@weave-kit/engine 1.1.0 → 1.3.0

package/dist/core/provider/capabilities/types.js

@@ -0,0 +1,3 @@
+/** contract version for `CapabilitiesProvider` implementers (stable seam) */
+export const CAPABILITIES_API = 1;
+//# sourceMappingURL=types.js.map

package/dist/core/provider/capabilities/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/provider/capabilities/types.ts"],"names":[],"mappings":"AAqBA,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC"}

package/dist/core/provider/identity/directory.d.ts

@@ -6,6 +6,9 @@ export interface IdentityUserRow {
     id: string;
     externalSource: string | null;
     externalId: string | null;
+    name?: string | null;
+    email?: string | null;
+    mobile?: string | null;
     roles: string[];
     departmentId: string | null;
     directorId: string | null;
@@ -16,6 +19,8 @@ export interface IdentityDepartmentRow {
     id: string;
     externalSource: string | null;
     externalId: string | null;
+    name?: string | null;
+    code?: string | null;
     parentId: string | null;
     managerId: string | null;
     enabled: boolean | null;
@@ -52,6 +57,14 @@ export interface IdentityUserCreate {
     directorId?: string | null;
     enabled?: boolean | null;
 }
+/** greenfield department creation (an engine-owned department with no external source) */
+export interface IdentityDepartmentCreate {
+    name?: string | null;
+    code?: string | null;
+    parentId?: string | null;
+    managerId?: string | null;
+    enabled?: boolean | null;
+}
 /**
  * Replaceable persistence for the local identity directory (default: PG over
  * `weavekit_user`/`weavekit_department`). The engine-only `external_source` +
@@ -82,6 +95,16 @@ export interface IdentityStore {
     }>;
     /** list local users (admin surface) */
     listUsers(): Promise<IdentityUserRow[]>;
+    /** set a user's roles (greenfield/external alike); false when the id is unknown */
+    updateUserRoles(id: string, roles: string[]): Promise<boolean>;
+    /** delete a user; false when the id is unknown */
+    deleteUser(id: string): Promise<boolean>;
+    /** create an engine-owned (greenfield) department with no external source */
+    createDepartment(input: IdentityDepartmentCreate): Promise<{
+        id: string;
+    }>;
+    /** list local departments (admin surface) */
+    listDepartments(): Promise<IdentityDepartmentRow[]>;
     setEnabled(kind: 'user' | 'department', id: string, enabled: boolean): Promise<void>;
     getCursor(source: string): Promise<string | null>;
     setCursor(source: string, cursor: string): Promise<void>;

package/dist/core/provider/identity/directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directory.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/identity/directory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB;AAED,sEAAsE;AACtE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1B;AAED,oCAAoC;AACpC,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACvD,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACxF,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACpG,oFAAoF;IACpF,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACrF,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E,uEAAuE;IACvE,UAAU,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,uCAAuC;IACvC,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAClD,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CACzF"}
+{"version":3,"file":"directory.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/identity/directory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB;AAED,sEAAsE;AACtE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1B;AAED,oCAAoC;AACpC,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1B;AAED,0FAA0F;AAC1F,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACvD,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACxF,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACpG,oFAAoF;IACpF,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACrF,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E,uEAAuE;IACvE,UAAU,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,uCAAuC;IACvC,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,mFAAmF;IACnF,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,kDAAkD;IAClD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,6EAA6E;IAC7E,gBAAgB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E,6CAA6C;IAC7C,eAAe,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACpD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAClD,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CACzF"}

package/dist/core/provider/identity/index.d.ts

@@ -1,6 +1,6 @@
 export type { IdentitySubject, VerifiedIdentity, IdentityUser, IdentityDepartment, IdentityPullResult, IdentityResolver, } from './types.js';
 export type { IdentitySource } from './source.js';
 export { IDENTITY_SOURCE_API } from './source.js';
-export type { IdentityStore, IdentityDirectory, IdentityUserRow, IdentityDepartmentRow, IdentityUserInput, IdentityDepartmentInput, IdentityUserCreate, } from './directory.js';
+export type { IdentityStore, IdentityDirectory, IdentityUserRow, IdentityDepartmentRow, IdentityUserInput, IdentityDepartmentInput, IdentityUserCreate, IdentityDepartmentCreate, } from './directory.js';
 export { IDENTITY_STORE_API } from './directory.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/provider/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/identity/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/identity/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/core/provider/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/provider/identity/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAUlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/provider/identity/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAWlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/core/provider/identity/types.d.ts

@@ -19,6 +19,12 @@ export interface IdentitySubject {
     departmentId?: string;
     /** tenant the subject belongs to (multi-tenancy; absent = single-tenant) */
     tenantId?: string;
+    /**
+     * generic row-scope value (the canonical name; `scopeId ?? tenantId`). Scopes
+     * objects declaring a `scope`/`tenant` field to this value (RBAC row scope +
+     * RLS + audit).
+     */
+    scopeId?: string;
 }
 /** an authenticated but not-yet-resolved identity (a verifier's output) */
 export interface VerifiedIdentity {

package/dist/core/provider/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yDAAyD;IACzD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yCAAyC;IACzC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yDAAyD;IACzD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yCAAyC;IACzC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC"}

package/dist/core/provider/index.d.ts

@@ -1,4 +1,5 @@
 export * from './alerts/index.js';
 export * from './identity/index.js';
 export * from './event/index.js';
+export * from './capabilities/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/provider/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/provider/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/provider/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC"}

package/dist/core/provider/index.js

@@ -1,4 +1,5 @@
 export * from './alerts/index.js';
 export * from './identity/index.js';
 export * from './event/index.js';
+export * from './capabilities/index.js';
 //# sourceMappingURL=index.js.map

package/dist/core/provider/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/provider/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/provider/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC"}

package/dist/core/rbac/index.d.ts

@@ -5,6 +5,7 @@ export { resolvePermission } from './resolve.js';
 export { canCreate, canDelete, canUpdate, canUpdateField, allowedUpdateFields, assertCanCreate, assertCanUpdate, assertCanDelete, assertCanUpdateField, } from './authorize.js';
 export { buildRowScope } from './rowScope.js';
 export { resolvePermissionFor, buildRowScopeFor, type ObjectLookup } from './details.js';
+export { scopeFieldName, scopeMarkerOf } from './scopeMarker.js';
 export { excludedFields } from './fields.js';
 export { buildRlsPolicy, buildRlsPolicyDdl, buildRlsGrantDdl, policyName, isSafeRlsRole } from './rls.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/rbac/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}

package/dist/core/rbac/index.js

@@ -2,6 +2,7 @@ export { resolvePermission } from './resolve.js';
 export { canCreate, canDelete, canUpdate, canUpdateField, allowedUpdateFields, assertCanCreate, assertCanUpdate, assertCanDelete, assertCanUpdateField, } from './authorize.js';
 export { buildRowScope } from './rowScope.js';
 export { resolvePermissionFor, buildRowScopeFor } from './details.js';
+export { scopeFieldName, scopeMarkerOf } from './scopeMarker.js';
 export { excludedFields } from './fields.js';
 export { buildRlsPolicy, buildRlsPolicyDdl, buildRlsGrantDdl, policyName, isSafeRlsRole } from './rls.js';
 //# sourceMappingURL=index.js.map

package/dist/core/rbac/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/rbac/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAqB,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/rbac/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAqB,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}

package/dist/core/rbac/rls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rls.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/rls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAiC1D,wBAAgB,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAExD;AAUD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAMxE;AA4BD,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAQjE;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5E;AAkCD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnD"}
+{"version":3,"file":"rls.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/rls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAkC1D,wBAAgB,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAExD;AAUD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAWxE;AA4BD,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAQjE;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5E;AAkCD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnD"}

package/dist/core/rbac/rls.js

@@ -1,5 +1,6 @@
 import { READ_SCOPES, ROW_SCOPE_MARKERS } from '../types/index.js';
 import { sqlIdent } from '../storage/sql-literals.js';
+import { scopeFieldName, scopeMarkerOf } from './scopeMarker.js';
 const q = (id) => `"${id}"`;
 /**
  * Row-level security policy generation for the script sandbox's restricted SQL
@@ -44,10 +45,15 @@ export function buildRlsPolicy(def) {
     const base = baseRlsPolicy(def);
     if (base === undefined)
         return undefined;
-    const tenant = markerField(def, ROW_SCOPE_MARKERS.TENANT);
-    if (tenant === undefined)
+    const marker = scopeMarkerOf(def);
+    if (marker === undefined)
         return base;
-    return `(${base}) AND current_setting('weavekit.tenant_id', true) = ${q(tenant)}`;
+    const field = scopeFieldName(def);
+    // the row-scope key is carried by a session GUC: `scope` marker → the generic
+    // `weavekit.scope_id`; the `tenant` alias keeps `weavekit.tenant_id`. The
+    // executor sets both from the resolved scope value, so either name works.
+    const guc = marker === 'scope' ? 'weavekit.scope_id' : 'weavekit.tenant_id';
+    return `(${base}) AND current_setting('${guc}', true) = ${q(field)}`;
 }
 function baseRlsPolicy(def) {
     if (def.permissions === undefined) {

package/dist/core/rbac/rls.js.map

@@ -1 +1 @@
-{"version":3,"file":"rls.js","sourceRoot":"","sources":["../../../src/core/rbac/rls.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAEtD,MAAM,CAAC,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,MAAM,UAAU,UAAU,CAAC,GAAqB;IAC9C,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,yEAAyE,CAAC;AAC/G,CAAC;AAED,SAAS,WAAW,CAAC,GAAqB,EAAE,MAAsB;IAChE,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAwC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAqB;IAClD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,IAAI,IAAI,uDAAuD,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,SAAS,aAAa,CAAC,GAAqB;IAC1C,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClC,kFAAkF;QAClF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,UAAU,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AAC1E,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,GAAqB;IACrD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAa,CAAC,yBAAyB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,MAAM,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,GAAqB,EAAE,IAAY;IAClE,OAAO,mBAAmB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;AAChE,CAAC;AAED,+DAA+D;AAC/D,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAS;IACjE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY;IAC7E,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS;IACrE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO;IACtE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB;IACnE,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY;IAC5E,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK;IAC1E,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO;IACxE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM;IACvE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB;IAC5E,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;IAC1E,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW;IAC5E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO;IAC1E,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM;IAC1E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM;CAClE,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAS;IACxD,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB;IAC3E,gBAAgB,EAAE,MAAM,EAAE,OAAO;CAClC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACjG,CAAC"}
+{"version":3,"file":"rls.js","sourceRoot":"","sources":["../../../src/core/rbac/rls.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjE,MAAM,CAAC,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,MAAM,UAAU,UAAU,CAAC,GAAqB;IAC9C,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,yEAAyE,CAAC;AAC/G,CAAC;AAED,SAAS,WAAW,CAAC,GAAqB,EAAE,MAAsB;IAChE,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAwC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAqB;IAClD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAE,CAAC;IACnC,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,GAAG,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAC5E,OAAO,IAAI,IAAI,0BAA0B,GAAG,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,aAAa,CAAC,GAAqB;IAC1C,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClC,kFAAkF;QAClF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,UAAU,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AAC1E,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,GAAqB;IACrD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAa,CAAC,yBAAyB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,MAAM,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,GAAqB,EAAE,IAAY;IAClE,OAAO,mBAAmB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;AAChE,CAAC;AAED,+DAA+D;AAC/D,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAS;IACjE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY;IAC7E,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS;IACrE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO;IACtE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB;IACnE,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY;IAC5E,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK;IAC1E,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO;IACxE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM;IACvE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB;IAC5E,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;IAC1E,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW;IAC5E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO;IAC1E,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM;IAC1E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM;CAClE,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAS;IACxD,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB;IAC3E,gBAAgB,EAAE,MAAM,EAAE,OAAO;CAClC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACjG,CAAC"}

package/dist/core/rbac/rowScope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rowScope.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/rowScope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAA+B,MAAM,mBAAmB,CAAC;AAElG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAsED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,GACb,gBAAgB,GAAG,SAAS,CAY9B"}
+{"version":3,"file":"rowScope.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/rowScope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAA+B,MAAM,mBAAmB,CAAC;AAElG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGrE,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAsED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,GACb,gBAAgB,GAAG,SAAS,CAe9B"}

package/dist/core/rbac/rowScope.js

@@ -1,5 +1,6 @@
 import { READ_SCOPES, ROW_SCOPE_MARKERS, SCOPE_SOURCES } from '../types/index.js';
 import { SchemaError } from '../types/errors.js';
+import { scopeFieldName } from './scopeMarker.js';
 const q = (name) => `"${name}"`;
 /** qualify a column when a table alias is in play (`p."owner_id"`), else bare */
 const col = (alias, name) => alias === undefined ? q(name) : `${alias}.${q(name)}`;
@@ -70,18 +71,21 @@ function departmentByOwnerFragment(ownership, alias) {
  */
 export function buildRowScope(def, scope, subject, roles, locale, alias) {
     const base = baseRowScope(def, scope, subject, roles, locale, alias);
-    // tenant boundary applies on top of RBAC (even for `all`); a tenant-less
-    // subject or an object without a tenant column leaves the scope unchanged
-    const tenantField = markerField(def, ROW_SCOPE_MARKERS.TENANT);
-    if (tenantField === undefined || subject.tenantId === undefined)
+    // scope boundary applies on top of RBAC (even for `all`); a scope-less
+    // subject or an object without a scope column leaves the scope unchanged.
+    // The row-scope key is the generic `scope` marker (the `tenant` alias still
+    // works), valued by `subject.scopeId ?? subject.tenantId`.
+    const scopeField = scopeFieldName(def);
+    const scopeValue = subject.scopeId ?? subject.tenantId;
+    if (scopeField === undefined || scopeValue === undefined)
         return base;
-    const tenantFragment = {
-        sql: `${col(alias, tenantField.name)} = $${base === undefined ? 1 : 2}`,
-        params: [subject.tenantId],
+    const scopeFragment = {
+        sql: `${col(alias, scopeField)} = $${base === undefined ? 1 : 2}`,
+        params: [scopeValue],
     };
     if (base === undefined)
-        return tenantFragment;
-    return { sql: `${base.sql} AND ${tenantFragment.sql}`, params: [...base.params, ...tenantFragment.params] };
+        return scopeFragment;
+    return { sql: `${base.sql} AND ${scopeFragment.sql}`, params: [...base.params, ...scopeFragment.params] };
 }
 function baseRowScope(def, scope, subject, roles, locale, alias) {
     if (scope === undefined || scope === READ_SCOPES.ALL)

package/dist/core/rbac/rowScope.js.map

@@ -1 +1 @@
-{"version":3,"file":"rowScope.js","sourceRoot":"","sources":["../../../src/core/rbac/rowScope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAQjD,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;AAExC,iFAAiF;AACjF,MAAM,GAAG,GAAG,CAAC,KAAyB,EAAE,IAAY,EAAU,EAAE,CAC9D,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAQxD,SAAS,WAAW,CAAC,GAAqB,EAAE,MAAsB;IAChE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAwC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACjG,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,GAAG,GAAG,KAA2C,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC;IACtC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,MAAM,KAAK,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ;KAC5F,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,oBAAoB;IAC3B,OAAO;;;;wBAIe,CAAC;AACzB,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,SAAqB,EAAE,KAAc;IACxD,IAAI,SAAS,CAAC,MAAM,KAAK,aAAa,CAAC,QAAQ,EAAE,CAAC;QAChD,0EAA0E;QAC1E,OAAO;YACL,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,iEAAiE;YACnG,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,qEAAqE;AACrE,SAAS,wBAAwB,CAAC,IAAgB,EAAE,KAAc;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC3C,OAAO;YACL,GAAG,EAAE,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC;aACvB,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,sEAAsE,oBAAoB,EAAE,IAAI;YAC5H,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,oBAAoB,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACzH,CAAC;AAED,2FAA2F;AAC3F,SAAS,yBAAyB,CAAC,SAAqB,EAAE,KAAc;IACtE,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,KAAK,aAAa,CAAC,QAAQ;QAC3D,CAAC,CAAC,mBAAmB,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE;QACjD,CAAC,CAAC,gBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IACjD,OAAO;QACL,GAAG,EAAE,+CAA+C,SAAS;oEACG,oBAAoB,EAAE,IAAI;QAC1F,MAAM,EAAE,EAAE;KACX,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAqB,EACrB,KAA4B,EAC5B,OAAwB,EACxB,KAAwB,EACxB,MAAe,EACf,KAAc;IAEd,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACrE,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,cAAc,GAAqB;QACvC,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACvE,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;KAC3B,CAAC;IACF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC;IAC9C,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,cAAc,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED,SAAS,YAAY,CACnB,GAAqB,EACrB,KAA4B,EAC5B,OAAwB,EACxB,KAAwB,EACxB,MAAe,EACf,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACvE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE7B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAEhE,IAAI,KAAK,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,WAAW,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,KAAK,KAAK,WAAW,CAAC,UAAU,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,WAAW,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC7D,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"rowScope.js","sourceRoot":"","sources":["../../../src/core/rbac/rowScope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAOlD,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;AAExC,iFAAiF;AACjF,MAAM,GAAG,GAAG,CAAC,KAAyB,EAAE,IAAY,EAAU,EAAE,CAC9D,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAQxD,SAAS,WAAW,CAAC,GAAqB,EAAE,MAAsB;IAChE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAwC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACjG,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,GAAG,GAAG,KAA2C,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC;IACtC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,MAAM,KAAK,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ;KAC5F,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,oBAAoB;IAC3B,OAAO;;;;wBAIe,CAAC;AACzB,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,SAAqB,EAAE,KAAc;IACxD,IAAI,SAAS,CAAC,MAAM,KAAK,aAAa,CAAC,QAAQ,EAAE,CAAC;QAChD,0EAA0E;QAC1E,OAAO;YACL,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,iEAAiE;YACnG,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,qEAAqE;AACrE,SAAS,wBAAwB,CAAC,IAAgB,EAAE,KAAc;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC3C,OAAO;YACL,GAAG,EAAE,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC;aACvB,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,sEAAsE,oBAAoB,EAAE,IAAI;YAC5H,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,oBAAoB,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACzH,CAAC;AAED,2FAA2F;AAC3F,SAAS,yBAAyB,CAAC,SAAqB,EAAE,KAAc;IACtE,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,KAAK,aAAa,CAAC,QAAQ;QAC3D,CAAC,CAAC,mBAAmB,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE;QACjD,CAAC,CAAC,gBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IACjD,OAAO;QACL,GAAG,EAAE,+CAA+C,SAAS;oEACG,oBAAoB,EAAE,IAAI;QAC1F,MAAM,EAAE,EAAE;KACX,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAqB,EACrB,KAA4B,EAC5B,OAAwB,EACxB,KAAwB,EACxB,MAAe,EACf,KAAc;IAEd,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACrE,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,aAAa,GAAqB;QACtC,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACjE,MAAM,EAAE,CAAC,UAAU,CAAC;KACrB,CAAC;IACF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IAC7C,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,aAAa,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;AAC5G,CAAC;AAED,SAAS,YAAY,CACnB,GAAqB,EACrB,KAA4B,EAC5B,OAAwB,EACxB,KAAwB,EACxB,MAAe,EACf,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACvE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE7B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAEhE,IAAI,KAAK,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,WAAW,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,KAAK,KAAK,WAAW,CAAC,UAAU,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,WAAW,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC7D,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/core/rbac/scopeMarker.d.ts

@@ -0,0 +1,10 @@
+import type { ObjectDefinition } from '../types/index.js';
+/**
+ * The object's row-scope field name, from the generic `scope` marker OR the
+ * retained `tenant` alias (they are the same mechanism). `undefined` = the
+ * object is not row-scoped.
+ */
+export declare function scopeFieldName(def: ObjectDefinition): string | undefined;
+/** which marker an object uses for its row-scope column (for RLS GUC selection) */
+export declare function scopeMarkerOf(def: ObjectDefinition): 'scope' | 'tenant' | undefined;
+//# sourceMappingURL=scopeMarker.d.ts.map

package/dist/core/rbac/scopeMarker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopeMarker.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/scopeMarker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAMxE;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAQnF"}

package/dist/core/rbac/scopeMarker.js

@@ -0,0 +1,25 @@
+import { ROW_SCOPE_MARKERS } from '../types/index.js';
+/**
+ * The object's row-scope field name, from the generic `scope` marker OR the
+ * retained `tenant` alias (they are the same mechanism). `undefined` = the
+ * object is not row-scoped.
+ */
+export function scopeFieldName(def) {
+    const field = def.fields.find((f) => {
+        const raw = f;
+        return raw[ROW_SCOPE_MARKERS.SCOPE] === true || raw[ROW_SCOPE_MARKERS.TENANT] === true;
+    });
+    return field?.name;
+}
+/** which marker an object uses for its row-scope column (for RLS GUC selection) */
+export function scopeMarkerOf(def) {
+    const field = def.fields.find((f) => {
+        const raw = f;
+        return raw[ROW_SCOPE_MARKERS.SCOPE] === true || raw[ROW_SCOPE_MARKERS.TENANT] === true;
+    });
+    if (field === undefined)
+        return undefined;
+    const raw = field;
+    return raw[ROW_SCOPE_MARKERS.SCOPE] === true ? 'scope' : 'tenant';
+}
+//# sourceMappingURL=scopeMarker.js.map

package/dist/core/rbac/scopeMarker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopeMarker.js","sourceRoot":"","sources":["../../../src/core/rbac/scopeMarker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAqB;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,CAAuC,CAAC;QACpD,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IACzF,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,EAAE,IAAI,CAAC;AACrB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,GAAqB;IACjD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,CAAuC,CAAC;QACpD,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IACzF,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,GAAG,GAAG,KAA2C,CAAC;IACxD,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpE,CAAC"}

package/dist/core/script/types.d.ts

@@ -30,6 +30,8 @@ export interface ScriptUser {
     departmentId?: string;
     /** tenant of the subject (multi-tenancy) */
     tenantId?: string;
+    /** generic row-scope of the subject (canonical; `scopeId ?? tenantId`) */
+    scopeId?: string;
 }
 /** filter/sort shapes are structurally compatible with the data-access layer */
 export interface ScriptSort {

package/dist/core/script/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/script/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,YAAY;;;;;;;;;;;;CAYf,CAAC;AACX,MAAM,MAAM,UAAU,GAAG,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAExE,gDAAgD;AAChD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,KAAK,GAAG,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC3D,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mEAAmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAED,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAAC;IAChD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE;QAAE,IAAI,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC;YAAE,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC/E,KAAK,EAAE;QAAE,IAAI,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAC7D,OAAO,EAAE;QAAE,IAAI,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;CACrE;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;IAC3C,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,QAAQ,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,4DAA4D;IAC5D,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,kEAAkE;IAClE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IACnD,QAAQ,CACN,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,EAAE,gBAIpC,CAAC;AAEF,+CAA+C;AAC/C,MAAM,WAAW,yBAAyB;IACxC,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/script/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,YAAY;;;;;;;;;;;;CAYf,CAAC;AACX,MAAM,MAAM,UAAU,GAAG,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAExE,gDAAgD;AAChD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gFAAgF;AAChF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,KAAK,GAAG,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC3D,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mEAAmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAED,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAAC;IAChD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE;QAAE,IAAI,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC;YAAE,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC/E,KAAK,EAAE;QAAE,IAAI,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAC7D,OAAO,EAAE;QAAE,IAAI,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;CACrE;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;IAC3C,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,QAAQ,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,4DAA4D;IAC5D,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,kEAAkE;IAClE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IACnD,QAAQ,CACN,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,EAAE,gBAIpC,CAAC;AAEF,+CAA+C;AAC/C,MAAM,WAAW,yBAAyB;IACxC,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B"}

package/dist/core/script/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/script/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,cAAc;IAC7B,YAAY,EAAE,aAAa;IAC3B,aAAa,EAAE,cAAc;IAC7B,YAAY,EAAE,aAAa;IAC3B,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,QAAQ,EAAE,SAAS;IACnB,OAAO,EAAE,QAAQ;IACjB,UAAU,EAAE,WAAW;CACf,CAAC;AAsIX,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAqB;IACtD,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;IAChB,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACxC,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;CACtB,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/script/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,cAAc;IAC7B,YAAY,EAAE,aAAa;IAC3B,aAAa,EAAE,cAAc;IAC7B,YAAY,EAAE,aAAa;IAC3B,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,QAAQ,EAAE,SAAS;IACnB,OAAO,EAAE,QAAQ;IACjB,UAAU,EAAE,WAAW;CACf,CAAC;AAwIX,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAqB;IACtD,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;IAChB,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACxC,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;CACtB,CAAC"}

package/dist/core/tools/values.d.ts

@@ -27,6 +27,17 @@ export declare const WORKFLOW_TOOLS: {
     readonly TRANSITION: "workflow_transition";
 };
 export type WorkflowTool = typeof WORKFLOW_TOOLS[keyof typeof WORKFLOW_TOOLS];
+/**
+ * fixed approval-queue tool names. Exposed only to admin subjects when an
+ * approval queue is wired (the queue carries request arguments — a write
+ * authority boundary, mirrors the REST `/approvals` admin gate).
+ */
+export declare const APPROVAL_TOOLS: {
+    readonly LIST: "list_approvals";
+    readonly APPROVE: "approve_approval";
+    readonly REJECT: "reject_approval";
+};
+export type ApprovalTool = typeof APPROVAL_TOOLS[keyof typeof APPROVAL_TOOLS];
 /** custom tool `name` format (snake_case, lowercase start) */
 export declare const TOOL_NAME_PATTERN = "^[a-z][a-z0-9_]*$";
 /** audit namespace prefix custom tools must not use (action = `<prefix>.<detail>`) */

package/dist/core/tools/values.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../../src/core/tools/values.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;CAMjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAE9E,yCAAyC;AACzC,eAAO,MAAM,mBAAmB;;;CAGtB,CAAC;AAEX,wFAAwF;AACxF,eAAO,MAAM,cAAc;;CAEjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAE9E,8DAA8D;AAC9D,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAE9C,oFAAoF;AACpF,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAQtF,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD"}
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../../src/core/tools/values.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;CAMjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAE9E,yCAAyC;AACzC,eAAO,MAAM,mBAAmB;;;CAGtB,CAAC;AAEX,wFAAwF;AACxF,eAAO,MAAM,cAAc;;CAEjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAE9E,8DAA8D;AAC9D,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAE9C,oFAAoF;AACpF,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAStF,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/dist/core/tools/values.js

@@ -25,6 +25,16 @@ export const INTROSPECTION_TOOLS = {
 export const WORKFLOW_TOOLS = {
     TRANSITION: 'workflow_transition',
 };
+/**
+ * fixed approval-queue tool names. Exposed only to admin subjects when an
+ * approval queue is wired (the queue carries request arguments — a write
+ * authority boundary, mirrors the REST `/approvals` admin gate).
+ */
+export const APPROVAL_TOOLS = {
+    LIST: 'list_approvals',
+    APPROVE: 'approve_approval',
+    REJECT: 'reject_approval',
+};
 /** custom tool `name` format (snake_case, lowercase start) */
 export const TOOL_NAME_PATTERN = '^[a-z][a-z0-9_]*$';
 /** audit namespace prefix custom tools must not use (action = `<prefix>.<detail>`) */
@@ -39,6 +49,7 @@ const reservedNames = [
     ...Object.values(REGISTRY_TOOLS),
     ...Object.values(INTROSPECTION_TOOLS),
     ...Object.values(WORKFLOW_TOOLS),
+    ...Object.values(APPROVAL_TOOLS),
 ];
 /** true when a custom tool name collides with a built-in tool or the audit namespace */
 export function isReservedToolName(name) {

package/dist/core/tools/values.js.map

@@ -1 +1 @@
-{"version":3,"file":"values.js","sourceRoot":"","sources":["../../../src/core/tools/values.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM,EAAE,gBAAgB;IACxB,GAAG,EAAE,YAAY;IACjB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,eAAe;CACf,CAAC;AAGX,yCAAyC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAEX,wFAAwF;AACxF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU,EAAE,qBAAqB;CACzB,CAAC;AAGX,8DAA8D;AAC9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAGX,MAAM,aAAa,GAAsB;IACvC,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAChC,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACrC,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;CACjC,CAAC;AAEF,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;AAClF,CAAC"}
+{"version":3,"file":"values.js","sourceRoot":"","sources":["../../../src/core/tools/values.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM,EAAE,gBAAgB;IACxB,GAAG,EAAE,YAAY;IACjB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,eAAe;CACf,CAAC;AAGX,yCAAyC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAEX,wFAAwF;AACxF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU,EAAE,qBAAqB;CACzB,CAAC;AAGX;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,iBAAiB;CACjB,CAAC;AAGX,8DAA8D;AAC9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAGX,MAAM,aAAa,GAAsB;IACvC,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAChC,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACrC,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAChC,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;CACjC,CAAC;AAEF,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;AAClF,CAAC"}

package/dist/core/types/fields.d.ts

@@ -47,6 +47,8 @@ export interface StringField extends FieldBase {
     departmentSource?: ScopeSource;
     /** tenant marker: every read/write is implicitly scoped to the subject's tenant (at most one per object) */
     tenant?: boolean;
+    /** generic row-scope marker (canonical name; alias of `tenant`); at most one of `scope`/`tenant` per object */
+    scope?: boolean;
 }
 export interface TextField extends FieldBase {
     type: typeof FIELD_TYPES.TEXT;

package/dist/core/types/fields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../../../src/core/types/fields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,WAAW,EACX,aAAa,EACd,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE9F,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qFAAqF;IACrF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,WAAW,CAAC,MAAM,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,sFAAsF;IACtF,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B,wFAAwF;IACxF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,4GAA4G;IAC5G,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,IAAI,EAAE,OAAO,WAAW,CAAC,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,WAAW,CAAC,MAAM,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,uDAAuD;AACvD,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,IAAI,EAAE,OAAO,WAAW,CAAC,QAAQ,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,WAAW,CAAC,MAAM,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,WAAW,CAAC,MAAM,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,IAAI,EAAE,OAAO,WAAW,CAAC,QAAQ,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,IAAI,EAAE,OAAO,WAAW,CAAC,OAAO,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+FAA+F;AAC/F,UAAU,iBAAkB,SAAQ,SAAS;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAU,SAAQ,iBAAiB;IAClD,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,SAAU,SAAQ,iBAAiB;IAClD,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,WAAY,SAAQ,iBAAiB;IACpD,IAAI,EAAE,OAAO,WAAW,CAAC,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,IAAI,EAAE,OAAO,WAAW,CAAC,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,IAAI,EAAE,OAAO,WAAW,CAAC,WAAW,CAAC;CACtC;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,IAAI,EAAE,OAAO,WAAW,CAAC,QAAQ,CAAC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,4EAA4E;AAC5E,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC3C,IAAI,EAAE,OAAO,WAAW,CAAC,KAAK,CAAC;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEnF,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,8EAA8E;IAC9E,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,IAAI,EAAE,OAAO,WAAW,CAAC,QAAQ,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,IAAI,EAAE,OAAO,WAAW,CAAC,OAAO,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACnD,IAAI,EAAE,OAAO,WAAW,CAAC,cAAc,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC3C,IAAI,EAAE,OAAO,WAAW,CAAC,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,IAAI,EAAE,OAAO,WAAW,CAAC,UAAU,CAAC;CACrC;AAED,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,IAAI,EAAE,OAAO,WAAW,CAAC,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,UAAW,SAAQ,aAAa;IAC/C,IAAI,EAAE,OAAO,WAAW,CAAC,KAAK,CAAC;CAChC;AAED,MAAM,WAAW,UAAW,SAAQ,aAAa;IAC/C,IAAI,EAAE,OAAO,WAAW,CAAC,KAAK,CAAC;CAChC;AAED,4EAA4E;AAC5E,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC3C,IAAI,EAAE,OAAO,WAAW,CAAC,KAAK,CAAC;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC7B;AAED,0FAA0F;AAC1F,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,yGAAyG;AACzG,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,IAAI,EAAE,OAAO,WAAW,CAAC,UAAU,CAAC;IACpC,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,2FAA2F;AAC3F,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,SAAS,GACT,SAAS,GACT,aAAa,GACb,YAAY,GACZ,WAAW,GACX,WAAW,GACX,SAAS,GACT,WAAW,GACX,aAAa,GACb,YAAY,GACZ,SAAS,GACT,SAAS,GACT,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,SAAS,GACT,SAAS,GACT,UAAU,GACV,SAAS,GACT,aAAa,GACb,YAAY,GACZ,kBAAkB,GAClB,UAAU,GACV,cAAc,GACd,aAAa,GACb,UAAU,GACV,UAAU,GACV,UAAU,GACV,SAAS,GACT,eAAe,CAAC"}
+{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../../../src/core/types/fields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,WAAW,EACX,aAAa,EACd,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE9F,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qFAAqF;IACrF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,WAAW,CAAC,MAAM,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,sFAAsF;IACtF,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B,wFAAwF;IACxF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,4GAA4G;IAC5G,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+GAA+G;IAC/G,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,IAAI,EAAE,OAAO,WAAW,CAAC,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,WAAW,CAAC,MAAM,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,uDAAuD;AACvD,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,IAAI,EAAE,OAAO,WAAW,CAAC,QAAQ,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,WAAW,CAAC,MAAM,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,IAAI,EAAE,OAAO,WAAW,CAAC,MAAM,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,IAAI,EAAE,OAAO,WAAW,CAAC,QAAQ,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,IAAI,EAAE,OAAO,WAAW,CAAC,OAAO,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+FAA+F;AAC/F,UAAU,iBAAkB,SAAQ,SAAS;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAU,SAAQ,iBAAiB;IAClD,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,SAAU,SAAQ,iBAAiB;IAClD,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,WAAY,SAAQ,iBAAiB;IACpD,IAAI,EAAE,OAAO,WAAW,CAAC,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,IAAI,EAAE,OAAO,WAAW,CAAC,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,IAAI,EAAE,OAAO,WAAW,CAAC,WAAW,CAAC;CACtC;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,IAAI,EAAE,OAAO,WAAW,CAAC,QAAQ,CAAC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,4EAA4E;AAC5E,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC3C,IAAI,EAAE,OAAO,WAAW,CAAC,KAAK,CAAC;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEnF,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,8EAA8E;IAC9E,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,IAAI,EAAE,OAAO,WAAW,CAAC,QAAQ,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,IAAI,EAAE,OAAO,WAAW,CAAC,OAAO,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACnD,IAAI,EAAE,OAAO,WAAW,CAAC,cAAc,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC3C,IAAI,EAAE,OAAO,WAAW,CAAC,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,IAAI,EAAE,OAAO,WAAW,CAAC,UAAU,CAAC;CACrC;AAED,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,IAAI,EAAE,OAAO,WAAW,CAAC,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,UAAW,SAAQ,aAAa;IAC/C,IAAI,EAAE,OAAO,WAAW,CAAC,KAAK,CAAC;CAChC;AAED,MAAM,WAAW,UAAW,SAAQ,aAAa;IAC/C,IAAI,EAAE,OAAO,WAAW,CAAC,KAAK,CAAC;CAChC;AAED,4EAA4E;AAC5E,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC3C,IAAI,EAAE,OAAO,WAAW,CAAC,KAAK,CAAC;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC7B;AAED,0FAA0F;AAC1F,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAC9B,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,yGAAyG;AACzG,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,IAAI,EAAE,OAAO,WAAW,CAAC,UAAU,CAAC;IACpC,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,2FAA2F;AAC3F,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,SAAS,GACT,SAAS,GACT,aAAa,GACb,YAAY,GACZ,WAAW,GACX,WAAW,GACX,SAAS,GACT,WAAW,GACX,aAAa,GACb,YAAY,GACZ,SAAS,GACT,SAAS,GACT,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,SAAS,GACT,SAAS,GACT,UAAU,GACV,SAAS,GACT,aAAa,GACb,YAAY,GACZ,kBAAkB,GAClB,UAAU,GACV,cAAc,GACd,aAAa,GACb,UAAU,GACV,UAAU,GACV,UAAU,GACV,SAAS,GACT,eAAe,CAAC"}

package/dist/core/types/principal.d.ts

@@ -19,6 +19,7 @@ export type AccessPrincipal = {
     capability: SystemCapability;
     reason?: string;
     tenantId?: string;
+    scopeId?: string;
 };
 /** build a user principal */
 export declare function userPrincipal(subject: IdentitySubject): AccessPrincipal;
@@ -28,6 +29,8 @@ export declare function systemPrincipal(capability: SystemCapability, reason?: s
 export declare function principalSubject(principal: AccessPrincipal): IdentitySubject | undefined;
 /** the tenant a principal acts within (user subject's tenant, or a system principal's) */
 export declare function principalTenantId(principal: AccessPrincipal): string | undefined;
+/** the row-scope a principal acts within (canonical; `scopeId ?? tenantId`) */
+export declare function principalScopeId(principal: AccessPrincipal): string | undefined;
 /** true for a system principal */
 export declare function isSystemPrincipal(principal: AccessPrincipal): principal is Extract<AccessPrincipal, {
     kind: 'system';

package/dist/core/types/principal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../../src/core/types/principal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;;;CAGtB,CAAC;AACX,MAAM,MAAM,gBAAgB,GAAG,OAAO,mBAAmB,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAE5F,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzF,6BAA6B;AAC7B,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,eAAe,CAEvE;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,UAAU,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe,CAOjH;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,eAAe,GAAG,eAAe,GAAG,SAAS,CAExF;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAEhF;AAED,kCAAkC;AAClC,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,eAAe,GACzB,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CAE3D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAEnE"}
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../../src/core/types/principal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;;;CAGtB,CAAC;AACX,MAAM,MAAM,gBAAgB,GAAG,OAAO,mBAAmB,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAE5F,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3G,6BAA6B;AAC7B,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,eAAe,CAEvE;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,UAAU,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe,CAOjH;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,eAAe,GAAG,eAAe,GAAG,SAAS,CAExF;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAEhF;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAI/E;AAED,kCAAkC;AAClC,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,eAAe,GACzB,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CAE3D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAEnE"}

package/dist/core/types/principal.js

@@ -30,6 +30,12 @@ export function principalSubject(principal) {
 export function principalTenantId(principal) {
     return principal.kind === 'user' ? principal.subject.tenantId : principal.tenantId;
 }
+/** the row-scope a principal acts within (canonical; `scopeId ?? tenantId`) */
+export function principalScopeId(principal) {
+    return principal.kind === 'user'
+        ? (principal.subject.scopeId ?? principal.subject.tenantId)
+        : (principal.scopeId ?? principal.tenantId);
+}
 /** true for a system principal */
 export function isSystemPrincipal(principal) {
     return principal.kind === 'system';

package/dist/core/types/principal.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../../src/core/types/principal.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAOX,6BAA6B;AAC7B,MAAM,UAAU,aAAa,CAAC,OAAwB;IACpD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAAC,UAA4B,EAAE,MAAe,EAAE,QAAiB;IAC9F,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,UAAU;QACV,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,SAA0B;IACzD,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,SAA0B;IAC1D,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;AACrF,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,iBAAiB,CAC/B,SAA0B;IAE1B,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAA0B;IACzD,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrE,CAAC"}
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../../src/core/types/principal.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAOX,6BAA6B;AAC7B,MAAM,UAAU,aAAa,CAAC,OAAwB;IACpD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAAC,UAA4B,EAAE,MAAe,EAAE,QAAiB;IAC9F,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,UAAU;QACV,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,SAA0B;IACzD,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,SAA0B;IAC1D,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;AACrF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,SAA0B;IACzD,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM;QAC9B,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3D,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,iBAAiB,CAC/B,SAA0B;IAE1B,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAA0B;IACzD,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrE,CAAC"}

package/dist/core/types/values.d.ts

@@ -116,12 +116,18 @@ export declare const READ_SCOPES: {
     readonly ALL: "all";
 };
 export type ReadScope = typeof READ_SCOPES[keyof typeof READ_SCOPES];
-/** field markers that declare row-level scope columns (ownership/department/tenant) */
+/** field markers that declare row-level scope columns (ownership/department/tenant/scope) */
 export declare const ROW_SCOPE_MARKERS: {
     readonly OWNERSHIP: "ownership";
     readonly DEPARTMENT: "department";
     /** tenant column: every read/write is implicitly scoped to the subject's tenant */
     readonly TENANT: "tenant";
+    /**
+     * generic row-scope column: same semantics as `tenant` (a single column scopes
+     * every read/write to the subject's scope value). `scope` is the canonical
+     * name; `tenant` is the retained alias. An object may declare at most one.
+     */
+    readonly SCOPE: "scope";
 };
 export type RowScopeMarker = typeof ROW_SCOPE_MARKERS[keyof typeof ROW_SCOPE_MARKERS];
 /**

package/dist/core/types/values.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../../src/core/types/values.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;CAoBjB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;CAc7B,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAGd,CAAC;AACX,8DAA8D;AAC9D,MAAM,MAAM,gBAAgB,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAC5E;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,gBAAgB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEzD,kFAAkF;AAClF,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,OAAO,qBAAqB,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAElG,kEAAkE;AAClE,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAEtF,2CAA2C;AAC3C,eAAO,MAAM,WAAW;;;;CAId,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAErE,uFAAuF;AACvF,eAAO,MAAM,iBAAiB;;;IAG5B,mFAAmF;;CAE3E,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAEtF;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,OAAO,aAAa,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE3E,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD,0BAA0B;AAC1B,eAAO,MAAM,WAAW;;;;CAId,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAErE,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB;;CAEnB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,OAAO,gBAAgB,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAEpF,sCAAsC;AACtC,eAAO,MAAM,eAAe;;;CAGlB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEjF,6DAA6D;AAC7D,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEjF,iEAAiE;AACjE,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;CAKf,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAEzE,0DAA0D;AAC1D,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../../src/core/types/values.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;CAoBjB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;CAc7B,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAGd,CAAC;AACX,8DAA8D;AAC9D,MAAM,MAAM,gBAAgB,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAC5E;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,gBAAgB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEzD,kFAAkF;AAClF,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,OAAO,qBAAqB,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAElG,kEAAkE;AAClE,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAEtF,2CAA2C;AAC3C,eAAO,MAAM,WAAW;;;;CAId,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAErE,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB;;;IAG5B,mFAAmF;;IAEnF;;;;OAIG;;CAEK,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAEtF;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,OAAO,aAAa,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE3E,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD,0BAA0B;AAC1B,eAAO,MAAM,WAAW;;;;CAId,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAErE,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB;;CAEnB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,OAAO,gBAAgB,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAEpF,sCAAsC;AACtC,eAAO,MAAM,eAAe;;;CAGlB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEjF,6DAA6D;AAC7D,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEjF,iEAAiE;AACjE,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;CAKf,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAEzE,0DAA0D;AAC1D,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC"}