@weave-kit/engine 0.8.0 → 0.10.0

package/dist/runtime/data-access/rbac.js

@@ -1,6 +1,7 @@
-import { DETAILS_COLUMNS, SchemaError, primaryFieldsOf, recordKeySql } from '../../core/index.js';
+import { DETAILS_COLUMNS, SchemaError, primaryFieldsOf, principalActorId, recordKeySql } from '../../core/index.js';
 import { assertCanCreate, assertCanDelete, assertCanUpdate, buildRowScope, buildRowScopeFor, resolvePermissionFor, } from '../../core/index.js';
 import { AUDIT_ACTOR_TYPES, DATA_ACTIONS } from '../../core/audit/index.js';
+import { isSystemCtx, subjectOf } from './types.js';
 import { scopeSuffix } from './builder.js';
 const q = (id) => `"${id}"`;
 function deniedCreate(object, role, locale) {
@@ -11,20 +12,20 @@ function deniedCreate(object, role, locale) {
  * parent row the subject can read (within the parent's row scope). Nested child
  * writes go through the parent's own create (which already enforces this).
  */
-async function assertChildParentInScope(ctx, def, data) {
+async function assertChildParentInScope(ctx, def, data, subject) {
     const parentName = def.detailsParent;
-    if (parentName === undefined || ctx.subject === undefined)
+    if (parentName === undefined)
         return;
     const parent = ctx.registry.get(parentName);
     if (parent === undefined)
         return;
-    const role = ctx.subject.roles.join(',');
+    const role = subject.roles.join(',');
     const parentId = data[DETAILS_COLUMNS.PARENT_ID];
-    const pp = resolvePermissionFor(ctx.registry, parent, ctx.subject.roles);
+    const pp = resolvePermissionFor(ctx.registry, parent, subject.roles);
     if (pp === undefined || pp.read === undefined || parentId === undefined || parentId === null) {
         deniedCreate(def.name, role, ctx.locale);
     }
-    const scope = buildRowScope(parent, pp.read, ctx.subject, ctx.subject.roles, ctx.locale);
+    const scope = buildRowScope(parent, pp.read, subject, subject.roles, ctx.locale);
     const rk = recordKeySql(parent, (field) => q(field));
     let sql = `SELECT 1 FROM ${q(parent.name)} WHERE ${rk} = $1`;
     const params = [String(parentId)];
@@ -47,14 +48,16 @@ function requireDef(ctx, objectName) {
 function denied(sink, ctx, action, objectName, objectId, error) {
     if (sink === undefined)
         return;
+    const principal = ctx.principal;
     void sink.record({
-        actorType: ctx.subject !== undefined ? AUDIT_ACTOR_TYPES.USER : AUDIT_ACTOR_TYPES.SYSTEM,
-        actorId: ctx.subject?.id ?? 'system',
+        actorType: principal.kind === 'user' ? AUDIT_ACTOR_TYPES.USER : AUDIT_ACTOR_TYPES.SYSTEM,
+        actorId: principalActorId(principal),
         action,
         objectName,
         objectId,
         isError: true,
         errorCode: error instanceof SchemaError ? error.code : undefined,
+        ...(ctx.requestId === undefined ? {} : { requestId: ctx.requestId }),
         timestamp: new Date(),
     });
 }
@@ -69,43 +72,46 @@ function strip(record, exclude) {
     return out;
 }
 function scopedCtx(ctx, objectName, read) {
-    if (read === undefined || ctx.subject === undefined)
+    const subject = subjectOf(ctx);
+    if (read === undefined || subject === undefined)
         return ctx;
     const def = requireDef(ctx, objectName);
-    const rowScope = buildRowScopeFor(ctx.registry, def, read, ctx.subject, ctx.subject.roles, ctx.locale);
+    const rowScope = buildRowScopeFor(ctx.registry, def, read, subject, subject.roles, ctx.locale);
     return { ...ctx, rowScope };
 }
 /**
  * Decorate an object data-access with RBAC enforcement.
  *
- * Reads the authenticated `subject` from the execution context and:
+ * Reads the principal from the execution context and:
  * - find/findOne: injects the row-level scope and excludes hidden fields
  * - create/update/delete: authorizes the operation, filters update changes to
  *   the allowed field set, and scopes update/delete to the read row scope
- * - no subject → pass-through (unrestricted, for internal/admin use)
+ * - a `system` principal → pass-through (explicit, capability-tagged)
  */
 export function withRbac(inner, options = {}) {
     const { audit } = options;
     return {
         async find(objectName, opts, ctx) {
-            if (ctx.subject === undefined)
+            if (isSystemCtx(ctx))
                 return inner.find(objectName, opts, ctx);
+            const subject = subjectOf(ctx);
             const def = requireDef(ctx, objectName);
-            const p = resolvePermissionFor(ctx.registry, def, ctx.subject.roles);
+            const p = resolvePermissionFor(ctx.registry, def, subject.roles);
             if (p === undefined || p.read === undefined) {
-                const err = new SchemaError('rbac.denied.read', { object: objectName, role: ctx.subject.roles.join(',') }, ctx.locale);
+                const err = new SchemaError('rbac.denied.read', { object: objectName, role: subject.roles.join(',') }, ctx.locale);
                 denied(audit, ctx, DATA_ACTIONS.READ, objectName, undefined, err);
                 throw err;
             }
             return inner.find(objectName, { ...opts, exclude: p.exclude }, scopedCtx(ctx, objectName, p.read));
         },
         async findOne(objectName, id, ctx) {
-            if (ctx.subject === undefined)
+            if (isSystemCtx(ctx))
                 return inner.findOne(objectName, id, ctx);
+            const subject = subjectOf(ctx);
             const def = requireDef(ctx, objectName);
-            const p = resolvePermissionFor(ctx.registry, def, ctx.subject.roles);
+            const p = resolvePermissionFor(ctx.registry, def, subject.roles);
             if (p === undefined || p.read === undefined) {
-                const err = new SchemaError('rbac.denied.read', { object: objectName, role: ctx.subject.roles.join(',') }, ctx.locale);
+                const err = new SchemaError('rbac.denied.read', { object: objectName, role: subject.roles.join(',') }, ctx.locale);
                 denied(audit, ctx, DATA_ACTIONS.READ, objectName, id, err);
                 throw err;
             }
@@ -113,19 +119,20 @@ export function withRbac(inner, options = {}) {
             return record === null ? null : strip(record, p.exclude);
         },
         async create(objectName, data, ctx) {
-            if (ctx.subject === undefined)
+            if (isSystemCtx(ctx))
                 return inner.create(objectName, data, ctx);
+            const subject = subjectOf(ctx);
             const def = requireDef(ctx, objectName);
             try {
-                assertCanCreate(def, ctx.subject.roles, ctx.locale, ctx.registry);
+                assertCanCreate(def, subject.roles, ctx.locale, ctx.registry);
             }
             catch (error) {
                 denied(audit, ctx, DATA_ACTIONS.CREATE, objectName, undefined, error);
                 throw error;
             }
-            const p = resolvePermissionFor(ctx.registry, def, ctx.subject.roles);
+            const p = resolvePermissionFor(ctx.registry, def, subject.roles);
             // a direct details-child create must attach to a parent row in scope
-            await assertChildParentInScope(ctx, def, data);
+            await assertChildParentInScope(ctx, def, data, subject);
             // `p.createFields === null` means "all writable fields allowed on create"
             // (no fields.create declared); otherwise only the whitelist is accepted
             let payload = data;
@@ -139,7 +146,7 @@ export function withRbac(inner, options = {}) {
                         continue;
                     }
                     if (!allowed.includes(key)) {
-                        const err = new SchemaError('rbac.denied.field', { object: objectName, role: ctx.subject.roles.join(','), field: key }, ctx.locale);
+                        const err = new SchemaError('rbac.denied.field', { object: objectName, role: subject.roles.join(','), field: key }, ctx.locale);
                         denied(audit, ctx, DATA_ACTIONS.CREATE, objectName, undefined, err);
                         throw err;
                     }
@@ -151,21 +158,22 @@ export function withRbac(inner, options = {}) {
             return strip(record, p?.exclude ?? []);
         },
         async update(objectName, id, changes, ctx) {
-            if (ctx.subject === undefined)
+            if (isSystemCtx(ctx))
                 return inner.update(objectName, id, changes, ctx);
+            const subject = subjectOf(ctx);
             const def = requireDef(ctx, objectName);
             try {
-                assertCanUpdate(def, ctx.subject.roles, ctx.locale, ctx.registry);
+                assertCanUpdate(def, subject.roles, ctx.locale, ctx.registry);
             }
             catch (error) {
                 denied(audit, ctx, DATA_ACTIONS.UPDATE, objectName, id, error);
                 throw error;
             }
-            const p = resolvePermissionFor(ctx.registry, def, ctx.subject.roles);
+            const p = resolvePermissionFor(ctx.registry, def, subject.roles);
             // fail-closed: without a read scope we cannot derive a row scope, so an
             // update would silently target any row — deny instead
             if (p?.read === undefined) {
-                const err = new SchemaError('rbac.denied.update', { object: objectName, role: ctx.subject.roles.join(',') }, ctx.locale);
+                const err = new SchemaError('rbac.denied.update', { object: objectName, role: subject.roles.join(',') }, ctx.locale);
                 denied(audit, ctx, DATA_ACTIONS.UPDATE, objectName, id, err);
                 throw err;
             }
@@ -181,7 +189,7 @@ export function withRbac(inner, options = {}) {
                     throw err;
                 }
                 if (allowed !== null && !allowed.includes(key)) {
-                    const err = new SchemaError('rbac.denied.field', { object: objectName, role: ctx.subject.roles.join(','), field: key }, ctx.locale);
+                    const err = new SchemaError('rbac.denied.field', { object: objectName, role: subject.roles.join(','), field: key }, ctx.locale);
                     denied(audit, ctx, DATA_ACTIONS.UPDATE, objectName, id, err);
                     throw err;
                 }
@@ -191,19 +199,20 @@ export function withRbac(inner, options = {}) {
             return strip(record, p?.exclude ?? []);
         },
         async transition(objectName, id, action, ctx, payload) {
-            if (ctx.subject === undefined)
+            if (isSystemCtx(ctx))
                 return inner.transition(objectName, id, action, ctx, payload);
+            const subject = subjectOf(ctx);
             const def = requireDef(ctx, objectName);
             try {
-                assertCanUpdate(def, ctx.subject.roles, ctx.locale, ctx.registry);
+                assertCanUpdate(def, subject.roles, ctx.locale, ctx.registry);
             }
             catch (error) {
                 denied(audit, ctx, DATA_ACTIONS.UPDATE, objectName, id, error);
                 throw error;
             }
-            const p = resolvePermissionFor(ctx.registry, def, ctx.subject.roles);
+            const p = resolvePermissionFor(ctx.registry, def, subject.roles);
             if (p?.read === undefined) {
-                const err = new SchemaError('rbac.denied.update', { object: objectName, role: ctx.subject.roles.join(',') }, ctx.locale);
+                const err = new SchemaError('rbac.denied.update', { object: objectName, role: subject.roles.join(',') }, ctx.locale);
                 denied(audit, ctx, DATA_ACTIONS.UPDATE, objectName, id, err);
                 throw err;
             }
@@ -211,53 +220,82 @@ export function withRbac(inner, options = {}) {
             return strip(record, p?.exclude ?? []);
         },
         async workflowStatus(objectName, id, ctx) {
-            if (ctx.subject === undefined)
+            if (isSystemCtx(ctx))
                 return inner.workflowStatus(objectName, id, ctx);
+            const subject = subjectOf(ctx);
             const def = requireDef(ctx, objectName);
-            const p = resolvePermissionFor(ctx.registry, def, ctx.subject.roles);
+            const p = resolvePermissionFor(ctx.registry, def, subject.roles);
             if (p === undefined || p.read === undefined) {
-                const err = new SchemaError('rbac.denied.read', { object: objectName, role: ctx.subject.roles.join(',') }, ctx.locale);
+                const err = new SchemaError('rbac.denied.read', { object: objectName, role: subject.roles.join(',') }, ctx.locale);
                 denied(audit, ctx, DATA_ACTIONS.READ, objectName, id, err);
                 throw err;
             }
             return inner.workflowStatus(objectName, id, scopedCtx(ctx, objectName, p.read));
         },
         async acquireWorkflowLock(objectName, id, ctx) {
-            if (ctx.subject === undefined)
+            if (isSystemCtx(ctx))
                 return inner.acquireWorkflowLock(objectName, id, ctx);
+            const subject = subjectOf(ctx);
             const def = requireDef(ctx, objectName);
-            const p = resolvePermissionFor(ctx.registry, def, ctx.subject.roles);
+            const p = resolvePermissionFor(ctx.registry, def, subject.roles);
             if (p === undefined || p.read === undefined) {
-                const err = new SchemaError('rbac.denied.read', { object: objectName, role: ctx.subject.roles.join(',') }, ctx.locale);
+                const err = new SchemaError('rbac.denied.read', { object: objectName, role: subject.roles.join(',') }, ctx.locale);
                 denied(audit, ctx, DATA_ACTIONS.READ, objectName, id, err);
                 throw err;
             }
             return inner.acquireWorkflowLock(objectName, id, scopedCtx(ctx, objectName, p.read));
         },
         async releaseWorkflowLock(objectName, id, ctx) {
+            // privileged op guard (fail-closed): an ordinary identity must hold read on
+            // the object; a system principal passes through
+            if (!isSystemCtx(ctx)) {
+                const def = requireDef(ctx, objectName);
+                const p = resolvePermissionFor(ctx.registry, def, subjectOf(ctx).roles);
+                if (p === undefined || p.read === undefined) {
+                    const err = new SchemaError('rbac.denied.read', { object: objectName, role: subjectOf(ctx).roles.join(',') }, ctx.locale);
+                    denied(audit, ctx, DATA_ACTIONS.READ, objectName, id, err);
+                    throw err;
+                }
+            }
             return inner.releaseWorkflowLock(objectName, id, ctx);
         },
         async workflowHistory(objectName, id, ctx) {
-            if (ctx.subject === undefined)
+            if (isSystemCtx(ctx))
                 return inner.workflowHistory(objectName, id, ctx);
+            const subject = subjectOf(ctx);
             const def = requireDef(ctx, objectName);
-            const p = resolvePermissionFor(ctx.registry, def, ctx.subject.roles);
+            const p = resolvePermissionFor(ctx.registry, def, subject.roles);
             if (p === undefined || p.read === undefined) {
-                const err = new SchemaError('rbac.denied.read', { object: objectName, role: ctx.subject.roles.join(',') }, ctx.locale);
+                const err = new SchemaError('rbac.denied.read', { object: objectName, role: subject.roles.join(',') }, ctx.locale);
                 denied(audit, ctx, DATA_ACTIONS.READ, objectName, id, err);
                 throw err;
             }
             return inner.workflowHistory(objectName, id, scopedCtx(ctx, objectName, p.read));
         },
         async workflowTodos(ctx) {
+            // privileged op guard (fail-closed): an ordinary identity must be able to
+            // read at least one object; a system principal passes through
+            if (!isSystemCtx(ctx)) {
+                const subject = subjectOf(ctx);
+                const canReadAny = ctx.registry.list().some((def) => {
+                    const p = resolvePermissionFor(ctx.registry, def, subject.roles);
+                    return p !== undefined && p.read !== undefined;
+                });
+                if (!canReadAny) {
+                    const err = new SchemaError('rbac.denied.read', { object: '*', role: subject.roles.join(',') }, ctx.locale);
+                    denied(audit, ctx, DATA_ACTIONS.READ, '*', undefined, err);
+                    throw err;
+                }
+            }
             return inner.workflowTodos(ctx);
         },
         async overrideWorkflow(objectName, id, patch, ctx) {
-            if (ctx.subject === undefined)
+            if (isSystemCtx(ctx))
                 return inner.overrideWorkflow(objectName, id, patch, ctx);
+            const subject = subjectOf(ctx);
             const def = requireDef(ctx, objectName);
             try {
-                assertCanUpdate(def, ctx.subject.roles, ctx.locale, ctx.registry);
+                assertCanUpdate(def, subject.roles, ctx.locale, ctx.registry);
             }
             catch (error) {
                 denied(audit, ctx, DATA_ACTIONS.UPDATE, objectName, id, error);
@@ -266,20 +304,21 @@ export function withRbac(inner, options = {}) {
             return inner.overrideWorkflow(objectName, id, patch, ctx);
         },
         async delete(objectName, id, ctx) {
-            if (ctx.subject === undefined)
+            if (isSystemCtx(ctx))
                 return inner.delete(objectName, id, ctx);
+            const subject = subjectOf(ctx);
             const def = requireDef(ctx, objectName);
             try {
-                assertCanDelete(def, ctx.subject.roles, ctx.locale, ctx.registry);
+                assertCanDelete(def, subject.roles, ctx.locale, ctx.registry);
             }
             catch (error) {
                 denied(audit, ctx, DATA_ACTIONS.DELETE, objectName, id, error);
                 throw error;
             }
-            const p = resolvePermissionFor(ctx.registry, def, ctx.subject.roles);
+            const p = resolvePermissionFor(ctx.registry, def, subject.roles);
             // fail-closed: same as update — no read scope means no row scope
             if (p?.read === undefined) {
-                const err = new SchemaError('rbac.denied.delete', { object: objectName, role: ctx.subject.roles.join(',') }, ctx.locale);
+                const err = new SchemaError('rbac.denied.delete', { object: objectName, role: subject.roles.join(',') }, ctx.locale);
                 denied(audit, ctx, DATA_ACTIONS.DELETE, objectName, id, err);
                 throw err;
             }

package/dist/runtime/data-access/rbac.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../src/runtime/data-access/rbac.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAElG,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAG5E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,CAAC,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;AAEpC,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY,EAAE,MAAe;IACjE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,wBAAwB,CACrC,GAAsB,EACtB,GAAqB,EACrB,IAA6B;IAE7B,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC;IACrC,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO;IAClE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7F,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzF,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,IAAI,GAAG,GAAG,iBAAiB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7D,MAAM,MAAM,GAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,GAAG,GAAG,GAAG,GAAG,SAAS,MAAM,CAAC,GAAG,GAAG,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC;QAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB,EAAE,UAAkB;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,SAAS,MAAM,CACb,IAA2B,EAC3B,GAAsB,EACtB,MAAc,EACd,UAAkB,EAClB,QAA4B,EAC5B,KAAc;IAEd,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,KAAK,IAAI,CAAC,MAAM,CAAC;QACf,SAAS,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM;QACxF,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,QAAQ;QACpC,MAAM;QACN,UAAU;QACV,QAAQ;QACR,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAChE,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED,sDAAsD;AACtD,SAAS,KAAK,CAAI,MAAS,EAAE,OAA0B;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnG,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,GAAI,MAAkC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,GAAsB,EAAE,UAAkB,EAAE,IAA2B;IACxF,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAChE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvG,OAAO,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAuB,EAAE,UAAiC,EAAE;IACnF,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1B,OAAO;QACL,KAAK,CAAC,IAAI,CACR,UAAkB,EAClB,IAAiB,EACjB,GAAsB;YAEtB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAI,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3E,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACvH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;gBAClE,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAI,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxG,CAAC;QAED,KAAK,CAAC,OAAO,CACX,UAAkB,EAClB,EAAU,EACV,GAAsB;YAEtB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,OAAO,CAAI,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5E,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACvH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAI,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1F,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAED,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,IAA6B,EAC7B,GAAsB;YAEtB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAI,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7E,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;gBACtE,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrE,qEAAqE;YACrE,MAAM,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC/C,0EAA0E;YAC1E,wEAAwE;YACxE,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,MAAM,OAAO,GAAG,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;YACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,QAAQ,GAA4B,EAAE,CAAC;gBAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBACzB,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;wBACtB,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC3B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;wBACpI,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;wBACpE,MAAM,GAAG,CAAC;oBACZ,CAAC;oBACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACxB,CAAC;gBACD,OAAO,GAAG,QAAQ,CAAC;YACrB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAI,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,EAAU,EACV,OAAgC,EAChC,GAAsB;YAEtB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAI,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACpF,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC/D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrE,wEAAwE;YACxE,sDAAsD;YACtD,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACzH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC7D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,gFAAgF;YAChF,yEAAyE;YACzE,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;YACzB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACtE,MAAM,QAAQ,GAA4B,EAAE,CAAC;YAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnD,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBACtG,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC7D,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBACpI,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC7D,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAI,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YACjH,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,UAAU,CACd,UAAkB,EAClB,EAAU,EACV,MAAc,EACd,GAAsB,EACtB,OAAiC;YAEjC,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,UAAU,CAAI,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAChG,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC/D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACzH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC7D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAI,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1H,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,UAAkB,EAAE,EAAU,EAAE,GAAsB;YACzE,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAChF,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACvH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,UAAkB,EAAE,EAAU,EAAE,GAAsB;YAC9E,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACrF,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACvH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,KAAK,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvF,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,UAAkB,EAAE,EAAU,EAAE,GAAsB;YAC9E,OAAO,KAAK,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,EAAU,EAAE,GAAsB;YAC1E,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACjF,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACvH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACnF,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,GAAsB;YACxC,OAAO,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,gBAAgB,CACpB,UAAkB,EAClB,EAAU,EACV,KAAwC,EACxC,GAAsB;YAEtB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACzF,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC/D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,EAAU,EAAE,GAAsB;YACjE,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC/D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrE,iEAAiE;YACjE,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACzH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC7D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../src/runtime/data-access/rbac.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEpH,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE5E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,CAAC,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;AAEpC,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY,EAAE,MAAe;IACjE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,wBAAwB,CACrC,GAAsB,EACtB,GAAqB,EACrB,IAA6B,EAC7B,OAAwB;IAExB,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC;IACrC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7F,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjF,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,IAAI,GAAG,GAAG,iBAAiB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7D,MAAM,MAAM,GAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,GAAG,GAAG,GAAG,GAAG,SAAS,MAAM,CAAC,GAAG,GAAG,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC;QAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB,EAAE,UAAkB;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,SAAS,MAAM,CACb,IAA2B,EAC3B,GAAsB,EACtB,MAAc,EACd,UAAkB,EAClB,QAA4B,EAC5B,KAAc;IAEd,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAChC,KAAK,IAAI,CAAC,MAAM,CAAC;QACf,SAAS,EAAE,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM;QACxF,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC;QACpC,MAAM;QACN,UAAU;QACV,QAAQ;QACR,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAChE,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QACpE,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED,sDAAsD;AACtD,SAAS,KAAK,CAAI,MAAS,EAAE,OAA0B;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnG,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,GAAI,MAAkC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,GAAsB,EAAE,UAAkB,EAAE,IAA2B;IACxF,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAC5D,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/F,OAAO,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAuB,EAAE,UAAiC,EAAE;IACnF,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1B,OAAO;QACL,KAAK,CAAC,IAAI,CACR,UAAkB,EAClB,IAAiB,EACjB,GAAsB;YAEtB,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAI,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAE,CAAC;YAChC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;gBAClE,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAI,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxG,CAAC;QAED,KAAK,CAAC,OAAO,CACX,UAAkB,EAClB,EAAU,EACV,GAAsB;YAEtB,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,OAAO,CAAI,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAE,CAAC;YAChC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAI,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1F,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAED,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,IAA6B,EAC7B,GAAsB;YAEtB,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAI,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAE,CAAC;YAChC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;gBACtE,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACjE,qEAAqE;YACrE,MAAM,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACxD,0EAA0E;YAC1E,wEAAwE;YACxE,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,MAAM,OAAO,GAAG,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;YACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,QAAQ,GAA4B,EAAE,CAAC;gBAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBACzB,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;wBACtB,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC3B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;wBAChI,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;wBACpE,MAAM,GAAG,CAAC;oBACZ,CAAC;oBACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACxB,CAAC;gBACD,OAAO,GAAG,QAAQ,CAAC;YACrB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAI,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,EAAU,EACV,OAAgC,EAChC,GAAsB;YAEtB,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAI,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC3E,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAE,CAAC;YAChC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC/D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACjE,wEAAwE;YACxE,sDAAsD;YACtD,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACrH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC7D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,gFAAgF;YAChF,yEAAyE;YACzE,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;YACzB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACtE,MAAM,QAAQ,GAA4B,EAAE,CAAC;YAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnD,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBACtG,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC7D,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBAChI,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC7D,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAI,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YACjH,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,UAAU,CACd,UAAkB,EAClB,EAAU,EACV,MAAc,EACd,GAAsB,EACtB,OAAiC;YAEjC,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,UAAU,CAAI,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACvF,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAE,CAAC;YAChC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC/D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACrH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC7D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAI,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1H,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,UAAkB,EAAE,EAAU,EAAE,GAAsB;YACzE,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACvE,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAE,CAAC;YAChC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,UAAkB,EAAE,EAAU,EAAE,GAAsB;YAC9E,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAE,CAAC;YAChC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,KAAK,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvF,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,UAAkB,EAAE,EAAU,EAAE,GAAsB;YAC9E,4EAA4E;YAC5E,gDAAgD;YAChD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAE,CAAC,KAAK,CAAC,CAAC;gBACzE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC3H,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC3D,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,EAAU,EAAE,GAAsB;YAC1E,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAE,CAAC;YAChC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACnF,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,GAAsB;YACxC,0EAA0E;YAC1E,8DAA8D;YAC9D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAE,CAAC;gBAChC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;oBAClD,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;oBACjE,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;gBACjD,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC5G,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;oBAC3D,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,gBAAgB,CACpB,UAAkB,EAClB,EAAU,EACV,KAAwC,EACxC,GAAsB;YAEtB,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAChF,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAE,CAAC;YAChC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC/D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,EAAU,EAAE,GAAsB;YACjE,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAE,CAAC;YAChC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC/D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACjE,iEAAiE;YACjE,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACrH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC7D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/runtime/data-access/sql-executor.d.ts

@@ -1,6 +1,7 @@
 import type { Pool } from 'pg';
 import type { Locale } from '../../core/index.js';
 import type { SqlAnalyzer } from '../sql-analyzer/index.js';
+import type { QueryBudget } from './query-budget.js';
 export interface RestrictedSqlSubject {
     id: string;
     roles: string[];
@@ -28,6 +29,8 @@ export interface RestrictedSqlOptions {
     analyzer?: SqlAnalyzer;
     /** message locale for gate failures */
     locale?: Locale;
+    /** query budget: caps maxRows / maxSqlLength / maxJoins / statementTimeoutMs */
+    budget?: QueryBudget;
 }
 export interface RestrictedSqlResult {
     rows: unknown[];

package/dist/runtime/data-access/sql-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql-executor.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/sql-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAeD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,EAAE,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAkD9B"}
+{"version":3,"file":"sql-executor.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/sql-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAeD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,EAAE,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAwD9B"}

package/dist/runtime/data-access/sql-executor.js

@@ -30,17 +30,23 @@ function defaultAnalyzer() {
  *   this function runs)
  */
 export async function executeRestrictedSql(pool, sql, params, options = {}) {
-    const maxRows = options.maxRows ?? MAX_ROWS_DEFAULT;
-    const timeoutMs = options.timeoutMs ?? TIMEOUT_DEFAULT;
+    const maxRows = options.maxRows ?? options.budget?.maxRows ?? MAX_ROWS_DEFAULT;
+    const timeoutMs = options.timeoutMs ?? options.budget?.statementTimeoutMs ?? TIMEOUT_DEFAULT;
     if (typeof sql !== 'string') {
         throw new SchemaError('script.query.invalid', { detail: 'sql must be a string' });
     }
     let trimmed = sql.trim();
     if (trimmed.endsWith(';'))
         trimmed = trimmed.slice(0, -1);
+    if (options.budget !== undefined && trimmed.length > options.budget.maxSqlLength) {
+        throw new SchemaError('query.budget.exceeded', { limit: 'sqlLength', max: options.budget.maxSqlLength }, options.locale);
+    }
     // mandatory AST gate (fail-closed): the analyzer — not a regex — is the single
     // SELECT-only check, so a direct caller cannot run a non-SELECT or multi-statement.
-    await (options.analyzer ?? defaultAnalyzer()).analyzeSelect(trimmed, options.locale);
+    const analysis = await (options.analyzer ?? defaultAnalyzer()).analyzeSelect(trimmed, options.locale);
+    if (options.budget !== undefined && analysis.joinCount > options.budget.maxJoins) {
+        throw new SchemaError('query.budget.exceeded', { limit: 'joins', max: options.budget.maxJoins }, options.locale);
+    }
     if (options.rls !== undefined && !isSafeRlsRole(options.rls.role)) {
         throw new SchemaError('script.query.invalid', { detail: `invalid RLS role "${options.rls.role}"` });
     }

package/dist/runtime/data-access/sql-executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"sql-executor.js","sourceRoot":"","sources":["../../../src/runtime/data-access/sql-executor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAsC7D,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAC1C,CAAC;AAED,mFAAmF;AACnF,IAAI,cAAuC,CAAC;AAC5C,SAAS,eAAe;IACtB,OAAO,CAAC,cAAc,KAAK,iBAAiB,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAU,EACV,GAAW,EACX,MAAiB,EACjB,UAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC;IAEvD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,qBAAqB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,aAAa,GAAG,IAAI,CAAC;QACrB,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;YACtC,MAAM,MAAM,CAAC,KAAK,CAAC,kBAAkB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvD,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9E,MAAM,MAAM,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,MAAM,CAAC,KAAK,CAAC,sCAAsC,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,kBAAkB,OAAO,8BAA8B,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,EAC1E,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC,CACrB,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,aAAa,GAAG,KAAK,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAiB,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;YACnE,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"sql-executor.js","sourceRoot":"","sources":["../../../src/runtime/data-access/sql-executor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAyC7D,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAC1C,CAAC;AAED,mFAAmF;AACnF,IAAI,cAAuC,CAAC;AAC5C,SAAS,eAAe;IACtB,OAAO,CAAC,cAAc,KAAK,iBAAiB,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAU,EACV,GAAW,EACX,MAAiB,EACjB,UAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,gBAAgB,CAAC;IAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,kBAAkB,IAAI,eAAe,CAAC;IAE7F,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACjF,MAAM,IAAI,WAAW,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3H,CAAC;IACD,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtG,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjF,MAAM,IAAI,WAAW,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,qBAAqB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,aAAa,GAAG,IAAI,CAAC;QACrB,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;YACtC,MAAM,MAAM,CAAC,KAAK,CAAC,kBAAkB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvD,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9E,MAAM,MAAM,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,MAAM,CAAC,KAAK,CAAC,sCAAsC,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,kBAAkB,OAAO,8BAA8B,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,EAC1E,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC,CACrB,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,aAAa,GAAG,KAAK,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAiB,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;YACnE,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/runtime/data-access/types.d.ts

@@ -1,8 +1,9 @@
 import type { Pool, PoolClient } from "pg";
 import type { Locale } from "../../core/index.js";
 import type { ObjectRegistry } from "../../core/index.js";
-import type { IdentitySubject } from "../../core/index.js";
+import type { AccessPrincipal, IdentitySubject } from "../../core/index.js";
 import type { FilterOp, SortDir } from "./values.js";
+import type { QueryBudget } from "./query-budget.js";
 import type { WorkflowStatus, WorkflowHistory, WorkflowTodo, WorkflowOverride } from "./workflow.js";
 /** pool or pooled client — anything that can run parameterized queries */
 export type Queryable = Pool | PoolClient;
@@ -38,19 +39,28 @@ export interface FindOptions {
     fields?: string[];
     /** columns always excluded from the projection (RBAC fields.exclude) */
     exclude?: string[];
+    /**
+     * Opaque keyset cursor (see `cursor.ts`). When set on an object with a single
+     * primary key, the page is fetched with `pk > cursor` ordered by `pk` (a
+     * caller-provided `sort` is ignored); REST keeps using `offset`.
+     */
+    cursor?: string;
 }
 export interface FindResult<T = Record<string, unknown>> {
     rows: T[];
     total: number;
+    /** next-page keyset cursor (present only when a cursor was used and more remain) */
+    nextCursor?: string;
+    /** whether more rows exist beyond this page (offset or cursor mode) */
+    hasMore?: boolean;
 }
 /**
  * Execution context for data-access operations. `rowScope` is the RBAC
- * row-level filter (own/all) injected by the RBAC layer; consumers may
- * leave it unset to access all rows. `subject` is the authenticated identity
- * the RBAC layer decides for; absent = unrestricted. `client` threads an
- * outer transaction: when set, write operations reuse the connection and the
- * surrounding transaction instead of BEGIN/COMMIT/ROLLBACK themselves
- * (see `runtime/data-access/tx.ts`).
+ * row-level filter (own/all) injected by the RBAC layer. `principal` is the
+ * explicit actor (user or system capability) — there is no implicit
+ * unrestricted path. `client` threads an outer transaction: when set, write
+ * operations reuse the connection and the surrounding transaction instead of
+ * BEGIN/COMMIT/ROLLBACK themselves (see `runtime/data-access/tx.ts`).
  */
 export interface DataAccessContext {
     pool: Pool;
@@ -60,11 +70,15 @@ export interface DataAccessContext {
         sql: string;
         params: unknown[];
     };
-    /** authenticated identity for RBAC decisions; absent = no enforcement */
-    subject?: IdentitySubject;
+    /** who is acting — an authenticated user or an explicit system capability (required) */
+    principal: AccessPrincipal;
     locale?: Locale;
     /** outer transaction connection; present inside `withTx` (skips nested BEGIN/COMMIT/release) */
     client?: PoolClient;
+    /** request correlation id (Fastify request id / inbound x-request-id) attached to audit events */
+    requestId?: string;
+    /** per-context query budget override (defaults to the data-access instance's budget) */
+    budget?: QueryBudget;
     /**
      * channel for non-fatal write warnings — afterUpdate/afterDelete script hooks
      * fail after the write is committed; the messages are delivered here so the
@@ -72,6 +86,10 @@ export interface DataAccessContext {
      */
     onWarnings?: (warnings: string[]) => void;
 }
+/** the authenticated identity for a user principal, else undefined (system principal) */
+export declare function subjectOf(ctx: DataAccessContext): IdentitySubject | undefined;
+/** true when the context is an explicit system principal (unrestricted path) */
+export declare function isSystemCtx(ctx: DataAccessContext): boolean;
 /** contract for the controlled object data-access layer */
 export interface ObjectDataAccess {
     find<T = Record<string, unknown>>(objectName: string, opts: FindOptions, ctx: DataAccessContext): Promise<FindResult<T>>;

package/dist/runtime/data-access/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAErG,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,UAAU,CAAC;AAE1C,MAAM,MAAM,WAAW,GAAG;KAAG,EAAE,IAAI,QAAQ,CAAC,CAAC,EAAE,OAAO;CAAE,CAAC;AAEzD,oFAAoF;AACpF,MAAM,MAAM,WAAW,GAAG;IAAE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,MAAM,MAAM,GAAG,WAAW,GAAG;IAAE,GAAG,CAAC,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAE3D,MAAM,WAAW,IAAI;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACd,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACrD,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,cAAc,CAAC;IACzB,sFAAsF;IACtF,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAC9C,yEAAyE;IACzE,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;CAC3C;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACrB,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,CAAC,CAAC;IACd;;;;;;;;OAQG;IACH,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,iBAAiB,EACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,yEAAyE;IACzE,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChG,+EAA+E;IAC/E,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAC1G,yCAAyC;IACzC,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,2DAA2D;IAC3D,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAClG,yDAAyD;IACzD,aAAa,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/D,0EAA0E;IAC1E,gBAAgB,CACd,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,gBAAgB,EACvB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE5E,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAErG,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,UAAU,CAAC;AAE1C,MAAM,MAAM,WAAW,GAAG;KAAG,EAAE,IAAI,QAAQ,CAAC,CAAC,EAAE,OAAO;CAAE,CAAC;AAEzD,oFAAoF;AACpF,MAAM,MAAM,WAAW,GAAG;IAAE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,MAAM,MAAM,GAAG,WAAW,GAAG;IAAE,GAAG,CAAC,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAE3D,MAAM,WAAW,IAAI;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACd,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACrD,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,cAAc,CAAC;IACzB,sFAAsF;IACtF,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAC9C,wFAAwF;IACxF,SAAS,EAAE,eAAe,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;CAC3C;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,GAAG,EAAE,iBAAiB,GAAG,eAAe,GAAG,SAAS,CAE7E;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAE3D;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACrB,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,CAAC,CAAC;IACd;;;;;;;;OAQG;IACH,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,iBAAiB,EACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,yEAAyE;IACzE,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChG,+EAA+E;IAC/E,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAC1G,yCAAyC;IACzC,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,2DAA2D;IAC3D,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAClG,yDAAyD;IACzD,aAAa,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/D,0EAA0E;IAC1E,gBAAgB,CACd,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,gBAAgB,EACvB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD"}

package/dist/runtime/data-access/types.js

@@ -1,2 +1,10 @@
-export {};
+import { principalSubject } from "../../core/index.js";
+/** the authenticated identity for a user principal, else undefined (system principal) */
+export function subjectOf(ctx) {
+    return principalSubject(ctx.principal);
+}
+/** true when the context is an explicit system principal (unrestricted path) */
+export function isSystemCtx(ctx) {
+    return ctx.principal.kind === 'system';
+}
 //# sourceMappingURL=types.js.map

package/dist/runtime/data-access/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/runtime/data-access/types.ts"],"names":[],"mappings":""}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/runtime/data-access/types.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAqFvD,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,GAAsB;IAC9C,OAAO,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,GAAsB;IAChD,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC;AACzC,CAAC"}

package/dist/runtime/engine.d.ts

@@ -1,6 +1,6 @@
 import type { FastifyInstance } from 'fastify';
 import type { Pool } from 'pg';
-import { ObjectRegistry, type CounterStore, type EngineScriptConfig, type EngineWorkflowConfig, type EventPublisher, type FieldTypeRegistration, type GuardrailPolicy, type Locale, type ProxyTargetResolver, type ScriptDispatcher, type ToolDefinition } from '../core/index.js';
+import { ObjectRegistry, type AuditMode, type CounterStore, type EngineScriptConfig, type EngineWorkflowConfig, type EventPublisher, type FieldTypeRegistration, type GuardrailPolicy, type Locale, type ProxyTargetResolver, type ScriptDispatcher, type ToolDefinition } from '../core/index.js';
 import type { ObjectDataAccess } from './data-access/index.js';
 import type { ProjectType } from '../cli/types/index.js';
 import { type ApprovalsQueue } from './tools/index.js';
@@ -13,6 +13,7 @@ import type { IngressConfig } from '../core/provider/event/index.js';
 import { type EngineMcpConfig, type McpServerHandle } from '../adapters/mcp/index.js';
 import { type EngineGraphQLConfig, type GraphQLServerHandle } from '../adapters/graphql/index.js';
 import type { AuditEngine } from '../subsystems/audit/index.js';
+import { type QueryBudget } from './data-access/index.js';
 import type { WorkflowTimerScheduler } from '../subsystems/workflow/index.js';
 /** REST interface configuration */
 export interface EngineRestConfig {
@@ -39,6 +40,13 @@ export interface EngineRestConfig {
 /** audit subsystem config (optional; disabled = not loaded = zero overhead) */
 export interface EngineAuditConfig {
     enabled?: boolean;
+    /**
+     * Durability mode (default `best-effort`): `best-effort` = fire-and-forget
+     * process buffer; `transactional` = audit row written in the business
+     * transaction; `durable` = transactional outbox + relay (crash-safe,
+     * at-least-once).
+     */
+    mode?: AuditMode;
     /** retention window placeholder (auto-cleanup is not implemented yet) */
     retention?: string;
     /** audit diff replay: attach before/after row snapshots to update/delete audit events (default off; table always has the columns) */
@@ -242,6 +250,12 @@ export interface EngineConfig {
     quotas?: {
         backend?: 'pg';
     };
+    /**
+     * Agent-native query budget: caps rows/filters/sorts (data-access), joins /
+     * SQL length / statement timeout (restricted SQL) and GraphQL depth. Absent =
+     * defaults (see `QUERY_BUDGET_DEFAULTS`).
+     */
+    queryBudget?: Partial<QueryBudget>;
     /** generic outbound proxy route wiring (applications provide the resolver) */
     proxy?: EngineProxyConfig;
     /**