@weave-kit/engine 0.5.0 → 0.6.0

package/dist/core/rbac/authorize.js

@@ -1,44 +1,49 @@
 import { SchemaError } from '../types/errors.js';
 import { resolvePermission } from './resolve.js';
+import { resolvePermissionFor } from './details.js';
 function deny(locale, code, params) {
     throw new SchemaError(code, params, locale);
 }
-export function canCreate(def, roles) {
-    return resolvePermission(def, roles)?.create === true;
+/** resolve a permission, deriving from a details parent when `lookup` is given */
+function perm(def, roles, lookup) {
+    return lookup === undefined ? resolvePermission(def, roles) : resolvePermissionFor(lookup, def, roles);
 }
-export function canDelete(def, roles) {
-    return resolvePermission(def, roles)?.delete === true;
+export function canCreate(def, roles, lookup) {
+    return perm(def, roles, lookup)?.create === true;
 }
-export function canUpdate(def, roles) {
-    const p = resolvePermission(def, roles);
+export function canDelete(def, roles, lookup) {
+    return perm(def, roles, lookup)?.delete === true;
+}
+export function canUpdate(def, roles, lookup) {
+    const p = perm(def, roles, lookup);
     if (p === undefined)
         return false;
     return p.update === null || p.update.length > 0;
 }
-export function canUpdateField(def, roles, field) {
-    const p = resolvePermission(def, roles);
+export function canUpdateField(def, roles, field, lookup) {
+    const p = perm(def, roles, lookup);
     if (p === undefined)
         return false;
     return p.update === null || p.update.includes(field);
 }
 /** allowed update fields; null = all fields, [] = none */
-export function allowedUpdateFields(def, roles) {
-    return resolvePermission(def, roles)?.update ?? null;
+export function allowedUpdateFields(def, roles, lookup) {
+    return perm(def, roles, lookup)?.update ?? null;
 }
-export function assertCanCreate(def, roles, locale) {
-    if (!canCreate(def, roles))
+export function assertCanCreate(def, roles, locale, lookup) {
+    if (!canCreate(def, roles, lookup))
         deny(locale, 'rbac.denied.create', { object: def.name, role: roles.join(',') });
 }
-export function assertCanUpdate(def, roles, locale) {
-    if (!canUpdate(def, roles))
+export function assertCanUpdate(def, roles, locale, lookup) {
+    if (!canUpdate(def, roles, lookup))
         deny(locale, 'rbac.denied.update', { object: def.name, role: roles.join(',') });
 }
-export function assertCanDelete(def, roles, locale) {
-    if (!canDelete(def, roles))
+export function assertCanDelete(def, roles, locale, lookup) {
+    if (!canDelete(def, roles, lookup))
         deny(locale, 'rbac.denied.delete', { object: def.name, role: roles.join(',') });
 }
-export function assertCanUpdateField(def, roles, field, locale) {
-    if (!canUpdateField(def, roles, field)) {
+export function assertCanUpdateField(def, roles, field, locale, lookup) {
+    if (!canUpdateField(def, roles, field, lookup)) {
         deny(locale, 'rbac.denied.field', { object: def.name, role: roles.join(','), field });
     }
 }

package/dist/core/rbac/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/core/rbac/authorize.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,SAAS,IAAI,CAAC,MAA0B,EAAE,IAAgB,EAAE,MAA+B;IACzF,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAqB,EAAE,KAAwB;IACvE,OAAO,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAqB,EAAE,KAAwB;IACvE,OAAO,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAqB,EAAE,KAAwB;IACvE,MAAM,CAAC,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAqB,EAAE,KAAwB,EAAE,KAAa;IAC3F,MAAM,CAAC,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,mBAAmB,CAAC,GAAqB,EAAE,KAAwB;IACjF,OAAO,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAqB,EACrB,KAAwB,EACxB,MAAe;IAEf,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAqB,EACrB,KAAwB,EACxB,MAAe;IAEf,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAqB,EACrB,KAAwB,EACxB,MAAe;IAEf,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAqB,EACrB,KAAwB,EACxB,KAAa,EACb,MAAe;IAEf,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/core/rbac/authorize.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAA2B,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAqB,MAAM,cAAc,CAAC;AAEvE,SAAS,IAAI,CAAC,MAA0B,EAAE,IAAgB,EAAE,MAA+B;IACzF,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,kFAAkF;AAClF,SAAS,IAAI,CACX,GAAqB,EACrB,KAAwB,EACxB,MAAqB;IAErB,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AACzG,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAqB,EAAE,KAAwB,EAAE,MAAqB;IAC9F,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAqB,EAAE,KAAwB,EAAE,MAAqB;IAC9F,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAqB,EAAE,KAAwB,EAAE,MAAqB;IAC9F,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAqB,EACrB,KAAwB,EACxB,KAAa,EACb,MAAqB;IAErB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,mBAAmB,CACjC,GAAqB,EACrB,KAAwB,EACxB,MAAqB;IAErB,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAqB,EACrB,KAAwB,EACxB,MAAe,EACf,MAAqB;IAErB,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAqB,EACrB,KAAwB,EACxB,MAAe,EACf,MAAqB;IAErB,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAqB,EACrB,KAAwB,EACxB,MAAe,EACf,MAAqB;IAErB,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAqB,EACrB,KAAwB,EACxB,KAAa,EACb,MAAe,EACf,MAAqB;IAErB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}

package/dist/core/rbac/details.d.ts

@@ -0,0 +1,33 @@
+import type { ObjectDefinition, ReadScope } from '../types/index.js';
+import type { Locale } from '../i18n/index.js';
+import type { IdentitySubject } from '../provider/identity/types.js';
+import { type ResolvedPermission } from './resolve.js';
+import { type RowScopeFragment } from './rowScope.js';
+/**
+ * Details-child permission inheritance.
+ *
+ * A `details` child is an owned part of its parent record: its effective
+ * permission/scope is derived from the parent. A child may **narrow** (declare
+ * stricter permissions) but never broaden — the two are intersected. A child
+ * with no declared `permissions` is exactly its parent's.
+ */
+/** minimal registry lookup (ObjectRegistry structurally satisfies it) — avoids a core cycle */
+export interface ObjectLookup {
+    get(name: string): ObjectDefinition | undefined;
+}
+/**
+ * Effective permission for `def`, deriving from its details parent when it is a
+ * child (intersection — never broader). Non-child objects resolve as-is.
+ */
+export declare function resolvePermissionFor(lookup: ObjectLookup, def: ObjectDefinition, roles: readonly string[]): ResolvedPermission | undefined;
+/**
+ * Row-scope fragment for `def`. A details child is scoped by membership in its
+ * (scoped) parent set: `EXISTS (SELECT 1 FROM parent p WHERE <parent scope> AND
+ * p.<record_key> = child.parent_id)`.
+ *
+ * `alias` qualifies the child-side column references (the child's `parent_id`),
+ * for embedding the predicate in a correlated subquery over an aliased target
+ * table (e.g. element-level scoping of a `multiRelation` target).
+ */
+export declare function buildRowScopeFor(lookup: ObjectLookup, def: ObjectDefinition, scope: ReadScope | undefined, subject: IdentitySubject, roles: readonly string[], locale?: Locale, alias?: string): RowScopeFragment | undefined;
+//# sourceMappingURL=details.d.ts.map

package/dist/core/rbac/details.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"details.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/details.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAErE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAqB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGrE;;;;;;;GAOG;AAEH,+FAA+F;AAC/F,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAAC;CACjD;AAmBD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,kBAAkB,GAAG,SAAS,CAkBhC;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,GACb,gBAAgB,GAAG,SAAS,CAa9B"}

package/dist/core/rbac/details.js

@@ -0,0 +1,74 @@
+import { DETAILS_COLUMNS } from '../types/values.js';
+import { resolvePermission } from './resolve.js';
+import { buildRowScope } from './rowScope.js';
+import { recordKeySql } from '../storage/record-key-sql.js';
+const q = (name) => `"${name}"`;
+const SCOPE_RANK = { own: 1, department: 2, all: 3 };
+/** the narrower of two scopes; undefined (denied) on either side wins */
+function narrowerScope(a, b) {
+    if (a === undefined || b === undefined)
+        return undefined;
+    return SCOPE_RANK[a] <= SCOPE_RANK[b] ? a : b;
+}
+/** intersect two allowed-field lists (`null` = all; `[]` = none) */
+function intersectAllowed(a, b) {
+    if (a === null)
+        return b;
+    if (b === null)
+        return a;
+    const set = new Set(b);
+    return a.filter((field) => set.has(field));
+}
+/**
+ * Effective permission for `def`, deriving from its details parent when it is a
+ * child (intersection — never broader). Non-child objects resolve as-is.
+ */
+export function resolvePermissionFor(lookup, def, roles) {
+    const own = resolvePermission(def, roles);
+    const parentName = def.detailsParent;
+    if (parentName === undefined)
+        return own;
+    const parent = lookup.get(parentName);
+    if (parent === undefined)
+        return own;
+    const parentPerm = resolvePermission(parent, roles);
+    // fail-closed: a denial on either side denies the child
+    if (parentPerm === undefined || own === undefined)
+        return undefined;
+    return {
+        read: narrowerScope(parentPerm.read, own.read),
+        manage: narrowerScope(parentPerm.manage, own.manage),
+        create: parentPerm.create && own.create,
+        update: intersectAllowed(parentPerm.update, own.update),
+        delete: parentPerm.delete && own.delete,
+        exclude: Array.from(new Set([...parentPerm.exclude, ...own.exclude])),
+        createFields: intersectAllowed(parentPerm.createFields, own.createFields),
+    };
+}
+/**
+ * Row-scope fragment for `def`. A details child is scoped by membership in its
+ * (scoped) parent set: `EXISTS (SELECT 1 FROM parent p WHERE <parent scope> AND
+ * p.<record_key> = child.parent_id)`.
+ *
+ * `alias` qualifies the child-side column references (the child's `parent_id`),
+ * for embedding the predicate in a correlated subquery over an aliased target
+ * table (e.g. element-level scoping of a `multiRelation` target).
+ */
+export function buildRowScopeFor(lookup, def, scope, subject, roles, locale, alias) {
+    const parentName = def.detailsParent;
+    if (parentName === undefined)
+        return buildRowScope(def, scope, subject, roles, locale, alias);
+    const parent = lookup.get(parentName);
+    if (parent === undefined)
+        return buildRowScope(def, scope, subject, roles, locale, alias);
+    const parentFragment = buildRowScope(parent, scope, subject, roles, locale, 'p');
+    if (parentFragment === undefined)
+        return undefined;
+    const rk = recordKeySql(parent, (field) => `p.${q(field)}`);
+    const childId = alias === undefined ? q(DETAILS_COLUMNS.PARENT_ID) : `${alias}.${q(DETAILS_COLUMNS.PARENT_ID)}`;
+    return {
+        sql: `EXISTS (SELECT 1 FROM ${q(parent.name)} p WHERE (${parentFragment.sql}) AND ${rk} = ${childId})`,
+        params: parentFragment.params,
+    };
+}
+//# sourceMappingURL=details.js.map

package/dist/core/rbac/details.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"details.js","sourceRoot":"","sources":["../../../src/core/rbac/details.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,EAAE,iBAAiB,EAA2B,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAyB,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAgB5D,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;AACxC,MAAM,UAAU,GAA8B,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAEhF,yEAAyE;AACzE,SAAS,aAAa,CAAC,CAAwB,EAAE,CAAwB;IACvE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,oEAAoE;AACpE,SAAS,gBAAgB,CAAC,CAAkB,EAAE,CAAkB;IAC9D,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAoB,EACpB,GAAqB,EACrB,KAAwB;IAExB,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC;IACrC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACrC,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,wDAAwD;IACxD,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO;QACL,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;QAC9C,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACpD,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;QACvC,MAAM,EAAE,gBAAgB,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACvD,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;QACvC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,YAAY,EAAE,gBAAgB,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,GAAqB,EACrB,KAA4B,EAC5B,OAAwB,EACxB,KAAwB,EACxB,MAAe,EACf,KAAc;IAEd,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC;IACrC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1F,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;IAChH,OAAO;QACL,GAAG,EAAE,yBAAyB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,cAAc,CAAC,GAAG,SAAS,EAAE,MAAM,OAAO,GAAG;QACtG,MAAM,EAAE,cAAc,CAAC,MAAM;KAC9B,CAAC;AACJ,CAAC"}

package/dist/core/rbac/fields.d.ts

@@ -1,4 +1,5 @@
 import type { ObjectDefinition } from '../types/index.js';
+import { type ObjectLookup } from './details.js';
 /** fields hidden from read output for the given roles (empty = nothing hidden) */
-export declare function excludedFields(def: ObjectDefinition, roles: readonly string[]): string[];
+export declare function excludedFields(def: ObjectDefinition, roles: readonly string[], lookup?: ObjectLookup): string[];
 //# sourceMappingURL=fields.d.ts.map

package/dist/core/rbac/fields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/fields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAExF"}
+{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/fields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvE,kFAAkF;AAClF,wBAAgB,cAAc,CAC5B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,YAAY,GACpB,MAAM,EAAE,CAEV"}

package/dist/core/rbac/fields.js

@@ -1,6 +1,7 @@
 import { resolvePermission } from './resolve.js';
+import { resolvePermissionFor } from './details.js';
 /** fields hidden from read output for the given roles (empty = nothing hidden) */
-export function excludedFields(def, roles) {
-    return resolvePermission(def, roles)?.exclude ?? [];
+export function excludedFields(def, roles, lookup) {
+    return (lookup === undefined ? resolvePermission(def, roles) : resolvePermissionFor(lookup, def, roles))?.exclude ?? [];
 }
 //# sourceMappingURL=fields.js.map

package/dist/core/rbac/fields.js.map

@@ -1 +1 @@
-{"version":3,"file":"fields.js","sourceRoot":"","sources":["../../../src/core/rbac/fields.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,GAAqB,EAAE,KAAwB;IAC5E,OAAO,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"fields.js","sourceRoot":"","sources":["../../../src/core/rbac/fields.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAqB,MAAM,cAAc,CAAC;AAEvE,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAC5B,GAAqB,EACrB,KAAwB,EACxB,MAAqB;IAErB,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;AAC1H,CAAC"}

package/dist/core/rbac/index.d.ts

@@ -1,9 +1,10 @@
-export type { RbacSubject } from './types.js';
+export type { IdentitySubject } from './types.js';
 export type { ResolvedPermission } from './resolve.js';
 export type { RowScopeFragment } from './rowScope.js';
 export { resolvePermission } from './resolve.js';
 export { canCreate, canDelete, canUpdate, canUpdateField, allowedUpdateFields, assertCanCreate, assertCanUpdate, assertCanDelete, assertCanUpdateField, } from './authorize.js';
 export { buildRowScope } from './rowScope.js';
+export { resolvePermissionFor, buildRowScopeFor, type ObjectLookup } from './details.js';
 export { excludedFields } from './fields.js';
-export { buildRlsPolicy, buildRlsPolicyDdl, buildRlsGrantDdl, policyName } from './rls.js';
+export { buildRlsPolicy, buildRlsPolicyDdl, buildRlsGrantDdl, policyName, isSafeRlsRole } from './rls.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/rbac/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}

package/dist/core/rbac/index.js

@@ -1,6 +1,7 @@
 export { resolvePermission } from './resolve.js';
 export { canCreate, canDelete, canUpdate, canUpdateField, allowedUpdateFields, assertCanCreate, assertCanUpdate, assertCanDelete, assertCanUpdateField, } from './authorize.js';
 export { buildRowScope } from './rowScope.js';
+export { resolvePermissionFor, buildRowScopeFor } from './details.js';
 export { excludedFields } from './fields.js';
-export { buildRlsPolicy, buildRlsPolicyDdl, buildRlsGrantDdl, policyName } from './rls.js';
+export { buildRlsPolicy, buildRlsPolicyDdl, buildRlsGrantDdl, policyName, isSafeRlsRole } from './rls.js';
 //# sourceMappingURL=index.js.map

package/dist/core/rbac/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/rbac/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/rbac/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAqB,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}

package/dist/core/rbac/resolve.d.ts

@@ -3,6 +3,8 @@ import type { ObjectDefinition, ReadScope } from '../types/index.js';
 export interface ResolvedPermission {
     /** read scope; undefined = read denied */
     read?: ReadScope;
+    /** write scope (update/delete/transition); defaults to `read` */
+    manage?: ReadScope;
     create: boolean;
     /** null = all fields updatable; [] = none; otherwise the whitelist */
     update: string[] | null;
@@ -16,7 +18,7 @@ export interface ResolvedPermission {
  * Resolve the effective permission for a subject's roles.
  * - no `permissions` map on the object → full CRUD (open mode)
  * - permissions declared but none of the roles listed → denied (returns undefined)
- * - multiple roles → merged: read takes the most permissive scope, update/exclude union
+ * - multiple roles → merged: read/manage take the most permissive scope, update/exclude union
  */
 export declare function resolvePermission(def: ObjectDefinition, roles: readonly string[]): ResolvedPermission | undefined;
 //# sourceMappingURL=resolve.d.ts.map

package/dist/core/rbac/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAwB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG3F,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uFAAuF;IACvF,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC/B;AAkBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,kBAAkB,GAAG,SAAS,CA+BhC"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAwB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG3F,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,iEAAiE;IACjE,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uFAAuF;IACvF,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC/B;AA6BD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,kBAAkB,GAAG,SAAS,CA4BhC"}

package/dist/core/rbac/resolve.js

@@ -1,9 +1,20 @@
 import { READ_SCOPES } from '../types/index.js';
-const READ_RANK = { own: 1, team: 2, all: 3 };
+const SCOPE_RANK = { own: 1, department: 2, all: 3 };
+/** the most permissive scope among several (undefined when none is set) */
+function mostPermissive(scopes) {
+    let best;
+    for (const scope of scopes) {
+        if (scope !== undefined && (best === undefined || SCOPE_RANK[scope] > SCOPE_RANK[best]))
+            best = scope;
+    }
+    return best;
+}
 /** defaults for a declared role: unspecified operations are denied (fail-closed) */
 function declaredPermission(p) {
     return {
         read: p.read,
+        // manage defaults to the role's read scope (narrow read, broad manage is opt-in)
+        manage: p.manage ?? p.read,
         create: p.create ?? false,
         // update: true -> null (all fields updatable); false/undefined -> [] (none)
         update: p.update === true ? null : (typeof p.update === 'boolean' ? [] : (p.update ?? [])),
@@ -17,11 +28,11 @@ function declaredPermission(p) {
  * Resolve the effective permission for a subject's roles.
  * - no `permissions` map on the object → full CRUD (open mode)
  * - permissions declared but none of the roles listed → denied (returns undefined)
- * - multiple roles → merged: read takes the most permissive scope, update/exclude union
+ * - multiple roles → merged: read/manage take the most permissive scope, update/exclude union
  */
 export function resolvePermission(def, roles) {
     if (def.permissions === undefined) {
-        return { read: READ_SCOPES.ALL, create: true, update: null, delete: true, exclude: [], createFields: null };
+        return { read: READ_SCOPES.ALL, manage: READ_SCOPES.ALL, create: true, update: null, delete: true, exclude: [], createFields: null };
     }
     const resolved = [];
     for (const role of roles) {
@@ -31,12 +42,8 @@ export function resolvePermission(def, roles) {
     }
     if (resolved.length === 0)
         return undefined;
-    let read;
-    for (const r of resolved) {
-        if (r.read !== undefined && (read === undefined || READ_RANK[r.read] > READ_RANK[read])) {
-            read = r.read;
-        }
-    }
+    const read = mostPermissive(resolved.map((r) => r.read));
+    const manage = mostPermissive(resolved.map((r) => r.manage));
     const update = resolved.some((r) => r.update === null)
         ? null
         : Array.from(new Set(resolved.flatMap((r) => r.update ?? [])));
@@ -45,6 +52,7 @@ export function resolvePermission(def, roles) {
         : Array.from(new Set(resolved.flatMap((r) => r.createFields ?? [])));
     return {
         read,
+        manage,
         create: resolved.some((r) => r.create),
         delete: resolved.some((r) => r.delete),
         update,

package/dist/core/rbac/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/core/rbac/resolve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAgBhD,MAAM,SAAS,GAA8B,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAEzE,oFAAoF;AACpF,SAAS,kBAAkB,CAAC,CAAuB;IACjD,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK;QACzB,4EAA4E;QAC5E,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK;QACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE;QAChC,mGAAmG;QACnG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;KACtE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAqB,EACrB,KAAwB;IAExB,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC9G,CAAC;IACD,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5C,IAAI,IAA2B,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxF,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAoB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;QACrE,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAoB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC;QACjF,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/core/rbac/resolve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAkBhD,MAAM,UAAU,GAA8B,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAEhF,2EAA2E;AAC3E,SAAS,cAAc,CAAC,MAAoC;IAC1D,IAAI,IAA2B,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAAE,IAAI,GAAG,KAAK,CAAC;IACxG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,SAAS,kBAAkB,CAAC,CAAuB;IACjD,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,iFAAiF;QACjF,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK;QACzB,4EAA4E;QAC5E,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK;QACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE;QAChC,mGAAmG;QACnG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;KACtE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAqB,EACrB,KAAwB;IAExB,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACvI,CAAC;IACD,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5C,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAoB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;QACrE,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAoB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC;QACjF,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO;QACL,IAAI;QACJ,MAAM;QACN,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/core/rbac/rls.d.ts

@@ -9,4 +9,10 @@ export declare function buildRlsPolicy(def: ObjectDefinition): string | undefine
 export declare function buildRlsPolicyDdl(def: ObjectDefinition): string[];
 /** GRANT the restricted-SQL role read access to one object */
 export declare function buildRlsGrantDdl(def: ObjectDefinition, role: string): string;
+/**
+ * True when `role` is a safe, non-reserved identifier for `SET LOCAL ROLE` /
+ * `CREATE ROLE`. The name is always emitted quoted (`sqlIdent`), so this guards
+ * against pseudo-roles and reserved keywords rather than injection.
+ */
+export declare function isSafeRlsRole(role: string): boolean;
 //# sourceMappingURL=rls.d.ts.map

package/dist/core/rbac/rls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rls.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/rls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA0B1D,wBAAgB,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAExD;AAUD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAwBxE;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAQjE;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5E"}
+{"version":3,"file":"rls.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/rls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAiC1D,wBAAgB,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAExD;AAUD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAwBxE;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAQjE;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5E;AAkCD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnD"}

package/dist/core/rbac/rls.js

@@ -1,4 +1,5 @@
 import { READ_SCOPES, ROW_SCOPE_MARKERS } from '../types/index.js';
+import { sqlIdent } from '../storage/sql-literals.js';
 const q = (id) => `"${id}"`;
 /**
  * Row-level security policy generation for the script sandbox's restricted SQL
@@ -7,15 +8,21 @@ const q = (id) => `"${id}"`;
  * `db.query` switches to a dedicated non-owner role (`SET LOCAL ROLE`) that IS
  * subject to RLS, and the subject is carried in session GUCs:
  *
- * - `weavekit.roles`     comma-joined role names
- * - `weavekit.actor_id`  subject id (own scope)
- * - `weavekit.team_id`   subject team id (team scope)
+ * - `weavekit.roles`         comma-joined role names
+ * - `weavekit.actor_id`      subject id (own scope)
+ * - `weavekit.department_id` subject department id (department scope)
  *
  * Unset GUCs resolve to NULL → the predicate is false → **0 rows (fail-closed)**.
  *
  * The predicate mirrors `resolvePermission` + `buildRowScope`: this is a second
  * encoding of the same matrix, so a parity test (db.objects vs db.query must
  * return the same rows for the same subject) guards against drift.
+ *
+ * Limitation: a script's `db.query` scopes `own`/`department` by flat equality
+ * on the marked column (internal source). The recursive department subtree and
+ * external-source translation are applied only by the application-layer
+ * `buildRowScope`; use `db.objects` for those. (Flat equality is strictly
+ * narrower, so RLS never over-exposes.)
  */
 const POLICY_PREFIX = 'weavekit_read_';
 export function policyName(def) {
@@ -49,10 +56,10 @@ export function buildRlsPolicy(def) {
                 clauses.push(`(${roleIn(role)} AND current_setting('weavekit.actor_id', true) = ${q(field)})`);
             }
         }
-        else if (p.read === READ_SCOPES.TEAM) {
-            const field = markerField(def, ROW_SCOPE_MARKERS.TEAM);
+        else if (p.read === READ_SCOPES.DEPARTMENT) {
+            const field = markerField(def, ROW_SCOPE_MARKERS.DEPARTMENT);
             if (field !== undefined) {
-                clauses.push(`(${roleIn(role)} AND current_setting('weavekit.team_id', true) = ${q(field)})`);
+                clauses.push(`(${roleIn(role)} AND current_setting('weavekit.department_id', true) = ${q(field)})`);
             }
         }
     }
@@ -72,6 +79,44 @@ export function buildRlsPolicyDdl(def) {
 }
 /** GRANT the restricted-SQL role read access to one object */
 export function buildRlsGrantDdl(def, role) {
-    return `GRANT SELECT ON ${q(def.name)} TO ${role};`;
+    return `GRANT SELECT ON ${q(def.name)} TO ${sqlIdent(role)};`;
+}
+/** the restricted-SQL role name shape (`weavekit_query`, …) */
+const RLS_ROLE_RE = /^[a-z_][a-z0-9_]*$/;
+/**
+ * PostgreSQL reserved keywords (Appendix C, "reserved" + "reserved, can be
+ * function or type name"). Rejected as a role name so a config typo can never
+ * produce an ambiguous DDL token; identifiers are also quoted below, so an
+ * accepted name is always emitted safely.
+ */
+const RESERVED_SQL_KEYWORDS = new Set([
+    'all', 'analyse', 'analyze', 'and', 'any', 'array', 'as', 'asc', 'asymmetric',
+    'authorization', 'binary', 'both', 'case', 'cast', 'check', 'collate',
+    'collation', 'column', 'concurrently', 'constraint', 'create', 'cross',
+    'current_catalog', 'current_date', 'current_role', 'current_schema',
+    'current_time', 'current_timestamp', 'current_user', 'default', 'deferrable',
+    'desc', 'distinct', 'do', 'else', 'end', 'except', 'false', 'fetch', 'for',
+    'foreign', 'freeze', 'from', 'full', 'grant', 'group', 'having', 'ilike',
+    'in', 'initially', 'inner', 'intersect', 'into', 'is', 'isnull', 'join',
+    'lateral', 'leading', 'left', 'like', 'limit', 'localtime', 'localtimestamp',
+    'natural', 'not', 'notnull', 'null', 'offset', 'on', 'only', 'or', 'order',
+    'outer', 'over', 'overlaps', 'placing', 'primary', 'references', 'returning',
+    'right', 'select', 'session_user', 'similar', 'some', 'symmetric', 'table',
+    'tablesample', 'then', 'to', 'trailing', 'true', 'union', 'unique', 'user',
+    'using', 'variadic', 'verbose', 'when', 'where', 'window', 'with',
+]);
+/** PostgreSQL pseudo-roles that cannot be created / used as a target role */
+const PSEUDO_ROLES = new Set([
+    'public', 'current_user', 'session_user', 'current_role', 'current_catalog',
+    'current_schema', 'none', 'group',
+]);
+/**
+ * True when `role` is a safe, non-reserved identifier for `SET LOCAL ROLE` /
+ * `CREATE ROLE`. The name is always emitted quoted (`sqlIdent`), so this guards
+ * against pseudo-roles and reserved keywords rather than injection.
+ */
+export function isSafeRlsRole(role) {
+    const lower = role.toLowerCase();
+    return RLS_ROLE_RE.test(role) && !RESERVED_SQL_KEYWORDS.has(lower) && !PSEUDO_ROLES.has(lower);
 }
 //# sourceMappingURL=rls.js.map

package/dist/core/rbac/rls.js.map

@@ -1 +1 @@
-{"version":3,"file":"rls.js","sourceRoot":"","sources":["../../../src/core/rbac/rls.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGnE,MAAM,CAAC,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;AAEpC;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,MAAM,UAAU,UAAU,CAAC,GAAqB;IAC9C,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,yEAAyE,CAAC;AAC/G,CAAC;AAED,SAAS,WAAW,CAAC,GAAqB,EAAE,MAAsB;IAChE,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAwC,CAAC,MAA2B,CAAC,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC;AACvH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAqB;IAClD,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClC,kFAAkF;QAClF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AAC1E,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,GAAqB;IACrD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAa,CAAC,yBAAyB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,MAAM,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,GAAqB,EAAE,IAAY;IAClE,OAAO,mBAAmB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC;AACtD,CAAC"}
+{"version":3,"file":"rls.js","sourceRoot":"","sources":["../../../src/core/rbac/rls.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAEtD,MAAM,CAAC,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,MAAM,UAAU,UAAU,CAAC,GAAqB;IAC9C,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,yEAAyE,CAAC;AAC/G,CAAC;AAED,SAAS,WAAW,CAAC,GAAqB,EAAE,MAAsB;IAChE,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAwC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAqB;IAClD,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClC,kFAAkF;QAClF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,UAAU,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AAC1E,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,GAAqB;IACrD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAa,CAAC,yBAAyB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,MAAM,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,GAAqB,EAAE,IAAY;IAClE,OAAO,mBAAmB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;AAChE,CAAC;AAED,+DAA+D;AAC/D,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAS;IACjE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY;IAC7E,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS;IACrE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO;IACtE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB;IACnE,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY;IAC5E,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK;IAC1E,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO;IACxE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM;IACvE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB;IAC5E,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;IAC1E,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW;IAC5E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO;IAC1E,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM;IAC1E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM;CAClE,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAS;IACxD,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB;IAC3E,gBAAgB,EAAE,MAAM,EAAE,OAAO;CAClC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACjG,CAAC"}

package/dist/core/rbac/rowScope.d.ts

@@ -1,15 +1,22 @@
 import type { ObjectDefinition, ReadScope } from '../types/index.js';
 import type { Locale } from '../i18n/index.js';
-import type { RbacSubject } from './types.js';
+import type { IdentitySubject } from '../provider/identity/types.js';
 export interface RowScopeFragment {
     sql: string;
     params: unknown[];
 }
 /**
- * Build the row-level WHERE fragment for a read scope.
- * - all → undefined (no restriction)
- * - own → `"<ownershipField>" = :subject.id`
- * - team → `"<teamField>" = :subject.teamId` (throws if the subject has no teamId)
+ * Build the row-level WHERE fragment for a scope (`read` or `manage`):
+ * - `all` → undefined (no restriction)
+ * - `own` → the record's ownership column identifies the subject
+ * - `department` → the record's department (a declared `department` column, or
+ *   derived from its owner's `weavekit_user.department_id`) is the subject's
+ *   department or a descendant (recursive over `weavekit_department`)
+ *
+ * The fragment uses `$1` for the subject attribute; `builder.scopeSuffix`
+ * renumbers it against the surrounding query. `alias` qualifies the scope
+ * column references against a table alias (used when embedding the predicate in
+ * a correlated subquery, e.g. a details child scoped by its parent).
  */
-export declare function buildRowScope(def: ObjectDefinition, read: ReadScope | undefined, subject: RbacSubject, roles: readonly string[], locale?: Locale): RowScopeFragment | undefined;
+export declare function buildRowScope(def: ObjectDefinition, scope: ReadScope | undefined, subject: IdentitySubject, roles: readonly string[], locale?: Locale, alias?: string): RowScopeFragment | undefined;
 //# sourceMappingURL=rowScope.d.ts.map

package/dist/core/rbac/rowScope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rowScope.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/rowScope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAkB,MAAM,mBAAmB,CAAC;AAErF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAUD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,SAAS,GAAG,SAAS,EAC3B,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,gBAAgB,GAAG,SAAS,CAU9B"}
+{"version":3,"file":"rowScope.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/rowScope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAA+B,MAAM,mBAAmB,CAAC;AAElG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAsED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,GACb,gBAAgB,GAAG,SAAS,CA+B9B"}