dzql 0.6.36 → 0.7.0

package/src/cli/compiler/permissions.ts

@@ -1,43 +1,43 @@
 /**
- * Compiles a permission rule into SQL.
+ * Compiles permission rules into SQL.
  *
  * Supported formats:
- * - Literal: TRUE, FALSE
+ * - Literal: TRUE (public), FALSE (nobody), AUTHENTICATED (any signed-in user)
  * - Simple field check: @author_id (implies author_id == user_id)
  * - Explicit comparison: @field == @user_id
  * - Single-hop traversal: @org_id->acts_for[org_id=$]{active}.user_id
  * - Multi-hop traversal: @venue_id->venues.org_id->acts_for[org_id=$]{active}.user_id
- * - Deep traversal: @site_id->sites.venue_id->venues.org_id->acts_for[org_id=$]{active}.user_id
+ * - Filtered middle hop: @occasion_id->occasion_promoters[occasion_id=$].promoter_id->user_orgs[org_id=$].user_id
+ * - Several filters: @org_id->user_orgs[org_id=$,role=owner].user_id
  * - Table-first: contractor_rights[package_id=@package_id]{active}.contractor_org_id->...
  *
- * Uses the shared path parser for parity with notification compilation.
- *
- * @param entityName - The entity name
- * @param rule - The permission rule string
- * @param context - Optional context (unused)
- * @param dataVar - Either a JSONB variable name (e.g., 'p_data') or a table name (e.g., 'packages')
- *                  When it's a table name, we use table.column syntax instead of jsonb->>'column'
+ * Uses the shared path parser for parity with notification and subscribe compilation.
+ * A rule that can't be compiled throws PathCompileError; it never compiles to FALSE.
  */
 
-import { parsePath, compilePathToExists } from "./paths.js";
-
-export function compilePermission(entityName: string, rule: string, context: any, dataVar: string = 'p_data'): string {
-  // Literal TRUE/FALSE - public access or deny all
-  if (rule === 'TRUE' || rule === 'true') {
-    return 'TRUE';
-  }
-  if (rule === 'FALSE' || rule === 'false') {
-    return 'FALSE';
-  }
+import { parsePath, compilePathToExists, PathCompileError, type RowSource } from "./paths.js";
 
-  // Parse the path
+/**
+ * @param entityName - The entity name (for error messages)
+ * @param rule - The permission rule string
+ * @param context - Optional context (unused)
+ * @param dataVar - A JSONB variable name (e.g., 'p_data', 'v_old_data'), a table name or
+ *                  alias in scope (e.g., 'packages'), or an explicit RowSource
+ */
+export function compilePermission(entityName: string, rule: string, context: any, dataVar: string | RowSource = 'p_data'): string {
   const parsed = parsePath(rule);
-
   if (!parsed.isValid) {
-    console.warn(`[Compiler] Warning: ${parsed.error}`);
-    return 'FALSE';
+    throw new PathCompileError(`${entityName}: ${parsed.error}`, rule);
   }
-
-  // Compile to EXISTS check
   return compilePathToExists(parsed, dataVar, 'p_user_id');
 }
+
+/**
+ * Compile a list of rules: any one of them grants access. An empty or missing
+ * list denies everyone.
+ */
+export function compileRuleList(entityName: string, rules: string[] | undefined, dataVar: string | RowSource = 'p_data'): string {
+  if (!rules || rules.length === 0) return 'FALSE';
+  if (rules.length === 1) return compilePermission(entityName, rules[0], null, dataVar);
+  return rules.map(rule => `(${compilePermission(entityName, rule, null, dataVar)})`).join(' OR ');
+}

package/src/cli/index.ts

@@ -1,9 +1,6 @@
 #!/usr/bin/env bun
 import { loadDomain } from "./compiler/loader.js";
-import { analyzeDomain } from "./compiler/analyzer.js";
-import { generateIR } from "./compiler/ir.js";
-import { generateCoreSQL, generateAuthSQL, generateEntitySQL, generateSchemaSQL } from "./codegen/sql.js";
-import { generateSubscribableSQL, generateComputeAffectedKeysFunction } from "./codegen/subscribable_sql.js";
+import { compileDomain, DomainValidationError } from "./compile.js";
 import { generateManifest } from "./codegen/manifest.js";
 import { generateSubscribableStore } from "./codegen/subscribable_store.js";
 import { generateClientSDK } from "./codegen/client.js";
@@ -60,62 +57,19 @@ async function main() {
       const domain = await loadDomain(fullInputPath);
       console.log("[Compiler] Domain loaded.");
 
-      const errors = analyzeDomain(domain);
-      if (errors.length > 0) {
-        console.error("[Compiler] Validation Failed:");
-        errors.forEach(err => console.error(`  - ${err}`));
-        process.exit(1);
-      }
-
-      // Phase 2: Generate IR
-      const ir = generateIR(domain);
-      console.log(`[Compiler] IR Generated. Subscribables: ${Object.keys(ir.subscribables).join(', ')}`);
-
-      // Phase 3: Generate SQL
-      const coreSQL = generateCoreSQL();
-
-      // Topologically sort entities by FK dependencies
-      // Entities must be created before entities that reference them
-      // Also detects circular FKs that need deferred constraint creation
-      const { sorted: sortedEntityNames, circularFKs } = topologicalSortEntities(ir.entities);
-
-      // Build set of circular FK columns for stripping during schema generation
-      const circularFKSet = new Set(circularFKs.map(fk => `${fk.table}.${fk.column}`));
-
-      const entitySQL: string[] = [];
-      for (const name of sortedEntityNames) {
-        const entityIR = ir.entities[name];
-        // Pass circular FK info so schema generation can strip those constraints
-        entitySQL.push(generateSchemaSQL(name, entityIR, circularFKSet));
-        // Skip CRUD generation for unmanaged entities (e.g., junction tables)
-        if (entityIR.managed !== false) {
-          entitySQL.push(generateEntitySQL(name, entityIR));
-        } else {
-          console.log(`[Compiler] Skipping CRUD for unmanaged entity: ${name}`);
+      let compiled;
+      try {
+        compiled = compileDomain(domain);
+      } catch (e) {
+        if (e instanceof DomainValidationError) {
+          console.error("[Compiler] Validation Failed:");
+          e.errors.forEach(err => console.error(`  - ${err}`));
+          process.exit(1);
         }
+        throw e;
       }
-
-      // Add deferred FK constraints at the end (for circular dependencies)
-      if (circularFKs.length > 0) {
-        entitySQL.push(generateDeferredFKConstraints(circularFKs));
-      }
-
-      // Generate subscribable SQL functions
-      const subscribableSQL: string[] = [];
-      const subscribableNames = Object.keys(ir.subscribables);
-      for (const [name, subIR] of Object.entries(ir.subscribables)) {
-        console.log(`[Compiler] Generating SQL for subscribable: ${name}`);
-        subscribableSQL.push(generateSubscribableSQL(name, subIR as any, ir.entities));
-      }
-      // Generate central compute_affected_keys function that aggregates all subscribables
-      subscribableSQL.push(generateComputeAffectedKeysFunction(subscribableNames));
-
-      // Collect custom functions SQL
-      const customFunctionSQL: string[] = [];
-      for (const fn of ir.customFunctions) {
-        console.log(`[Compiler] Adding custom function: ${fn.name}`);
-        customFunctionSQL.push(fn.sql);
-      }
+      const { ir, coreSQL, schemaSQL } = compiled;
+      console.log(`[Compiler] IR Generated. Subscribables: ${Object.keys(ir.subscribables).join(', ')}`);
 
       // Phase 4: Generate Manifest
       const manifest = generateManifest(ir);
@@ -128,26 +82,15 @@ async function main() {
 
       writeFileSync(resolve(dbDir, `000_core.sql`), coreSQL);
       const timestamp = new Date().toISOString().replace(/[:.-]/g, '');
+      writeFileSync(resolve(dbDir, `${timestamp}_schema.sql`), schemaSQL);
 
-      // Combine entity SQL with auth functions and custom functions
-      // Auth functions must come after schema (they depend on users table)
-      const authSQL = generateAuthSQL();
-      let schemaContent = entitySQL.join('\n');
-      schemaContent += '\n\n-- Auth Functions\n' + authSQL;
-      if (customFunctionSQL.length > 0) {
-        schemaContent += '\n\n-- Custom Functions\n' + customFunctionSQL.join('\n\n');
-      }
-      writeFileSync(resolve(dbDir, `${timestamp}_schema.sql`), schemaContent);
-
-      if (customFunctionSQL.length > 0) {
-        console.log(`[Generated] ${customFunctionSQL.length} Custom Functions`);
+      if (compiled.customFunctionCount > 0) {
+        console.log(`[Generated] ${compiled.customFunctionCount} Custom Functions`);
       }
 
       // Write subscribable SQL
-      if (subscribableSQL.length > 0) {
-        writeFileSync(resolve(dbDir, `${timestamp}_subscribables.sql`), subscribableSQL.join('\n\n'));
-        console.log(`[Generated] ${subscribableSQL.length} Subscribable SQL functions`);
-      }
+      writeFileSync(resolve(dbDir, `${timestamp}_subscribables.sql`), compiled.subscribableSQL);
+      console.log(`[Generated] Subscribable SQL for ${Object.keys(ir.subscribables).length} subscribables`);
 
       console.log(`[Generated] DB Migrations in ${dbDir}`);
 
@@ -227,148 +170,3 @@ async function main() {
 }
 
 main();
-
-/** FK info for dependency analysis */
-interface FKInfo {
-  table: string;
-  column: string;
-  referencedTable: string;
-  fullConstraint: string; // e.g., "int NOT NULL REFERENCES users(id)"
-}
-
-/** Result of topological sort with cycle detection */
-interface SortResult {
-  sorted: string[];
-  circularFKs: FKInfo[];
-}
-
-/**
- * Topologically sort entities based on FK dependencies.
- * Entities that are referenced by others come first.
- * Uses Kahn's algorithm for topological sorting.
- * Returns both sorted order and any circular FK constraints that need deferred creation.
- */
-function topologicalSortEntities(entities: Record<string, any>): SortResult {
-  const entityNames = Object.keys(entities);
-
-  // Build dependency graph: entity -> entities it depends on (references)
-  const dependencies: Record<string, Set<string>> = {};
-  const dependents: Record<string, Set<string>> = {};
-
-  // Track all FK info for cycle detection
-  const allFKs: FKInfo[] = [];
-
-  for (const name of entityNames) {
-    dependencies[name] = new Set();
-    dependents[name] = new Set();
-  }
-
-  // Parse REFERENCES from column types
-  for (const name of entityNames) {
-    const entity = entities[name];
-    for (const col of entity.columns || []) {
-      const match = col.type?.match(/REFERENCES\s+(\w+)/i);
-      if (match) {
-        const referencedEntity = match[1];
-        // Only track dependencies to entities we're managing
-        if (entityNames.includes(referencedEntity)) {
-          dependencies[name].add(referencedEntity);
-          dependents[referencedEntity].add(name);
-          allFKs.push({
-            table: name,
-            column: col.name,
-            referencedTable: referencedEntity,
-            fullConstraint: col.type
-          });
-        }
-      }
-    }
-  }
-
-  // Kahn's algorithm
-  const result: string[] = [];
-  const noIncoming: string[] = [];
-  const remainingDeps: Record<string, Set<string>> = {};
-
-  // Copy dependencies for mutation
-  for (const name of entityNames) {
-    remainingDeps[name] = new Set(dependencies[name]);
-  }
-
-  // Find entities with no dependencies (no incoming edges)
-  for (const name of entityNames) {
-    if (remainingDeps[name].size === 0) {
-      noIncoming.push(name);
-    }
-  }
-
-  while (noIncoming.length > 0) {
-    const node = noIncoming.shift()!;
-    result.push(node);
-
-    // Remove this node from the graph
-    for (const dependent of dependents[node]) {
-      remainingDeps[dependent].delete(node);
-      if (remainingDeps[dependent].size === 0) {
-        noIncoming.push(dependent);
-      }
-    }
-  }
-
-  // Detect circular FKs
-  const circularFKs: FKInfo[] = [];
-  if (result.length !== entityNames.length) {
-    const cycleEntities = new Set(entityNames.filter(n => !result.includes(n)));
-    console.warn(`[Compiler] Warning: Circular FK dependencies detected among: ${[...cycleEntities].join(', ')}`);
-
-    // Find FKs that are part of the cycle - these need deferred creation
-    for (const fk of allFKs) {
-      if (cycleEntities.has(fk.table) && cycleEntities.has(fk.referencedTable)) {
-        circularFKs.push(fk);
-        console.log(`[Compiler] Deferring circular FK: ${fk.table}.${fk.column} -> ${fk.referencedTable}`);
-      }
-    }
-
-    // Add remaining entities (cycle members) to result
-    result.push(...cycleEntities);
-  }
-
-  return { sorted: result, circularFKs };
-}
-
-/**
- * Generate ALTER TABLE statements for deferred circular FK constraints.
- */
-function generateDeferredFKConstraints(circularFKs: FKInfo[]): string {
-  if (circularFKs.length === 0) return '';
-
-  const statements: string[] = [
-    '\n-- === DEFERRED FK CONSTRAINTS (for circular dependencies) ===\n'
-  ];
-
-  for (const fk of circularFKs) {
-    // Extract the REFERENCES part from the full constraint
-    const refMatch = fk.fullConstraint.match(/REFERENCES\s+(\w+)(\([^)]+\))?(\s+ON\s+.+)?/i);
-    if (refMatch) {
-      const targetTable = refMatch[1];
-      const targetCol = refMatch[2] || '(id)';
-      const cascadeClause = refMatch[3] || '';
-      const constraintName = `fk_${fk.table}_${fk.column}`;
-
-      statements.push(`ALTER TABLE ${fk.table} ADD CONSTRAINT ${constraintName} FOREIGN KEY (${fk.column}) REFERENCES ${targetTable}${targetCol}${cascadeClause};`);
-    }
-  }
-
-  return statements.join('\n');
-}
-
-/**
- * Remove REFERENCES clause from a column type for deferred FK creation.
- * Preserves NOT NULL and other modifiers.
- */
-function stripReferences(columnType: string): string {
-  // Remove REFERENCES clause and any ON DELETE/UPDATE clauses
-  return columnType
-    .replace(/\s*REFERENCES\s+\w+(\([^)]+\))?(\s+ON\s+(DELETE|UPDATE)\s+(CASCADE|SET NULL|SET DEFAULT|RESTRICT|NO ACTION))*\s*/gi, ' ')
-    .trim();
-}

package/src/client/ws.ts

@@ -51,6 +51,8 @@ export class WebSocketManager {
   protected maxReconnectAttempts = 5;
   protected tokenName = 'dzql_token';
   protected isShuttingDown = false;
+  /** The URL last given to connect(): a reconnect goes back to it. */
+  protected url: string | null = null;
 
   public user: any = null;
   public ready: boolean = false;
@@ -101,15 +103,16 @@ export class WebSocketManager {
     this.ready = false;
     this.ws?.close();
     this.ws = null;
-    this.isShuttingDown = false;
   }
 
   connect(url: string | null = null, timeout = 5000): Promise<void> {
     return new Promise((resolve, reject) => {
       this.ready = false;
       this.user = null;
+      this.isShuttingDown = false;
 
-      let wsUrl = url;
+      let wsUrl = url ?? this.url;
+      if (url) this.url = url;
       if (!wsUrl) {
         if (typeof globalThis !== "undefined" && "window" in globalThis) {
           const win = globalThis as unknown as { location: { protocol: string; host: string } };
@@ -128,19 +131,20 @@ export class WebSocketManager {
       }
 
       const connectionTimeout = setTimeout(() => {
-        this.ws?.close();
+        socket.close();
         reject(new Error('WebSocket connection timed out'));
       }, timeout);
 
-      this.ws = new WebSocket(wsUrl);
+      const socket = new WebSocket(wsUrl);
+      this.ws = socket;
 
-      this.ws.onopen = () => {
+      socket.onopen = () => {
         clearTimeout(connectionTimeout);
         this.reconnectAttempts = 0;
         resolve();
       };
 
-      this.ws.onmessage = (event) => {
+      socket.onmessage = (event) => {
         try {
           this.handleMessage(JSON.parse(event.data));
         } catch (error) {
@@ -148,13 +152,14 @@ export class WebSocketManager {
         }
       };
 
-      this.ws.onclose = () => {
-        if (!this.isShuttingDown) {
+      // only the current socket reconnects: one replaced by a later connect() or a disconnect() does not
+      socket.onclose = () => {
+        if (this.ws === socket && !this.isShuttingDown) {
           this.attemptReconnect();
         }
       };
 
-      this.ws.onerror = (error) => {
+      socket.onerror = (error) => {
         clearTimeout(connectionTimeout);
         reject(error);
       };
@@ -164,7 +169,12 @@ export class WebSocketManager {
   attemptReconnect() {
     if (this.reconnectAttempts < this.maxReconnectAttempts) {
       this.reconnectAttempts++;
-      setTimeout(() => this.connect(), 1000 * this.reconnectAttempts);
+      setTimeout(() => {
+        // a disconnect() since, or a connect() already open or opening, needs no reconnect
+        if (this.isShuttingDown || (this.ws && this.ws.readyState <= WebSocket.OPEN)) return;
+        // a failed attempt closes, and its onclose tries again: nothing to reject to
+        this.connect().catch(() => {});
+      }, 1000 * this.reconnectAttempts);
     }
   }
 

package/src/runtime/auth.ts

@@ -1,7 +1,38 @@
 import { jwtVerify, SignJWT } from "jose";
 
-const JWT_SECRET = process.env.JWT_SECRET || "default_dev_secret";
-const SECRET_KEY = new TextEncoder().encode(JWT_SECRET);
+export const DEV_JWT_SECRET = "default_dev_secret";
+
+/**
+ * Resolve the JWT signing secret, failing closed in production.
+ *
+ * A hardcoded default secret is catastrophic: anyone can forge a token for any
+ * user_id and impersonate any account. So in production (NODE_ENV=production) we
+ * refuse to start unless JWT_SECRET is set to something other than the dev
+ * default. Outside production we fall back to the dev secret with a loud warning
+ * so local development and tests still work.
+ */
+export function resolveJwtSecret(env: NodeJS.ProcessEnv = process.env): string {
+  const secret = env.JWT_SECRET;
+  const isProd = env.NODE_ENV === "production";
+
+  if (!secret || secret === DEV_JWT_SECRET) {
+    if (isProd) {
+      throw new Error(
+        "JWT_SECRET must be set to a strong, unique value in production; " +
+          "refusing to start with a missing or default development secret.",
+      );
+    }
+    console.warn(
+      "[dzql] JWT_SECRET is not set; using an insecure development secret. " +
+        "Set JWT_SECRET to a strong value before deploying.",
+    );
+    return DEV_JWT_SECRET;
+  }
+
+  return secret;
+}
+
+const SECRET_KEY = new TextEncoder().encode(resolveJwtSecret());
 
 export interface UserSession {
   userId: number;

package/src/runtime/index.ts

@@ -2,7 +2,8 @@ import { serve } from "bun";
 import { config } from "dotenv";
 import { Database } from "./db.js";
 import { WebSocketServer } from "./ws.js";
-import { loadManifest } from "./manifest_loader.js";
+import { loadManifest, getEntityHidden } from "./manifest_loader.js";
+import { projectVisible } from "./projection.js";
 import { readFileSync } from "fs";
 import { resolve } from "path";
 import { runtimeLogger, notifyLogger, serverLogger } from "./logger.js";
@@ -44,7 +45,7 @@ const wsServer = new WebSocketServer(db);
  *
  * Each connection receives the event at most once, even if matched by both.
  */
-function processEventNotifications(event: {
+async function processEventNotifications(event: {
   table: string;
   op: string;
   pk: Record<string, unknown>;
@@ -52,7 +53,7 @@ function processEventNotifications(event: {
   user_id: number | null;
   affected_keys: string[];
   notify_users: number[];
-}) {
+}): Promise<void> {
   const { table, op, pk, data, affected_keys, notify_users } = event;
 
   notifyLogger.debug(`processEventNotifications called for ${table}:${op}`);
@@ -62,11 +63,24 @@ function processEventNotifications(event: {
   // Track which connections we've already notified to avoid duplicates
   const notifiedConnections = new Set<string>();
 
+  // Project out the entity's hidden columns before broadcasting. The stored
+  // event row is full (routing needs it) but subscribers must only ever see
+  // what the getter would return — never e.g. users.password_hash on an update.
+  const visibleData = projectVisible(data, getEntityHidden(table));
+
   // Build the event message for entity broadcasts
   const entityEventMessage = JSON.stringify({
     jsonrpc: "2.0",
     method: `${table}:${op}`,
-    params: { table, op, pk, data }
+    params: { table, op, pk, data: visibleData }
+  });
+
+  // The same event carrying only its key, for a subscriber who may be told a
+  // row was deleted but not what it contained.
+  const keyOnlyEventMessage = JSON.stringify({
+    jsonrpc: "2.0",
+    method: `${table}:${op}`,
+    params: { table, op, pk, data: pk }
   });
 
   // 1. Send to users in notify_users list (entity notifications)
@@ -102,7 +116,34 @@ function processEventNotifications(event: {
         if (affected_keys.includes(subKey)) {
           // Send entity broadcast (not subscription:event) so global dispatcher can route it
           if (!notifiedConnections.has(sub.connection_id)) {
-            const sent = wsServer.toConnection(sub.connection_id, entityEventMessage);
+            // Re-authorize on push: a matching affected_key means the change is
+            // relevant to this subscription's params, not that the subscriber may
+            // see it. can_receive re-runs can_subscribe (so revoked access stops
+            // updates) and, for a list, checks this row against the subscriber's
+            // view rules and documents. It answers 'row', 'pk' (send the key only,
+            // for a delete), or NULL. Fail closed.
+            // Pass params and data as objects so postgres serializes them to jsonb;
+            // do NOT JSON.stringify + ::jsonb, which double-encodes into a json
+            // string scalar and makes every ->> lookup null (and the check fail).
+            let receive: string | null = null;
+            try {
+              const rows: any = await db.query(
+                `SELECT dzql_v2.${subscribableName}_can_receive($1, $2, $3, $4, $5) AS receive`,
+                [sub.user_id, sub.params ?? {}, table, op, data ?? {}]
+              );
+              receive = rows?.[0]?.receive ?? null;
+            } catch (e: any) {
+              notifyLogger.error(`can_receive check failed for ${subscribableName}: ${e.message}`);
+              receive = null;
+            }
+
+            if (receive !== 'row' && receive !== 'pk') {
+              notifyLogger.debug(`Suppressed push to ${sub.connection_id.slice(0, 8)}... (may not see this ${table} row via ${subscribableName})`);
+              continue;
+            }
+
+            const message = receive === 'row' ? entityEventMessage : keyOnlyEventMessage;
+            const sent = wsServer.toConnection(sub.connection_id, message);
             if (sent) {
               notifiedConnections.add(sub.connection_id);
               notifyLogger.debug(`Sent entity broadcast to ${sub.connection_id.slice(0, 8)}... via ${subscribableName} (${table}:${op})`);
@@ -135,7 +176,7 @@ async function startListener() {
       notifyLogger.debug(`Fetched ${events.length} events for commit ${commit_id}`);
       for (const event of events) {
         notifyLogger.debug(`Processing event: ${event.table_name}:${event.op}`);
-        processEventNotifications({
+        await processEventNotifications({
           table: event.table_name,
           op: event.op,
           pk: event.pk,

package/src/runtime/manifest_loader.ts

@@ -16,6 +16,16 @@ export function getManifest(): Manifest {
   return activeManifest;
 }
 
+/**
+ * Hidden columns for an entity, from the loaded manifest. Returns [] when the
+ * manifest or entity is unknown so callers can treat "no manifest" as "hide
+ * nothing extra" without throwing on the realtime hot path.
+ */
+export function getEntityHidden(table: string): string[] {
+  const entity = activeManifest?.entities?.[table] as { hidden?: string[] } | undefined;
+  return entity?.hidden ?? [];
+}
+
 export function resolveFunction(name: string) {
   const manifest = getManifest();
   const fn = manifest.functions[name];

package/src/runtime/projection.ts

@@ -0,0 +1,19 @@
+/**
+ * Strip an entity's hidden columns from a row before it is pushed to clients.
+ *
+ * The realtime path stores the full row in the events table (routing needs it),
+ * but what is broadcast to subscribers must match what the getter would return:
+ * a hidden column (e.g. users.password_hash) must never ride out on a live
+ * update even though it is present in the stored event data.
+ */
+export function projectVisible<T extends Record<string, unknown>>(
+  data: T | null | undefined,
+  hidden: string[] | undefined,
+): T | null | undefined {
+  if (!data || !hidden || hidden.length === 0) return data;
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (!hidden.includes(key)) out[key] = value;
+  }
+  return out as T;
+}