScopeFilters.UNRESTRICTED` bypasses the guard\n   * too, which is the deliberate way to write across scopes (system scope, an admin role).\n   *\n   * Not checked: an update that does not name the scope column (the row was already selected through\n   * the scoped `where`), and raw statements that bypass the repository.\n   */\n  mode?: TScopeWriteGuard;\n\n  /**\n   * `true` lets a restricted caller write `null` to a scope column, or leave it out on create: the\n   * row has no owner and is shared. Default `false`, so `null` is refused like any other value\n   * outside the scope, even when the resolved scope has a `null` branch (that branch lets the caller\n   * READ shared rows, a separate permission). Reads are scoped as before.\n   */\n  sharedRows?: boolean;\n}\n\n/**\n * Row access for `@model` settings.access - resolved per query, so it can depend on the current\n * request (tenant, org, membership). Framework-internal escape hatches aside, nothing short of\n * removing this setting from the model turns scoping off.\n */\nexport interface IModelAccessSettings {\n  /**\n   * Returns the scope `where`; `ScopeFilters.UNRESTRICTED` to apply no scope for THIS call (an\n   * internal operator, a caller the application has decided sees everything); or null/undefined\n   * when this caller's scope cannot be determined at all.\n   */\n  resolve: () => TNullable<TWhere> | typeof ScopeFilters.UNRESTRICTED;\n\n  /**\n   * What `applyScopeFilter` does when `resolve()` returns null/undefined - no request context, no\n   * tenant, a background job. Defaults to `deny`: an unresolved scope matches zero rows, never\n   * every row. `allow` is an explicit, reviewed opt-out for migrations and background jobs, declared\n   * per MODEL - it cannot express a per-USER bypass; use `ScopeFilters.UNRESTRICTED` for that.\n   */\n  onMissing?: TScopeFilterMissingBehavior;\n\n  /**\n   * The property names the write guard checks. Optional: with none declared the guard checks every\n   * column the resolved scope constrains. When declared, each name must exist on the model (checked\n   * at boot), and a resolved scope that constrains any other column is refused as unverifiable.\n   */\n  columns?: string[];\n\n  /** What a restricted caller may write to the scope columns. See {@link IModelAccessWriteSettings}. */\n  write?: IModelAccessWriteSettings;\n}\n\n/**\n * The old, flat shape of {@link IModelAccessSettings}.\n *\n * @deprecated Use `settings.access` (`writeGuard` is `access.write.mode`, `sharedRows` is\n * `access.write.sharedRows`). Removed in 0.4.3.\n */\nexport interface IScopeFilterSettings {\n  resolve: () => TNullable<TWhere> | typeof ScopeFilters.UNRESTRICTED;\n  onMissing?: TScopeFilterMissingBehavior;\n  writeGuard?: TScopeWriteGuard;\n  sharedRows?: boolean;\n  columns?: string[];\n}\n\n/** What a query runs with when it names nothing (`@model` settings.query). */\nexport interface IModelQuerySettings {\n  /** Default filter auto-applied to all repository operations. Bypassable via shouldSkipDefaultFilter. */\n  filter?: TFilter;\n\n  limit?: {\n    /** Default row limit when a query omits `limit`. Must be a positive integer. Falls back to DEFAULT_LIMIT (10). */\n    default?: number;\n\n    /**\n     * Largest `limit` a CALLER may ask for. Must be a positive integer. Falls back to\n     * DEFAULT_MAX_LIMIT (1000).\n     *\n     * Policy, not capacity - the engine's own ceiling sits far above it. The number is chosen so\n     * that reaching it means the caller is doing something unusual, and raising it is how a model\n     * says so deliberately.\n     */\n    max?: number;\n  };\n}\n\nexport interface IModelSettings {\n  /** Properties excluded from all query results at SQL level. */\n  hiddenProperties?: string[];\n\n  /** Default filter and limits of a query: `filter`, `limit.default`, `limit.max`. */\n  query?: IModelQuerySettings;\n\n  /**\n   * Row access: the scope ANDed into every read and write whose scope is expressible as a filter\n   * clause, NOT removable by `shouldSkipDefaultFilter`, and the guard that holds writes to it.\n   * Ownership resolved per row or through a polymorphic reference is NOT expressible here - that\n   * check is still the application's to perform.\n   *\n   * Relational repositories only - a search-backed model (Typesense, Meilisearch) never reads\n   * this setting, so mirroring a scoped entity into a search index needs its own query-time scope.\n   */\n  access?: IModelAccessSettings;\n\n  /** Authorization settings for this model (principal name, etc.). */\n  authorize?: IModelAuthorizeSettings;\n\n  /** @deprecated Use `query.filter`. Removed in 0.4.3. */\n  defaultFilter?: TFilter;\n\n  /** @deprecated Use `access`. Removed in 0.4.3. */\n  scopeFilter?: IScopeFilterSettings;\n\n  /** @deprecated Use `query.limit.default`. Removed in 0.4.3. */\n  defaultLimit?: number;\n\n  /** @deprecated Use `query.limit.max`. Removed in 0.4.3. */\n  maxLimit?: number;\n}\n\n/** One deprecated settings key a model still uses, and the key that replaces it. */\nexport interface IDeprecatedModelSetting {\n  /** The old key, written as the model wrote it: `defaultFilter`, `scopeFilter.writeGuard`. */\n  key: string;\n  /** The key that replaces it: `query.filter`, `access.write.mode`. */\n  use: string;\n}\n\nexport interface IModelMetadata extends IArtifactRegistrationOptions {\n  type: 'entity' | 'view';\n  tableName?: string;\n  skipMigrate?: boolean;\n\n  /** As the `@model` decorator stores it: normalised to the new keys; the deprecated keys are gone. */\n  settings?: IModelSettings;\n\n  /** Set by the decorator, read by the boot warning; not for application code. */\n  deprecatedSettings?: IDeprecatedModelSetting[];\n}\n\nexport interface IEntityStatics {\n  schema?: unknown;\n  relations?: TValueOrResolver<Array<unknown>>;\n}\n\nexport type TModelClass<Model extends AbstractEntity = AbstractEntity> = TClass<Model> &\n  IEntityStatics;\n\n/** Decorator target for model classes (supports both strongly typed and ClassDecorator patterns). */\nexport type TDecoratorModelTarget<Model extends AbstractEntity = AbstractEntity> =\n  | TModelClass<Model>\n  | (Function & IEntityStatics);\n\nexport interface IModelRegistryEntry<Model extends AbstractEntity = AbstractEntity> {\n  target: TValueOrResolver<TClass<Model>>;\n  metadata: IModelMetadata;\n  schema: unknown;\n\n  /** Lazy resolver to avoid circular deps. Resolved when DataSource builds schema. */\n  relationsResolver?: TValueOrResolver<Array<unknown>>;\n\n  /** Cache populated on first buildSchema() call. */\n  _builtRelations?: unknown;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venizia/ignis-kernel",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Browser-pure kernel of the IGNIS framework: dependency injection, lifecycle, REST controllers, repository and datasource abstractions, and the authentication and authorization seams. No node builtin and no server-only peer, so the same kernel serves a Bun server and a browser Worker.",
   "keywords": [
     "authentication",
@@ -79,14 +79,14 @@
     "prepublishOnly": "make rebuild"
   },
   "dependencies": {
-    "@venizia/ignis-filter": "0.4.1",
-    "@venizia/ignis-helpers": "0.4.1",
-    "@venizia/ignis-inversion": "0.4.1",
+    "@venizia/ignis-filter": "0.4.2",
+    "@venizia/ignis-helpers": "0.4.2",
+    "@venizia/ignis-inversion": "0.4.2",
     "reflect-metadata": "^0.2.2"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
-    "@venizia/dev-configs": "0.4.1",
+    "@venizia/dev-configs": "0.4.2",
     "casbin": "^5.51.1",
     "eslint": "^10.13.0",
     "oxlint": "1.89.0",