@weave-kit/engine 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -3,6 +3,85 @@
 All notable changes to `@weave-kit/engine`. Format follows [Keep a Changelog](https://keepachangelog.com/);
 the project uses [Semantic Versioning](https://semver.org/).
 
+## [0.9.0]
+
+A **breaking** consistency/authorization release. Read the **Breaking** section before upgrading.
+
+### Breaking
+
+- **`DataAccessContext.principal` is now required; the implicit `subject` field is removed.** The old
+  convention — omit `subject` and get unrestricted access — is gone, so a forgotten actor is now a
+  **compile error** instead of a silent RBAC bypass. Migrate:
+  - a user call → `principal: userPrincipal(subject)` (or a literal `{ kind: 'user', subject }`);
+  - an internal/seed/system call → `principal: systemPrincipal(SYSTEM_CAPABILITIES.INTERNAL_ADMIN)`
+    (or `{ kind: 'system', capability: 'internal.admin' }`).
+  `AccessPrincipal`, `userPrincipal`, `systemPrincipal` and `SYSTEM_CAPABILITIES` are exported from
+  the package root. `withRbac` passes through only for an explicit **system** principal.
+
+### Added
+
+- **Global schema revisions + atomic deploys.** New `weavekit_schema_revision` (append-only, anchored
+  on a deterministic aggregate `computeSchemaHash(files)`). `weave migrate` / `weave deploy apply` now
+  commit the DDL, the metadata cache and the schema revision in **one transaction** (serialized by an
+  advisory lock) — a failure rolls the whole deploy back. New CLI: `weave deploy plan` (read-only
+  preview + risk) and `weave deploy apply`.
+- **Audit durability modes.** `subsystems.audit.mode`: `best-effort` (default, unchanged),
+  `transactional` (audit row written in the business transaction) and `durable` (transactional outbox
+  `weavekit_audit_outbox` + a crash-safe, at-least-once relay). New `AuditSink.recordInTx(event,
+  client)` seam; audit events gain `requestId` / `traceId` (new indexed columns).
+- **Cursor pagination.** `FindOptions.cursor` + `FindResult.nextCursor` / `hasMore` (opaque keyset on
+  the single primary key). MCP `search_records` accepts `cursor` and returns `hasMore`/`nextCursor`;
+  offset remains supported.
+- **Access principal types** (`core/types/principal.ts`): `AccessPrincipal`, `SYSTEM_CAPABILITIES`,
+  `userPrincipal`, `systemPrincipal`, `principalSubject`, `principalActorId`.
+
+### Changed
+
+- **MCP compiled-surface cache** key now includes a schema signature (registry-derived) and the
+  custom-tool set, and the cache is bounded — a schema/tool change no longer serves stale tools.
+- **Workflow privileged operations** (`releaseWorkflowLock` / `workflowTodos` / `overrideWorkflow`)
+  are now guarded in the RBAC decorator (fail-closed read/update checks) instead of passing through.
+
+### Fixed
+
+- **Implicit-unrestricted holes** in the custom-tool base context and the transition guardrail
+  context: both now carry a user principal, so a tool/policy cannot read unrestricted by omission.
+
+## [0.8.0]
+
+### Added
+
+- **GraphQL adapter (opt-in).** `adapters.graphql` compiles the same `schema.json` into a read/write
+  GraphQL endpoint (`/graphql`, POST + GET) that reuses the engine's RBAC / RLS / audit unchanged:
+  queries (`<object>` pages + `<object>_by_id`, with nested relations batched per request),
+  mutations (`create`/`update`/`delete` plus workflow `transition`), query hardening
+  (depth / complexity / alias limits), an operation allow list, and an introspection toggle.
+  Its only runtime dependency is `graphql@16` — the engine speaks GraphQL-over-HTTP itself
+  (`graphql-http` is not required). New CLI: `weave graphql:schema` emits the SDL offline. **Off by
+  default** (`adapters.graphql.enabled`).
+- **Named enums (schema v6).** Declare an enum once in `enums/<name>.json` and reference it from any
+  field with `{ "type": "enum", "enumType": "<name>" }`. Values validate centrally, generate named
+  TypeScript unions (`weave types`), surface as shared OpenAPI `components.schemas` (with
+  `x-enumLabels`), and are listed with `weave enum:list` / `weave enum:check`; `weave field:add
+  --enum` wires a new field to an existing enum. The on-disk format is bumped to **v6**
+  (`SCHEMA_FORMAT_VERSION`); existing v5 files migrate on read (additive — run `weave schema:upgrade`
+  to stamp them).
+
+### Changed
+
+- **Uncategorized `SchemaError`s now map to HTTP 400** instead of falling through to 500. The error
+  space is dominated by request conditions (bad params/fields, RBAC, not-found); genuine server
+  faults keep 500 via an explicit set (`http.internal`, `data.schemaDrift`, and script runtime
+  failures `script.timeout` / `script.busy` / `script.compile` / `script.sandbox.unavailable`).
+
+### Fixed
+
+- **MCP session ↔ agent binding.** A follow-up request on an existing session now re-verifies that
+  the presented Bearer key is the one that established the session (compared by a non-secret SHA-256
+  fingerprint); a different key reusing a session id is rejected with `mcp.session.agentMismatch`.
+  The raw API key is no longer stored on the session or written to the audit log — audit `actorId`
+  is the credential fingerprint and the agent principal id stays in `meta`.
+
 ## [0.7.0]
 
 ### Added

package/README.md

@@ -50,10 +50,14 @@ write.
 - **Custom field types** — register business-semantic types (`money`, `address`, …) as thin, namespaced
   layers over a built-in primitive; they inherit storage, REST/MCP/OpenAPI schemas and generated
   types. Declared in a project-local, Git-committed `field-types/` directory.
+- **Named enums** — declare a shared enum once in `enums/` and reference it from any object by
+  `enumType`; every field shares one native PostgreSQL type and one set of per-value labels.
 - **Governed REST API** — object CRUD with row-level (`all`/`own`/`team`) and field-level RBAC and a
   uniform error contract.
 - **MCP tool surface** — a streamable HTTP endpoint at `/mcp` with a per-identity tool surface and
   guardrails.
+- **GraphQL API** — an opt-in read/write GraphQL endpoint compiled from the same `schema.json`, with
+  nested relations, the same RBAC/audit, per-request batching and query hardening.
 - **Audit log** — an immutable event log for data mutations.
 - **Sandboxed hooks** — `*.server.js` lifecycle hooks running in isolated workers.
 - **Type generation** — object-level TypeScript types derived from the schema.
@@ -139,12 +143,15 @@ await engine.app.listen({ port: 3000 });
 | `weave schema:map [object] [--drift]` | Report the schema field ↔ PostgreSQL column mapping |
 | `weave schema:upgrade [--dry-run]` | Upgrade `objects/*/schema.json` to the current format version |
 | `weave openapi [--out] [--generic] [--server]` | Emit an OpenAPI 3.1 document for the REST API |
+| `weave graphql:schema [--out]` | Emit the GraphQL SDL for this project |
 | `weave mcp:config [--host]` | Print MCP client config for this project's `/mcp` endpoint |
 | `weave connect` | Connect a self-hosted engine out to a governance tunnel endpoint |
 | `weave object:create <name>` | Scaffold `objects/<name>/schema.json` + `server.js` hooks |
 | `weave field:add <object>` | Add a validated field to a schema |
 | `weave field-type:list` | List built-in + registered field types |
 | `weave field-type:check` | Validate registrations + schemas against the registry |
+| `weave enum:list` | List declared named enums (`enums/<name>.json`) |
+| `weave enum:check` | Validate enum declarations + schema references |
 | `weave module:add` / `module:remove <name>` | Enable/disable an optional subsystem (audit/script) |
 
 ## Object-level types

package/dist/adapters/graphql/http.d.ts

@@ -0,0 +1,24 @@
+import type { FastifyInstance } from 'fastify';
+import { type GraphQLSchema } from 'graphql';
+import { type Locale } from '../../core/index.js';
+import { type Authenticator } from '../auth/index.js';
+import type { EngineGraphQLConfig, GraphQLEngine } from './types.js';
+/**
+ * Fastify adapter for the GraphQL endpoint (`/graphql`, POST + GET).
+ *
+ * A thin, dependency-light HTTP handler (per the plan's decision 1B): the engine
+ * ships `graphql` as its only new runtime dependency and speaks GraphQL-over-HTTP
+ * itself. Request order: authenticate (plain `401`) → rate limit → parse →
+ * validate → query hardening (depth/complexity/alias) → execute. GraphQL-level
+ * problems (parse/validate/execute) return `200 { errors }`; a rejected security
+ * limit carries its stable code in `errors[].extensions.code`.
+ */
+export interface GraphQLRouteDeps {
+    engine: GraphQLEngine;
+    authenticator: Authenticator;
+    schema: GraphQLSchema;
+    graphql: EngineGraphQLConfig | undefined;
+    locale: Locale;
+}
+export declare function registerGraphQLRoutes(app: FastifyInstance, deps: GraphQLRouteDeps): void;
+//# sourceMappingURL=http.d.ts.map

package/dist/adapters/graphql/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/adapters/graphql/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAC7E,OAAO,EAA0C,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAA0D,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE1G,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAErE;;;;;;;;;GASG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,aAAa,CAAC;IACtB,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC;CAChB;AAyED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAgFxF"}

package/dist/adapters/graphql/http.js

@@ -0,0 +1,147 @@
+import { execute, GraphQLError, parse, validate } from 'graphql';
+import { createSlidingWindow, SchemaError } from '../../core/index.js';
+import { mapSchemaError } from '../../core/api/index.js';
+import { authenticate } from '../auth/index.js';
+import { createRecordLoader } from './loader.js';
+import { resolveSecurity, validateQuery, validationRules } from './security.js';
+/** uniform error body (matches the REST/MCP contract) */
+function errorBody(code, message, params) {
+    return { error: { code, message, ...(params === undefined ? {} : { params }) } };
+}
+function formatError(error) {
+    return {
+        message: error.message,
+        ...(error.locations === undefined ? {} : { locations: error.locations }),
+        ...(error.path === undefined ? {} : { path: error.path }),
+        ...(error.extensions === undefined || Object.keys(error.extensions).length === 0
+            ? {}
+            : { extensions: error.extensions }),
+    };
+}
+function badRequest(detail, param) {
+    return errorBody('http.param.invalid', detail, { param });
+}
+/** parse a POST (JSON body) or GET (query string) request into a GraphQL operation */
+function parseOperation(request) {
+    if (request.method === 'GET') {
+        const q = request.query;
+        if (typeof q.query !== 'string' || q.query.length === 0)
+            return badRequest('query is required', 'query');
+        let variables;
+        if (typeof q.variables === 'string' && q.variables.length > 0) {
+            try {
+                variables = JSON.parse(q.variables);
+            }
+            catch {
+                return badRequest('variables must be valid JSON', 'variables');
+            }
+        }
+        const operationName = typeof q.operationName === 'string' && q.operationName.length > 0 ? q.operationName : undefined;
+        return {
+            query: q.query,
+            ...(variables === undefined ? {} : { variables }),
+            ...(operationName === undefined ? {} : { operationName }),
+        };
+    }
+    const body = request.body;
+    if (body === undefined || typeof body !== 'object' || body === null) {
+        return badRequest('request body must be a JSON object', 'body');
+    }
+    if (typeof body.query !== 'string' || body.query.length === 0)
+        return badRequest('query is required', 'query');
+    let variables;
+    if (body.variables !== undefined) {
+        if (typeof body.variables !== 'object' || body.variables === null || Array.isArray(body.variables)) {
+            return badRequest('variables must be an object', 'variables');
+        }
+        variables = body.variables;
+    }
+    const operationName = typeof body.operationName === 'string' && body.operationName.length > 0 ? body.operationName : undefined;
+    return {
+        query: body.query,
+        ...(variables === undefined ? {} : { variables }),
+        ...(operationName === undefined ? {} : { operationName }),
+    };
+}
+function isParsed(value) {
+    return typeof value.query === 'string';
+}
+export function registerGraphQLRoutes(app, deps) {
+    const path = deps.graphql?.prefix ?? '/graphql';
+    const limiter = deps.graphql?.rateLimit === undefined ? undefined : createSlidingWindow(deps.graphql.rateLimit);
+    const security = resolveSecurity(deps.graphql?.security);
+    app.route({
+        method: ['POST', 'GET'],
+        url: path,
+        handler: async (request, reply) => {
+            // authenticate before executing (401 stays a plain HTTP error)
+            let subject;
+            try {
+                subject = await authenticate(deps.authenticator, request.headers.authorization, deps.locale);
+            }
+            catch (error) {
+                const spec = mapSchemaError(error, deps.locale);
+                reply.status(spec.status).send(spec.body);
+                return;
+            }
+            if (limiter !== undefined) {
+                const auth = request.headers.authorization;
+                const key = typeof auth === 'string' ? auth.replace(/^Bearer\s+/i, '') : subject.id;
+                if (!limiter.check(key)) {
+                    reply.status(429).send(errorBody('http.rateLimited', 'rate limit exceeded'));
+                    return;
+                }
+            }
+            const parsed = parseOperation(request);
+            if (!isParsed(parsed)) {
+                reply.status(400).send(parsed);
+                return;
+            }
+            // parse → validate → harden → execute (all GraphQL-level failures are 200)
+            let document;
+            try {
+                document = parse(parsed.query);
+            }
+            catch (error) {
+                reply.status(200).send({ errors: [formatError(error)] });
+                return;
+            }
+            const validationErrors = validate(deps.schema, document, validationRules(security));
+            if (validationErrors.length > 0) {
+                reply.status(200).send({ errors: validationErrors.map(formatError) });
+                return;
+            }
+            try {
+                validateQuery(document, security, deps.locale);
+            }
+            catch (error) {
+                if (error instanceof SchemaError) {
+                    reply.status(200).send({
+                        errors: [
+                            {
+                                message: error.localize(deps.locale),
+                                extensions: { code: error.code, ...(Object.keys(error.params).length === 0 ? {} : { params: error.params }) },
+                            },
+                        ],
+                    });
+                    return;
+                }
+                throw error;
+            }
+            const result = await execute({
+                schema: deps.schema,
+                document,
+                ...(parsed.variables === undefined ? {} : { variableValues: parsed.variables }),
+                ...(parsed.operationName === undefined ? {} : { operationName: parsed.operationName }),
+                contextValue: { subject, engine: deps.engine, loader: createRecordLoader(deps.engine, subject), requestId: request.id },
+            });
+            const body = {};
+            if (result.data !== undefined)
+                body.data = result.data;
+            if (result.errors !== undefined)
+                body.errors = result.errors.map(formatError);
+            reply.status(200).send(body);
+        },
+    });
+}
+//# sourceMappingURL=http.js.map

package/dist/adapters/graphql/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/adapters/graphql/http.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAsB,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAqC,MAAM,qBAAqB,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAsB,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAsBhF,yDAAyD;AACzD,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,MAAgC;IAChF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,WAAW,CAAC,KAAmB;IACtC,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACzD,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;YAC9E,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAQD,SAAS,UAAU,CAAC,MAAc,EAAE,KAAa;IAC/C,OAAO,SAAS,CAAC,oBAAoB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,sFAAsF;AACtF,SAAS,cAAc,CAAC,OAAuB;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,KAA0E,CAAC;QAC7F,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACzG,IAAI,SAA8C,CAAC;QACnD,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAA4B,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,UAAU,CAAC,8BAA8B,EAAE,WAAW,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QACtH,OAAO;YACL,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YACjD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAqF,CAAC;IAC3G,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,UAAU,CAAC,oCAAoC,EAAE,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC/G,IAAI,SAA8C,CAAC;IACnD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACnG,OAAO,UAAU,CAAC,6BAA6B,EAAE,WAAW,CAAC,CAAC;QAChE,CAAC;QACD,SAAS,GAAG,IAAI,CAAC,SAAoC,CAAC;IACxD,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/H,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACjD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAgD;IAChE,OAAO,OAAQ,KAAyB,CAAC,KAAK,KAAK,QAAQ,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAoB,EAAE,IAAsB;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,UAAU,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChH,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEzD,GAAG,CAAC,KAAK,CAAC;QACR,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;QACvB,GAAG,EAAE,IAAI;QACT,OAAO,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;YAC7E,+DAA+D;YAC/D,IAAI,OAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;gBAC3C,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC,CAAC;oBAC7E,OAAO;gBACT,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/B,OAAO;YACT,CAAC;YAED,2EAA2E;YAC3E,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,KAAqB,CAAC,CAAC,EAAE,CAAC,CAAC;gBACzE,OAAO;YACT,CAAC;YAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpF,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;oBACjC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACrB,MAAM,EAAE;4BACN;gCACE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;gCACpC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;6BAC9G;yBACF;qBACF,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;gBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ;gBACR,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC/E,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;gBACtF,YAAY,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE;aACxH,CAAC,CAAC;YAEH,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACvD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC9E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/graphql/index.d.ts

@@ -0,0 +1,33 @@
+import type { FastifyInstance } from 'fastify';
+import type { GraphQLSchema } from 'graphql';
+import type { Locale } from '../../core/index.js';
+import type { Authenticator } from '../auth/index.js';
+import type { EngineGraphQLConfig, GraphQLEngine } from './types.js';
+/**
+ * GraphQL adapter assembly. `registerGraphQL` compiles the object registry into
+ * a GraphQL schema and mounts the `/graphql` endpoint on the fastify app. The
+ * adapter reuses the engine's data-access/RBAC/audit layer — the assembly layer
+ * (createEngine) injects the same `dataAccess` + `authenticator` as REST/MCP.
+ *
+ * Disabled unless `adapters.graphql.enabled` is true (decision 7): the engine
+ * only mounts the endpoint when a project opts in.
+ */
+export interface GraphQLDeps {
+    engine: GraphQLEngine;
+    authenticator: Authenticator;
+    graphql: EngineGraphQLConfig | undefined;
+    locale: Locale;
+}
+export interface GraphQLServerHandle {
+    /** the compiled schema (read-only; exposed for tooling / SDL export) */
+    readonly schema: GraphQLSchema;
+    close(): Promise<void>;
+}
+/** Register the GraphQL endpoint on an existing fastify app. */
+export declare function registerGraphQL(app: FastifyInstance, deps: GraphQLDeps): GraphQLServerHandle;
+export { buildGraphQLSchema, printGraphQLSchema } from './schema.js';
+export { registerGraphQLRoutes } from './http.js';
+export { GRAPHQL_DEFAULT_MAX_DEPTH, operationHash, validationRules } from './security.js';
+export type { GraphQLRouteDeps } from './http.js';
+export type { GraphQLEngine, EngineGraphQLConfig, GraphQLSecurityConfig, RecordLoader } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/graphql/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/graphql/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAErE;;;;;;;;GAQG;AAEH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,aAAa,CAAC;IACtB,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,mBAAmB,CAgB5F;AAED,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC1F,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/adapters/graphql/index.js

@@ -0,0 +1,24 @@
+import { buildGraphQLSchema } from './schema.js';
+import { registerGraphQLRoutes } from './http.js';
+/** Register the GraphQL endpoint on an existing fastify app. */
+export function registerGraphQL(app, deps) {
+    const schema = buildGraphQLSchema(deps.engine);
+    registerGraphQLRoutes(app, {
+        engine: deps.engine,
+        authenticator: deps.authenticator,
+        schema,
+        graphql: deps.graphql,
+        locale: deps.locale,
+    });
+    return {
+        schema,
+        async close() {
+            // per-request execution holds no persistent resources yet; reserved for
+            // loaders/schedulers added in later phases.
+        },
+    };
+}
+export { buildGraphQLSchema, printGraphQLSchema } from './schema.js';
+export { registerGraphQLRoutes } from './http.js';
+export { GRAPHQL_DEFAULT_MAX_DEPTH, operationHash, validationRules } from './security.js';
+//# sourceMappingURL=index.js.map

package/dist/adapters/graphql/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/graphql/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AA0BlD,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,GAAoB,EAAE,IAAiB;IACrE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,qBAAqB,CAAC,GAAG,EAAE;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM;QACN,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,KAAK,CAAC,KAAK;YACT,wEAAwE;YACxE,4CAA4C;QAC9C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/adapters/graphql/loader.d.ts

@@ -0,0 +1,4 @@
+import { type IdentitySubject } from '../../core/index.js';
+import type { GraphQLEngine, RecordLoader } from './types.js';
+export declare function createRecordLoader(engine: GraphQLEngine, subject: IdentitySubject): RecordLoader;
+//# sourceMappingURL=loader.d.ts.map

package/dist/adapters/graphql/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/adapters/graphql/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,eAAe,EAErB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAsB9D,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,GAAG,YAAY,CAqJhG"}

package/dist/adapters/graphql/loader.js

@@ -0,0 +1,135 @@
+import { DETAILS_COLUMNS, decodeRecordKey, FIELD_TYPES, primaryFieldsOf, RECORD_META_ID_FIELD, userPrincipal, } from '../../core/index.js';
+export function createRecordLoader(engine, subject) {
+    const recordPending = new Map();
+    const childPending = new Map();
+    let scheduled = false;
+    const context = () => ({
+        pool: engine.pool,
+        registry: engine.registry,
+        principal: userPrincipal(subject),
+        locale: engine.locale,
+    });
+    const projection = (def, extra = []) => [
+        ...def.fields.filter((f) => f.type !== FIELD_TYPES.DETAILS).map((f) => f.name),
+        ...extra,
+        RECORD_META_ID_FIELD,
+    ];
+    const schedule = () => {
+        if (scheduled)
+            return;
+        scheduled = true;
+        queueMicrotask(() => {
+            void flush();
+        });
+    };
+    async function flush() {
+        scheduled = false;
+        const records = new Map(recordPending);
+        const children = new Map(childPending);
+        recordPending.clear();
+        childPending.clear();
+        await Promise.all([
+            ...[...records].map(([object, byKey]) => flushRecords(object, byKey)),
+            ...[...children].map(([object, byKey]) => flushChildren(object, byKey)),
+        ]);
+    }
+    async function flushRecords(objectName, byKey) {
+        try {
+            const rows = await loadRecords(objectName, [...byKey.keys()]);
+            const byId = new Map(rows.map((row) => [String(row[RECORD_META_ID_FIELD]), row]));
+            for (const [key, entries] of byKey) {
+                const value = byId.get(key) ?? null;
+                for (const entry of entries)
+                    entry.resolve(value);
+            }
+        }
+        catch (error) {
+            for (const entries of byKey.values())
+                for (const entry of entries)
+                    entry.reject(error);
+        }
+    }
+    async function loadRecords(objectName, keys) {
+        const def = engine.registry.get(objectName);
+        if (def === undefined)
+            return [];
+        const pks = primaryFieldsOf(def);
+        if (pks.length === 1) {
+            const values = keys.map((key) => {
+                try {
+                    return decodeRecordKey(key)[0];
+                }
+                catch {
+                    return key;
+                }
+            });
+            const result = await engine.dataAccess.find(objectName, { filter: { [pks[0].name]: { in: values } }, fields: projection(def) }, context());
+            return result.rows;
+        }
+        const rows = [];
+        for (const key of keys) {
+            const row = await engine.dataAccess.findOne(objectName, key, context());
+            if (row !== null)
+                rows.push(row);
+        }
+        return rows;
+    }
+    async function flushChildren(childObject, byKey) {
+        try {
+            const rows = await loadChildrenRows(childObject, [...byKey.keys()]);
+            const grouped = new Map();
+            for (const row of rows) {
+                const parentId = String(row[DETAILS_COLUMNS.PARENT_ID] ?? '');
+                const list = grouped.get(parentId);
+                if (list === undefined)
+                    grouped.set(parentId, [row]);
+                else
+                    list.push(row);
+            }
+            for (const list of grouped.values()) {
+                list.sort((a, b) => Number(a[DETAILS_COLUMNS.PARENT_IDX] ?? 0) - Number(b[DETAILS_COLUMNS.PARENT_IDX] ?? 0));
+            }
+            for (const [key, entries] of byKey) {
+                const list = grouped.get(key) ?? [];
+                for (const entry of entries)
+                    entry.resolve(list);
+            }
+        }
+        catch (error) {
+            for (const entries of byKey.values())
+                for (const entry of entries)
+                    entry.reject(error);
+        }
+    }
+    async function loadChildrenRows(childObject, parentKeys) {
+        const def = engine.registry.get(childObject);
+        if (def === undefined)
+            return [];
+        const result = await engine.dataAccess.find(childObject, {
+            filter: { [DETAILS_COLUMNS.PARENT_ID]: { in: parentKeys } },
+            fields: projection(def, [DETAILS_COLUMNS.PARENT_ID, DETAILS_COLUMNS.PARENT_IDX]),
+        }, context());
+        return result.rows;
+    }
+    function enqueue(store, objectName, key, entry) {
+        const byKey = store.get(objectName) ?? new Map();
+        store.set(objectName, byKey);
+        const list = byKey.get(key) ?? [];
+        list.push(entry);
+        byKey.set(key, list);
+        schedule();
+    }
+    return {
+        load(objectName, recordKey) {
+            return new Promise((resolve, reject) => {
+                enqueue(recordPending, objectName, recordKey, { resolve, reject });
+            });
+        },
+        loadChildren(childObject, parentKey) {
+            return new Promise((resolve, reject) => {
+                enqueue(childPending, childObject, parentKey, { resolve, reject });
+            });
+        },
+    };
+}
+//# sourceMappingURL=loader.js.map

package/dist/adapters/graphql/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/adapters/graphql/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,eAAe,EACf,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,aAAa,GAGd,MAAM,qBAAqB,CAAC;AAwB7B,MAAM,UAAU,kBAAkB,CAAC,MAAqB,EAAE,OAAwB;IAChF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkE,CAAC;IAChG,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6D,CAAC;IAC1F,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,MAAM,OAAO,GAAG,GAAsB,EAAE,CAAC,CAAC;QACxC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,CAAC,GAAqB,EAAE,QAA2B,EAAE,EAAY,EAAE,CAAC;QACrF,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,GAAG,KAAK;QACR,oBAAoB;KACrB,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,IAAI,SAAS;YAAE,OAAO;QACtB,SAAS,GAAG,IAAI,CAAC;QACjB,cAAc,CAAC,GAAG,EAAE;YAClB,KAAK,KAAK,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,KAAK,UAAU,KAAK;QAClB,SAAS,GAAG,KAAK,CAAC;QAClB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACvC,aAAa,CAAC,KAAK,EAAE,CAAC;QACtB,YAAY,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACrE,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,UAAkB,EAClB,KAA6D;QAE7D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YAClF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;gBACpC,KAAK,MAAM,KAAK,IAAI,OAAO;oBAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,MAAM,KAAK,IAAI,OAAO;oBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,IAAc;QAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC9B,IAAI,CAAC;oBACH,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,GAAG,CAAC;gBACb,CAAC;YACH,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CACzC,UAAU,EACV,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,EACvE,OAAO,EAAE,CACV,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,GAA8B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,IAAI,GAAG,KAAK,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,aAAa,CAC1B,WAAmB,EACnB,KAAwD;QAExD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqC,CAAC;YAC7D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;;oBAChD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CACP,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAC1F,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACpC,KAAK,MAAM,KAAK,IAAI,OAAO;oBAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,MAAM,KAAK,IAAI,OAAO;oBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,WAAmB,EAAE,UAAoB;QACvE,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CACzC,WAAW,EACX;YACE,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE;YAC3D,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;SACjF,EACD,OAAO,EAAE,CACV,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,SAAS,OAAO,CACd,KAA6C,EAC7C,UAAkB,EAClB,GAAW,EACX,KAAiB;QAEjB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QACjD,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrB,QAAQ,EAAE,CAAC;IACb,CAAC;IAED,OAAO;QACL,IAAI,CAAC,UAAU,EAAE,SAAS;YACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,YAAY,CAAC,WAAW,EAAE,SAAS;YACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,OAAO,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/graphql/resolvers.d.ts

@@ -0,0 +1,52 @@
+import { type ObjectDefinition } from '../../core/index.js';
+import type { Sort } from '../../runtime/data-access/index.js';
+import type { GraphQLContext } from './types.js';
+/**
+ * Root Query resolvers. Each one builds a {@link DataAccessContext} from the
+ * request context and calls the RBAC-decorated data-access layer — so row scope
+ * (`own`/`department`), field exclusion and (for writes) auditing come from the
+ * existing layer, exactly as REST/MCP. A thrown {@link SchemaError} is mapped to
+ * a GraphQLError carrying its stable `extensions.code`.
+ */
+interface ListArgs {
+    filter?: unknown;
+    sort?: Sort[];
+    limit?: number;
+    offset?: number;
+}
+/** `<object>` — a page of records, row-scoped by the identity's read RBAC */
+export declare function listResolver(objectName: string): (_parent: unknown, args: ListArgs, context: GraphQLContext) => Promise<{
+    rows: unknown[];
+    total: number;
+}>;
+/** `<object>_by_id` — one record by its `weave_id` (record_key), or null */
+export declare function singleResolver(objectName: string): (_parent: unknown, args: {
+    id: string;
+}, context: GraphQLContext) => Promise<unknown>;
+/** `create<Object>(data:)` — create one record (RBAC-checked + audited by data-access) */
+export declare function createResolver(objectName: string): (_parent: unknown, args: {
+    data: Record<string, unknown>;
+}, context: GraphQLContext) => Promise<unknown>;
+/** `update<Object>(id:, changes:)` — update one record by its `weave_id` */
+export declare function updateResolver(objectName: string): (_parent: unknown, args: {
+    id: string;
+    changes: Record<string, unknown>;
+}, context: GraphQLContext) => Promise<unknown>;
+/** `delete<Object>(id:)` — delete one record; returns true (throws when absent/denied) */
+export declare function deleteResolver(objectName: string): (_parent: unknown, args: {
+    id: string;
+}, context: GraphQLContext) => Promise<boolean>;
+/** `transition<Object>(id:, action:, payload:)` — run a workflow action */
+export declare function transitionResolver(objectName: string): (_parent: unknown, args: {
+    id: string;
+    action: string;
+    payload?: Record<string, unknown>;
+}, context: GraphQLContext) => Promise<unknown>;
+/** a `relation`/`user`/`department` output field → the target object (batched) */
+export declare function relationResolver(target: string, fieldName: string): (parent: unknown, _args: unknown, context: GraphQLContext) => Promise<Record<string, unknown> | null>;
+/** a `multiRelation` output field → the target objects (batched) */
+export declare function multiRelationResolver(target: string, targetDef: ObjectDefinition, fieldName: string): (parent: unknown, _args: unknown, context: GraphQLContext) => Promise<Record<string, unknown>[]>;
+/** a `details` output field → the parent's children (batched, ordered by `parent_idx`) */
+export declare function detailsResolver(childObject: string): (parent: unknown, _args: unknown, context: GraphQLContext) => Promise<Record<string, unknown>[]>;
+export {};
+//# sourceMappingURL=resolvers.d.ts.map

package/dist/adapters/graphql/resolvers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../../../src/adapters/graphql/resolvers.ts"],"names":[],"mappings":"AACA,OAAO,EAQL,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAA6B,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;GAMG;AAEH,UAAU,QAAQ;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkCD,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,IAE3C,SAAS,OAAO,EAChB,MAAM,QAAQ,EACd,SAAS,cAAc,KACtB,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB/C;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,IACjC,SAAS,OAAO,EAAE,MAAM;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,cAAc,KAAG,OAAO,CAAC,OAAO,CAAC,CAOjG;AAED,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,IACjC,SAAS,OAAO,EAAE,MAAM;IAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EAAE,SAAS,cAAc,KAAG,OAAO,CAAC,OAAO,CAAC,CAMpH;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,IAE7C,SAAS,OAAO,EAChB,MAAM;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACtD,SAAS,cAAc,KACtB,OAAO,CAAC,OAAO,CAAC,CAMpB;AAED,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,IACjC,SAAS,OAAO,EAAE,MAAM;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,cAAc,KAAG,OAAO,CAAC,OAAO,CAAC,CAIjG;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,IAEjD,SAAS,OAAO,EAChB,MAAM;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACvE,SAAS,cAAc,KACtB,OAAO,CAAC,OAAO,CAAC,CAapB;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,IAE9D,QAAQ,OAAO,EACf,OAAO,OAAO,EACd,SAAS,cAAc,KACtB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAK3C;AAED,oEAAoE;AACpE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,IACpF,QAAQ,OAAO,EAAE,OAAO,OAAO,EAAE,SAAS,cAAc,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAS5G;AAED,0FAA0F;AAC1F,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,IACnC,QAAQ,OAAO,EAAE,OAAO,OAAO,EAAE,SAAS,cAAc,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAK5G"}