@weave-kit/engine 0.1.0

package/dist/runtime/data-access/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../src/runtime/data-access/rbac.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAI5E,SAAS,UAAU,CAAC,GAAsB,EAAE,UAAkB;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,SAAS,MAAM,CACb,IAA2B,EAC3B,GAAsB,EACtB,MAAc,EACd,UAAkB,EAClB,QAA4B,EAC5B,KAAc;IAEd,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,KAAK,IAAI,CAAC,MAAM,CAAC;QACf,SAAS,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM;QACxF,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,QAAQ;QACpC,MAAM;QACN,UAAU;QACV,QAAQ;QACR,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAChE,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED,sDAAsD;AACtD,SAAS,KAAK,CAAI,MAAS,EAAE,OAA0B;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnG,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,GAAI,MAAkC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,GAAsB,EAAE,UAAkB,EAAE,IAA2B;IACxF,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAChE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtF,OAAO,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAuB,EAAE,UAAiC,EAAE;IACnF,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1B,OAAO;QACL,KAAK,CAAC,IAAI,CACR,UAAkB,EAClB,IAAiB,EACjB,GAAsB;YAEtB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAI,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3E,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACvH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;gBAClE,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAI,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxG,CAAC;QAED,KAAK,CAAC,OAAO,CACX,UAAkB,EAClB,EAAU,EACV,GAAsB;YAEtB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,OAAO,CAAI,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5E,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACvH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAI,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1F,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAED,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,IAA6B,EAC7B,GAAsB;YAEtB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAI,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7E,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;gBACtE,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,0EAA0E;YAC1E,wEAAwE;YACxE,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,MAAM,OAAO,GAAG,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;YACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,QAAQ,GAA4B,EAAE,CAAC;gBAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,IAAI,GAAG,KAAK,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;wBACtB,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC3B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;wBACpI,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;wBACpE,MAAM,GAAG,CAAC;oBACZ,CAAC;oBACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACxB,CAAC;gBACD,OAAO,GAAG,QAAQ,CAAC;YACrB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAI,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,EAAU,EACV,OAAgC,EAChC,GAAsB;YAEtB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAI,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACpF,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC/D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,wEAAwE;YACxE,sDAAsD;YACtD,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACzH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC7D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,gFAAgF;YAChF,yEAAyE;YACzE,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;YACzB,MAAM,QAAQ,GAA4B,EAAE,CAAC;YAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnD,IAAI,GAAG,KAAK,YAAY,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACxC,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBACpI,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC7D,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAI,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YACpG,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,EAAU,EAAE,GAAsB;YACjE,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC/D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,iEAAiE;YACjE,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACzH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC7D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/runtime/data-access/seqno.d.ts

@@ -0,0 +1,11 @@
+import type { SeqNoField } from '../../core/index.js';
+import type { Queryable } from './types.js';
+/** create the seq counter table if it does not exist (once per write transaction) */
+export declare function ensureSeqTable(db: Queryable): Promise<void>;
+/** counter bucket: format literal prefix; for cycle=year the year is baked in */
+export declare function seqBucket(field: SeqNoField, format: string, now: Date): string;
+/** render a sequence value through the format template ({seq}, {seq:N}, {year}/{month}/{day}) */
+export declare function renderSeq(format: string, lastValue: number, now: Date): string;
+/** atomically allocate the next sequence value for (object, field) and render it */
+export declare function generateSeqNo(db: Queryable, object: string, field: SeqNoField, now: Date): Promise<string>;
+//# sourceMappingURL=seqno.d.ts.map

package/dist/runtime/data-access/seqno.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seqno.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/seqno.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C,qFAAqF;AACrF,wBAAsB,cAAc,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CASjE;AAED,iFAAiF;AACjF,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,CAI9E;AAED,iGAAiG;AACjG,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,CAS9E;AAED,oFAAoF;AACpF,wBAAsB,aAAa,CACjC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,MAAM,CAAC,CAUjB"}

package/dist/runtime/data-access/seqno.js

@@ -0,0 +1,37 @@
+const SEQ_TABLE = 'weavekit_seq';
+/** create the seq counter table if it does not exist (once per write transaction) */
+export async function ensureSeqTable(db) {
+    await db.query(`CREATE TABLE IF NOT EXISTS ${SEQ_TABLE} (
+       object_name text NOT NULL,
+       bucket text NOT NULL,
+       last_value bigint NOT NULL,
+       PRIMARY KEY (object_name, bucket)
+     )`);
+}
+/** counter bucket: format literal prefix; for cycle=year the year is baked in */
+export function seqBucket(field, format, now) {
+    const idx = format.indexOf('{seq');
+    const prefix = idx === -1 ? format : format.slice(0, idx);
+    return field.cycle === 'year' ? prefix.replace(/\{year\}/g, String(now.getFullYear())) : prefix;
+}
+/** render a sequence value through the format template ({seq}, {seq:N}, {year}/{month}/{day}) */
+export function renderSeq(format, lastValue, now) {
+    return format
+        .replace(/\{seq(?::(\d+))?\}/g, (_m, pad) => {
+        const s = String(lastValue);
+        return pad !== undefined && s.length < Number(pad) ? s.padStart(Number(pad), '0') : s;
+    })
+        .replace(/\{year\}/g, String(now.getFullYear()))
+        .replace(/\{month\}/g, String(now.getMonth() + 1))
+        .replace(/\{day\}/g, String(now.getDate()));
+}
+/** atomically allocate the next sequence value for (object, field) and render it */
+export async function generateSeqNo(db, object, field, now) {
+    const format = field.format ?? '{seq}';
+    const bucket = seqBucket(field, format, now);
+    const res = await db.query(`INSERT INTO ${SEQ_TABLE} (object_name, bucket, last_value) VALUES ($1, $2, 1)
+     ON CONFLICT (object_name, bucket) DO UPDATE SET last_value = ${SEQ_TABLE}.last_value + 1
+     RETURNING last_value`, [object, bucket]);
+    return renderSeq(format, res.rows[0].last_value, now);
+}
+//# sourceMappingURL=seqno.js.map

package/dist/runtime/data-access/seqno.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seqno.js","sourceRoot":"","sources":["../../../src/runtime/data-access/seqno.ts"],"names":[],"mappings":"AAGA,MAAM,SAAS,GAAG,cAAc,CAAC;AAEjC,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAa;IAChD,MAAM,EAAE,CAAC,KAAK,CACZ,8BAA8B,SAAS;;;;;OAKpC,CACJ,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,KAAiB,EAAE,MAAc,EAAE,GAAS;IACpE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAClG,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,SAAiB,EAAE,GAAS;IACpE,OAAO,MAAM;SACV,OAAO,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAAE,GAAuB,EAAE,EAAE;QAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,OAAO,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC;SACD,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;SAC/C,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;SACjD,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAa,EACb,MAAc,EACd,KAAiB,EACjB,GAAS;IAET,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC;IACvC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CACxB,eAAe,SAAS;oEACwC,SAAS;0BACnD,EACtB,CAAC,MAAM,EAAE,MAAM,CAAC,CACjB,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC"}

package/dist/runtime/data-access/sql-executor.d.ts

@@ -0,0 +1,45 @@
+import type { Pool } from 'pg';
+export interface RestrictedSqlSubject {
+    id: string;
+    roles: string[];
+    teamId?: string;
+}
+export interface RestrictedSqlRls {
+    /** non-owner role to switch to via `SET LOCAL ROLE` so PostgreSQL RLS applies */
+    role: string;
+    /** the script author; carried to RLS policies via `weavekit.*` session GUCs */
+    subject: RestrictedSqlSubject;
+}
+export interface RestrictedSqlOptions {
+    /** maximum rows returned; defaults to 1000 */
+    maxRows?: number;
+    /** server-side statement timeout in ms; defaults to 2000 */
+    timeoutMs?: number;
+    /**
+     * row-level security wrapper: runs the query in a transaction under
+     * `SET LOCAL ROLE <role>` with `weavekit.actor_id/roles/team_id` GUCs so the
+     * table's RLS policies scope the result rows. Unset GUCs make policies deny
+     * (0 rows) — fail-closed.
+     */
+    rls?: RestrictedSqlRls;
+}
+export interface RestrictedSqlResult {
+    rows: unknown[];
+}
+/**
+ * Controlled SQL execution for sandbox scripts (`this.db.query`).
+ *
+ * Gates:
+ * - SELECT-only — any other statement is rejected before touching the pool
+ * - single statement — a `;` anywhere (after stripping one trailing) is rejected
+ * - row cap — the query is wrapped in a subquery and the outer LIMIT is
+ *   clamped to `maxRows`, so a runaway result can never flood the response
+ * - server-side timeout — runs on a dedicated pooled client with
+ *   `statement_timeout`, so a slow query is cancelled by PostgreSQL itself
+ * - row-level security — with `rls`, the query runs in a transaction under
+ *   `SET LOCAL ROLE <role>` + `weavekit.*` GUCs, so RLS policies scope the rows
+ *   (column-level `exclude` is enforced by the application-layer SQL gate before
+ *   this function runs)
+ */
+export declare function executeRestrictedSql(pool: Pool, sql: string, params: unknown[], options?: RestrictedSqlOptions): Promise<RestrictedSqlResult>;
+//# sourceMappingURL=sql-executor.d.ts.map

package/dist/runtime/data-access/sql-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-executor.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/sql-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAG/B,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAUD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,EAAE,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAqD9B"}

package/dist/runtime/data-access/sql-executor.js

@@ -0,0 +1,76 @@
+import { SchemaError } from '../../core/index.js';
+const MAX_ROWS_DEFAULT = 1000;
+const TIMEOUT_DEFAULT = 2000;
+const RLS_ROLE_RE = /^[a-z_][a-z0-9_]*$/;
+function gucLiteral(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+/**
+ * Controlled SQL execution for sandbox scripts (`this.db.query`).
+ *
+ * Gates:
+ * - SELECT-only — any other statement is rejected before touching the pool
+ * - single statement — a `;` anywhere (after stripping one trailing) is rejected
+ * - row cap — the query is wrapped in a subquery and the outer LIMIT is
+ *   clamped to `maxRows`, so a runaway result can never flood the response
+ * - server-side timeout — runs on a dedicated pooled client with
+ *   `statement_timeout`, so a slow query is cancelled by PostgreSQL itself
+ * - row-level security — with `rls`, the query runs in a transaction under
+ *   `SET LOCAL ROLE <role>` + `weavekit.*` GUCs, so RLS policies scope the rows
+ *   (column-level `exclude` is enforced by the application-layer SQL gate before
+ *   this function runs)
+ */
+export async function executeRestrictedSql(pool, sql, params, options = {}) {
+    const maxRows = options.maxRows ?? MAX_ROWS_DEFAULT;
+    const timeoutMs = options.timeoutMs ?? TIMEOUT_DEFAULT;
+    if (typeof sql !== 'string') {
+        throw new SchemaError('script.query.invalid', { detail: 'sql must be a string' });
+    }
+    let trimmed = sql.trim();
+    if (trimmed.endsWith(';'))
+        trimmed = trimmed.slice(0, -1);
+    if (!/^SELECT\s/i.test(trimmed)) {
+        throw new SchemaError('script.query.invalid', { detail: 'only SELECT statements are allowed' });
+    }
+    if (trimmed.includes(';')) {
+        throw new SchemaError('script.query.invalid', { detail: 'multiple statements are not allowed' });
+    }
+    if (options.rls !== undefined && !RLS_ROLE_RE.test(options.rls.role)) {
+        throw new SchemaError('script.query.invalid', { detail: `invalid RLS role "${options.rls.role}"` });
+    }
+    const client = await pool.connect();
+    let inTransaction = false;
+    try {
+        await client.query('BEGIN');
+        inTransaction = true;
+        await client.query(`SET LOCAL statement_timeout = ${Math.max(1, Math.floor(timeoutMs))}`);
+        if (options.rls !== undefined) {
+            const { role, subject } = options.rls;
+            await client.query(`SET LOCAL ROLE ${role}`);
+            await client.query(`SET LOCAL weavekit.actor_id = ${gucLiteral(subject.id)}`);
+            await client.query(`SET LOCAL weavekit.roles = ${gucLiteral(subject.roles.join(','))}`);
+            if (subject.teamId !== undefined) {
+                await client.query(`SET LOCAL weavekit.team_id = ${gucLiteral(subject.teamId)}`);
+            }
+        }
+        const result = await client.query(`SELECT * FROM (${trimmed}) AS __restricted__ LIMIT $${params.length + 1}`, [...params, maxRows]);
+        await client.query('COMMIT');
+        inTransaction = false;
+        return { rows: result.rows };
+    }
+    catch (error) {
+        if (inTransaction) {
+            try {
+                await client.query('ROLLBACK');
+            }
+            catch {
+                // the client may be broken after a timeout — release and move on
+            }
+        }
+        throw error;
+    }
+    finally {
+        client.release();
+    }
+}
+//# sourceMappingURL=sql-executor.js.map

package/dist/runtime/data-access/sql-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-executor.js","sourceRoot":"","sources":["../../../src/runtime/data-access/sql-executor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAiClD,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEzC,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAU,EACV,GAAW,EACX,MAAiB,EACjB,UAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC;IAEvD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,qBAAqB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,aAAa,GAAG,IAAI,CAAC;QACrB,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;YACtC,MAAM,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;YAC7C,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9E,MAAM,MAAM,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,MAAM,CAAC,KAAK,CAAC,gCAAgC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,kBAAkB,OAAO,8BAA8B,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,EAC1E,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC,CACrB,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,aAAa,GAAG,KAAK,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAiB,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;YACnE,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/runtime/data-access/sql-gate.d.ts

@@ -0,0 +1,35 @@
+import type { Locale, ObjectRegistry } from '../../core/index.js';
+import type { SqlAnalysis } from '../sql-analyzer/index.js';
+/**
+ * RBAC gates for restricted SQL (`this.db.query`), run before execution.
+ *
+ * Layered on top of the SQL analyzer's authoritative table/column references
+ * and the core RBAC decision layer (`resolvePermission` / `buildRowScope`):
+ *
+ * 1. **read permission** — the subject must have a read permission on every
+ *    referenced object table (deterministic error instead of a silent 0 rows).
+ * 2. **team scope** — a `team`-read object requires `subject.teamId`.
+ * 3. **field `exclude`** (fine-grained, column-level) — a query that references
+ *    an excluded column of a field-restricted object is rejected:
+ *    - a star (`*` / `t.*`) over a field-restricted object
+ *    - a qualified column reference (`t.excluded`) to an excluded field
+ *    - a bare column that matches an excluded field of any referenced
+ *      field-restricted object (conservative — we cannot resolve bare columns
+ *      to a table without schema knowledge, so we over-block rather than leak)
+ *
+ * Row-level scoping is handled separately by PostgreSQL RLS (see the C2 design);
+ * this module is the permission + column boundary in the application layer.
+ * All failures are `script.query.denied` (403) except missing `teamId`, which is
+ * the existing `rbac.teamId.missing`.
+ */
+export interface SqlGateOptions {
+    analysis: SqlAnalysis;
+    registry: ObjectRegistry;
+    /** subject role names (resolved permission derives the read scope + exclusions) */
+    roles: readonly string[];
+    /** subject team id, required when a referenced object's read scope is `team` */
+    teamId?: string;
+    locale?: Locale;
+}
+export declare function enforceSqlGates(options: SqlGateOptions): void;
+//# sourceMappingURL=sql-gate.d.ts.map

package/dist/runtime/data-access/sql-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-gate.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/sql-gate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAoB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,mFAAmF;IACnF,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAiE7D"}

package/dist/runtime/data-access/sql-gate.js

@@ -0,0 +1,70 @@
+import { SchemaError, resolvePermission } from '../../core/index.js';
+import { READ_SCOPES } from '../../core/index.js';
+function denied(object, detail, locale) {
+    throw new SchemaError('script.query.denied', { object, detail }, locale);
+}
+export function enforceSqlGates(options) {
+    const { analysis, registry, roles, teamId, locale } = options;
+    // fail-closed: every referenced table must be an engine-managed object.
+    // A table outside the registry has no RBAC policy and no RLS strategy, so
+    // letting the query through would bypass the permission model entirely
+    // (e.g. system tables, other schemas, or the customer's own ad-hoc tables).
+    for (const table of analysis.tables) {
+        if (registry.get(table) === undefined) {
+            denied(table, 'table is not a managed object', locale);
+        }
+    }
+    // referenced object tables (registry-known) → resolved permission
+    const objects = new Map();
+    for (const table of analysis.tables) {
+        const def = registry.get(table);
+        if (def !== undefined)
+            objects.set(table, def);
+    }
+    // excluded fields per referenced object (empty set = not field-restricted)
+    const excludedByTable = new Map();
+    for (const [name, def] of objects) {
+        const p = resolvePermission(def, roles);
+        if (p === undefined || p.read === undefined) {
+            denied(name, 'role has no read permission on this object', locale);
+        }
+        if (p.read === READ_SCOPES.TEAM && teamId === undefined) {
+            throw new SchemaError('rbac.teamId.missing', { object: name }, locale);
+        }
+        if (p.exclude !== undefined && p.exclude.length > 0) {
+            excludedByTable.set(name, new Set(p.exclude));
+        }
+    }
+    if (excludedByTable.size === 0)
+        return;
+    for (const ref of analysis.columnRefs) {
+        if (ref.star) {
+            // star: qualified star resolves to one table; bare star covers all FROM tables
+            const tables = ref.qualifier !== undefined ? [analysis.resolvers[ref.qualifier]] : analysis.tables;
+            for (const table of tables) {
+                if (table !== undefined && excludedByTable.has(table)) {
+                    denied(table, 'field-restricted object cannot be selected with *', locale);
+                }
+            }
+        }
+        else if (ref.qualifier !== undefined) {
+            const table = analysis.resolvers[ref.qualifier];
+            if (table !== undefined) {
+                const excluded = excludedByTable.get(table);
+                if (excluded !== undefined && excluded.has(ref.column)) {
+                    denied(table, `field "${ref.column}" is restricted for this role`, locale);
+                }
+            }
+        }
+        else {
+            // bare column — conservative: if it matches an excluded field of any
+            // referenced field-restricted object, reject (it may be that object's column)
+            for (const [table, excluded] of excludedByTable) {
+                if (excluded.has(ref.column)) {
+                    denied(table, `field "${ref.column}" is restricted for this role`, locale);
+                }
+            }
+        }
+    }
+}
+//# sourceMappingURL=sql-gate.js.map

package/dist/runtime/data-access/sql-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-gate.js","sourceRoot":"","sources":["../../../src/runtime/data-access/sql-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAoClD,SAAS,MAAM,CAAC,MAAc,EAAE,MAAc,EAAE,MAAe;IAC7D,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAuB;IACrD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE9D,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,CAAC,KAAK,EAAE,+BAA+B,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,2EAA2E;IAC3E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,EAAE,4CAA4C,EAAE,MAAM,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACxD,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAEvC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,+EAA+E;YAC/E,MAAM,MAAM,GACV,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtD,MAAM,CAAC,KAAK,EAAE,mDAAmD,EAAE,MAAM,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC5C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvD,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,CAAC,MAAM,+BAA+B,EAAE,MAAM,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,8EAA8E;YAC9E,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,eAAe,EAAE,CAAC;gBAChD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7B,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,CAAC,MAAM,+BAA+B,EAAE,MAAM,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/runtime/data-access/tx.d.ts

@@ -0,0 +1,12 @@
+import type { DataAccessContext } from './types.js';
+/**
+ * `withTx` — cross-operation atomic execution (D1). Leases a pooled client,
+ * opens a transaction and re-enters the callback with a context that carries
+ * that connection as `client`, so nested data-access calls reuse the
+ * transaction instead of opening their own (see `DefaultObjectDataAccess`
+ * owned-connection handling). Commits on success, rolls back on throw,
+ * releases in `finally`. Nested calls are safe: when the context already
+ * carries a `client`, the callback runs directly inside the outer transaction.
+ */
+export declare function withTx<T>(ctx: DataAccessContext, fn: (txCtx: DataAccessContext) => Promise<T>): Promise<T>;
+//# sourceMappingURL=tx.d.ts.map

package/dist/runtime/data-access/tx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tx.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/tx.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAAC,CAAC,EAC5B,GAAG,EAAE,iBAAiB,EACtB,EAAE,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3C,OAAO,CAAC,CAAC,CAAC,CAiBZ"}

package/dist/runtime/data-access/tx.js

@@ -0,0 +1,30 @@
+/**
+ * `withTx` — cross-operation atomic execution (D1). Leases a pooled client,
+ * opens a transaction and re-enters the callback with a context that carries
+ * that connection as `client`, so nested data-access calls reuse the
+ * transaction instead of opening their own (see `DefaultObjectDataAccess`
+ * owned-connection handling). Commits on success, rolls back on throw,
+ * releases in `finally`. Nested calls are safe: when the context already
+ * carries a `client`, the callback runs directly inside the outer transaction.
+ */
+export async function withTx(ctx, fn) {
+    if (ctx.client !== undefined) {
+        return fn(ctx);
+    }
+    const client = await ctx.pool.connect();
+    const txCtx = { ...ctx, client };
+    try {
+        await client.query('BEGIN');
+        const result = await fn(txCtx);
+        await client.query('COMMIT');
+        return result;
+    }
+    catch (err) {
+        await client.query('ROLLBACK');
+        throw err;
+    }
+    finally {
+        client.release();
+    }
+}
+//# sourceMappingURL=tx.js.map

package/dist/runtime/data-access/tx.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tx.js","sourceRoot":"","sources":["../../../src/runtime/data-access/tx.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,GAAsB,EACtB,EAA4C;IAE5C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,KAAK,GAAsB,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/runtime/data-access/types.d.ts

@@ -0,0 +1,82 @@
+import type { Pool, PoolClient } from "pg";
+import type { Locale } from "../../core/index.js";
+import type { ObjectRegistry } from "../../core/index.js";
+import type { RbacSubject } from "../../core/index.js";
+import type { FilterOp, SortDir } from "./values.js";
+/** pool or pooled client — anything that can run parameterized queries */
+export type Queryable = Pool | PoolClient;
+export type FilterValue = {
+    [op in FilterOp]?: unknown;
+};
+/** a single equality/operator object filter — conditions across fields are AND'd */
+export type FilterGroup = {
+    [field: string]: unknown | FilterValue;
+};
+/**
+ * Filter contract (M5 REST `filter` JSON):
+ * - plain object form (AND across fields), e.g. `{ status: 'open', amount: { gte: 100 } }`
+ * - OR across groups via the reserved top-level `$or` key:
+ *   `{ $or: [ { status: 'open' }, { amount: { gte: 100 } } ] }` → `(status = 'open' OR amount >= 100)`
+ * `$or` groups AND with any top-level field conditions and with the RBAC row scope.
+ */
+export type Filter = FilterGroup & {
+    $or?: FilterGroup[];
+};
+export interface Sort {
+    field: string;
+    dir: SortDir;
+}
+export interface FindOptions {
+    filter?: Filter;
+    sort?: Sort[];
+    /** rows per page; defaults to PAGINATION.DEFAULT_LIMIT, capped at PAGINATION.MAX_LIMIT */
+    limit?: number;
+    /** rows to skip; defaults to PAGINATION.DEFAULT_OFFSET */
+    offset?: number;
+    /** column projection whitelist */
+    fields?: string[];
+    /** columns always excluded from the projection (RBAC fields.exclude) */
+    exclude?: string[];
+}
+export interface FindResult<T = Record<string, unknown>> {
+    rows: T[];
+    total: number;
+}
+/**
+ * Execution context for data-access operations. `rowScope` is the RBAC
+ * row-level filter (own/all) injected by the RBAC layer; consumers may
+ * leave it unset to access all rows. `subject` is the authenticated identity
+ * the RBAC layer decides for; absent = unrestricted. `client` threads an
+ * outer transaction: when set, write operations reuse the connection and the
+ * surrounding transaction instead of BEGIN/COMMIT/ROLLBACK themselves
+ * (see `runtime/data-access/tx.ts`).
+ */
+export interface DataAccessContext {
+    pool: Pool;
+    registry: ObjectRegistry;
+    /** extra WHERE fragment (AND'd), injected by the RBAC layer for own/team/all scope */
+    rowScope?: {
+        sql: string;
+        params: unknown[];
+    };
+    /** authenticated identity for RBAC decisions; absent = no enforcement */
+    subject?: RbacSubject;
+    locale?: Locale;
+    /** outer transaction connection; present inside `withTx` (skips nested BEGIN/COMMIT/release) */
+    client?: PoolClient;
+    /**
+     * channel for non-fatal write warnings — afterUpdate/afterDelete script hooks
+     * fail after the write is committed; the messages are delivered here so the
+     * API layer can surface them (e.g. a `warnings` array on the response)
+     */
+    onWarnings?: (warnings: string[]) => void;
+}
+/** contract for the controlled object data-access layer */
+export interface ObjectDataAccess {
+    find<T = Record<string, unknown>>(objectName: string, opts: FindOptions, ctx: DataAccessContext): Promise<FindResult<T>>;
+    findOne<T = Record<string, unknown>>(objectName: string, id: string, ctx: DataAccessContext): Promise<T | null>;
+    create<T = Record<string, unknown>>(objectName: string, data: Record<string, unknown>, ctx: DataAccessContext): Promise<T>;
+    update<T = Record<string, unknown>>(objectName: string, id: string, changes: Record<string, unknown>, ctx: DataAccessContext): Promise<T>;
+    delete(objectName: string, id: string, ctx: DataAccessContext): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/runtime/data-access/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAErD,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,UAAU,CAAC;AAE1C,MAAM,MAAM,WAAW,GAAG;KAAG,EAAE,IAAI,QAAQ,CAAC,CAAC,EAAE,OAAO;CAAE,CAAC;AAEzD,oFAAoF;AACpF,MAAM,MAAM,WAAW,GAAG;IAAE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,MAAM,MAAM,GAAG,WAAW,GAAG;IAAE,GAAG,CAAC,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAE3D,MAAM,WAAW,IAAI;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACd,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACrD,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,cAAc,CAAC;IACzB,sFAAsF;IACtF,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAC9C,yEAAyE;IACzE,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;CAC3C;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACrB,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/E"}

package/dist/runtime/data-access/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/runtime/data-access/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/runtime/data-access/types.ts"],"names":[],"mappings":""}

package/dist/runtime/data-access/validate.d.ts

@@ -0,0 +1,17 @@
+import type { Locale, ObjectDefinition, ObjectRegistry } from '../../core/index.js';
+import type { Queryable } from './types.js';
+import { type WriteMode } from './values.js';
+export interface ValidateRecordOptions {
+    pool: Queryable;
+    registry: ObjectRegistry;
+    locale?: Locale;
+}
+/**
+ * Validate a record before write:
+ * - rejects unknown fields and writes to read-only (system/formula/seq_no) fields
+ * - enforces required (create), field type, enum/min/max/length/regex
+ * - verifies relation / multiRelation targets exist
+ * - rejects nested details on update (child rows are managed via the child object CRUD)
+ */
+export declare function validateRecord(object: ObjectDefinition, data: Record<string, unknown>, mode: WriteMode, options: ValidateRecordOptions): Promise<void>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/runtime/data-access/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAc,gBAAgB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIhG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ1D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA0HD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CA6Cf"}