fastify-auto-sqlapi 0.2.0 → 0.2.2

package/dist/lib/tenant.d.ts

@@ -1,8 +1,15 @@
-import type { FastifyRequest } from 'fastify';
+import type { ApiRequest } from '../types/request.js';
 import type { QueryClient } from './db.js';
 import { ConditionBuilder, type ConditionValue, type ConditionValueOrUndefined } from 'node-condition-builder';
-import type { ITable, SqlApiPluginOptions, TenantId, TenantScope, TenantScopeIndirect, TenantContext } from '../types.js';
-export declare function resolveTenant(options: SqlApiPluginOptions, tableConf: ITable, request: FastifyRequest): Promise<TenantContext | undefined>;
+import type { ITable, SqlApiPluginOptions, TenantId, TenantScope, TenantScopeDirect, TenantScopeIndirect, TenantScopeAnyOf, TenantContext } from '../types.js';
+export declare function resolveTenant(options: SqlApiPluginOptions, tableConf: ITable, request: ApiRequest): Promise<TenantContext | undefined>;
+/**
+ * The read predicate for a scope, as a fragment every caller appends to its own WHERE.
+ *
+ * An `anyOf` scope returns an OR-mode builder — the row is visible when any listed column holds
+ * a tenant id — and every caller appends it, so the group keeps its own parentheses. A NULL
+ * column simply fails to match, which is the wanted behaviour: the other party still decides.
+ */
 export declare function buildTenantCondition(db: QueryClient, scope: TenantScope, tenantIds: TenantId[], ownTable: string): ConditionBuilder;
 /**
  * Re-target a tenant context onto a related table: the caller's tenant ids paired with that
@@ -21,21 +28,35 @@ export declare function tenantForTable(tenant: TenantContext | undefined, tableC
  *
  * `tableRef` is the name the scoped rows go by in that statement — the table name in a DELETE,
  * the join alias in an ON clause, the subquery alias inside a correlated SELECT. Returns
- * undefined without a tenant context (admin).
+ * undefined without a tenant context (admin) or when the table carries no scope.
  */
 export declare function buildTenantRowGuard(db: QueryClient, tenant: TenantContext | undefined, tableRef: string): ConditionBuilder | undefined;
 export declare function buildTenantJoin(db: QueryClient, scope: TenantScopeIndirect, mainTableName: string): string;
+/**
+ * The insert-side rule for an `anyOf` scope: the payload must anchor the row itself.
+ *
+ * Nothing is auto-injected — with several owner columns the plugin cannot know which party the
+ * caller is meant to be, and guessing would either invent a relationship or refuse a legitimate
+ * one. So the record must name at least one listed column, and at least one of the named ones
+ * must hold a tenant id. The *other* parties are deliberately left alone: a swap request points
+ * at a colleague by definition, and requiring every listed column to match would make the shape
+ * unusable.
+ *
+ * @testonly Exported only so unit tests can exercise it directly.
+ */
+export declare function assertTenantAnchor(record: Record<string, unknown>, scope: TenantScopeAnyOf, tenantIds: TenantId[]): void;
 /** Writes the tenant value into a record according to its scope.
  * @testonly Exported only so unit tests can exercise it directly.
  */
-export declare function injectTenantValue(record: Record<string, unknown>, scope: TenantScope, tenantIds: TenantId[]): void;
+export declare function injectTenantValue(record: Record<string, unknown>, scope: TenantScopeDirect | TenantScopeIndirect, tenantIds: TenantId[]): void;
 /** Checks that an indirect-scope FK really belongs to the tenant.
  * @testonly Exported only so unit tests can exercise it directly.
  */
 export declare function validateTenantFK(db: QueryClient, scope: TenantScopeIndirect, tenantIds: TenantId[], fkValues: unknown[]): Promise<void>;
 /**
  * Build WHERE clause for DELETE with tenant filtering.
- * Handles both direct (simple AND) and indirect (subquery via JOIN) scopes.
+ * Handles both direct (simple AND) and indirect (subquery via JOIN) scopes; a tenant whose
+ * addressed table declares no scope yields the plain primary-key clause.
  */
 export declare function buildTenantDeleteWhere(db: QueryClient, tableName: string, pkCol: string, pkValue: ConditionValueOrUndefined | ConditionValue[], tenant: TenantContext): {
     where: string;
@@ -64,8 +85,9 @@ export declare function assertTenantOwnsConflicts(db: QueryClient, tenant: Tenan
  */
 export declare function enforceTenantFKOnUpdate(db: QueryClient, tenant: TenantContext | undefined, updateFields: Record<string, unknown>): Promise<void>;
 /**
- * Mutates `fields` in-place: removes the tenant column from a SET payload (direct scopes only).
- * No-op for indirect or no scope.
+ * Mutates `fields` in-place: removes the tenant columns from a SET payload (scopes whose columns
+ * live on the table itself). An `anyOf` scope drops *every* listed column — neither party can be
+ * reassigned, the same spirit as "a tenant cannot move its own row". No-op for indirect scopes.
  */
 export declare function stripTenantColumn(fields: Record<string, unknown>, scope: TenantScope): void;
 /**
@@ -75,6 +97,19 @@ export declare function stripTenantColumn(fields: Record<string, unknown>, scope
  * Throws 400 (ambiguous tenant) or 403 (mismatch) on violation. No-op when `tenant` is undefined.
  */
 export declare function enforceTenantOnWrites(db: QueryClient, tenant: TenantContext | undefined, records: Record<string, unknown>[]): Promise<void>;
+/**
+ * Columns an UPSERT must leave alone when it lands on an existing row.
+ *
+ * `stripTenantColumn` does this for a plain UPDATE, but an upsert's payload doubles as the
+ * INSERT branch, where the owner columns are exactly what anchors a new row — they cannot simply
+ * be dropped. So they are excluded from the `DO UPDATE SET` instead: state which party you are
+ * to create the row, and that statement is ignored when the row already exists.
+ *
+ * Only `anyOf` scopes need this. A direct scope injects the caller's own tenant, so writing it
+ * back onto a row the conflict guard already proved theirs is a no-op; an indirect one keeps its
+ * owner on another table entirely.
+ */
+export declare function tenantImmutableColumns(tenant: TenantContext | undefined): string[];
 /**
  * For update: builds the optional `extraCondition` ConditionBuilder for direct tenants.
  * Returns undefined for indirect or no-tenant scenarios — those are handled separately

package/dist/lib/tenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/lib/tenant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAE/G,OAAO,KAAK,EACV,MAAM,EACN,mBAAmB,EACnB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,aAAa,EACd,MAAM,aAAa,CAAC;AAMrB,wBAAsB,aAAa,CACjC,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CASpC;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,QAAQ,EAAE,EACrB,QAAQ,EAAE,MAAM,GACf,gBAAgB,CAgBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,aAAa,GAAG,SAAS,CAI3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,QAAQ,EAAE,MAAM,GACf,gBAAgB,GAAG,SAAS,CAmB9B;AAED,wBAAgB,eAAe,CAC7B,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,mBAAmB,EAC1B,aAAa,EAAE,MAAM,GACpB,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,QAAQ,EAAE,GACpB,IAAI,CAiBN;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,mBAAmB,EAC1B,SAAS,EAAE,QAAQ,EAAE,EACrB,QAAQ,EAAE,OAAO,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GAAG,cAAc,EAAE,EACrD,MAAM,EAAE,aAAa,GACpB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAsBtC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CA2Df;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,WAAW,GACjB,IAAI,CAGN;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,GAChC,gBAAgB,GAAG,SAAS,CAM9B;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,OAAO,EAAE,cAAc,GAAG,cAAc,EAAE,GACzC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,cAAc,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC,CAgBf"}
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/lib/tenant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAE/G,OAAO,KAAK,EAEV,MAAM,EACN,mBAAmB,EACnB,QAAQ,EACR,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACd,MAAM,aAAa,CAAC;AAwCrB,wBAAsB,aAAa,CACjC,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAWpC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,QAAQ,EAAE,EACrB,QAAQ,EAAE,MAAM,GACf,gBAAgB,CAgBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,aAAa,GAAG,SAAS,CAI3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,QAAQ,EAAE,MAAM,GACf,gBAAgB,GAAG,SAAS,CAoB9B;AAED,wBAAgB,eAAe,CAC7B,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,mBAAmB,EAC1B,aAAa,EAAE,MAAM,GACpB,MAAM,CAMR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,QAAQ,EAAE,GACpB,IAAI,CAYN;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,iBAAiB,GAAG,mBAAmB,EAC9C,SAAS,EAAE,QAAQ,EAAE,GACpB,IAAI,CAiBN;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,mBAAmB,EAC1B,SAAS,EAAE,QAAQ,EAAE,EACrB,QAAQ,EAAE,OAAO,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GAAG,cAAc,EAAE,EACrD,MAAM,EAAE,aAAa,GACpB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAwBtC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CA4Ef;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,WAAW,GACjB,IAAI,CAGN;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,EAAE,CAGlF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,GAChC,gBAAgB,GAAG,SAAS,CAU9B;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,OAAO,EAAE,cAAc,GAAG,cAAc,EAAE,GACzC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,cAAc,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC,CAiBf"}

package/dist/lib/tenant.js

@@ -3,31 +3,72 @@ import { httpError } from './errors.js';
 function isIndirect(scope) {
     return 'through' in scope;
 }
+function isAnyOf(scope) {
+    return 'anyOf' in scope;
+}
+/**
+ * The tenant columns living on the scoped table itself, in declaration order: one for a direct
+ * scope, several for an `anyOf` one. Never called for an indirect scope, whose column belongs to
+ * the through table.
+ */
+function ownColumns(scope) {
+    return isAnyOf(scope) ? scope.anyOf : [scope.column];
+}
+/**
+ * Whether this request could touch a scoped row at all: the addressed table is scoped, or one of
+ * the tables it can reach through a declared relation is.
+ *
+ * Relations are what makes the second case necessary — a relation is a read grant on its target
+ * and a write join a write grant, so a deliberately public host must still carry its neighbours'
+ * scopes into the joins and secondaries it drives. One level is the whole reach: joins resolve
+ * from the addressed table's own `allowedReadJoins`/`allowedWriteJoins` and never chain further.
+ *
+ * When nothing scoped is in reach, `getTenantId` is not called at all — a request that cannot
+ * read or write a scoped row should not pay for resolving a tenant, and consumer code that
+ * assumes an authenticated request should not run on routes that never needed one.
+ */
+function scopeInReach(tableConf, dbTables) {
+    if (tableConf.tenantScope)
+        return true;
+    if (!dbTables)
+        return false;
+    const relations = [...(tableConf.allowedReadJoins ?? []), ...(tableConf.allowedWriteJoins ?? [])];
+    return relations.some((join) => dbTables[join.joinSchema.tableName]?.tenantScope !== undefined);
+}
 export async function resolveTenant(options, tableConf, request) {
     if (!options.getTenantId)
         return undefined;
-    if (!tableConf.tenantScope)
+    if (!scopeInReach(tableConf, options.DbTables))
         return undefined;
     const raw = await options.getTenantId(request);
     if (raw == null)
         return undefined; // admin
     const ids = Array.isArray(raw) ? raw : [raw];
+    // `scope` stays undefined for an unscoped host: the ids still travel, so the tables it reaches
+    // enforce their own scopes, while the host itself keeps no filter.
     return { ids, scope: tableConf.tenantScope };
 }
+/**
+ * The read predicate for a scope, as a fragment every caller appends to its own WHERE.
+ *
+ * An `anyOf` scope returns an OR-mode builder — the row is visible when any listed column holds
+ * a tenant id — and every caller appends it, so the group keeps its own parentheses. A NULL
+ * column simply fails to match, which is the wanted behaviour: the other party still decides.
+ */
 export function buildTenantCondition(db, scope, tenantIds, ownTable) {
-    const col = scope.column;
-    let qualifier;
     if (isIndirect(scope)) {
         const throughTable = scope.through.schema.tableName;
-        qualifier = `${db.qi(throughTable)}.${db.qi(col)}`;
+        const cb = new ConditionBuilder('AND', db.cbDialect);
+        cb.isIn(`${db.qi(throughTable)}.${db.qi(scope.column)}`, tenantIds);
+        return cb;
     }
-    else {
-        // Qualify with the table the scope column lives on: the statement may carry
-        // joins, and a bare column shared with a joined table would be ambiguous.
-        qualifier = `${db.qi(ownTable)}.${db.qi(col)}`;
+    // Qualify with the table the scope columns live on: the statement may carry
+    // joins, and a bare column shared with a joined table would be ambiguous.
+    const cols = ownColumns(scope);
+    const cb = new ConditionBuilder(cols.length > 1 ? 'OR' : 'AND', db.cbDialect);
+    for (const col of cols) {
+        cb.isIn(`${db.qi(ownTable)}.${db.qi(col)}`, tenantIds);
     }
-    const cb = new ConditionBuilder('AND', db.cbDialect);
-    cb.isIn(qualifier, tenantIds);
     return cb;
 }
 /**
@@ -52,17 +93,18 @@ export function tenantForTable(tenant, tableConf) {
  *
  * `tableRef` is the name the scoped rows go by in that statement — the table name in a DELETE,
  * the join alias in an ON clause, the subquery alias inside a correlated SELECT. Returns
- * undefined without a tenant context (admin).
+ * undefined without a tenant context (admin) or when the table carries no scope.
  */
 export function buildTenantRowGuard(db, tenant, tableRef) {
-    if (!tenant)
+    const scope = tenant?.scope;
+    if (!tenant || !scope)
         return undefined;
     const cb = new ConditionBuilder('AND', db.cbDialect);
-    if (!isIndirect(tenant.scope)) {
-        cb.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableRef));
+    if (!isIndirect(scope)) {
+        cb.append(buildTenantCondition(db, scope, tenant.ids, tableRef));
         return cb;
     }
-    const { through, column } = tenant.scope;
+    const { through, column } = scope;
     const throughRef = db.qi(through.schema.tableName);
     const markers = tenant.ids.map(() => '?').join(', ');
     cb.raw(`EXISTS (SELECT 1 FROM ${throughRef} WHERE ` +
@@ -76,6 +118,27 @@ export function buildTenantJoin(db, scope, mainTableName) {
     const foreignField = scope.through.foreignField;
     return `INNER JOIN ${db.qi(throughTable)} ON ${db.qi(mainTableName)}.${db.qi(localField)} = ${db.qi(throughTable)}.${db.qi(foreignField)}`;
 }
+/**
+ * The insert-side rule for an `anyOf` scope: the payload must anchor the row itself.
+ *
+ * Nothing is auto-injected — with several owner columns the plugin cannot know which party the
+ * caller is meant to be, and guessing would either invent a relationship or refuse a legitimate
+ * one. So the record must name at least one listed column, and at least one of the named ones
+ * must hold a tenant id. The *other* parties are deliberately left alone: a swap request points
+ * at a colleague by definition, and requiring every listed column to match would make the shape
+ * unusable.
+ *
+ * @testonly Exported only so unit tests can exercise it directly.
+ */
+export function assertTenantAnchor(record, scope, tenantIds) {
+    const present = scope.anyOf.filter((col) => record[col] != null);
+    if (!present.length) {
+        throw httpError(400, `Missing tenant anchor: one of ${scope.anyOf.join(', ')} must be set`);
+    }
+    if (!present.some((col) => tenantIds.includes(record[col]))) {
+        throw httpError(403, 'Access denied: tenant value does not match');
+    }
+}
 /** Writes the tenant value into a record according to its scope.
  * @testonly Exported only so unit tests can exercise it directly.
  */
@@ -121,16 +184,18 @@ export async function validateTenantFK(db, scope, tenantIds, fkValues) {
 }
 /**
  * Build WHERE clause for DELETE with tenant filtering.
- * Handles both direct (simple AND) and indirect (subquery via JOIN) scopes.
+ * Handles both direct (simple AND) and indirect (subquery via JOIN) scopes; a tenant whose
+ * addressed table declares no scope yields the plain primary-key clause.
  */
 export function buildTenantDeleteWhere(db, tableName, pkCol, pkValue, tenant) {
-    if (isIndirect(tenant.scope)) {
+    const scope = tenant.scope;
+    if (scope && isIndirect(scope)) {
         const innerCb = new ConditionBuilder('AND', db.cbDialect);
         innerCb.isIn(`${db.qi(tableName)}.${db.qi(pkCol)}`, (Array.isArray(pkValue) ? pkValue : [pkValue]));
-        innerCb.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableName));
+        innerCb.append(buildTenantCondition(db, scope, tenant.ids, tableName));
         const innerWhere = innerCb.build(1, db.ph);
         const values = innerCb.getValues();
-        const joinSql = buildTenantJoin(db, tenant.scope, tableName);
+        const joinSql = buildTenantJoin(db, scope, tableName);
         const where = `${db.qi(pkCol)} IN (SELECT ${db.qi(tableName)}.${db.qi(pkCol)} FROM ${db.qi(tableName)} ${joinSql} WHERE ${innerWhere})`;
         return { where, values };
     }
@@ -141,7 +206,8 @@ export function buildTenantDeleteWhere(db, tableName, pkCol, pkValue, tenant) {
     else {
         cb.isEqual(db.qi(pkCol), pkValue);
     }
-    cb.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableName));
+    if (scope)
+        cb.append(buildTenantCondition(db, scope, tenant.ids, tableName));
     const where = cb.build(1, db.ph);
     const values = cb.getValues();
     return { where, values };
@@ -158,7 +224,8 @@ export function buildTenantDeleteWhere(db, tableName, pkCol, pkValue, tenant) {
  * any conflict column are skipped (they can only INSERT, never hit a conflict).
  */
 export async function assertTenantOwnsConflicts(db, tenant, tableName, conflictCols, records) {
-    if (!tenant || !conflictCols.length)
+    const scope = tenant?.scope;
+    if (!tenant || !scope || !conflictCols.length)
         return;
     // Collect distinct, fully-specified conflict-key tuples.
     const tuples = [];
@@ -199,19 +266,35 @@ export async function assertTenantOwnsConflicts(db, tenant, tableName, conflictC
     }
     // Tenant-mismatch clause: rows whose tenant is NOT one the caller owns.
     let joinSql = '';
-    let tenantCol;
-    if (isIndirect(tenant.scope)) {
-        joinSql = ` ${buildTenantJoin(db, tenant.scope, tableName)}`;
-        tenantCol = `${db.qi(tenant.scope.through.schema.tableName)}.${db.qi(tenant.scope.column)}`;
+    let tenantCols;
+    if (isIndirect(scope)) {
+        joinSql = ` ${buildTenantJoin(db, scope, tableName)}`;
+        tenantCols = [`${db.qi(scope.through.schema.tableName)}.${db.qi(scope.column)}`];
     }
     else {
-        tenantCol = `${qTable}.${db.qi(tenant.scope.column)}`;
+        tenantCols = ownColumns(scope).map((c) => `${qTable}.${db.qi(c)}`);
+    }
+    const inClause = (col) => {
+        const phs = tenant.ids.map((id) => {
+            values.push(id);
+            return db.ph(values.length);
+        });
+        return `${col} IN (${phs.join(', ')})`;
+    };
+    let mismatchSql;
+    if (tenantCols.length === 1) {
+        mismatchSql = `${tenantCols[0]} NOT IN (${tenant.ids.map((id) => {
+            values.push(id);
+            return db.ph(values.length);
+        }).join(', ')})`;
+    }
+    else {
+        // A NULL party makes `IN` return NULL, and `NOT NULL` is not TRUE — a plain negation would
+        // let a row with one party NULL and the other owned by a stranger pass the probe unflagged.
+        // COALESCE turns "unknown" into "not visible to me", which is what the read side already
+        // does implicitly by never matching a NULL.
+        mismatchSql = `NOT COALESCE(${tenantCols.map(inClause).join(' OR ')}, FALSE)`;
     }
-    const tenantPhs = tenant.ids.map((id) => {
-        values.push(id);
-        return db.ph(values.length);
-    });
-    const mismatchSql = `${tenantCol} NOT IN (${tenantPhs.join(', ')})`;
     const sql = `SELECT 1 FROM ${qTable}${joinSql} WHERE ${matchSql} AND ${mismatchSql} LIMIT 1`;
     const r = await db.query(sql, values);
     if (r.rows.length > 0) {
@@ -228,24 +311,27 @@ export async function assertTenantOwnsConflicts(db, tenant, tableName, conflictC
  * `updateFields` keys are DB column names (snake_case), matching `through.localField`.
  */
 export async function enforceTenantFKOnUpdate(db, tenant, updateFields) {
-    if (!tenant || !isIndirect(tenant.scope))
+    if (!tenant?.scope || !isIndirect(tenant.scope))
         return;
-    const localCol = tenant.scope.through.localField;
+    const scope = tenant.scope;
+    const localCol = scope.through.localField;
     if (!(localCol in updateFields))
         return;
     const newValue = updateFields[localCol];
     if (newValue == null)
         return;
-    await validateTenantFK(db, tenant.scope, tenant.ids, [newValue]);
+    await validateTenantFK(db, scope, tenant.ids, [newValue]);
 }
 /**
- * Mutates `fields` in-place: removes the tenant column from a SET payload (direct scopes only).
- * No-op for indirect or no scope.
+ * Mutates `fields` in-place: removes the tenant columns from a SET payload (scopes whose columns
+ * live on the table itself). An `anyOf` scope drops *every* listed column — neither party can be
+ * reassigned, the same spirit as "a tenant cannot move its own row". No-op for indirect scopes.
  */
 export function stripTenantColumn(fields, scope) {
     if (isIndirect(scope))
         return;
-    delete fields[scope.column];
+    for (const col of ownColumns(scope))
+        delete fields[col];
 }
 /**
  * For insert/bulk-upsert: enforce tenant on records that are about to be written.
@@ -254,15 +340,38 @@ export function stripTenantColumn(fields, scope) {
  * Throws 400 (ambiguous tenant) or 403 (mismatch) on violation. No-op when `tenant` is undefined.
  */
 export async function enforceTenantOnWrites(db, tenant, records) {
-    if (!tenant)
+    const scope = tenant?.scope;
+    if (!tenant || !scope)
         return;
-    if (isIndirect(tenant.scope)) {
-        const fkCol = tenant.scope.through.localField;
-        await validateTenantFK(db, tenant.scope, tenant.ids, records.map((r) => r[fkCol]));
+    if (isIndirect(scope)) {
+        const fkCol = scope.through.localField;
+        await validateTenantFK(db, scope, tenant.ids, records.map((r) => r[fkCol]));
+        return;
+    }
+    if (isAnyOf(scope)) {
+        for (const r of records)
+            assertTenantAnchor(r, scope, tenant.ids);
         return;
     }
     for (const r of records)
-        injectTenantValue(r, tenant.scope, tenant.ids);
+        injectTenantValue(r, scope, tenant.ids);
+}
+/**
+ * Columns an UPSERT must leave alone when it lands on an existing row.
+ *
+ * `stripTenantColumn` does this for a plain UPDATE, but an upsert's payload doubles as the
+ * INSERT branch, where the owner columns are exactly what anchors a new row — they cannot simply
+ * be dropped. So they are excluded from the `DO UPDATE SET` instead: state which party you are
+ * to create the row, and that statement is ignored when the row already exists.
+ *
+ * Only `anyOf` scopes need this. A direct scope injects the caller's own tenant, so writing it
+ * back onto a row the conflict guard already proved theirs is a no-op; an indirect one keeps its
+ * owner on another table entirely.
+ */
+export function tenantImmutableColumns(tenant) {
+    if (!tenant?.scope || !isAnyOf(tenant.scope))
+        return [];
+    return tenant.scope.anyOf;
 }
 /**
  * For update: builds the optional `extraCondition` ConditionBuilder for direct tenants.
@@ -270,13 +379,17 @@ export async function enforceTenantOnWrites(db, tenant, records) {
  * (indirect uses pre-check via `assertTenantOwnership`).
  */
 export function buildTenantUpdateExtra(db, tenant) {
-    if (!tenant || isIndirect(tenant.scope))
+    const scope = tenant?.scope;
+    if (!scope || isIndirect(scope))
         return undefined;
-    const cb = new ConditionBuilder('AND', db.cbDialect);
-    if (tenant.ids.length === 1)
-        cb.isEqual(tenant.scope.column, tenant.ids[0]);
-    else
-        cb.isIn(tenant.scope.column, tenant.ids);
+    const cols = ownColumns(scope);
+    const cb = new ConditionBuilder(cols.length > 1 ? 'OR' : 'AND', db.cbDialect);
+    for (const col of cols) {
+        if (tenant.ids.length === 1)
+            cb.isEqual(col, tenant.ids[0]);
+        else
+            cb.isIn(col, tenant.ids);
+    }
     return cb;
 }
 /**
@@ -285,14 +398,15 @@ export function buildTenantUpdateExtra(db, tenant) {
  * No-op for direct or no-tenant — those are enforced via `extraCondition` in the UPDATE itself.
  */
 export async function assertTenantOwnership(db, tenant, tableName, pkCol, pkValue) {
-    if (!tenant || !isIndirect(tenant.scope))
+    if (!tenant?.scope || !isIndirect(tenant.scope))
         return;
+    const scope = tenant.scope;
     const cb = new ConditionBuilder('AND', db.cbDialect);
     const cols = Array.isArray(pkCol) ? pkCol : [pkCol];
     const vals = Array.isArray(pkValue) ? pkValue : [pkValue];
     cols.forEach((c, i) => cb.isEqual(`${db.qi(tableName)}.${db.qi(c)}`, vals[i]));
-    cb.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableName));
-    const sql = `SELECT 1 FROM ${db.qi(tableName)} ${buildTenantJoin(db, tenant.scope, tableName)} WHERE ${cb.build(1, db.ph)} LIMIT 1`;
+    cb.append(buildTenantCondition(db, scope, tenant.ids, tableName));
+    const sql = `SELECT 1 FROM ${db.qi(tableName)} ${buildTenantJoin(db, scope, tableName)} WHERE ${cb.build(1, db.ph)} LIMIT 1`;
     const r = await db.query(sql, cb.getValues());
     if (r.rows.length === 0) {
         throw httpError(404, 'Record not found');
@@ -305,13 +419,14 @@ export async function assertTenantOwnership(db, tenant, tableName, pkCol, pkValu
  * `beforeBulkDelete` hook, so user code never runs against rows the caller cannot access.
  */
 export async function assertTenantOwnsAll(db, tenant, tableName, pkCol, ids) {
-    if (!tenant || !ids.length)
+    const scope = tenant?.scope;
+    if (!tenant || !scope || !ids.length)
         return;
     const qualifiedPk = `${db.qi(tableName)}.${db.qi(pkCol)}`;
     const cb = new ConditionBuilder('AND', db.cbDialect);
     cb.isIn(qualifiedPk, ids);
-    cb.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableName));
-    const join = isIndirect(tenant.scope) ? ` ${buildTenantJoin(db, tenant.scope, tableName)}` : '';
+    cb.append(buildTenantCondition(db, scope, tenant.ids, tableName));
+    const join = isIndirect(scope) ? ` ${buildTenantJoin(db, scope, tableName)}` : '';
     const sql = `SELECT DISTINCT ${qualifiedPk} AS pk FROM ${db.qi(tableName)}${join} WHERE ${cb.build(1, db.ph)}`;
     const r = await db.query(sql, cb.getValues());
     const uniqueRequested = new Set(ids.map((v) => String(v))).size;

package/dist/lib/write-access.d.ts

@@ -0,0 +1,36 @@
+import type { TSchema } from '@sinclair/typebox';
+import type { ITable, SchemaDefinition } from '../types.js';
+/**
+ * Write visibility — the counterpart of `read-access.ts`.
+ *
+ * A field is excluded from writes for one of two reasons:
+ *
+ *  - the database computes it (`GENERATED ALWAYS AS (<expr>)`), which the generated Schema
+ *    publishes in `generatedFields`. Naming such a column in an INSERT or an UPDATE is an
+ *    error on both engines, whoever put the value there, so this exclusion is a fact about
+ *    the column rather than a decision about the caller;
+ *  - the table config lists it in `writeExclude`, for a column the deployment keeps read-only
+ *    for reasons of its own.
+ *
+ * Excluded fields are removed from the write body schemas — so an HTTP caller gets a 400 from
+ * `additionalProperties: false` rather than a driver error — and dropped again in the engines,
+ * which `sqlApi.*` reaches without passing through those schemas.
+ *
+ * This is not `excludeFromCreation`, which whitelists CLIENT input on insert only and lets a
+ * hook assign the field afterwards (ADR 0005); nor is it the place for per-caller field rules,
+ * which stay in `beforeUpdate` / `validate` (ADR 0011).
+ */
+export declare function writeExcludedFields(tableConf: ITable | undefined, schema: SchemaDefinition | undefined): Set<string>;
+/**
+ * A field map minus everything that may not be written. Used to build the write body schemas,
+ * where the removal is what turns a rejected column into a 400 instead of a 500.
+ */
+export declare function writableFields(fields: Record<string, TSchema>, tableConf: ITable | undefined, schema: SchemaDefinition | undefined): Record<string, TSchema>;
+/**
+ * Drop the non-writable fields from a camelCase record, in place.
+ *
+ * Call this AFTER the write hooks, unlike `excludeFromCreation`: a hook cannot be allowed to
+ * put back a value the database will refuse, so the last word has to belong to the exclusion.
+ */
+export declare function removeWriteExcluded(record: Record<string, unknown>, tableConf: ITable | undefined, schema: SchemaDefinition | undefined): void;
+//# sourceMappingURL=write-access.d.ts.map

package/dist/lib/write-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-access.d.ts","sourceRoot":"","sources":["../../src/lib/write-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,gBAAgB,GAAG,SAAS,GACnC,GAAG,CAAC,MAAM,CAAC,CAIb;AAUD;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,gBAAgB,GAAG,SAAS,GACnC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,gBAAgB,GAAG,SAAS,GACnC,IAAI,CAKN"}

package/dist/lib/write-access.js

@@ -0,0 +1,58 @@
+/**
+ * Write visibility — the counterpart of `read-access.ts`.
+ *
+ * A field is excluded from writes for one of two reasons:
+ *
+ *  - the database computes it (`GENERATED ALWAYS AS (<expr>)`), which the generated Schema
+ *    publishes in `generatedFields`. Naming such a column in an INSERT or an UPDATE is an
+ *    error on both engines, whoever put the value there, so this exclusion is a fact about
+ *    the column rather than a decision about the caller;
+ *  - the table config lists it in `writeExclude`, for a column the deployment keeps read-only
+ *    for reasons of its own.
+ *
+ * Excluded fields are removed from the write body schemas — so an HTTP caller gets a 400 from
+ * `additionalProperties: false` rather than a driver error — and dropped again in the engines,
+ * which `sqlApi.*` reaches without passing through those schemas.
+ *
+ * This is not `excludeFromCreation`, which whitelists CLIENT input on insert only and lets a
+ * hook assign the field afterwards (ADR 0005); nor is it the place for per-caller field rules,
+ * which stay in `beforeUpdate` / `validate` (ADR 0011).
+ */
+export function writeExcludedFields(tableConf, schema) {
+    const excluded = new Set(schema?.generatedFields ?? []);
+    for (const field of tableConf?.writeExclude ?? [])
+        excluded.add(field);
+    return excluded;
+}
+/** True when the table has nothing to exclude — lets callers keep their existing object. */
+function hasWriteExclusions(tableConf, schema) {
+    return (schema?.generatedFields?.length ?? 0) > 0 || (tableConf?.writeExclude?.length ?? 0) > 0;
+}
+/**
+ * A field map minus everything that may not be written. Used to build the write body schemas,
+ * where the removal is what turns a rejected column into a 400 instead of a 500.
+ */
+export function writableFields(fields, tableConf, schema) {
+    if (!hasWriteExclusions(tableConf, schema))
+        return fields;
+    const excluded = writeExcludedFields(tableConf, schema);
+    const result = {};
+    for (const [name, value] of Object.entries(fields)) {
+        if (!excluded.has(name))
+            result[name] = value;
+    }
+    return result;
+}
+/**
+ * Drop the non-writable fields from a camelCase record, in place.
+ *
+ * Call this AFTER the write hooks, unlike `excludeFromCreation`: a hook cannot be allowed to
+ * put back a value the database will refuse, so the last word has to belong to the exclusion.
+ */
+export function removeWriteExcluded(record, tableConf, schema) {
+    if (!hasWriteExclusions(tableConf, schema))
+        return;
+    for (const field of writeExcludedFields(tableConf, schema)) {
+        delete record[field];
+    }
+}

package/dist/routes/auto/get.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/get.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAA8B,SAAS,CACrC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAkBf"}
+{"version":3,"file":"get.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/get.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAA8B,SAAS,CACrC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/routes/auto/get.routes.js

@@ -1,4 +1,5 @@
 import { Type } from '@sinclair/typebox';
+import { GetTableResponse } from '../../lib/schema/get.js';
 import { registerForAllTables } from './route-helpers.js';
 export default async function getRoutes(fastify, options) {
     await registerForAllTables(fastify, options, {
@@ -7,9 +8,9 @@ export default async function getRoutes(fastify, options) {
         method: 'GET',
         url: (tc) => `/rest/${tc.Schema.tableName}/:id`,
         successStatus: 200,
-        schemas: (_db, _table, tc) => ({
+        schemas: (db, table) => ({
             params: Type.Object({ id: Type.String() }),
-            response: Type.Object({ main: Type.Partial(Type.Object(tc.Schema.fields)) }),
+            response: GetTableResponse(db, table),
         }),
         summary: 'Get',
         description: (name) => `Get a record from ${name} by primary key`,

package/dist/routes/auto/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAc7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;kCAuD/C,eAAe,WACf,mBAAmB,KAC3B,OAAO,CAAC,IAAI,CAAC;AAHhB,wBA6DoC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAc7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;kCAuD/C,eAAe,WACf,mBAAmB,KAC3B,OAAO,CAAC,IAAI,CAAC;AAHhB,wBAsEoC"}

package/dist/routes/auto/plugin.js

@@ -1,8 +1,8 @@
 import fp from 'fastify-plugin';
 import { ConditionBuilder } from 'node-condition-builder';
 import { getDialect } from '../../lib/dialect.js';
-import { ensureSqlApiDecorator } from '../../lib/sql-api-decorator.js';
-import { setupSwagger } from '../../lib/setup-swagger.js';
+import { ensureSqlApiDecorator } from '../sql-api-decorator.js';
+import { setupSwagger } from '../setup-swagger.js';
 import searchRoutes from './search.routes.js';
 import getRoutes from './get.routes.js';
 import insertRoutes from './insert.routes.js';
@@ -82,10 +82,16 @@ export default fp(async function fastifyAutoSqlApi(fastify, options) {
                 });
             }
             const statusCode = error.statusCode || 500;
+            // A sanitized error carries the request id so the client can point at the log line
+            // holding the real cause, and — under `exposeDebugInfo` — the description of that
+            // cause (ADR 0013). Both are additive: the fields above never change shape.
+            const sanitized = error;
             reply.status(statusCode).send({
                 statusCode,
                 error: error.name || 'Error',
                 message: error.message,
+                ...(sanitized.requestId ? { requestId: sanitized.requestId } : {}),
+                ...(sanitized.debugInfo ? { debugInfo: sanitized.debugInfo } : {}),
             });
         });
         if (options.swagger) {

package/dist/routes/auto/route-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-helpers.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/route-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG7E,OAAO,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAQ5F,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQlG;AAED,UAAU,WAAW;IAEnB,IAAI,CAAC,EAAE,GAAG,CAAC;IAEX,MAAM,CAAC,EAAE,GAAG,CAAC;IAEb,WAAW,CAAC,EAAE,GAAG,CAAC;IAElB,QAAQ,CAAC,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,iGAAiG;IACjG,SAAS,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1C,gFAAgF;IAChF,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,aAAa,EAAE,GAAG,GAAG,GAAG,CAAC;IACzB,wIAAwI;IACxI,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,WAAW,CAAC;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,MAAM,CAAC;IACpF;2EACuE;IACvE,MAAM,EAAE,CACN,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,KAChB,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AA6DD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAuBf"}
+{"version":3,"file":"route-helpers.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/route-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI7E,OAAO,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAQ5F,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQlG;AAED,UAAU,WAAW;IAEnB,IAAI,CAAC,EAAE,GAAG,CAAC;IAEX,MAAM,CAAC,EAAE,GAAG,CAAC;IAEb,WAAW,CAAC,EAAE,GAAG,CAAC;IAElB,QAAQ,CAAC,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,iGAAiG;IACjG,SAAS,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1C,gFAAgF;IAChF,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,aAAa,EAAE,GAAG,GAAG,GAAG,CAAC;IACzB,wIAAwI;IACxI,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,WAAW,CAAC;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,MAAM,CAAC;IACpF;2EACuE;IACvE,MAAM,EAAE,CACN,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,KAChB,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AA6DD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CA6Bf"}