@weave-kit/engine 0.1.0

package/dist/runtime/data-access/query.js

@@ -0,0 +1,435 @@
+import { SchemaError, primaryKeyOf } from '../../core/index.js';
+import { DETAILS_COLUMNS, FIELD_TYPES } from '../../core/index.js';
+import { AUDIT_ACTOR_TYPES, DATA_ACTIONS } from '../../core/audit/index.js';
+import { NOOP_SCRIPT_DISPATCHER, SCRIPT_HOOKS } from '../../core/index.js';
+import { buildCountSql, buildFindSql, scopeSuffix } from './builder.js';
+import { deleteDetailsChildren, insertDetails } from './details.js';
+import { computeFormulas } from './formula.js';
+import { ensureSeqTable, generateSeqNo } from './seqno.js';
+import { validateRecord } from './validate.js';
+import { WRITE_MODES } from './values.js';
+const q = (id) => `"${id}"`;
+/** PG error 42703 = undefined_column: a query referenced a column that doesn't exist */
+function isUndefinedColumn(error) {
+    return typeof error === 'object' && error !== null && error.code === '42703';
+}
+/** parse `column "X" of relation "Y" does not exist` → the column/field name */
+function undefinedColumnOf(error) {
+    const message = error?.message;
+    if (typeof message !== 'string')
+        return undefined;
+    const m = /column "([^"]+)" of relation/.exec(message);
+    return m?.[1];
+}
+/**
+ * Run a SQL statement against an object's table, mapping PG `undefined_column`
+ * (42703) — a schema/DB drift (schema declares a field the table lacks) — to an
+ * actionable error instead of a raw 500.
+ */
+async function runTableQuery(q, objectName, sql, params, locale) {
+    try {
+        return await q.query(sql, params);
+    }
+    catch (error) {
+        if (isUndefinedColumn(error)) {
+            const field = undefinedColumnOf(error);
+            throw new SchemaError('data.schemaDrift', { object: objectName, field: field ?? '' }, locale);
+        }
+        throw error;
+    }
+}
+/** emit a write-audit event (fire-and-forget — audit never blocks the business path) */
+function auditWrite(sink, ctx, action, objectName, objectId, changes, error, before, after) {
+    if (sink === undefined)
+        return;
+    const event = {
+        actorType: ctx.subject !== undefined ? AUDIT_ACTOR_TYPES.USER : AUDIT_ACTOR_TYPES.SYSTEM,
+        actorId: ctx.subject?.id ?? 'system',
+        action,
+        objectName,
+        objectId,
+        changes,
+        isError: error !== undefined,
+        errorCode: error instanceof SchemaError ? error.code : undefined,
+        timestamp: new Date(),
+    };
+    if (before !== undefined)
+        event.before = before;
+    if (after !== undefined)
+        event.after = after;
+    void sink.record(event);
+}
+/** rebuild `this.user` for hooks from the authenticated subject */
+function scriptUserOf(ctx) {
+    return {
+        id: ctx.subject?.id ?? 'system',
+        roles: ctx.subject?.roles ?? [],
+        teamId: ctx.subject?.teamId,
+    };
+}
+const PARENT_COLUMNS = new Set([
+    DETAILS_COLUMNS.PARENT_ID,
+    DETAILS_COLUMNS.PARENT_TYPE,
+    DETAILS_COLUMNS.PARENT_IDX,
+]);
+function isDetailsChild(registry, name) {
+    return registry
+        .list()
+        .some((o) => o.fields.some((f) => f.type === FIELD_TYPES.DETAILS && f.target === name));
+}
+function requireDef(ctx, objectName) {
+    const def = ctx.registry.get(objectName);
+    if (def === undefined)
+        throw new SchemaError('data.objectUnknown', { object: objectName }, ctx.locale);
+    return def;
+}
+function bctx(ctx, objectName) {
+    return { object: objectName, locale: ctx.locale, allowParentCols: isDetailsChild(ctx.registry, objectName) };
+}
+/**
+ * Serialize a value for binding to a DB column. pg (node-postgres) auto-stringifies
+ * JSON *objects* but serializes JSON *arrays* as a PG array literal (`{"a"}`) which
+ * is invalid as `json` — so we explicitly `JSON.stringify` non-string json values
+ * (arrays/objects/numbers/booleans) to valid JSON text. `null` stays SQL NULL.
+ */
+function dbJsonValue(field, value) {
+    if (field !== undefined && field.type === FIELD_TYPES.JSON && value !== null && typeof value !== 'string') {
+        return JSON.stringify(value);
+    }
+    return value;
+}
+/** controlled object data-access implementation (PG-backed) */
+export class DefaultObjectDataAccess {
+    audit;
+    script;
+    /** M10 diff replay: attach before/after row snapshots to update/delete audit events */
+    replay;
+    /** M12 live events: publish committed writes to the bus (undefined = zero overhead) */
+    events;
+    /** objects currently dispatching onLoad — skips re-entrant onLoad (a hook re-reading the same object) */
+    onLoadInFlight = new Set();
+    constructor(options = {}) {
+        this.audit = options.audit;
+        this.script = options.script ?? NOOP_SCRIPT_DISPATCHER;
+        this.replay = options.replay ?? false;
+        this.events = options.events;
+    }
+    /**
+     * Run the read hook (`onLoad`) over a fetched batch. The hook receives the
+     * whole batch as `this.records` and returns an **equal-length** array (or
+     * undefined/null to keep the batch unchanged). A length mismatch is an error
+     * (fail-closed: never silently drop rows — `total` stays the DB count).
+     * Re-entrant onLoad for the same object is skipped to avoid recursion.
+     */
+    async runOnLoad(objectName, records, ctx) {
+        if (records.length === 0 || !this.script.has(objectName, SCRIPT_HOOKS.ON_LOAD))
+            return records;
+        if (this.onLoadInFlight.has(objectName))
+            return records;
+        this.onLoadInFlight.add(objectName);
+        try {
+            const result = await this.script.dispatch(objectName, SCRIPT_HOOKS.ON_LOAD, {
+                records,
+                record: null,
+                changes: {},
+                user: scriptUserOf(ctx),
+            });
+            if (result.records === undefined)
+                return records;
+            if (result.records.length !== records.length) {
+                throw new SchemaError('script.abort', { hook: 'onLoad', message: `onLoad returned ${result.records.length} records, expected ${records.length}` }, ctx.locale);
+            }
+            return result.records;
+        }
+        finally {
+            this.onLoadInFlight.delete(objectName);
+        }
+    }
+    /**
+     * Run a before-write hook (validate/beforeUpdate/beforeDelete). Throws on
+     * hook failure → the surrounding transaction rolls back. Returns the
+     * possibly-modified changes from beforeUpdate (undefined = keep original).
+     */
+    async runBeforeHook(hook, objectName, record, changes, ctx) {
+        if (!this.script.has(objectName, hook))
+            return undefined;
+        const result = await this.script.dispatch(objectName, hook, {
+            record,
+            changes,
+            user: scriptUserOf(ctx),
+        });
+        return result.changes;
+    }
+    /**
+     * Run an after-write hook (afterUpdate/afterDelete) — the write is already
+     * committed, so a hook failure is a non-fatal warning: recorded to audit and
+     * delivered via `ctx.onWarnings`, never rethrown.
+     */
+    async runAfterHook(hook, action, objectName, record, changes, ctx, warnings, objectId) {
+        if (!this.script.has(objectName, hook))
+            return;
+        try {
+            await this.script.dispatch(objectName, hook, {
+                record,
+                changes,
+                user: scriptUserOf(ctx),
+            });
+        }
+        catch (error) {
+            // surface the hook's own message (SchemaError(script.abort) wraps it)
+            const message = error instanceof SchemaError && typeof error.params.message === 'string'
+                ? error.params.message
+                : error instanceof Error
+                    ? error.message
+                    : String(error);
+            warnings.push(message);
+            auditWrite(this.audit, ctx, action, objectName, objectId, changes, error);
+        }
+    }
+    async find(objectName, opts, ctx) {
+        const def = requireDef(ctx, objectName);
+        const q = ctx.client ?? ctx.pool;
+        const { sql, params } = buildFindSql(def, opts, bctx(ctx, objectName), ctx.rowScope, opts.exclude);
+        const { rows } = await runTableQuery(q, objectName, sql, params, ctx.locale);
+        const { sql: countSql, params: countParams } = buildCountSql(def, opts, bctx(ctx, objectName), ctx.rowScope);
+        const { rows: countRows } = await runTableQuery(q, objectName, countSql, countParams, ctx.locale);
+        const loaded = await this.runOnLoad(objectName, rows, ctx);
+        return { rows: loaded, total: countRows[0].total };
+    }
+    async findOne(objectName, id, ctx) {
+        const def = requireDef(ctx, objectName);
+        const pk = primaryKeyOf(def);
+        if (pk === undefined) {
+            throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
+        }
+        const result = await this.find(objectName, { filter: { [pk]: id }, limit: 1 }, ctx);
+        return result.rows[0] ?? null;
+    }
+    async create(objectName, data, ctx) {
+        const def = requireDef(ctx, objectName);
+        const pk = primaryKeyOf(def);
+        if (pk === undefined) {
+            throw new SchemaError('data.recordNotFound', { object: objectName }, ctx.locale);
+        }
+        let client;
+        let owned = false;
+        if (ctx.client !== undefined) {
+            client = ctx.client;
+        }
+        else {
+            owned = true;
+            client = await ctx.pool.connect();
+        }
+        const warnings = [];
+        try {
+            if (owned)
+                await client.query('BEGIN');
+            await validateRecord(def, data, WRITE_MODES.CREATE, { pool: client, registry: ctx.registry, locale: ctx.locale });
+            // validate → beforeUpdate (may rewrite the payload); both abort on throw
+            await this.runBeforeHook(SCRIPT_HOOKS.VALIDATE, objectName, null, data, ctx);
+            let payload = data;
+            const before = await this.runBeforeHook(SCRIPT_HOOKS.BEFORE_UPDATE, objectName, null, data, ctx);
+            if (before !== undefined)
+                payload = before;
+            const now = new Date();
+            const record = {};
+            // apply schema defaults for missing fields
+            for (const field of def.fields) {
+                if (field.type === FIELD_TYPES.DETAILS)
+                    continue;
+                const raw = field;
+                if (raw.default === undefined)
+                    continue;
+                if (payload[field.name] !== undefined)
+                    continue;
+                record[field.name] =
+                    (field.type === FIELD_TYPES.DATETIME || field.type === FIELD_TYPES.DATE) && raw.default === 'now'
+                        ? now.toISOString()
+                        : raw.default;
+            }
+            Object.assign(record, payload);
+            const seqFields = def.fields.filter((f) => f.type === FIELD_TYPES.SEQ_NO);
+            if (seqFields.length > 0) {
+                await ensureSeqTable(client);
+                for (const f of seqFields)
+                    record[f.name] = await generateSeqNo(client, def.name, f, now);
+            }
+            const child = isDetailsChild(ctx.registry, def.name);
+            if (child && record[DETAILS_COLUMNS.PARENT_ID] !== undefined && record[DETAILS_COLUMNS.PARENT_IDX] === undefined) {
+                const res = await runTableQuery(client, def.name, `SELECT COALESCE(MAX(${q(DETAILS_COLUMNS.PARENT_IDX)}), 0) + 1 AS n FROM ${q(def.name)}
+           WHERE ${q(DETAILS_COLUMNS.PARENT_ID)} = $1 AND ${q(DETAILS_COLUMNS.PARENT_TYPE)} = $2`, [record[DETAILS_COLUMNS.PARENT_ID], record[DETAILS_COLUMNS.PARENT_TYPE]], ctx.locale);
+                record[DETAILS_COLUMNS.PARENT_IDX] = res.rows[0].n;
+            }
+            const cols = [
+                ...def.fields.filter((f) => f.type !== FIELD_TYPES.DETAILS).map((f) => f.name),
+                ...(child ? [...PARENT_COLUMNS] : []),
+            ];
+            const fieldByName = new Map(def.fields.map((f) => [f.name, f]));
+            const values = cols.map((c) => dbJsonValue(fieldByName.get(c), record[c] ?? null));
+            const placeholders = cols.map((_, i) => `$${i + 1}`).join(', ');
+            await runTableQuery(client, def.name, `INSERT INTO ${q(def.name)} (${cols.map(q).join(', ')}) VALUES (${placeholders})`, values, ctx.locale);
+            await insertDetails(client, def, record[pk], payload, ctx.registry, ctx.locale);
+            // compute formula fields AFTER children exist (aggregates see them), then persist
+            await computeFormulas(def, record, client, ctx.registry, now);
+            const formulaCols = def.fields
+                .filter((f) => f.formula !== undefined)
+                .map((f) => f.name);
+            if (formulaCols.length > 0) {
+                const setSql = formulaCols.map((c, i) => `${q(c)} = $${i + 1}`).join(', ');
+                const formulaValues = formulaCols.map((c) => record[c] ?? null);
+                await runTableQuery(client, def.name, `UPDATE ${q(def.name)} SET ${setSql} WHERE ${q(pk)} = $${formulaCols.length + 1}`, [...formulaValues, record[pk]], ctx.locale);
+            }
+            if (owned)
+                await client.query('COMMIT');
+            auditWrite(this.audit, ctx, DATA_ACTIONS.CREATE, objectName, String(record[pk] ?? ''), record);
+            this.events?.publishRecordChange('created', objectName, String(record[pk] ?? ''));
+            await this.runAfterHook(SCRIPT_HOOKS.AFTER_UPDATE, DATA_ACTIONS.CREATE, objectName, record, payload, ctx, warnings, String(record[pk] ?? ''));
+            if (warnings.length > 0)
+                ctx.onWarnings?.(warnings);
+            const loaded = await this.runOnLoad(objectName, [record], ctx);
+            return loaded[0];
+        }
+        catch (err) {
+            if (owned)
+                await client.query('ROLLBACK');
+            auditWrite(this.audit, ctx, DATA_ACTIONS.CREATE, objectName, data[pk] === undefined ? undefined : String(data[pk]), data, err);
+            throw err;
+        }
+        finally {
+            if (owned)
+                client.release();
+        }
+    }
+    async update(objectName, id, changes, ctx) {
+        const def = requireDef(ctx, objectName);
+        const pk = primaryKeyOf(def);
+        if (pk === undefined) {
+            throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
+        }
+        let client;
+        let owned = false;
+        if (ctx.client !== undefined) {
+            client = ctx.client;
+        }
+        else {
+            owned = true;
+            client = await ctx.pool.connect();
+        }
+        const warnings = [];
+        try {
+            if (owned)
+                await client.query('BEGIN');
+            await validateRecord(def, changes, WRITE_MODES.UPDATE, { pool: client, registry: ctx.registry, locale: ctx.locale });
+            const { sql, params } = buildFindSql(def, { filter: { [pk]: id }, limit: 1 }, bctx(ctx, objectName), ctx.rowScope);
+            const { rows } = await runTableQuery(client, objectName, sql, params, ctx.locale);
+            const existing = rows[0];
+            if (existing === undefined) {
+                throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
+            }
+            // validate → beforeUpdate; hooks see the pre-update record and may rewrite changes
+            await this.runBeforeHook(SCRIPT_HOOKS.VALIDATE, objectName, existing, changes, ctx);
+            let payload = changes;
+            const before = await this.runBeforeHook(SCRIPT_HOOKS.BEFORE_UPDATE, objectName, existing, changes, ctx);
+            if (before !== undefined)
+                payload = before;
+            const now = new Date();
+            const record = { ...existing, ...payload };
+            await computeFormulas(def, record, client, ctx.registry, now);
+            const settable = new Set();
+            for (const key of Object.keys(payload)) {
+                if (isDetailsChild(ctx.registry, def.name) && PARENT_COLUMNS.has(key)) {
+                    settable.add(key);
+                    continue;
+                }
+                const field = def.fields.find((f) => f.name === key);
+                if (field !== undefined && field.type !== FIELD_TYPES.DETAILS)
+                    settable.add(key);
+            }
+            for (const field of def.fields) {
+                if (field.formula !== undefined)
+                    settable.add(field.name);
+            }
+            settable.delete(pk);
+            if (settable.size > 0) {
+                const cols = [...settable];
+                const setSql = cols.map((c, i) => `${q(c)} = $${i + 1}`).join(', ');
+                const scope = ctx.rowScope !== undefined ? scopeSuffix(ctx.rowScope, cols.length + 1) : undefined;
+                const values = cols.map((c) => dbJsonValue(def.fields.find((f) => f.name === c), record[c] ?? null));
+                await runTableQuery(client, objectName, `UPDATE ${q(def.name)} SET ${setSql} WHERE ${q(pk)} = $${cols.length + 1}${scope !== undefined ? ` AND (${scope.sql})` : ''}`, [...values, id, ...(scope?.params ?? [])], ctx.locale);
+            }
+            if (owned)
+                await client.query('COMMIT');
+            auditWrite(this.audit, ctx, DATA_ACTIONS.UPDATE, objectName, id, payload, undefined, this.replay ? existing : undefined, this.replay ? record : undefined);
+            this.events?.publishRecordChange('updated', objectName, id);
+            await this.runAfterHook(SCRIPT_HOOKS.AFTER_UPDATE, DATA_ACTIONS.UPDATE, objectName, record, payload, ctx, warnings, id);
+            if (warnings.length > 0)
+                ctx.onWarnings?.(warnings);
+            const loaded = await this.runOnLoad(objectName, [record], ctx);
+            return loaded[0];
+        }
+        catch (err) {
+            if (owned)
+                await client.query('ROLLBACK');
+            auditWrite(this.audit, ctx, DATA_ACTIONS.UPDATE, objectName, id, changes, err);
+            throw err;
+        }
+        finally {
+            if (owned)
+                client.release();
+        }
+    }
+    async delete(objectName, id, ctx) {
+        const def = requireDef(ctx, objectName);
+        const pk = primaryKeyOf(def);
+        if (pk === undefined) {
+            throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
+        }
+        let client;
+        let owned = false;
+        if (ctx.client !== undefined) {
+            client = ctx.client;
+        }
+        else {
+            owned = true;
+            client = await ctx.pool.connect();
+        }
+        const warnings = [];
+        try {
+            if (owned)
+                await client.query('BEGIN');
+            const { sql, params } = buildFindSql(def, { filter: { [pk]: id }, limit: 1 }, bctx(ctx, objectName), ctx.rowScope);
+            const { rows } = await runTableQuery(client, objectName, sql, params, ctx.locale);
+            const existing = rows[0];
+            if (existing === undefined) {
+                throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
+            }
+            await this.runBeforeHook(SCRIPT_HOOKS.BEFORE_DELETE, objectName, existing, {}, ctx);
+            await deleteDetailsChildren(client, def, id, ctx.registry);
+            const scope = ctx.rowScope !== undefined ? scopeSuffix(ctx.rowScope, 1) : undefined;
+            const res = await runTableQuery(client, objectName, `DELETE FROM ${q(def.name)} WHERE ${q(pk)} = $1${scope !== undefined ? ` AND (${scope.sql})` : ''}`, [id, ...(scope?.params ?? [])], ctx.locale);
+            if (res.rowCount === 0)
+                throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
+            if (owned)
+                await client.query('COMMIT');
+            auditWrite(this.audit, ctx, DATA_ACTIONS.DELETE, objectName, id, undefined, undefined, this.replay ? existing : undefined);
+            this.events?.publishRecordChange('deleted', objectName, id);
+            await this.runAfterHook(SCRIPT_HOOKS.AFTER_DELETE, DATA_ACTIONS.DELETE, objectName, existing, {}, ctx, warnings, id);
+            if (warnings.length > 0)
+                ctx.onWarnings?.(warnings);
+        }
+        catch (err) {
+            if (owned)
+                await client.query('ROLLBACK');
+            auditWrite(this.audit, ctx, DATA_ACTIONS.DELETE, objectName, id, undefined, err);
+            throw err;
+        }
+        finally {
+            if (owned)
+                client.release();
+        }
+    }
+}
+export function createDataAccess(options = {}) {
+    return new DefaultObjectDataAccess(options);
+}
+//# sourceMappingURL=query.js.map

package/dist/runtime/data-access/query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../../src/runtime/data-access/query.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAe,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE5E,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAA2D,MAAM,qBAAqB,CAAC;AACpI,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;AAQpC,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAA4B,CAAC,IAAI,KAAK,OAAO,CAAC;AACvG,CAAC;AAED,gFAAgF;AAChF,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,OAAO,GAAI,KAAsC,EAAE,OAAO,CAAC;IACjE,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,CAAsE,EACtE,UAAkB,EAClB,GAAW,EACX,MAAiB,EACjB,MAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,UAAU,CACjB,IAA2B,EAC3B,GAAsB,EACtB,MAAc,EACd,UAAkB,EAClB,QAA4B,EAC5B,OAAgB,EAChB,KAAe,EACf,MAAgB,EAChB,KAAe;IAEf,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,MAAM,KAAK,GAAe;QACxB,SAAS,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM;QACxF,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,QAAQ;QACpC,MAAM;QACN,UAAU;QACV,QAAQ;QACR,OAAO;QACP,OAAO,EAAE,KAAK,KAAK,SAAS;QAC5B,SAAS,EAAE,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAChE,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,IAAI,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IAChD,IAAI,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IAC7C,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,mEAAmE;AACnE,SAAS,YAAY,CAAC,GAAsB;IAC1C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,QAAQ;QAC/B,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QAC/B,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,eAAe,CAAC,SAAS;IACzB,eAAe,CAAC,WAAW;IAC3B,eAAe,CAAC,UAAU;CAC3B,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,QAAwB,EAAE,IAAY;IAC5D,OAAO,QAAQ;SACZ,IAAI,EAAE;SACN,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB,EAAE,UAAkB;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,IAAI,CAAC,GAAsB,EAAE,UAAkB;IACtD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAoC,EAAE,KAAc;IACvE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1G,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+DAA+D;AAC/D,MAAM,OAAO,uBAAuB;IACjB,KAAK,CAAa;IAClB,MAAM,CAAmB;IAC1C,uFAAuF;IACtE,MAAM,CAAU;IACjC,uFAAuF;IACtE,MAAM,CAAkB;IACzC,yGAAyG;IACxF,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpD,YAAY,UAAuG,EAAE;QACnH,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC;QACvD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,SAAS,CACrB,UAAkB,EAClB,OAAkC,EAClC,GAAsB;QAEtB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;QAC/F,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,OAAO,CAAC;QACxD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,OAAO,EAAE;gBAC1E,OAAO;gBACP,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC;aACxB,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YACjD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,IAAI,WAAW,CACnB,cAAc,EACd,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,MAAM,CAAC,OAAO,CAAC,MAAM,sBAAsB,OAAO,CAAC,MAAM,EAAE,EAAE,EAC3G,GAAG,CAAC,MAAM,CACX,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,aAAa,CACzB,IAAgB,EAChB,UAAkB,EAClB,MAAsC,EACtC,OAAgC,EAChC,GAAsB;QAEtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE;YAC1D,MAAM;YACN,OAAO;YACP,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC;SACxB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,YAAY,CACxB,IAAgB,EAChB,MAAc,EACd,UAAkB,EAClB,MAAsC,EACtC,OAAgC,EAChC,GAAsB,EACtB,QAAkB,EAClB,QAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC;YAAE,OAAO;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE;gBAC3C,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,MAAM,OAAO,GACX,KAAK,YAAY,WAAW,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ;gBACtE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;gBACtB,CAAC,CAAC,KAAK,YAAY,KAAK;oBACtB,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,UAAkB,EAClB,IAAiB,EACjB,GAAsB;QAEtB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC;QACjC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnG,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7E,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7G,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAiC,EAAE,GAAG,CAAC,CAAC;QACxF,OAAO,EAAE,IAAI,EAAE,MAAa,EAAE,KAAK,EAAG,SAAS,CAAC,CAAC,CAAuB,CAAC,KAAK,EAAE,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,OAAO,CACX,UAAkB,EAClB,EAAU,EACV,GAAsB;QAEtB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAI,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,IAA6B,EAC7B,GAAsB;QAEtB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,MAAkB,CAAC;QACvB,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,KAAK;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAElH,yEAAyE;YACzE,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7E,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACjG,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,GAAG,MAAM,CAAC;YAE3C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,MAAM,GAA4B,EAAE,CAAC;YAE3C,2CAA2C;YAC3C,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO;oBAAE,SAAS;gBACjD,MAAM,GAAG,GAAG,KAA8B,CAAC;gBAC3C,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;oBAAE,SAAS;gBACxC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS;oBAAE,SAAS;gBAChD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;oBAChB,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;wBAC/F,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE;wBACnB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACpB,CAAC;YACD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAE/B,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC7B,KAAK,MAAM,CAAC,IAAI,SAAS;oBAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5F,CAAC;YAED,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,KAAK,IAAI,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,MAAM,EACN,GAAG,CAAC,IAAI,EACR,uBAAuB,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;mBAC7E,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,OAAO,EACvF,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,EACxE,GAAG,CAAC,MAAM,CACX,CAAC;gBACF,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,GAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAmB,CAAC,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,IAAI,GAAG;gBACX,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9E,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACtC,CAAC;YACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;YACnF,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChE,MAAM,aAAa,CACjB,MAAM,EACN,GAAG,CAAC,IAAI,EACR,eAAe,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,YAAY,GAAG,EACjF,MAAM,EACN,GAAG,CAAC,MAAM,CACX,CAAC;YAEF,MAAM,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAEhF,kFAAkF;YAClF,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC9D,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM;iBAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAA0B,CAAC,OAAO,KAAK,SAAS,CAAC;iBAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3E,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;gBAChE,MAAM,aAAa,CACjB,MAAM,EACN,GAAG,CAAC,IAAI,EACR,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,EACjF,CAAC,GAAG,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAC9B,GAAG,CAAC,MAAM,CACX,CAAC;YACJ,CAAC;YAED,IAAI,KAAK;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YAC/F,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAClF,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9I,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO,MAAM,CAAC,CAAC,CAAM,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,KAAK;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC1C,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/H,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,EAAU,EACV,OAAgC,EAChC,GAAsB;QAEtB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAkB,CAAC;QACvB,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,KAAK;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAErH,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAwC,CAAC;YAChE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACvF,CAAC;YAED,mFAAmF;YACnF,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACpF,IAAI,OAAO,GAAG,OAAO,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACxG,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,GAAG,MAAM,CAAC;YAE3C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;YAC3C,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAE9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;gBACrD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO;oBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnF,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC/B,IAAK,KAA8B,CAAC,OAAO,KAAK,SAAS;oBAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtF,CAAC;YACD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAEpB,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;gBAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAClG,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;gBACrG,MAAM,aAAa,CACjB,MAAM,EACN,UAAU,EACV,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAC7H,CAAC,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,EACzC,GAAG,CAAC,MAAM,CACX,CAAC;YACJ,CAAC;YAED,IAAI,KAAK;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC3J,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YACxH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO,MAAM,CAAC,CAAC,CAAM,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,KAAK;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC1C,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC/E,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,EAAU,EAAE,GAAsB;QACjE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAkB,CAAC;QACvB,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,KAAK;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAwC,CAAC;YAChE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACvF,CAAC;YAED,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACpF,MAAM,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,MAAM,EACN,UAAU,EACV,eAAe,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,QAAQ,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EACnG,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,EAC9B,GAAG,CAAC,MAAM,CACX,CAAC;YACF,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC;gBAAE,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7G,IAAI,KAAK;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC3H,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YACrH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,KAAK;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC1C,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YACjF,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAuG,EAAE;IACxI,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC"}

package/dist/runtime/data-access/rbac.d.ts

@@ -0,0 +1,15 @@
+import type { AuditSink } from '../../core/audit/index.js';
+import type { ObjectDataAccess } from './types.js';
+/**
+ * Decorate an object data-access with RBAC enforcement.
+ *
+ * Reads the authenticated `subject` from the execution context and:
+ * - find/findOne: injects the row-level scope and excludes hidden fields
+ * - create/update/delete: authorizes the operation, filters update changes to
+ *   the allowed field set, and scopes update/delete to the read row scope
+ * - no subject → pass-through (unrestricted, for internal/admin use)
+ */
+export declare function withRbac(inner: ObjectDataAccess, options?: {
+    audit?: AuditSink;
+}): ObjectDataAccess;
+//# sourceMappingURL=rbac.d.ts.map

package/dist/runtime/data-access/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/rbac.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,KAAK,EAA8C,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAgD/F;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,CAAA;CAAO,GAAG,gBAAgB,CAoIvG"}

package/dist/runtime/data-access/rbac.js

@@ -0,0 +1,172 @@
+import { SchemaError, primaryKeyOf } from '../../core/index.js';
+import { assertCanCreate, assertCanDelete, assertCanUpdate, buildRowScope, resolvePermission, } from '../../core/index.js';
+import { AUDIT_ACTOR_TYPES, DATA_ACTIONS } from '../../core/audit/index.js';
+function requireDef(ctx, objectName) {
+    const def = ctx.registry.get(objectName);
+    if (def === undefined)
+        throw new SchemaError('data.objectUnknown', { object: objectName }, ctx.locale);
+    return def;
+}
+/** record an RBAC denial event (fire-and-forget — audit never blocks the business path) */
+function denied(sink, ctx, action, objectName, objectId, error) {
+    if (sink === undefined)
+        return;
+    void sink.record({
+        actorType: ctx.subject !== undefined ? AUDIT_ACTOR_TYPES.USER : AUDIT_ACTOR_TYPES.SYSTEM,
+        actorId: ctx.subject?.id ?? 'system',
+        action,
+        objectName,
+        objectId,
+        isError: true,
+        errorCode: error instanceof SchemaError ? error.code : undefined,
+        timestamp: new Date(),
+    });
+}
+/** strip RBAC-hidden fields from a returned record */
+function strip(record, exclude) {
+    if (exclude.length === 0 || record === null || typeof record !== 'object' || Array.isArray(record)) {
+        return record;
+    }
+    const out = { ...record };
+    for (const f of exclude)
+        delete out[f];
+    return out;
+}
+function scopedCtx(ctx, objectName, read) {
+    if (read === undefined || ctx.subject === undefined)
+        return ctx;
+    const def = requireDef(ctx, objectName);
+    const rowScope = buildRowScope(def, read, ctx.subject, ctx.subject.roles, ctx.locale);
+    return { ...ctx, rowScope };
+}
+/**
+ * Decorate an object data-access with RBAC enforcement.
+ *
+ * Reads the authenticated `subject` from the execution context and:
+ * - find/findOne: injects the row-level scope and excludes hidden fields
+ * - create/update/delete: authorizes the operation, filters update changes to
+ *   the allowed field set, and scopes update/delete to the read row scope
+ * - no subject → pass-through (unrestricted, for internal/admin use)
+ */
+export function withRbac(inner, options = {}) {
+    const { audit } = options;
+    return {
+        async find(objectName, opts, ctx) {
+            if (ctx.subject === undefined)
+                return inner.find(objectName, opts, ctx);
+            const def = requireDef(ctx, objectName);
+            const p = resolvePermission(def, ctx.subject.roles);
+            if (p === undefined || p.read === undefined) {
+                const err = new SchemaError('rbac.denied.read', { object: objectName, role: ctx.subject.roles.join(',') }, ctx.locale);
+                denied(audit, ctx, DATA_ACTIONS.READ, objectName, undefined, err);
+                throw err;
+            }
+            return inner.find(objectName, { ...opts, exclude: p.exclude }, scopedCtx(ctx, objectName, p.read));
+        },
+        async findOne(objectName, id, ctx) {
+            if (ctx.subject === undefined)
+                return inner.findOne(objectName, id, ctx);
+            const def = requireDef(ctx, objectName);
+            const p = resolvePermission(def, ctx.subject.roles);
+            if (p === undefined || p.read === undefined) {
+                const err = new SchemaError('rbac.denied.read', { object: objectName, role: ctx.subject.roles.join(',') }, ctx.locale);
+                denied(audit, ctx, DATA_ACTIONS.READ, objectName, id, err);
+                throw err;
+            }
+            const record = await inner.findOne(objectName, id, scopedCtx(ctx, objectName, p.read));
+            return record === null ? null : strip(record, p.exclude);
+        },
+        async create(objectName, data, ctx) {
+            if (ctx.subject === undefined)
+                return inner.create(objectName, data, ctx);
+            const def = requireDef(ctx, objectName);
+            try {
+                assertCanCreate(def, ctx.subject.roles, ctx.locale);
+            }
+            catch (error) {
+                denied(audit, ctx, DATA_ACTIONS.CREATE, objectName, undefined, error);
+                throw error;
+            }
+            const p = resolvePermission(def, ctx.subject.roles);
+            // `p.createFields === null` means "all writable fields allowed on create"
+            // (no fields.create declared); otherwise only the whitelist is accepted
+            let payload = data;
+            const allowed = p?.createFields ?? null;
+            if (allowed !== null) {
+                const filtered = {};
+                for (const [key, value] of Object.entries(data)) {
+                    if (key === primaryKeyOf(def)) {
+                        filtered[key] = value;
+                        continue;
+                    }
+                    if (!allowed.includes(key)) {
+                        const err = new SchemaError('rbac.denied.field', { object: objectName, role: ctx.subject.roles.join(','), field: key }, ctx.locale);
+                        denied(audit, ctx, DATA_ACTIONS.CREATE, objectName, undefined, err);
+                        throw err;
+                    }
+                    filtered[key] = value;
+                }
+                payload = filtered;
+            }
+            const record = await inner.create(objectName, payload, ctx);
+            return strip(record, p?.exclude ?? []);
+        },
+        async update(objectName, id, changes, ctx) {
+            if (ctx.subject === undefined)
+                return inner.update(objectName, id, changes, ctx);
+            const def = requireDef(ctx, objectName);
+            try {
+                assertCanUpdate(def, ctx.subject.roles, ctx.locale);
+            }
+            catch (error) {
+                denied(audit, ctx, DATA_ACTIONS.UPDATE, objectName, id, error);
+                throw error;
+            }
+            const p = resolvePermission(def, ctx.subject.roles);
+            // fail-closed: without a read scope we cannot derive a row scope, so an
+            // update would silently target any row — deny instead
+            if (p?.read === undefined) {
+                const err = new SchemaError('rbac.denied.update', { object: objectName, role: ctx.subject.roles.join(',') }, ctx.locale);
+                denied(audit, ctx, DATA_ACTIONS.UPDATE, objectName, id, err);
+                throw err;
+            }
+            // `p.update === null` means "all fields updatable" (open mode / update: true) —
+            // keep the null sentinel; `?? []` would collapse it and deny every field
+            const allowed = p.update;
+            const filtered = {};
+            for (const [key, value] of Object.entries(changes)) {
+                if (key === primaryKeyOf(def))
+                    continue;
+                if (allowed !== null && !allowed.includes(key)) {
+                    const err = new SchemaError('rbac.denied.field', { object: objectName, role: ctx.subject.roles.join(','), field: key }, ctx.locale);
+                    denied(audit, ctx, DATA_ACTIONS.UPDATE, objectName, id, err);
+                    throw err;
+                }
+                filtered[key] = value;
+            }
+            const record = await inner.update(objectName, id, filtered, scopedCtx(ctx, objectName, p?.read));
+            return strip(record, p?.exclude ?? []);
+        },
+        async delete(objectName, id, ctx) {
+            if (ctx.subject === undefined)
+                return inner.delete(objectName, id, ctx);
+            const def = requireDef(ctx, objectName);
+            try {
+                assertCanDelete(def, ctx.subject.roles, ctx.locale);
+            }
+            catch (error) {
+                denied(audit, ctx, DATA_ACTIONS.DELETE, objectName, id, error);
+                throw error;
+            }
+            const p = resolvePermission(def, ctx.subject.roles);
+            // fail-closed: same as update — no read scope means no row scope
+            if (p?.read === undefined) {
+                const err = new SchemaError('rbac.denied.delete', { object: objectName, role: ctx.subject.roles.join(',') }, ctx.locale);
+                denied(audit, ctx, DATA_ACTIONS.DELETE, objectName, id, err);
+                throw err;
+            }
+            return inner.delete(objectName, id, scopedCtx(ctx, objectName, p.read));
+        },
+    };
+}
+//# sourceMappingURL=rbac.js.map