@weave-kit/engine 0.1.0

package/dist/core/proxy/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/proxy/types.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAEH,oDAAoD;AACpD,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;CACR,CAAC;AAGX,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAeX,+GAA+G;AAC/G,MAAM,CAAC,MAAM,mBAAmB,GAAe;IAC7C,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC;IACxG,KAAK,EAAE,CAAC,WAAW,CAAC;CACrB,CAAC;AAwDF,oGAAoG;AACpG,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACjD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAY,EAAE,KAAiB;IAChF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACnF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/rbac/authorize.d.ts

@@ -0,0 +1,13 @@
+import type { ObjectDefinition } from '../types/index.js';
+import type { Locale } from '../i18n/index.js';
+export declare function canCreate(def: ObjectDefinition, roles: readonly string[]): boolean;
+export declare function canDelete(def: ObjectDefinition, roles: readonly string[]): boolean;
+export declare function canUpdate(def: ObjectDefinition, roles: readonly string[]): boolean;
+export declare function canUpdateField(def: ObjectDefinition, roles: readonly string[], field: string): boolean;
+/** allowed update fields; null = all fields, [] = none */
+export declare function allowedUpdateFields(def: ObjectDefinition, roles: readonly string[]): string[] | null;
+export declare function assertCanCreate(def: ObjectDefinition, roles: readonly string[], locale?: Locale): void;
+export declare function assertCanUpdate(def: ObjectDefinition, roles: readonly string[], locale?: Locale): void;
+export declare function assertCanDelete(def: ObjectDefinition, roles: readonly string[], locale?: Locale): void;
+export declare function assertCanUpdateField(def: ObjectDefinition, roles: readonly string[], field: string, locale?: Locale): void;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/core/rbac/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAc,MAAM,kBAAkB,CAAC;AAQ3D,wBAAgB,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAElF;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAElF;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIlF;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAItG;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAEpG;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAIN"}

package/dist/core/rbac/authorize.js

@@ -0,0 +1,45 @@
+import { SchemaError } from '../types/errors.js';
+import { resolvePermission } from './resolve.js';
+function deny(locale, code, params) {
+    throw new SchemaError(code, params, locale);
+}
+export function canCreate(def, roles) {
+    return resolvePermission(def, roles)?.create === true;
+}
+export function canDelete(def, roles) {
+    return resolvePermission(def, roles)?.delete === true;
+}
+export function canUpdate(def, roles) {
+    const p = resolvePermission(def, roles);
+    if (p === undefined)
+        return false;
+    return p.update === null || p.update.length > 0;
+}
+export function canUpdateField(def, roles, field) {
+    const p = resolvePermission(def, roles);
+    if (p === undefined)
+        return false;
+    return p.update === null || p.update.includes(field);
+}
+/** allowed update fields; null = all fields, [] = none */
+export function allowedUpdateFields(def, roles) {
+    return resolvePermission(def, roles)?.update ?? null;
+}
+export function assertCanCreate(def, roles, locale) {
+    if (!canCreate(def, roles))
+        deny(locale, 'rbac.denied.create', { object: def.name, role: roles.join(',') });
+}
+export function assertCanUpdate(def, roles, locale) {
+    if (!canUpdate(def, roles))
+        deny(locale, 'rbac.denied.update', { object: def.name, role: roles.join(',') });
+}
+export function assertCanDelete(def, roles, locale) {
+    if (!canDelete(def, roles))
+        deny(locale, 'rbac.denied.delete', { object: def.name, role: roles.join(',') });
+}
+export function assertCanUpdateField(def, roles, field, locale) {
+    if (!canUpdateField(def, roles, field)) {
+        deny(locale, 'rbac.denied.field', { object: def.name, role: roles.join(','), field });
+    }
+}
+//# sourceMappingURL=authorize.js.map

package/dist/core/rbac/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/core/rbac/authorize.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,SAAS,IAAI,CAAC,MAA0B,EAAE,IAAgB,EAAE,MAA+B;IACzF,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAqB,EAAE,KAAwB;IACvE,OAAO,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAqB,EAAE,KAAwB;IACvE,OAAO,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAqB,EAAE,KAAwB;IACvE,MAAM,CAAC,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAqB,EAAE,KAAwB,EAAE,KAAa;IAC3F,MAAM,CAAC,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,mBAAmB,CAAC,GAAqB,EAAE,KAAwB;IACjF,OAAO,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAqB,EACrB,KAAwB,EACxB,MAAe;IAEf,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAqB,EACrB,KAAwB,EACxB,MAAe;IAEf,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAqB,EACrB,KAAwB,EACxB,MAAe;IAEf,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAqB,EACrB,KAAwB,EACxB,KAAa,EACb,MAAe;IAEf,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}

package/dist/core/rbac/fields.d.ts

@@ -0,0 +1,4 @@
+import type { ObjectDefinition } from '../types/index.js';
+/** fields hidden from read output for the given roles (empty = nothing hidden) */
+export declare function excludedFields(def: ObjectDefinition, roles: readonly string[]): string[];
+//# sourceMappingURL=fields.d.ts.map

package/dist/core/rbac/fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/fields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAExF"}

package/dist/core/rbac/fields.js

@@ -0,0 +1,6 @@
+import { resolvePermission } from './resolve.js';
+/** fields hidden from read output for the given roles (empty = nothing hidden) */
+export function excludedFields(def, roles) {
+    return resolvePermission(def, roles)?.exclude ?? [];
+}
+//# sourceMappingURL=fields.js.map

package/dist/core/rbac/fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields.js","sourceRoot":"","sources":["../../../src/core/rbac/fields.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,GAAqB,EAAE,KAAwB;IAC5E,OAAO,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;AACtD,CAAC"}

package/dist/core/rbac/index.d.ts

@@ -0,0 +1,9 @@
+export type { RbacSubject } from './types.js';
+export type { ResolvedPermission } from './resolve.js';
+export type { RowScopeFragment } from './rowScope.js';
+export { resolvePermission } from './resolve.js';
+export { canCreate, canDelete, canUpdate, canUpdateField, allowedUpdateFields, assertCanCreate, assertCanUpdate, assertCanDelete, assertCanUpdateField, } from './authorize.js';
+export { buildRowScope } from './rowScope.js';
+export { excludedFields } from './fields.js';
+export { buildRlsPolicy, buildRlsPolicyDdl, buildRlsGrantDdl, policyName } from './rls.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/rbac/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC"}

package/dist/core/rbac/index.js

@@ -0,0 +1,6 @@
+export { resolvePermission } from './resolve.js';
+export { canCreate, canDelete, canUpdate, canUpdateField, allowedUpdateFields, assertCanCreate, assertCanUpdate, assertCanDelete, assertCanUpdateField, } from './authorize.js';
+export { buildRowScope } from './rowScope.js';
+export { excludedFields } from './fields.js';
+export { buildRlsPolicy, buildRlsPolicyDdl, buildRlsGrantDdl, policyName } from './rls.js';
+//# sourceMappingURL=index.js.map

package/dist/core/rbac/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/rbac/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC"}

package/dist/core/rbac/resolve.d.ts

@@ -0,0 +1,22 @@
+import type { ObjectDefinition, ReadScope } from '../types/index.js';
+/** the effective permission for a set of roles, after applying defaults and merging */
+export interface ResolvedPermission {
+    /** read scope; undefined = read denied */
+    read?: ReadScope;
+    create: boolean;
+    /** null = all fields updatable; [] = none; otherwise the whitelist */
+    update: string[] | null;
+    delete: boolean;
+    /** fields hidden from read output for these roles */
+    exclude: string[];
+    /** null = all writable fields allowed on create; [] = none; otherwise the whitelist */
+    createFields: string[] | null;
+}
+/**
+ * Resolve the effective permission for a subject's roles.
+ * - no `permissions` map on the object → full CRUD (open mode)
+ * - permissions declared but none of the roles listed → denied (returns undefined)
+ * - multiple roles → merged: read takes the most permissive scope, update/exclude union
+ */
+export declare function resolvePermission(def: ObjectDefinition, roles: readonly string[]): ResolvedPermission | undefined;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/core/rbac/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAwB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG3F,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uFAAuF;IACvF,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC/B;AAkBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,kBAAkB,GAAG,SAAS,CA+BhC"}

package/dist/core/rbac/resolve.js

@@ -0,0 +1,55 @@
+import { READ_SCOPES } from '../types/index.js';
+const READ_RANK = { own: 1, team: 2, all: 3 };
+/** defaults for a declared role: unspecified operations are denied (fail-closed) */
+function declaredPermission(p) {
+    return {
+        read: p.read,
+        create: p.create ?? false,
+        // update: true -> null (all fields updatable); false/undefined -> [] (none)
+        update: p.update === true ? null : (typeof p.update === 'boolean' ? [] : (p.update ?? [])),
+        delete: p.delete ?? false,
+        exclude: p.fields?.exclude ?? [],
+        // fields.create: undefined -> null (unrestricted, backward compatible); [] -> none; else whitelist
+        createFields: p.fields?.create === undefined ? null : p.fields.create,
+    };
+}
+/**
+ * Resolve the effective permission for a subject's roles.
+ * - no `permissions` map on the object → full CRUD (open mode)
+ * - permissions declared but none of the roles listed → denied (returns undefined)
+ * - multiple roles → merged: read takes the most permissive scope, update/exclude union
+ */
+export function resolvePermission(def, roles) {
+    if (def.permissions === undefined) {
+        return { read: READ_SCOPES.ALL, create: true, update: null, delete: true, exclude: [], createFields: null };
+    }
+    const resolved = [];
+    for (const role of roles) {
+        const p = def.permissions[role];
+        if (p !== undefined)
+            resolved.push(declaredPermission(p));
+    }
+    if (resolved.length === 0)
+        return undefined;
+    let read;
+    for (const r of resolved) {
+        if (r.read !== undefined && (read === undefined || READ_RANK[r.read] > READ_RANK[read])) {
+            read = r.read;
+        }
+    }
+    const update = resolved.some((r) => r.update === null)
+        ? null
+        : Array.from(new Set(resolved.flatMap((r) => r.update ?? [])));
+    const createFields = resolved.some((r) => r.createFields === null)
+        ? null
+        : Array.from(new Set(resolved.flatMap((r) => r.createFields ?? [])));
+    return {
+        read,
+        create: resolved.some((r) => r.create),
+        delete: resolved.some((r) => r.delete),
+        update,
+        exclude: Array.from(new Set(resolved.flatMap((r) => r.exclude))),
+        createFields,
+    };
+}
+//# sourceMappingURL=resolve.js.map

package/dist/core/rbac/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/core/rbac/resolve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAgBhD,MAAM,SAAS,GAA8B,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAEzE,oFAAoF;AACpF,SAAS,kBAAkB,CAAC,CAAuB;IACjD,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK;QACzB,4EAA4E;QAC5E,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK;QACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE;QAChC,mGAAmG;QACnG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;KACtE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAqB,EACrB,KAAwB;IAExB,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC9G,CAAC;IACD,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5C,IAAI,IAA2B,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxF,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAoB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;QACrE,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAoB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC;QACjF,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/core/rbac/rls.d.ts

@@ -0,0 +1,12 @@
+import type { ObjectDefinition } from '../types/index.js';
+export declare function policyName(def: ObjectDefinition): string;
+/**
+ * The read-policy predicate for one object, or `undefined` when no declared role
+ * can read (default deny — no policy is created, RLS denies everything).
+ */
+export declare function buildRlsPolicy(def: ObjectDefinition): string | undefined;
+/** the policy DDL for a fresh table (drop+create keeps it idempotent across runs) */
+export declare function buildRlsPolicyDdl(def: ObjectDefinition): string[];
+/** GRANT the restricted-SQL role read access to one object */
+export declare function buildRlsGrantDdl(def: ObjectDefinition, role: string): string;
+//# sourceMappingURL=rls.d.ts.map

package/dist/core/rbac/rls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/rls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA0B1D,wBAAgB,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAExD;AAUD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAwBxE;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAQjE;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5E"}

package/dist/core/rbac/rls.js

@@ -0,0 +1,77 @@
+import { READ_SCOPES, ROW_SCOPE_MARKERS } from '../types/index.js';
+const q = (id) => `"${id}"`;
+/**
+ * Row-level security policy generation for the script sandbox's restricted SQL
+ * (`this.db.query`). The engine's own data access runs as the table owner, which
+ * bypasses RLS (no `FORCE`), so row scoping stays in the application layer there.
+ * `db.query` switches to a dedicated non-owner role (`SET LOCAL ROLE`) that IS
+ * subject to RLS, and the subject is carried in session GUCs:
+ *
+ * - `weavekit.roles`     comma-joined role names
+ * - `weavekit.actor_id`  subject id (own scope)
+ * - `weavekit.team_id`   subject team id (team scope)
+ *
+ * Unset GUCs resolve to NULL → the predicate is false → **0 rows (fail-closed)**.
+ *
+ * The predicate mirrors `resolvePermission` + `buildRowScope`: this is a second
+ * encoding of the same matrix, so a parity test (db.objects vs db.query must
+ * return the same rows for the same subject) guards against drift.
+ */
+const POLICY_PREFIX = 'weavekit_read_';
+export function policyName(def) {
+    return `${POLICY_PREFIX}${def.name}`;
+}
+function roleIn(role) {
+    return `'${role.replace(/'/g, "''")}' = ANY (string_to_array(current_setting('weavekit.roles', true), ','))`;
+}
+function markerField(def, marker) {
+    return def.fields.find((f) => f[marker] === true)?.name;
+}
+/**
+ * The read-policy predicate for one object, or `undefined` when no declared role
+ * can read (default deny — no policy is created, RLS denies everything).
+ */
+export function buildRlsPolicy(def) {
+    if (def.permissions === undefined) {
+        // open mode — any subject reaching the role-gated db.query path may read all rows
+        return 'true';
+    }
+    const clauses = [];
+    for (const [role, p] of Object.entries(def.permissions)) {
+        if (p.read === undefined)
+            continue;
+        if (p.read === READ_SCOPES.ALL) {
+            clauses.push(roleIn(role));
+        }
+        else if (p.read === READ_SCOPES.OWN) {
+            const field = markerField(def, ROW_SCOPE_MARKERS.OWNERSHIP);
+            if (field !== undefined) {
+                clauses.push(`(${roleIn(role)} AND current_setting('weavekit.actor_id', true) = ${q(field)})`);
+            }
+        }
+        else if (p.read === READ_SCOPES.TEAM) {
+            const field = markerField(def, ROW_SCOPE_MARKERS.TEAM);
+            if (field !== undefined) {
+                clauses.push(`(${roleIn(role)} AND current_setting('weavekit.team_id', true) = ${q(field)})`);
+            }
+        }
+    }
+    if (clauses.length === 0)
+        return undefined;
+    return clauses.length === 1 ? clauses[0] : `(${clauses.join(' OR ')})`;
+}
+/** the policy DDL for a fresh table (drop+create keeps it idempotent across runs) */
+export function buildRlsPolicyDdl(def) {
+    const name = policyName(def);
+    const policy = buildRlsPolicy(def);
+    const stmts = [`DROP POLICY IF EXISTS ${name} ON ${q(def.name)};`];
+    if (policy !== undefined) {
+        stmts.push(`CREATE POLICY ${name} ON ${q(def.name)} FOR SELECT USING (${policy});`);
+    }
+    return stmts;
+}
+/** GRANT the restricted-SQL role read access to one object */
+export function buildRlsGrantDdl(def, role) {
+    return `GRANT SELECT ON ${q(def.name)} TO ${role};`;
+}
+//# sourceMappingURL=rls.js.map

package/dist/core/rbac/rls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls.js","sourceRoot":"","sources":["../../../src/core/rbac/rls.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGnE,MAAM,CAAC,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;AAEpC;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,MAAM,UAAU,UAAU,CAAC,GAAqB;IAC9C,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,yEAAyE,CAAC;AAC/G,CAAC;AAED,SAAS,WAAW,CAAC,GAAqB,EAAE,MAAsB;IAChE,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAwC,CAAC,MAA2B,CAAC,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC;AACvH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAqB;IAClD,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClC,kFAAkF;QAClF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AAC1E,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,GAAqB;IACrD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAa,CAAC,yBAAyB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,MAAM,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,GAAqB,EAAE,IAAY;IAClE,OAAO,mBAAmB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC;AACtD,CAAC"}

package/dist/core/rbac/rowScope.d.ts

@@ -0,0 +1,15 @@
+import type { ObjectDefinition, ReadScope } from '../types/index.js';
+import type { Locale } from '../i18n/index.js';
+import type { RbacSubject } from './types.js';
+export interface RowScopeFragment {
+    sql: string;
+    params: unknown[];
+}
+/**
+ * Build the row-level WHERE fragment for a read scope.
+ * - all → undefined (no restriction)
+ * - own → `"<ownershipField>" = :subject.id`
+ * - team → `"<teamField>" = :subject.teamId` (throws if the subject has no teamId)
+ */
+export declare function buildRowScope(def: ObjectDefinition, read: ReadScope | undefined, subject: RbacSubject, roles: readonly string[], locale?: Locale): RowScopeFragment | undefined;
+//# sourceMappingURL=rowScope.d.ts.map

package/dist/core/rbac/rowScope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rowScope.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/rowScope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAkB,MAAM,mBAAmB,CAAC;AAErF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAUD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,SAAS,GAAG,SAAS,EAC3B,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,gBAAgB,GAAG,SAAS,CAU9B"}

package/dist/core/rbac/rowScope.js

@@ -0,0 +1,28 @@
+import { READ_SCOPES, ROW_SCOPE_MARKERS } from '../types/index.js';
+import { SchemaError } from '../types/errors.js';
+function ownershipField(def, role, locale, marker) {
+    const field = def.fields.find((f) => f[marker] === true);
+    if (field === undefined) {
+        throw new SchemaError('rbac.denied.read', { object: def.name, role }, locale);
+    }
+    return field.name;
+}
+/**
+ * Build the row-level WHERE fragment for a read scope.
+ * - all → undefined (no restriction)
+ * - own → `"<ownershipField>" = :subject.id`
+ * - team → `"<teamField>" = :subject.teamId` (throws if the subject has no teamId)
+ */
+export function buildRowScope(def, read, subject, roles, locale) {
+    if (read === undefined || read === READ_SCOPES.ALL)
+        return undefined;
+    const role = roles.join(',');
+    if (read === READ_SCOPES.OWN) {
+        return { sql: `"${ownershipField(def, role, locale, ROW_SCOPE_MARKERS.OWNERSHIP)}" = $1`, params: [subject.id] };
+    }
+    if (subject.teamId === undefined) {
+        throw new SchemaError('rbac.teamId.missing', { object: def.name }, locale);
+    }
+    return { sql: `"${ownershipField(def, role, locale, ROW_SCOPE_MARKERS.TEAM)}" = $1`, params: [subject.teamId] };
+}
+//# sourceMappingURL=rowScope.js.map

package/dist/core/rbac/rowScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rowScope.js","sourceRoot":"","sources":["../../../src/core/rbac/rowScope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAQjD,SAAS,cAAc,CAAC,GAAqB,EAAE,IAAY,EAAE,MAA0B,EAAE,MAAsB;IAC7G,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAwC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACjG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAqB,EACrB,IAA2B,EAC3B,OAAoB,EACpB,KAAwB,EACxB,MAAe;IAEf,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;AAClH,CAAC"}

package/dist/core/rbac/types.d.ts

@@ -0,0 +1,8 @@
+/** the authenticated identity that RBAC decisions are made for (constructed by the authentication layer) */
+export interface RbacSubject {
+    id: string;
+    roles: string[];
+    /** team identifier for read:team scope; a subject currently has a single team */
+    teamId?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/rbac/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/types.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/dist/core/rbac/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/rbac/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/rbac/types.ts"],"names":[],"mappings":""}

package/dist/core/script/index.d.ts

@@ -0,0 +1,6 @@
+export { NOOP_SCRIPT_DISPATCHER, SCRIPT_HOOKS, } from './types.js';
+export { SCRIPT_SOURCE_KINDS } from './values.js';
+export type { ScriptSourceKind } from './values.js';
+export { detectScriptHooks, invalidScriptHookSignatures } from './source.js';
+export type { EngineScriptConfig, EngineScriptSandboxConfig, ScriptContext, ScriptDb, ScriptDispatchArgs, ScriptDispatchResult, ScriptDispatcher, ScriptEmailSendOptions, ScriptFindOptions, ScriptFindResult, ScriptHook, ScriptObjectQueryBuilder, ScriptRestrictedQueryResult, ScriptServices, ScriptSlackPostOptions, ScriptSort, ScriptUser, ScriptWebhookCallOptions, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/script/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/script/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC7E,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,aAAa,EACb,QAAQ,EACR,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,cAAc,EACd,sBAAsB,EACtB,UAAU,EACV,UAAU,EACV,wBAAwB,GACzB,MAAM,YAAY,CAAC"}

package/dist/core/script/index.js

@@ -0,0 +1,4 @@
+export { NOOP_SCRIPT_DISPATCHER, SCRIPT_HOOKS, } from './types.js';
+export { SCRIPT_SOURCE_KINDS } from './values.js';
+export { detectScriptHooks, invalidScriptHookSignatures } from './source.js';
+//# sourceMappingURL=index.js.map

package/dist/core/script/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/script/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC"}

package/dist/core/script/source.d.ts

@@ -0,0 +1,6 @@
+import { type ScriptHook } from './types.js';
+/** Detect supported server hook exports without executing the source. */
+export declare function detectScriptHooks(source: string): ScriptHook[];
+/** Server hooks receive their context through `this` and must declare no arguments. */
+export declare function invalidScriptHookSignatures(source: string): ScriptHook[];
+//# sourceMappingURL=source.d.ts.map

package/dist/core/script/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../src/core/script/source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAO3D,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,CAS9D;AAED,uFAAuF;AACvF,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,CAmBxE"}

package/dist/core/script/source.js

@@ -0,0 +1,31 @@
+import { SCRIPT_HOOKS } from './types.js';
+/** One named export per match: `export function x` or `export const x`. */
+const EXPORT_PATTERN = /export\s+(?:async\s+)?function\s+(\w+)|export\s+(?:const|let|var)\s+(\w+)/g;
+const HOOK_VALUES = Object.values(SCRIPT_HOOKS);
+/** Detect supported server hook exports without executing the source. */
+export function detectScriptHooks(source) {
+    const found = new Set();
+    for (const match of source.matchAll(EXPORT_PATTERN)) {
+        const name = match[1] ?? match[2];
+        if (name !== undefined && HOOK_VALUES.includes(name)) {
+            found.add(name);
+        }
+    }
+    return [...found];
+}
+/** Server hooks receive their context through `this` and must declare no arguments. */
+export function invalidScriptHookSignatures(source) {
+    const invalid = new Set();
+    for (const hook of detectScriptHooks(source)) {
+        const declaration = new RegExp(`export\\s+(?:async\\s+)?function\\s+${hook}\\s*\\(([^)]*)\\)`).exec(source);
+        const assignedFunction = new RegExp(`export\\s+(?:const|let|var)\\s+${hook}\\s*=\\s*(?:async\\s+)?function(?:\\s+\\w+)?\\s*\\(([^)]*)\\)`).exec(source);
+        const assignedArrow = new RegExp(`export\\s+(?:const|let|var)\\s+${hook}\\s*=\\s*(?:async\\s+)?\\(([^)]*)\\)\\s*=>`).exec(source);
+        const singleParameterArrow = new RegExp(`export\\s+(?:const|let|var)\\s+${hook}\\s*=\\s*(?:async\\s+)?[A-Za-z_$][\\w$]*\\s*=>`).test(source);
+        const parameters = declaration?.[1] ?? assignedFunction?.[1] ?? assignedArrow?.[1];
+        if (parameters === undefined || parameters.trim() !== '' || singleParameterArrow) {
+            invalid.add(hook);
+        }
+    }
+    return [...invalid];
+}
+//# sourceMappingURL=source.js.map

package/dist/core/script/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../../src/core/script/source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AAE3D,2EAA2E;AAC3E,MAAM,cAAc,GAAG,4EAA4E,CAAC;AAEpG,MAAM,WAAW,GAAsB,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AAEnE,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAc,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,IAAkB,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,uCAAuC,IAAI,mBAAmB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5G,MAAM,gBAAgB,GAAG,IAAI,MAAM,CACjC,kCAAkC,IAAI,+DAA+D,CACtG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACf,MAAM,aAAa,GAAG,IAAI,MAAM,CAC9B,kCAAkC,IAAI,4CAA4C,CACnF,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACf,MAAM,oBAAoB,GAAG,IAAI,MAAM,CACrC,kCAAkC,IAAI,gDAAgD,CACvF,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACf,MAAM,UAAU,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,oBAAoB,EAAE,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC"}