@weave-kit/engine 1.4.0 → 1.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (154) hide show
  1. package/CHANGELOG.md +63 -0
  2. package/README.md +15 -8
  3. package/dist/adapters/graphql/resolvers.d.ts +3 -2
  4. package/dist/adapters/graphql/resolvers.d.ts.map +1 -1
  5. package/dist/adapters/graphql/resolvers.js +1 -0
  6. package/dist/adapters/graphql/resolvers.js.map +1 -1
  7. package/dist/adapters/graphql/schema.d.ts.map +1 -1
  8. package/dist/adapters/graphql/schema.js +11 -1
  9. package/dist/adapters/graphql/schema.js.map +1 -1
  10. package/dist/adapters/mcp/generate.d.ts +0 -1
  11. package/dist/adapters/mcp/generate.d.ts.map +1 -1
  12. package/dist/adapters/mcp/generate.js +2 -12
  13. package/dist/adapters/mcp/generate.js.map +1 -1
  14. package/dist/adapters/mcp/tools.d.ts.map +1 -1
  15. package/dist/adapters/mcp/tools.js +2 -0
  16. package/dist/adapters/mcp/tools.js.map +1 -1
  17. package/dist/adapters/openapi/document.d.ts.map +1 -1
  18. package/dist/adapters/openapi/document.js +4 -3
  19. package/dist/adapters/openapi/document.js.map +1 -1
  20. package/dist/adapters/rest/plugin.d.ts.map +1 -1
  21. package/dist/adapters/rest/plugin.js +8 -1
  22. package/dist/adapters/rest/plugin.js.map +1 -1
  23. package/dist/cli/commands/deploy.d.ts.map +1 -1
  24. package/dist/cli/commands/deploy.js +3 -0
  25. package/dist/cli/commands/deploy.js.map +1 -1
  26. package/dist/cli/commands/doctor.d.ts.map +1 -1
  27. package/dist/cli/commands/doctor.js +64 -1
  28. package/dist/cli/commands/doctor.js.map +1 -1
  29. package/dist/cli/commands/migrate.d.ts.map +1 -1
  30. package/dist/cli/commands/migrate.js +3 -0
  31. package/dist/cli/commands/migrate.js.map +1 -1
  32. package/dist/cli/project-types/manifest.d.ts +7 -0
  33. package/dist/cli/project-types/manifest.d.ts.map +1 -1
  34. package/dist/cli/project-types/manifest.js +4 -0
  35. package/dist/cli/project-types/manifest.js.map +1 -1
  36. package/dist/cli/scaffold.d.ts.map +1 -1
  37. package/dist/cli/scaffold.js +33 -7
  38. package/dist/cli/scaffold.js.map +1 -1
  39. package/dist/core/api/params.d.ts.map +1 -1
  40. package/dist/core/api/params.js +3 -0
  41. package/dist/core/api/params.js.map +1 -1
  42. package/dist/core/api/types.d.ts +4 -1
  43. package/dist/core/api/types.d.ts.map +1 -1
  44. package/dist/core/i18n/ar.d.ts.map +1 -1
  45. package/dist/core/i18n/ar.js +1 -0
  46. package/dist/core/i18n/ar.js.map +1 -1
  47. package/dist/core/i18n/de.d.ts.map +1 -1
  48. package/dist/core/i18n/de.js +1 -0
  49. package/dist/core/i18n/de.js.map +1 -1
  50. package/dist/core/i18n/en.d.ts +1 -0
  51. package/dist/core/i18n/en.d.ts.map +1 -1
  52. package/dist/core/i18n/en.js +1 -0
  53. package/dist/core/i18n/en.js.map +1 -1
  54. package/dist/core/i18n/es.d.ts.map +1 -1
  55. package/dist/core/i18n/es.js +1 -0
  56. package/dist/core/i18n/es.js.map +1 -1
  57. package/dist/core/i18n/fr.d.ts.map +1 -1
  58. package/dist/core/i18n/fr.js +1 -0
  59. package/dist/core/i18n/fr.js.map +1 -1
  60. package/dist/core/i18n/hi.d.ts.map +1 -1
  61. package/dist/core/i18n/hi.js +1 -0
  62. package/dist/core/i18n/hi.js.map +1 -1
  63. package/dist/core/i18n/id.d.ts.map +1 -1
  64. package/dist/core/i18n/id.js +1 -0
  65. package/dist/core/i18n/id.js.map +1 -1
  66. package/dist/core/i18n/ja.d.ts.map +1 -1
  67. package/dist/core/i18n/ja.js +1 -0
  68. package/dist/core/i18n/ja.js.map +1 -1
  69. package/dist/core/i18n/ko.d.ts.map +1 -1
  70. package/dist/core/i18n/ko.js +1 -0
  71. package/dist/core/i18n/ko.js.map +1 -1
  72. package/dist/core/i18n/pt.d.ts.map +1 -1
  73. package/dist/core/i18n/pt.js +1 -0
  74. package/dist/core/i18n/pt.js.map +1 -1
  75. package/dist/core/i18n/ru.d.ts.map +1 -1
  76. package/dist/core/i18n/ru.js +1 -0
  77. package/dist/core/i18n/ru.js.map +1 -1
  78. package/dist/core/i18n/vi.d.ts.map +1 -1
  79. package/dist/core/i18n/vi.js +1 -0
  80. package/dist/core/i18n/vi.js.map +1 -1
  81. package/dist/core/i18n/zh-hant.d.ts.map +1 -1
  82. package/dist/core/i18n/zh-hant.js +1 -0
  83. package/dist/core/i18n/zh-hant.js.map +1 -1
  84. package/dist/core/i18n/zh.d.ts.map +1 -1
  85. package/dist/core/i18n/zh.js +1 -0
  86. package/dist/core/i18n/zh.js.map +1 -1
  87. package/dist/core/rbac/index.d.ts +1 -1
  88. package/dist/core/rbac/index.d.ts.map +1 -1
  89. package/dist/core/rbac/index.js +1 -1
  90. package/dist/core/rbac/index.js.map +1 -1
  91. package/dist/core/rbac/rls.d.ts +34 -0
  92. package/dist/core/rbac/rls.d.ts.map +1 -1
  93. package/dist/core/rbac/rls.js +110 -0
  94. package/dist/core/rbac/rls.js.map +1 -1
  95. package/dist/core/storage/diff.d.ts +9 -0
  96. package/dist/core/storage/diff.d.ts.map +1 -1
  97. package/dist/core/storage/diff.js +47 -5
  98. package/dist/core/storage/diff.js.map +1 -1
  99. package/dist/core/storage/index.d.ts +2 -1
  100. package/dist/core/storage/index.d.ts.map +1 -1
  101. package/dist/core/storage/index.js +2 -1
  102. package/dist/core/storage/index.js.map +1 -1
  103. package/dist/core/storage/inspect.d.ts +4 -0
  104. package/dist/core/storage/inspect.d.ts.map +1 -1
  105. package/dist/core/storage/inspect.js +16 -8
  106. package/dist/core/storage/inspect.js.map +1 -1
  107. package/dist/core/storage/migrate.d.ts +8 -0
  108. package/dist/core/storage/migrate.d.ts.map +1 -1
  109. package/dist/core/storage/migrate.js +19 -0
  110. package/dist/core/storage/migrate.js.map +1 -1
  111. package/dist/core/storage/object-rls.d.ts +23 -0
  112. package/dist/core/storage/object-rls.d.ts.map +1 -0
  113. package/dist/core/storage/object-rls.js +44 -0
  114. package/dist/core/storage/object-rls.js.map +1 -0
  115. package/dist/index.d.ts.map +1 -1
  116. package/dist/index.js +3 -1
  117. package/dist/index.js.map +1 -1
  118. package/dist/runtime/data-access/builder.d.ts +7 -0
  119. package/dist/runtime/data-access/builder.d.ts.map +1 -1
  120. package/dist/runtime/data-access/builder.js +12 -0
  121. package/dist/runtime/data-access/builder.js.map +1 -1
  122. package/dist/runtime/data-access/index.d.ts +3 -3
  123. package/dist/runtime/data-access/index.d.ts.map +1 -1
  124. package/dist/runtime/data-access/index.js +2 -2
  125. package/dist/runtime/data-access/index.js.map +1 -1
  126. package/dist/runtime/data-access/query.d.ts +49 -7
  127. package/dist/runtime/data-access/query.d.ts.map +1 -1
  128. package/dist/runtime/data-access/query.js +235 -113
  129. package/dist/runtime/data-access/query.js.map +1 -1
  130. package/dist/runtime/data-access/rls-session.d.ts +24 -0
  131. package/dist/runtime/data-access/rls-session.d.ts.map +1 -0
  132. package/dist/runtime/data-access/rls-session.js +30 -0
  133. package/dist/runtime/data-access/rls-session.js.map +1 -0
  134. package/dist/runtime/data-access/sql-executor.d.ts.map +1 -1
  135. package/dist/runtime/data-access/sql-executor.js +2 -16
  136. package/dist/runtime/data-access/sql-executor.js.map +1 -1
  137. package/dist/runtime/data-access/types.d.ts +10 -2
  138. package/dist/runtime/data-access/types.d.ts.map +1 -1
  139. package/dist/runtime/data-access/types.js.map +1 -1
  140. package/dist/runtime/data-access/values.d.ts +10 -0
  141. package/dist/runtime/data-access/values.d.ts.map +1 -1
  142. package/dist/runtime/data-access/values.js +9 -0
  143. package/dist/runtime/data-access/values.js.map +1 -1
  144. package/dist/runtime/engine.d.ts +35 -4
  145. package/dist/runtime/engine.d.ts.map +1 -1
  146. package/dist/runtime/engine.js +32 -3
  147. package/dist/runtime/engine.js.map +1 -1
  148. package/dist/runtime/git/sync.d.ts +4 -0
  149. package/dist/runtime/git/sync.d.ts.map +1 -1
  150. package/dist/runtime/git/sync.js +1 -0
  151. package/dist/runtime/git/sync.js.map +1 -1
  152. package/dist/version.d.ts +1 -1
  153. package/dist/version.js +1 -1
  154. package/package.json +1 -1
@@ -1,7 +1,7 @@
1
- export { FILTER_OPS, SORT_DIRS, PAGINATION, WRITE_MODES } from "./values.js";
2
- export type { FilterOp, SortDir, WriteMode } from "./values.js";
1
+ export { FILTER_OPS, SORT_DIRS, PAGINATION, WRITE_MODES, TOTAL_MODES } from "./values.js";
2
+ export type { FilterOp, SortDir, WriteMode, TotalMode } from "./values.js";
3
3
  export type { Filter, FilterGroup, FilterValue, Sort, FindOptions, FindResult, DataAccessContext, ObjectDataAccess, Queryable, } from "./types.js";
4
- export { buildWhere, buildOrderBy, buildColumns, resolvePagination, buildFindSql, buildCountSql, } from "./builder.js";
4
+ export { buildWhere, buildOrderBy, buildColumns, resolvePagination, buildFindSql, buildCountSql, buildEstimateSql, } from "./builder.js";
5
5
  export { isSystemCtx, subjectOf, tenantOf, scopeOf } from "./types.js";
6
6
  export { CURSOR_VERSION, decodeCursor, encodeCursor } from "./cursor.js";
7
7
  export { QUERY_BUDGET_DEFAULTS, assertQueryBudget, countFilterConditions, resolveQueryBudget, } from "./query-budget.js";
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7E,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAChE,YAAY,EACV,MAAM,EACN,WAAW,EACX,WAAW,EACX,IAAI,EACJ,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,SAAS,EACT,SAAS,EACT,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,YAAY,EACV,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1F,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC3E,YAAY,EACV,MAAM,EACN,WAAW,EACX,WAAW,EACX,IAAI,EACJ,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,SAAS,EACT,SAAS,EACT,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,YAAY,EACV,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC"}
@@ -1,5 +1,5 @@
1
- export { FILTER_OPS, SORT_DIRS, PAGINATION, WRITE_MODES } from "./values.js";
2
- export { buildWhere, buildOrderBy, buildColumns, resolvePagination, buildFindSql, buildCountSql, } from "./builder.js";
1
+ export { FILTER_OPS, SORT_DIRS, PAGINATION, WRITE_MODES, TOTAL_MODES } from "./values.js";
2
+ export { buildWhere, buildOrderBy, buildColumns, resolvePagination, buildFindSql, buildCountSql, buildEstimateSql, } from "./builder.js";
3
3
  export { isSystemCtx, subjectOf, tenantOf, scopeOf } from "./types.js";
4
4
  export { CURSOR_VERSION, decodeCursor, encodeCursor } from "./cursor.js";
5
5
  export { QUERY_BUDGET_DEFAULTS, assertQueryBudget, countFilterConditions, resolveQueryBudget, } from "./query-budget.js";
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/data-access/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAa7E,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EACL,SAAS,EACT,SAAS,EACT,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAKzD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/data-access/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAa1F,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EACL,SAAS,EACT,SAAS,EACT,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAKzD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC"}
@@ -5,6 +5,7 @@ import { type GuardrailPolicy, type ScriptDispatcher, type WorkflowTimerSync } f
5
5
  import { type PolicyApprovals } from '../tools/policies.js';
6
6
  import { type WorkflowStatus, type WorkflowHistory, type WorkflowTodo, type WorkflowOverride } from './workflow.js';
7
7
  import { type DataAccessContext, type FindOptions, type FindResult, type ObjectDataAccess } from './types.js';
8
+ import { type TotalMode } from './values.js';
8
9
  import { type QueryBudget } from './query-budget.js';
9
10
  import { type EvidenceSink } from '../../core/index.js';
10
11
  /** controlled object data-access implementation (PG-backed) */
@@ -31,6 +32,10 @@ export declare class DefaultObjectDataAccess implements ObjectDataAccess {
31
32
  private readonly schemaRevision?;
32
33
  /** optional metrics sink (query-budget rejections); absent = zero overhead */
33
34
  private readonly metrics?;
35
+ /** object-path RLS role (`rls.enforce`); user-principal customer-table reads/updates/deletes run under it */
36
+ private readonly rlsRole?;
37
+ /** default `total` computation for `find` (per-call `opts.total` overrides) */
38
+ private readonly totalMode;
34
39
  constructor(options?: {
35
40
  audit?: AuditSink;
36
41
  script?: ScriptDispatcher;
@@ -43,7 +48,19 @@ export declare class DefaultObjectDataAccess implements ObjectDataAccess {
43
48
  evidence?: EvidenceSink;
44
49
  schemaRevision?: string;
45
50
  metrics?: MetricsSink;
51
+ rls?: {
52
+ role: string;
53
+ };
54
+ total?: TotalMode;
46
55
  });
56
+ /**
57
+ * Run customer-table statements under the object RLS role for a user
58
+ * principal (a pool request gets its own short transaction); system
59
+ * principals and enforcement-off run as the owner.
60
+ */
61
+ private readScoped;
62
+ /** {@link readScoped} for a client already inside the write transaction */
63
+ private underRls;
47
64
  /**
48
65
  * Run the read hook (`onLoad`) over a fetched batch. The hook receives the
49
66
  * whole batch as `this.records` and returns an **equal-length** array (or
@@ -66,16 +83,24 @@ export declare class DefaultObjectDataAccess implements ObjectDataAccess {
66
83
  private runAfterHook;
67
84
  find<T = Record<string, unknown>>(objectName: string, opts: FindOptions, ctx: DataAccessContext): Promise<FindResult<T>>;
68
85
  findOne<T = Record<string, unknown>>(objectName: string, id: string, ctx: DataAccessContext): Promise<T | null>;
86
+ /** pipeline context (actor/subject/correlation) for a governed write */
87
+ private pipelineCtx;
88
+ /** guardrail + approval decision for `action` (shared by writes and transitions) */
89
+ private decide;
69
90
  /**
70
- * Guardrail/approval gate for a data-access write (create/update/delete).
71
- * Runs only when policies are configured (`policies=[]` → zero overhead) and
72
- * is protocol-agnostic (action `object.<object>.<op>`), so REST / MCP /
73
- * GraphQL / script writes are all covered from this single choke point.
74
- * Deny throws; a `requiresApproval` policy throws with the approval key.
91
+ * Run a write (create/update/delete/transition) through the execution
92
+ * pipeline: guardrail/approval gate (when policies or `requireApproval` apply)
93
+ * → execute → one evidence row (when evidence is enabled). Protocol-agnostic
94
+ * (action `object.<object>.<op>` / `workflow.transition.<object>.<action>`),
95
+ * so REST / MCP / GraphQL / script writes share this single choke point.
96
+ * Without policies, approval or evidence the write runs directly.
75
97
  */
76
- private guardWrite;
98
+ private governed;
77
99
  create<T = Record<string, unknown>>(objectName: string, data: Record<string, unknown>, ctx: DataAccessContext): Promise<T>;
78
100
  update<T = Record<string, unknown>>(objectName: string, id: string, changes: Record<string, unknown>, ctx: DataAccessContext): Promise<T>;
101
+ delete(objectName: string, id: string, ctx: DataAccessContext): Promise<void>;
102
+ private doCreate;
103
+ private doUpdate;
79
104
  /**
80
105
  * Fire a workflow action against the three-layer runtime (instance/step/
81
106
  * workitem). Runs in one transaction: the instance row is locked, the current
@@ -83,10 +108,23 @@ export declare class DefaultObjectDataAccess implements ObjectDataAccess {
83
108
  * the side-table status mirror is updated. The customer row is never touched.
84
109
  */
85
110
  transition<T = Record<string, unknown>>(objectName: string, id: string, action: string, ctx: DataAccessContext, payload?: Record<string, unknown>): Promise<T>;
111
+ /**
112
+ * Existence check for a transition target. Submit is an owner action → the
113
+ * caller's manage scope; the other actions are authorized by workitem
114
+ * assignment / originator, not by row scope.
115
+ */
116
+ private transitionTargetSql;
117
+ private doTransition;
86
118
  /**
87
119
  * Read a record's workflow status (state/node/actions/own workitems).
88
120
  */
89
121
  workflowStatus(objectName: string, id: string, ctx: DataAccessContext): Promise<WorkflowStatus>;
122
+ /**
123
+ * A record's workflow is visible when the record is inside the caller's read
124
+ * scope, or the caller participates (originator / any workitem) — an assigned
125
+ * approver may sit outside the record's row scope.
126
+ */
127
+ private assertWorkflowVisible;
90
128
  /** Acquire/renew the caller's presence lock on the current step (TTL lease). */
91
129
  acquireWorkflowLock(objectName: string, id: string, ctx: DataAccessContext): Promise<{
92
130
  expiresAt: Date;
@@ -107,7 +145,7 @@ export declare class DefaultObjectDataAccess implements ObjectDataAccess {
107
145
  * inside the caller's transaction. `created` also stamps the creation facts.
108
146
  */
109
147
  private writeRecordMeta;
110
- delete(objectName: string, id: string, ctx: DataAccessContext): Promise<void>;
148
+ private doDelete;
111
149
  }
112
150
  export declare function createDataAccess(options?: {
113
151
  audit?: AuditSink;
@@ -121,5 +159,9 @@ export declare function createDataAccess(options?: {
121
159
  evidence?: EvidenceSink;
122
160
  schemaRevision?: string;
123
161
  metrics?: MetricsSink;
162
+ rls?: {
163
+ role: string;
164
+ };
165
+ total?: TotalMode;
124
166
  }): ObjectDataAccess;
125
167
  //# sourceMappingURL=query.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/query.ts"],"names":[],"mappings":"AAEA,OAAO,EAAyI,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE9L,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAA+D,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAyD,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC9N,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAIhF,OAAO,EAQL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAsB,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAIlI,OAAO,EAA4C,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAwC,KAAK,YAAY,EAA6B,MAAM,qBAAqB,CAAC;AA8QzH,+DAA+D;AAC/D,qBAAa,uBAAwB,YAAW,gBAAgB;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,yGAAyG;IACzG,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAkB;IAC7C,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAoB;IACpD,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,qFAAqF;IACrF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAe;IACzC,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAS;IACzC,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAc;gBAGrC,OAAO,GAAE;QACP,KAAK,CAAC,EAAE,SAAS,CAAC;QAClB,MAAM,CAAC,EAAE,gBAAgB,CAAC;QAC1B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,QAAQ,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QACtC,SAAS,CAAC,EAAE,eAAe,CAAC;QAC5B,cAAc,CAAC,EAAE,iBAAiB,CAAC;QACnC,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,QAAQ,CAAC,EAAE,YAAY,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,WAAW,CAAC;KAClB;IAeR;;;;;;OAMG;YACW,SAAS;IA6BvB;;;;OAIG;YACW,aAAa;IAkB3B;;;;OAIG;YACW,YAAY;IAgCpB,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAgEnB,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAiBpB;;;;;;OAMG;YACW,UAAU;IAoElB,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,CAAC;IA8IP,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,CAAC;IAmHb;;;;;OAKG;IACG,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,iBAAiB,EACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,CAAC,CAAC;IAkHb;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAQrG,gFAAgF;IAC1E,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;IAK/G,0CAA0C;IACpC,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhG,4DAA4D;IACtD,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAQvG,0DAA0D;IACpD,aAAa,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAIpE,2EAA2E;IACrE,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,gBAAgB,EACvB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA+B9C;;;OAGG;YACW,eAAe;IAmBvB,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;CA4DpF;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACtC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,cAAc,CAAC,EAAE,iBAAiB,CAAC;IACnC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,WAAW,CAAC;CAClB,GACL,gBAAgB,CAElB"}
1
+ {"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/runtime/data-access/query.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwJ,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE7M,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAA+D,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAyD,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC9N,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAIhF,OAAO,EASL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAsB,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAElI,OAAO,EAAmD,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE9F,OAAO,EAA4C,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAsB,KAAK,YAAY,EAAuC,MAAM,qBAAqB,CAAC;AAsRjH,+DAA+D;AAC/D,qBAAa,uBAAwB,YAAW,gBAAgB;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,yGAAyG;IACzG,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAkB;IAC7C,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAoB;IACpD,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,qFAAqF;IACrF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAe;IACzC,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAS;IACzC,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAc;IACvC,6GAA6G;IAC7G,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAGpC,OAAO,GAAE;QACP,KAAK,CAAC,EAAE,SAAS,CAAC;QAClB,MAAM,CAAC,EAAE,gBAAgB,CAAC;QAC1B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,QAAQ,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QACtC,SAAS,CAAC,EAAE,eAAe,CAAC;QAC5B,cAAc,CAAC,EAAE,iBAAiB,CAAC;QACnC,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,QAAQ,CAAC,EAAE,YAAY,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,WAAW,CAAC;QACtB,GAAG,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QACvB,KAAK,CAAC,EAAE,SAAS,CAAC;KACd;IAoBR;;;;OAIG;YACW,UAAU;IAmBxB,2EAA2E;IAC3E,OAAO,CAAC,QAAQ;IAKhB;;;;;;OAMG;YACW,SAAS;IA6BvB;;;;OAIG;YACW,aAAa;IAkB3B;;;;OAIG;YACW,YAAY;IAgCpB,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAyFnB,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAiBpB,wEAAwE;IACxE,OAAO,CAAC,WAAW;IAcnB,oFAAoF;YACtE,MAAM;IAyBpB;;;;;;;OAOG;YACW,QAAQ;IA6ChB,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,CAAC;IAUP,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,CAAC,CAAC;IAUP,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;YAUrE,QAAQ;YAiJR,QAAQ;IA0HtB;;;;;OAKG;IACG,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,iBAAiB,EACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,CAAC,CAAC;IAyCb;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;YAiBb,YAAY;IA8E1B;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IASrG;;;;OAIG;YACW,qBAAqB;IAqBnC,gFAAgF;IAC1E,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;IAK/G,0CAA0C;IACpC,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhG,4DAA4D;IACtD,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IASvG,0DAA0D;IACpD,aAAa,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAIpE,2EAA2E;IACrE,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,gBAAgB,EACvB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA+B9C;;;OAGG;YACW,eAAe;YAmBf,QAAQ;CA6DvB;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACtC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,cAAc,CAAC,EAAE,iBAAiB,CAAC;IACnC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,GAAG,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,CAAC;CACd,GACL,gBAAgB,CAElB"}