@weave-kit/engine 1.1.0 → 1.2.0

package/CHANGELOG.md

@@ -3,6 +3,33 @@
 All notable changes to `@weave-kit/engine`. Format follows [Keep a Changelog](https://keepachangelog.com/);
 the project uses [Semantic Versioning](https://semver.org/).
 
+## [1.2.0] - 2026-10-11
+
+Additive (no `CONTRACT_VERSION` bump): seams for the Cloud/Console control plane.
+
+### Added
+
+- **Generic row-scope (`scope`).** The canonical twin of `tenant`: a field marked `"scope": true`
+  scopes reads/writes to `subject.scopeId ?? subject.tenantId` — RBAC row scope + native RLS
+  (`weavekit.scope_id` GUC; `weavekit.tenant_id` retained and set alongside) + audit (`scopeId`).
+  `EngineConfig.scope`, `withDefaultScope`, `principalScopeId` / `scopeOf` / `scopedKey`, and the
+  `scopeId` alias on `IdentitySubject` / `AuditEvent` / `AuditQuery` / SSE events are additive; the
+  `tenant` names keep working.
+- **REST `principalFor` seam.** `EngineRestConfig.principalFor` maps an authenticated request to an
+  `AccessPrincipal`, letting a control plane run requests under a **system/admin scope**
+  (`systemPrincipal(SYSTEM_CAPABILITIES.INTERNAL_ADMIN)`) for cross-tenant global views.
+- **Identity sync trigger.** `POST {prefix}/identity/sync` (admin-gated) runs the configured
+  `identity.source` (`runIdentitySync`) on demand — the manual projection step for site members
+  (`dryRun` supported).
+- **Capabilities read seam.** `EngineConfig.capabilities.provider` + `GET {prefix}/capabilities`
+  (baseline + host-injected `Capabilities`). The engine surfaces entitlements verbatim and never
+  judges licensing.
+- **Identity admin write completeness.** `IdentityStore`/`IdentityAdmin` gain `updateUserRoles` /
+  `deleteUser` / `createDepartment` / `listDepartments` (rows now carry `name`/`email`/`mobile`,
+  departments `name`/`code`). REST adds `PATCH` roles on `/identity/users/:id`, `DELETE`
+  `/identity/users/:id`, and `/identity/departments` (`GET`/`POST`); CLI adds
+  `weave identity:set-roles` / `weave identity:delete`.
+
 ## [1.1.0] - 2026-10-10
 
 ### Removed

package/README.md

@@ -1,210 +1,210 @@
-<h1 align="center">Let AI agents operate your data — safely</h1>
-
-Define your data model once in `schema.json`, and WeaveKit compiles it into PostgreSQL tables, REST
-and GraphQL APIs with row- and field-level RBAC, an immutable audit log with execution evidence, and
-an MCP tool surface that AI agents call with typed tools — never raw SQL. Self-hosted: your data
-stays in your database.
-
-```
-objects/leads/schema.json   →   Git commit (source of truth)
-                                PostgreSQL tables + indexes + RLS
-                                REST + GraphQL APIs (CRUD + RBAC)
-                                MCP tools (per-identity surface + guardrails + approvals)
-                                Immutable audit log + execution evidence
-                                TypeScript types
-```
-
-## Why WeaveKit
-
-- **Safe by construction** — every agent action is authorized by row- and field-level RBAC and
-  native PostgreSQL RLS, and recorded in an immutable audit log. Guardrails (and optional
-  approvals) sit in front.
-- **Your model is a Git repository** — schema, hooks and policies are files you review, diff and
-  revert; the engine commits every change for you, and PostgreSQL is a derived cache.
-- **One agent, many users** — each MCP call carries the acting user's identity (on-behalf-of), and
-  the engine compiles a per-identity tool surface: a salesperson's agent sees only their own leads,
-  a finance agent cannot read sales notes. Prompt injection cannot bypass RBAC/RLS.
-- **Bring your existing PostgreSQL** — point the engine at a live database and declare the tables
-  you want to expose; existing tables stay read-only unless you explicitly allow additive DDL, and
-  `weave introspect` can reverse-model them into `schema.json`.
-- **Typed tools in minutes, not weeks** — hand-writing an MCP server (tools + permissions + audit)
-  for a few tables takes days; here it is a few `schema.json` files, and new fields or tables
-  extend the tool surface automatically.
-- **More than MCP** — the same schema also drives REST and GraphQL APIs and generated TypeScript
-  types, so people and agents share one governed contract.
-- **Self-hosted** — the engine runs in your environment; no data leaves your database.
-
-## How it works
-
-`weave` reads `objects/<name>/schema.json`, validates it, and syncs it to PostgreSQL (state-diff
-migrations; existing tables stay read-only unless you allow additive DDL). The same metadata drives
-the REST routes and the MCP tool surface, and the data-access layer enforces RBAC and audits every
-write.
-
-## Features
-
-- **Git-versioned metadata** — schema, hooks and policies are plain files in your repository; every
-  change is a scoped, atomic Git commit, so review, history and rollback come for free. PostgreSQL
-  stays a derived cache.
-- **Schema as the source of truth** — `objects/<name>/schema.json` drives the tables, REST API and MCP
-  surface; state-diff migrations to PostgreSQL.
-- **Custom field types** — register business-semantic types (`money`, `address`, …) as thin, namespaced
-  layers over a built-in primitive; they inherit storage, REST/MCP/OpenAPI schemas and generated
-  types. Declared in a project-local, Git-committed `field-types/` directory.
-- **Named enums** — declare a shared enum once in `enums/` and reference it from any object by
-  `enumType`; every field shares one native PostgreSQL type and one set of per-value labels.
-- **Governed REST API** — object CRUD with row-level (`all`/`own`/`department`) and field-level RBAC
-  and a uniform error contract.
-- **MCP tool surface** — a streamable HTTP endpoint at `/mcp` with a per-identity tool surface and
-  guardrails.
-- **GraphQL API** — an opt-in read/write GraphQL endpoint compiled from the same `schema.json`, with
-  nested relations, the same RBAC/audit, per-request batching and query hardening.
-- **Schema revisions & atomic deploys** — `weave deploy plan` previews the diff; `weave deploy apply`
-  commits the DDL, the metadata cache and a global **schema revision** in one transaction (no
-  half-applied deploys).
-- **Agent execution pipeline** — every write and tool call runs through one
-  Plan → Validate → Authorize → Guardrail → Approval → Execute → Commit → Evidence pipeline, so
-  guardrails and approvals cover REST, MCP and GraphQL alike; enable `evidence` to record a
-  `weavekit_evidence` row per execution (correlated by request / trace / schema revision).
-- **Query budget** — bound a read/query across the engine: rows, filters and sorts in data-access,
-  joins / SQL length / statement timeout in restricted SQL, and GraphQL depth.
-- **Multi-tenancy (row)** — mark a field `"tenant": true` and every read/write is scoped to the
-  subject's tenant (RBAC row scope + PostgreSQL RLS + audit); single-tenant by default.
-- **Audit log** — an immutable event log for data mutations, with durability modes
-  (`best-effort` / `transactional` / `durable`) and a keyset-cursor query.
-- **Observability** — a low-level metrics/trace seam (`MetricsSink` / `TraceSink`, `METRIC_NAMES`)
-  that emits request latency, RBAC denials, query-budget rejects and W3C `traceparent`-correlated
-  spans; the engine ships a no-op default and brings no backend.
-- **Sandboxed hooks** — `*.server.js` lifecycle hooks running in isolated workers.
-- **Type generation** — object-level TypeScript types derived from the schema.
-- **Live events** — an SSE stream with replay.
-- **Operations** — `weave doctor` preflight, health / readiness / version endpoints, request rate
-  limiting, CORS and structured logging.
-
-## Requirements
-
-- Node.js 22+
-- PostgreSQL 12+ (the engine's tested floor; `weave doctor` reports the version)
-
-## Quick start
-
-```sh
-npm create weavekit-app my-app -- --type=agent
-cd my-app
-cp .env.example .env      # set DATABASE_URL
-weave migrate             # state-diff migration: schema.json → PostgreSQL tables (+ metadata cache)
-weave dev                 # http://localhost:3000 — hot reload
-weave types               # object-level TS types → generated/types.ts
-```
-
-**Existing database?** Reverse-model it instead of authoring from scratch:
-
-```sh
-weave introspect          # live tables → objects/<table>/schema.json (read-only)
-weave schema:map          # schema field ↔ PostgreSQL column mapping + drift
-```
-
-**Connect an agent** (MCP is available at `/mcp`):
-
-```sh
-weave mcp:config          # ready-to-paste config for Claude Code / Cursor / VS Code / Claude Desktop
-```
-
-## Documentation
-
-Full documentation: **[docs.weavekit.io/engine](https://docs.weavekit.io/engine)**
-
-- [Getting started](https://docs.weavekit.io/engine/guides/getting-started) — scaffold, migrate, run, consume
-- [Git-versioned metadata](https://docs.weavekit.io/engine/guides/model/git-versioned-metadata) — your data model as reviewable Git commits
-- [Schema guide](https://docs.weavekit.io/engine/guides/model/schema) · [RBAC](https://docs.weavekit.io/engine/guides/access/rbac) · [Multi-tenancy](https://docs.weavekit.io/engine/guides/access/multi-tenancy) · [Formulas](https://docs.weavekit.io/engine/guides/model/formulas) · [Audit](https://docs.weavekit.io/engine/guides/platform/audit)
-- [CLI reference](https://docs.weavekit.io/engine/guides/platform/cli) · [Observability](https://docs.weavekit.io/engine/guides/platform/observability) · [MCP](https://docs.weavekit.io/engine/guides/agents/mcp) · [Execution & evidence](https://docs.weavekit.io/engine/guides/agents/execution-and-evidence) · [Script hooks](https://docs.weavekit.io/engine/guides/automation/script-hooks)
-- [Custom tools & guardrails](https://docs.weavekit.io/engine/guides/agents/custom-tools-and-guardrails) · [Query budget](https://docs.weavekit.io/engine/guides/automation/query-budget) · [Custom field types](https://docs.weavekit.io/engine/reference/schema/custom-field-types) · [Quotas](https://docs.weavekit.io/engine/guides/automation/quotas) · [Inbound events](https://docs.weavekit.io/engine/guides/integration/ingress)
-- [Public API & dependency budget](https://docs.weavekit.io/engine/reference/api/public-api) · [Enterprise seams](https://docs.weavekit.io/engine/reference/enterprise-seams) · [Contract freeze](https://docs.weavekit.io/engine/reference/contract-freeze)
-- [Practices & operations](https://docs.weavekit.io/engine/practices/agent/existing-crm-to-mcp) · [Release checklist](https://docs.weavekit.io/engine/operations/release) — real integration and deployment walkthroughs
-
-The Markdown sources live in [`docs/`](https://github.com/weavekit/engine/tree/main/docs).
-
-## Programmatic use
-
-```ts
-import { createEngine } from '@weave-kit/engine';
-
-const engine = await createEngine({
-  databaseUrl: process.env.DATABASE_URL,
-  schemaDir: '.', // project root containing objects/
-  auth: { source: { 'sk-admin': { id: 'admin', roles: ['admin'] } } },
-});
-await engine.app.listen({ port: 3000 });
-```
-
-## Metadata
-
-- **Objects** live in `objects/<name>/schema.json` (one directory per object; the directory name must
-  equal the object name).
-- **`weavekit.config.ts`** is the single wiring point — a default export `satisfies EngineConfig`
-  (`schemaDir`, `auth`, `adapters`, `subsystems`).
-- `schema.json` is versioned in Git and is the source of truth; the engine syncs it to PostgreSQL and
-  a metadata cache.
-
-## CLI
-
-| Command | Description |
-| --- | --- |
-| `weave migrate [--dry-run]` | State-diff migration + metadata cache + auto-commit |
-| `weave deploy plan` / `weave deploy apply` | Preview / atomically apply schema changes and record a global schema revision |
-| `weave doctor` | Read-only preflight (connection, PostgreSQL compatibility, drift, system tables, RLS + sandbox) |
-| `weave dev [--port]` | Run with hot reload |
-| `weave build` | Bundle the server entry (esbuild) |
-| `weave test` | Proxy the project test suite |
-| `weave types [--outdir]` | Compile `schema.json` into object-level TS types |
-| `weave introspect` | Reverse-model an existing Postgres DB into `objects/*/schema.json` |
-| `weave schema:map [object] [--drift]` | Report the schema field ↔ PostgreSQL column mapping |
-| `weave schema:upgrade [--dry-run]` | Upgrade `objects/*/schema.json` to the current format version |
-| `weave openapi [--out] [--generic] [--server]` | Emit an OpenAPI 3.1 document for the REST API |
-| `weave graphql:schema [--out]` | Emit the GraphQL SDL for this project |
-| `weave mcp:config [--host]` | Print MCP client config for this project's `/mcp` endpoint |
-| `weave connect` | Connect a self-hosted engine out to a governance tunnel endpoint |
-| `weave object:create <name>` | Scaffold `objects/<name>/schema.json` + `server.js` hooks |
-| `weave field:add <object>` | Add a validated field to a schema |
-| `weave field-type:list` | List built-in + registered field types |
-| `weave field-type:check` | Validate registrations + schemas against the registry |
-| `weave enum:list` | List declared named enums (`enums/<name>.json`) |
-| `weave enum:check` | Validate enum declarations + schema references |
-| `weave module:add` / `module:remove <name>` | Enable/disable an optional subsystem (audit/script/workflow) |
-
-## Object-level types
-
-```sh
-weave types   # → generated/types.ts
-```
-
-```ts
-import type { Lead } from './generated/types';
-import { createClient } from '@weave-kit/client';
-
-const leads = createClient({ baseUrl, apiKey }).objects<Lead>('lead');
-const { rows } = await leads.find({ filter: { status: 'open' } });
-```
-
-## Development
-
-```sh
-npm install
-npm run build        # tsc → dist
-npm test             # unit + e2e (e2e needs DATABASE_URL)
-npm run test:coverage # coverage gate on security-critical paths
-npm run typecheck
-npm run lint
-node scripts/check-exports.mjs  # verify package exports + contract names
-```
-
-Issues and pull requests are welcome. See [`AGENTS.md`](AGENTS.md) for architecture notes and
-contribution invariants.
-
-## Support
-
-Questions, bug reports and security reports: **support@weavekit.io**.
-
-## License
-
-[MIT](LICENSE) · For support, contact **support@weavekit.io**.
+<h1 align="center">Let AI agents operate your data — safely</h1>
+
+Define your data model once in `schema.json`, and WeaveKit compiles it into PostgreSQL tables, REST
+and GraphQL APIs with row- and field-level RBAC, an immutable audit log with execution evidence, and
+an MCP tool surface that AI agents call with typed tools — never raw SQL. Self-hosted: your data
+stays in your database.
+
+```
+objects/leads/schema.json   →   Git commit (source of truth)
+                                PostgreSQL tables + indexes + RLS
+                                REST + GraphQL APIs (CRUD + RBAC)
+                                MCP tools (per-identity surface + guardrails + approvals)
+                                Immutable audit log + execution evidence
+                                TypeScript types
+```
+
+## Why WeaveKit
+
+- **Safe by construction** — every agent action is authorized by row- and field-level RBAC and
+  native PostgreSQL RLS, and recorded in an immutable audit log. Guardrails (and optional
+  approvals) sit in front.
+- **Your model is a Git repository** — schema, hooks and policies are files you review, diff and
+  revert; the engine commits every change for you, and PostgreSQL is a derived cache.
+- **One agent, many users** — each MCP call carries the acting user's identity (on-behalf-of), and
+  the engine compiles a per-identity tool surface: a salesperson's agent sees only their own leads,
+  a finance agent cannot read sales notes. Prompt injection cannot bypass RBAC/RLS.
+- **Bring your existing PostgreSQL** — point the engine at a live database and declare the tables
+  you want to expose; existing tables stay read-only unless you explicitly allow additive DDL, and
+  `weave introspect` can reverse-model them into `schema.json`.
+- **Typed tools in minutes, not weeks** — hand-writing an MCP server (tools + permissions + audit)
+  for a few tables takes days; here it is a few `schema.json` files, and new fields or tables
+  extend the tool surface automatically.
+- **More than MCP** — the same schema also drives REST and GraphQL APIs and generated TypeScript
+  types, so people and agents share one governed contract.
+- **Self-hosted** — the engine runs in your environment; no data leaves your database.
+
+## How it works
+
+`weave` reads `objects/<name>/schema.json`, validates it, and syncs it to PostgreSQL (state-diff
+migrations; existing tables stay read-only unless you allow additive DDL). The same metadata drives
+the REST routes and the MCP tool surface, and the data-access layer enforces RBAC and audits every
+write.
+
+## Features
+
+- **Git-versioned metadata** — schema, hooks and policies are plain files in your repository; every
+  change is a scoped, atomic Git commit, so review, history and rollback come for free. PostgreSQL
+  stays a derived cache.
+- **Schema as the source of truth** — `objects/<name>/schema.json` drives the tables, REST API and MCP
+  surface; state-diff migrations to PostgreSQL.
+- **Custom field types** — register business-semantic types (`money`, `address`, …) as thin, namespaced
+  layers over a built-in primitive; they inherit storage, REST/MCP/OpenAPI schemas and generated
+  types. Declared in a project-local, Git-committed `field-types/` directory.
+- **Named enums** — declare a shared enum once in `enums/` and reference it from any object by
+  `enumType`; every field shares one native PostgreSQL type and one set of per-value labels.
+- **Governed REST API** — object CRUD with row-level (`all`/`own`/`department`) and field-level RBAC
+  and a uniform error contract.
+- **MCP tool surface** — a streamable HTTP endpoint at `/mcp` with a per-identity tool surface and
+  guardrails.
+- **GraphQL API** — an opt-in read/write GraphQL endpoint compiled from the same `schema.json`, with
+  nested relations, the same RBAC/audit, per-request batching and query hardening.
+- **Schema revisions & atomic deploys** — `weave deploy plan` previews the diff; `weave deploy apply`
+  commits the DDL, the metadata cache and a global **schema revision** in one transaction (no
+  half-applied deploys).
+- **Agent execution pipeline** — every write and tool call runs through one
+  Plan → Validate → Authorize → Guardrail → Approval → Execute → Commit → Evidence pipeline, so
+  guardrails and approvals cover REST, MCP and GraphQL alike; enable `evidence` to record a
+  `weavekit_evidence` row per execution (correlated by request / trace / schema revision).
+- **Query budget** — bound a read/query across the engine: rows, filters and sorts in data-access,
+  joins / SQL length / statement timeout in restricted SQL, and GraphQL depth.
+- **Multi-tenancy (row)** — mark a field `"tenant": true` and every read/write is scoped to the
+  subject's tenant (RBAC row scope + PostgreSQL RLS + audit); single-tenant by default.
+- **Audit log** — an immutable event log for data mutations, with durability modes
+  (`best-effort` / `transactional` / `durable`) and a keyset-cursor query.
+- **Observability** — a low-level metrics/trace seam (`MetricsSink` / `TraceSink`, `METRIC_NAMES`)
+  that emits request latency, RBAC denials, query-budget rejects and W3C `traceparent`-correlated
+  spans; the engine ships a no-op default and brings no backend.
+- **Sandboxed hooks** — `*.server.js` lifecycle hooks running in isolated workers.
+- **Type generation** — object-level TypeScript types derived from the schema.
+- **Live events** — an SSE stream with replay.
+- **Operations** — `weave doctor` preflight, health / readiness / version endpoints, request rate
+  limiting, CORS and structured logging.
+
+## Requirements
+
+- Node.js 22+
+- PostgreSQL 12+ (the engine's tested floor; `weave doctor` reports the version)
+
+## Quick start
+
+```sh
+npm create weavekit-app my-app -- --type=agent
+cd my-app
+cp .env.example .env      # set DATABASE_URL
+weave migrate             # state-diff migration: schema.json → PostgreSQL tables (+ metadata cache)
+weave dev                 # http://localhost:3000 — hot reload
+weave types               # object-level TS types → generated/types.ts
+```
+
+**Existing database?** Reverse-model it instead of authoring from scratch:
+
+```sh
+weave introspect          # live tables → objects/<table>/schema.json (read-only)
+weave schema:map          # schema field ↔ PostgreSQL column mapping + drift
+```
+
+**Connect an agent** (MCP is available at `/mcp`):
+
+```sh
+weave mcp:config          # ready-to-paste config for Claude Code / Cursor / VS Code / Claude Desktop
+```
+
+## Documentation
+
+Full documentation: **[docs.weavekit.io/engine](https://docs.weavekit.io/engine)**
+
+- [Getting started](https://docs.weavekit.io/engine/guides/getting-started) — scaffold, migrate, run, consume
+- [Git-versioned metadata](https://docs.weavekit.io/engine/guides/model/git-versioned-metadata) — your data model as reviewable Git commits
+- [Schema guide](https://docs.weavekit.io/engine/guides/model/schema) · [RBAC](https://docs.weavekit.io/engine/guides/access/rbac) · [Multi-tenancy](https://docs.weavekit.io/engine/guides/access/multi-tenancy) · [Formulas](https://docs.weavekit.io/engine/guides/model/formulas) · [Audit](https://docs.weavekit.io/engine/guides/platform/audit)
+- [CLI reference](https://docs.weavekit.io/engine/guides/platform/cli) · [Observability](https://docs.weavekit.io/engine/guides/platform/observability) · [MCP](https://docs.weavekit.io/engine/guides/agents/mcp) · [Execution & evidence](https://docs.weavekit.io/engine/guides/agents/execution-and-evidence) · [Script hooks](https://docs.weavekit.io/engine/guides/automation/script-hooks)
+- [Custom tools & guardrails](https://docs.weavekit.io/engine/guides/agents/custom-tools-and-guardrails) · [Query budget](https://docs.weavekit.io/engine/guides/automation/query-budget) · [Custom field types](https://docs.weavekit.io/engine/reference/schema/custom-field-types) · [Quotas](https://docs.weavekit.io/engine/guides/automation/quotas) · [Inbound events](https://docs.weavekit.io/engine/guides/integration/ingress)
+- [Public API & dependency budget](https://docs.weavekit.io/engine/reference/api/public-api) · [Enterprise seams](https://docs.weavekit.io/engine/reference/enterprise-seams) · [Contract freeze](https://docs.weavekit.io/engine/reference/contract-freeze)
+- [Practices & operations](https://docs.weavekit.io/engine/practices/agent/existing-crm-to-mcp) · [Release checklist](https://docs.weavekit.io/engine/operations/release) — real integration and deployment walkthroughs
+
+The Markdown sources live in [`docs/`](https://github.com/weavekit/engine/tree/main/docs).
+
+## Programmatic use
+
+```ts
+import { createEngine } from '@weave-kit/engine';
+
+const engine = await createEngine({
+  databaseUrl: process.env.DATABASE_URL,
+  schemaDir: '.', // project root containing objects/
+  auth: { source: { 'sk-admin': { id: 'admin', roles: ['admin'] } } },
+});
+await engine.app.listen({ port: 3000 });
+```
+
+## Metadata
+
+- **Objects** live in `objects/<name>/schema.json` (one directory per object; the directory name must
+  equal the object name).
+- **`weavekit.config.ts`** is the single wiring point — a default export `satisfies EngineConfig`
+  (`schemaDir`, `auth`, `adapters`, `subsystems`).
+- `schema.json` is versioned in Git and is the source of truth; the engine syncs it to PostgreSQL and
+  a metadata cache.
+
+## CLI
+
+| Command | Description |
+| --- | --- |
+| `weave migrate [--dry-run]` | State-diff migration + metadata cache + auto-commit |
+| `weave deploy plan` / `weave deploy apply` | Preview / atomically apply schema changes and record a global schema revision |
+| `weave doctor` | Read-only preflight (connection, PostgreSQL compatibility, drift, system tables, RLS + sandbox) |
+| `weave dev [--port]` | Run with hot reload |
+| `weave build` | Bundle the server entry (esbuild) |
+| `weave test` | Proxy the project test suite |
+| `weave types [--outdir]` | Compile `schema.json` into object-level TS types |
+| `weave introspect` | Reverse-model an existing Postgres DB into `objects/*/schema.json` |
+| `weave schema:map [object] [--drift]` | Report the schema field ↔ PostgreSQL column mapping |
+| `weave schema:upgrade [--dry-run]` | Upgrade `objects/*/schema.json` to the current format version |
+| `weave openapi [--out] [--generic] [--server]` | Emit an OpenAPI 3.1 document for the REST API |
+| `weave graphql:schema [--out]` | Emit the GraphQL SDL for this project |
+| `weave mcp:config [--host]` | Print MCP client config for this project's `/mcp` endpoint |
+| `weave connect` | Connect a self-hosted engine out to a governance tunnel endpoint |
+| `weave object:create <name>` | Scaffold `objects/<name>/schema.json` + `server.js` hooks |
+| `weave field:add <object>` | Add a validated field to a schema |
+| `weave field-type:list` | List built-in + registered field types |
+| `weave field-type:check` | Validate registrations + schemas against the registry |
+| `weave enum:list` | List declared named enums (`enums/<name>.json`) |
+| `weave enum:check` | Validate enum declarations + schema references |
+| `weave module:add` / `module:remove <name>` | Enable/disable an optional subsystem (audit/script/workflow) |
+
+## Object-level types
+
+```sh
+weave types   # → generated/types.ts
+```
+
+```ts
+import type { Lead } from './generated/types';
+import { createClient } from '@weave-kit/client';
+
+const leads = createClient({ baseUrl, apiKey }).objects<Lead>('lead');
+const { rows } = await leads.find({ filter: { status: 'open' } });
+```
+
+## Development
+
+```sh
+npm install
+npm run build        # tsc → dist
+npm test             # unit + e2e (e2e needs DATABASE_URL)
+npm run test:coverage # coverage gate on security-critical paths
+npm run typecheck
+npm run lint
+node scripts/check-exports.mjs  # verify package exports + contract names
+```
+
+Issues and pull requests are welcome. See [`AGENTS.md`](AGENTS.md) for architecture notes and
+contribution invariants.
+
+## Support
+
+Questions, bug reports and security reports: **support@weavekit.io**.
+
+## License
+
+[MIT](LICENSE) · For support, contact **support@weavekit.io**.

package/dist/adapters/auth/index.d.ts

@@ -4,7 +4,7 @@ import { type AuthConfig, type Authenticator } from './source.js';
 export type { Authenticator, AuthConfig, AuthResolver, AuthSource } from './source.js';
 export { createAuth } from './source.js';
 export type { AuthVerifier } from './verify.js';
-export { createDirectoryAuthenticator, enforceSyncedIdentity, withDefaultTenant } from './subject.js';
+export { createDirectoryAuthenticator, enforceSyncedIdentity, withDefaultTenant, withDefaultScope } from './subject.js';
 /**
  * Resolve the Authorization header into a subject, or throw a 401-family
  * {@link SchemaError}. Missing header → `auth.missingKey`; present but

package/dist/adapters/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAc,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAE9E,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtG;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAK1B;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CAEpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAc,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAE9E,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAExH;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAK1B;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CAEpE"}

package/dist/adapters/auth/index.js

@@ -1,7 +1,7 @@
 import { SchemaError } from '../../core/index.js';
 import { createAuth } from './source.js';
 export { createAuth } from './source.js';
-export { createDirectoryAuthenticator, enforceSyncedIdentity, withDefaultTenant } from './subject.js';
+export { createDirectoryAuthenticator, enforceSyncedIdentity, withDefaultTenant, withDefaultScope } from './subject.js';
 /**
  * Resolve the Authorization header into a subject, or throw a 401-family
  * {@link SchemaError}. Missing header → `auth.missingKey`; present but

package/dist/adapters/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAuC,MAAM,aAAa,CAAC;AAG9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtG;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAA4B,EAC5B,MAA0B,EAC1B,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAuC,MAAM,aAAa,CAAC;AAG9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAExH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAA4B,EAC5B,MAA0B,EAC1B,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}

package/dist/adapters/auth/subject.d.ts

@@ -25,4 +25,10 @@ export declare function enforceSyncedIdentity(inner: Authenticator, directory: I
  * deployments). A subject that already carries a tenant is left untouched.
  */
 export declare function withDefaultTenant(inner: Authenticator, defaultTenant: string): Authenticator;
+/**
+ * Generic scope stamping (the `scope` twin of {@link withDefaultTenant}): a
+ * subject without a scope is stamped with the configured default scope. A
+ * subject that already carries `scopeId`/`tenantId` is left untouched.
+ */
+export declare function withDefaultScope(inner: Authenticator, defaultScope: string): Authenticator;
 //# sourceMappingURL=subject.d.ts.map

package/dist/adapters/auth/subject.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/subject.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,iBAAiB,EAAmB,MAAM,uCAAuC,CAAC;AAChG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,QAAQ,EAAE,YAAY,CAAC;IACvB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,aAAa,CAahB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,MAAM,GACb,aAAa,CAYf;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,GAAG,aAAa,CAQ5F"}
+{"version":3,"file":"subject.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/subject.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,iBAAiB,EAAmB,MAAM,uCAAuC,CAAC;AAChG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,QAAQ,EAAE,YAAY,CAAC;IACvB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,aAAa,CAahB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,MAAM,GACb,aAAa,CAYf;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,GAAG,aAAa,CAQ5F;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,GAAG,aAAa,CAQ1F"}

package/dist/adapters/auth/subject.js

@@ -48,10 +48,25 @@ export function withDefaultTenant(inner, defaultTenant) {
     return {
         async resolve(header) {
             const subject = await inner.resolve(header);
-            if (subject === null || subject.tenantId !== undefined)
+            if (subject === null || subject.scopeId !== undefined || subject.tenantId !== undefined)
                 return subject;
             return { ...subject, tenantId: defaultTenant };
         },
     };
 }
+/**
+ * Generic scope stamping (the `scope` twin of {@link withDefaultTenant}): a
+ * subject without a scope is stamped with the configured default scope. A
+ * subject that already carries `scopeId`/`tenantId` is left untouched.
+ */
+export function withDefaultScope(inner, defaultScope) {
+    return {
+        async resolve(header) {
+            const subject = await inner.resolve(header);
+            if (subject === null || subject.scopeId !== undefined || subject.tenantId !== undefined)
+                return subject;
+            return { ...subject, scopeId: defaultScope };
+        },
+    };
+}
 //# sourceMappingURL=subject.js.map

package/dist/adapters/auth/subject.js.map

@@ -1 +1 @@
-{"version":3,"file":"subject.js","sourceRoot":"","sources":["../../../src/adapters/auth/subject.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKlD;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAI5C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAChD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAA0B;YACtC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAoB,EACpB,SAA4B,EAC5B,MAAc;IAEd,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAA0B;YACtC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAoB,EAAE,aAAqB;IAC3E,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAA0B;YACtC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YACvE,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"subject.js","sourceRoot":"","sources":["../../../src/adapters/auth/subject.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKlD;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAI5C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAChD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAA0B;YACtC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAoB,EACpB,SAA4B,EAC5B,MAAc;IAEd,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAA0B;YACtC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAoB,EAAE,aAAqB;IAC3E,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAA0B;YACtC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YACxG,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAoB,EAAE,YAAoB;IACzE,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAA0B;YACtC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YACxG,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/events/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/events/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAmB,MAAM,qBAAqB,CAAC;AACnF,OAAO,KAAK,EAGV,QAAQ,EACT,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAItD;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,QAAQ,CAAC;IACd,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;CAC1C;AAuBD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,GAAE,aAAkB,GAAG,IAAI,CAuD9G"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/events/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAmB,MAAM,qBAAqB,CAAC;AACnF,OAAO,KAAK,EAGV,QAAQ,EACT,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAItD;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,QAAQ,CAAC;IACd,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;CAC1C;AAyBD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,GAAE,aAAkB,GAAG,IAAI,CAuD9G"}

package/dist/adapters/events/index.js

@@ -16,8 +16,10 @@ function passesFilter(event, subject, readable, isAdmin) {
                 return true;
             if (payload.event.actorId !== subject.id)
                 return false;
-            // tenant boundary: a tenant-scoped identity never sees another tenant's events
-            return subject.tenantId === undefined || payload.event.tenantId === undefined || payload.event.tenantId === subject.tenantId;
+            // row-scope boundary: a scoped identity never sees another scope's events
+            const eventScope = payload.event.scopeId ?? payload.event.tenantId;
+            const subjectScope = subject.scopeId ?? subject.tenantId;
+            return subjectScope === undefined || eventScope === undefined || eventScope === subjectScope;
         }
         default:
             return true; // schema.changed — broadcast

package/dist/adapters/events/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/events/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AASzE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAwC9D,SAAS,YAAY,CAAC,KAAkB,EAAE,OAAwB,EAAE,QAAqB,EAAE,OAAgB;IACzG,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW,CAAC,cAAc,CAAC;QAChC,KAAK,WAAW,CAAC,cAAc,CAAC;QAChC,KAAK,WAAW,CAAC,cAAc,CAAC;QAChC,KAAK,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAA6B,CAAC;YACpD,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,OAA4B,CAAC;YACnD,IAAI,OAAO;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YACvD,+EAA+E;YAC/E,OAAO,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC;QAC/H,CAAC;QACD;YACE,OAAO,IAAI,CAAC,CAAC,6BAA6B;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAoB,EAAE,IAAgB,EAAE,UAAyB,EAAE;IACtG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAElD,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IAErC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7D,KAAK,CAAC,MAAM,EAAE,CAAC;QAEf,IAAI,WAAW,GAAG,GAAS,EAAE,GAAE,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO,EAAE,GAAG,EAAE;gBACZ,WAAW,EAAE,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;YACD,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEpB,MAAM,OAAO,GAAG,CAAC,KAAkB,EAAQ,EAAE;YAC3C,IAAI,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACzH,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3D,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAChD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,wEAAwE;gBACxE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,EAAE;oBAC1C,IAAI,EAAE,WAAW,CAAC,cAAc;oBAChC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/events/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AASzE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAwC9D,SAAS,YAAY,CAAC,KAAkB,EAAE,OAAwB,EAAE,QAAqB,EAAE,OAAgB;IACzG,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW,CAAC,cAAc,CAAC;QAChC,KAAK,WAAW,CAAC,cAAc,CAAC;QAChC,KAAK,WAAW,CAAC,cAAc,CAAC;QAChC,KAAK,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAA6B,CAAC;YACpD,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,OAA4B,CAAC;YACnD,IAAI,OAAO;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YACvD,0EAA0E;YAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YACnE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;YACzD,OAAO,YAAY,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,YAAY,CAAC;QAC/F,CAAC;QACD;YACE,OAAO,IAAI,CAAC,CAAC,6BAA6B;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAoB,EAAE,IAAgB,EAAE,UAAyB,EAAE;IACtG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAElD,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IAErC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7D,KAAK,CAAC,MAAM,EAAE,CAAC;QAEf,IAAI,WAAW,GAAG,GAAS,EAAE,GAAE,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO,EAAE,GAAG,EAAE;gBACZ,WAAW,EAAE,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;YACD,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEpB,MAAM,OAAO,GAAG,CAAC,KAAkB,EAAQ,EAAE;YAC3C,IAAI,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACzH,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3D,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAChD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,wEAAwE;gBACxE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,EAAE;oBAC1C,IAAI,EAAE,WAAW,CAAC,cAAc;oBAChC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAK/C,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuBzD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,WAAgB,GAAG,IAAI,CAwDzG"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAK/C,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuBzD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,WAAgB,GAAG,IAAI,CAyDzG"}