@abloatai/ablo 0.36.0 → 0.37.0

package/dist/transaction/schema/schema.js

@@ -1,325 +0,0 @@
-/**
- * Schema Definition + Type Inference
- *
- * defineSchema() wraps your models. Types are inferred via Zod — no custom type system.
- *
- * Usage:
- *   import { z } from 'zod';
- *   import { defineSchema, model, relation } from '@abloatai/ablo/schema';
- *
- *   const schema = defineSchema({
- *     tasks: model({
- *       title: z.string(),
- *       status: z.enum(['todo', 'doing', 'done']).default('todo'),
- *       projectId: z.string().optional(),
- *     }, {
- *       project: relation.belongsTo('projects', 'projectId'),
- *     }),
- *   });
- *
- *   type Task = InferModel<typeof schema, 'tasks'>;
- */
-import { z } from 'zod';
-import { AbloValidationError } from '../errors.js';
-import { fieldRef } from './fieldRef.js';
-import { scopeSchema, grantsRefSchema } from './roles.js';
-// Sync-group roles (identity and entity) are defined in `./roles.js` and
-// re-exported here so they can also be imported from this module. See
-// `./roles.js` for the full vocabulary.
-export { identityRole, entityRole, extractIdentityIds, extractEntityIds, composeIdentitySyncGroups, composeEntitySyncGroups, intersectRequestedWithAllowed, syncGroup, syncGroupSchema, syncGroupInputSchema, isSyncGroupInput, identityRoleSchema, entityRoleSchema, roleSchema, roleSourceSchema, scopeSchema, grantsRefSchema, groupsInputSchema, } from './roles.js';
-function resolveCasing(fn) {
-    if (fn === undefined)
-        return (x) => x;
-    if (typeof fn === 'function')
-        return fn;
-    switch (fn) {
-        case 'snake_case':
-            return camelToSnake;
-        case 'camelCase':
-            return (x) => x;
-    }
-}
-/** Converts a camelCase identifier to snake_case. Kept local so the package
- * carries no database-driver dependency, and so consumers on any stack get the
- * same result. */
-function camelToSnake(identifier) {
-    return identifier.replace(/[A-Z]/g, (ch) => `_${ch.toLowerCase()}`);
-}
-/**
- * Session settings Ablo already sets on its direct-write connection. A
- * `sessionSettings` entry FORWARDS Ablo's trusted context into a setting the
- * customer's own policies read — it may never reassign one of these, which would
- * let a schema push relax the engine's own scoping, timeouts, or `row_security`.
- * Shared with the engine's direct-write seam so authoring-time validation and
- * the runtime guard read one list. See ADR 0011.
- */
-export const RESERVED_SESSION_SETTINGS = [
-    'statement_timeout',
-    'lock_timeout',
-    'row_security',
-    'search_path',
-    'app.current_org_id',
-    'app.current_project_id',
-    'app.current_environment',
-    'app.current_sandbox_id',
-    'app.current_participant_id',
-    'app.current_participant_kind',
-    'app.current_user_id',
-];
-/**
- * Base fields every synced model gets automatically.
- *
- * Exported (internal) so `parseSchema` can rebuild a model's validator the
- * same way `defineSchema` does — `baseFieldsSchema.merge(modelSchema)` — when
- * reconstructing a `Schema` from its JSON form.
- */
-export const baseFieldsSchema = z.object({
-    id: z.string(),
-    createdAt: z.date(),
-    updatedAt: z.date(),
-    organizationId: z.string().optional(),
-    createdBy: z.string().optional(),
-});
-/**
- * The base-column names every model carries automatically — the keys of
- * {@link baseFieldsSchema}, kept here as the single source of truth. Code
- * generation reads it to avoid emitting a base column twice, and
- * {@link defineSchema} uses it to reject a model that redeclares one, since
- * merging the user's field over the base field would produce a `string & Date`
- * type and break the build.
- */
-export const BASE_FIELDS = [
-    'id',
-    'createdAt',
-    'updatedAt',
-    'organizationId',
-    'createdBy',
-];
-// ── Factory ───────────────────────────────────────────────────────────────
-/**
- * Define a sync engine schema.
- *
- * ```ts
- * const schema = defineSchema({
- *   tasks: model({ title: z.string(), status: z.string().default('todo') }),
- *   projects: model({ name: z.string() }),
- * });
- * ```
- */
-/**
- * Rejects field names that will not survive the sync driver's snake_case ↔
- * camelCase round-trip. The driver maps identifiers like this:
- *
- *   `content_json`       → `contentJson`   (snake → camel)
- *   `contentJson`        → `content_json`  (camel → snake)
- *   `contentJSON`        → `content_j_s_o_n` (does not round-trip)
- *
- * A name that does not round-trip through this pair of transforms will silently
- * fail to populate on the client: the wire delivers one casing, the model reads
- * another, and the field lands as `undefined`. Catching it here surfaces the
- * problem when the schema is defined rather than at runtime.
- *
- * The rule: a standard camelCase identifier has runs of a single uppercase
- * letter followed by lowercase letters, never two uppercase letters in a row.
- * `contentJSON` has `JSON` in all caps, so it is rejected.
- */
-function assertRoundTrippableCamelCase(modelName, fieldName) {
-    // Base fields merged in by defineSchema are already validated; skip.
-    if (fieldName === 'id')
-        return;
-    // Leading-lowercase constraint: fields must be camelCase, not PascalCase.
-    // PascalCase is reserved for typenames.
-    const first = fieldName.charAt(0);
-    if (first >= 'A' && first <= 'Z') {
-        throw new AbloValidationError(`[defineSchema] ${modelName}.${fieldName}: field names must start lowercase ` +
-            `(camelCase). Use "${first.toLowerCase()}${fieldName.slice(1)}" instead.`, { code: 'schema_field_not_camelcase' });
-    }
-    // Two-consecutive-uppercase check. The classic failure mode is
-    // `contentJSON`, `contentHTML`, `myURLParam`, etc. These don't round-trip
-    // through `postgres.camel` — the snake_case intermediate would be
-    // `content_j_s_o_n`, which is not a column that exists.
-    for (let i = 0; i < fieldName.length - 1; i++) {
-        const a = fieldName.charAt(i);
-        const b = fieldName.charAt(i + 1);
-        const aUpper = a >= 'A' && a <= 'Z';
-        const bUpper = b >= 'A' && b <= 'Z';
-        if (aUpper && bUpper) {
-            throw new AbloValidationError(`[defineSchema] ${modelName}.${fieldName}: two consecutive uppercase ` +
-                `letters ("${a}${b}") will not round-trip through the ` +
-                `snake_case ↔ camelCase transform used by the sync driver. ` +
-                `The wire delivers camelCase (lowercase after the first letter of ` +
-                `each word); a field named "${fieldName}" would never receive its ` +
-                `value and read as undefined on the client. Use standard ` +
-                `camelCase (e.g. "contentJson" instead of "contentJSON").`, { code: 'schema_field_consecutive_caps' });
-        }
-    }
-}
-/**
- * One {@link FieldRef} per declared field, keyed by model then field.
- *
- * Every construction of a {@link Schema} goes through here — `defineSchema`,
- * the `selectModels`/`omitModels` projections, and the deserializer — so a
- * projection carries references for exactly the models it kept and a schema
- * rebuilt from JSON carries them at all.
- */
-export function buildFieldRefs(models) {
-    const refs = {};
-    for (const [model, def] of Object.entries(models)) {
-        const perField = {};
-        for (const field of Object.keys(def.shape))
-            perField[field] = fieldRef(model, field);
-        refs[model] = perField;
-    }
-    return refs;
-}
-export function defineSchema(models, options) {
-    // Build validators with base fields merged in, and resolve defaults for
-    // `typename` and `persist.store` so downstream code (the loader and the
-    // hydration pipeline) can rely on these fields being set without re-deriving
-    // them at every call site.
-    //
-    // Defaults:
-    //   typename      ← schema key (e.g. `block` → `'block'`)
-    //   persist.store ← typename (only resolved when `persist` was provided)
-    //
-    // A consumer that passes `typename: 'Block'` explicitly (common when
-    // the wire shape uses PascalCase while the schema key is camelCase) keeps
-    // that value — the fallback only fires when the field is unset.
-    //
-    // The models record is rebuilt rather than mutated in place because
-    // `ModelDef`'s fields are `readonly`. The rebuild is a shallow spread per
-    // entry, so the inferred shape/relations/fields metadata references are
-    // preserved (no type inference regression at consumer call sites).
-    const validators = {};
-    const resolvedModels = {};
-    const casing = resolveCasing(options?.casing);
-    for (const [name, def] of Object.entries(models)) {
-        // Catch round-trip-hostile field names at definition time. Deferring
-        // this check to runtime means every affected field silently reads
-        // `undefined` on the client — and the author only notices when a UI
-        // that depends on the field goes blank. Throwing here makes the
-        // failure immediate and unambiguous.
-        for (const fieldName of Object.keys(def.shape)) {
-            assertRoundTrippableCamelCase(name, fieldName);
-            // Reserved base columns are merged in below via `baseFieldsSchema.merge`,
-            // and Zod `.merge` silently OVERWRITES the base field with the user's —
-            // e.g. a model declaring `createdAt: z.string()` ends up with a field
-            // typed `string & Date`, which breaks the build. Reject the collision at
-            // definition time so the author sees an unambiguous error instead.
-            if (BASE_FIELDS.includes(fieldName)) {
-                throw new AbloValidationError(`[defineSchema] ${name}.${fieldName}: field \`${fieldName}\` collides with a ` +
-                    `reserved field that the SDK provides automatically ` +
-                    `(${BASE_FIELDS.join(', ')}). Remove it from your model — redeclaring it ` +
-                    `produces a \`string & Date\` type and breaks the build.`, { code: 'schema_reserved_field', param: `${name}.${fieldName}` });
-            }
-        }
-        validators[name] = baseFieldsSchema.merge(def.schema);
-        // Resolve every relation's `foreignKeyColumn` once, now. The builder
-        // constructs each RelationDef with `foreignKeyColumn = foreignKey`
-        // (identity) so this is a no-op when `casing` is unset — existing
-        // consumers get the same behavior they had before the option landed.
-        // When `casing: 'snake_case'` is set, every FK flips to its
-        // snake_case DB column name here and nowhere else. A field-level
-        // `.from(column)` override wins over the convention, so legacy
-        // columns stay declared in the artifact instead of rediscovered by
-        // SQL compilers. Server-side SQL compilers read the resolved value
-        // directly.
-        for (const rel of Object.values(def.relations)) {
-            const fieldColumn = def.fields[rel.foreignKey]?.column;
-            rel.foreignKeyColumn = fieldColumn ?? casing(rel.foreignKey);
-        }
-        const typename = def.typename ?? name;
-        const persist = def.persist
-            ? { ...def.persist, store: def.persist.store ?? typename }
-            : undefined;
-        // Physical table defaults to the schema key — the SAME rule the
-        // provisioner/planner use (`tableName ?? key`), resolved here once so the
-        // serialized artifact always carries it. Required now that models are
-        // mutable by default: the server's `buildModelMap` rejects a mutable
-        // model with no `tableName`, which would otherwise break every commit.
-        const tableName = def.tableName ?? name;
-        resolvedModels[name] = { ...def, typename, tableName, persist };
-    }
-    validateSyncGroupSchema(resolvedModels);
-    validateSessionSettings(options?.sessionSettings ?? {});
-    return {
-        // Cast back to S: we only added values to optional fields that were
-        // already part of ModelDef, so the shape is structurally unchanged.
-        models: resolvedModels,
-        validators: validators,
-        fields: buildFieldRefs(resolvedModels),
-        identityRoles: options?.identityRoles ?? [],
-        sessionSettings: options?.sessionSettings ?? {},
-    };
-}
-/**
- * Reject session-setting mappings that couldn't do what the author intends —
- * caught here at definition time rather than silently dropped on the write path.
- * Each key must name a non-empty setting the customer's policies read, and must
- * not reassign one Ablo already manages. Uniqueness needs no check: the map is
- * keyed by the setting name, so a duplicate is unrepresentable.
- */
-function validateSessionSettings(settings) {
-    for (const setting of Object.keys(settings)) {
-        const name = setting.trim();
-        if (name === '') {
-            throw new AbloValidationError(`[defineSchema] sessionSettings: a key is empty. Name the Postgres ` +
-                `setting your row-level-security policies read, e.g. ` +
-                `\`{ 'app.current_org': 'orgId' }\`.`, { code: 'schema_definition_invalid', param: 'sessionSettings' });
-        }
-        if (RESERVED_SESSION_SETTINGS.includes(name)) {
-            throw new AbloValidationError(`[defineSchema] sessionSettings: \`${name}\` is a setting Ablo already ` +
-                `manages on its write connection, so a mapping can't reassign it — ` +
-                `that would let a schema relax the engine's own scoping. Point your ` +
-                `policies at a setting your app owns (e.g. \`app.current_org\`) and ` +
-                `map Ablo's trusted identity into that instead. Reserved: ` +
-                `${RESERVED_SESSION_SETTINGS.join(', ')}.`, { code: 'schema_definition_invalid', param: `sessionSettings.${name}` });
-        }
-    }
-}
-/**
- * Validates the relation-driven sync-group declarations (`scope` and `grants`)
- * at schema-build time, so a mistyped membership edge fails here — with a
- * structured error (`code`, `param`, `doc_url`) pointing at the exact
- * declaration — rather than silently mis-routing changes at runtime.
- */
-function validateSyncGroupSchema(models) {
-    for (const [name, def] of Object.entries(models)) {
-        // Shape-validate the `scope` declaration via the shared Zod schema.
-        if (def.scope !== undefined && !scopeSchema.safeParse(def.scope).success) {
-            throw new AbloValidationError(`Model "${name}": scope kind "${String(def.scope)}" must be a lowercase identifier (e.g. 'workspace').`, { code: 'schema_scope_kind_invalid', param: `${name}.scope` });
-        }
-        if (!def.grants)
-            continue;
-        // Shape-validate the `grants` edge via the shared Zod schema before the
-        // cross-field (relation-exists / belongsTo) checks below.
-        if (!grantsRefSchema.safeParse(def.grants).success) {
-            throw new AbloValidationError(`Model "${name}": grants must be { subject, scope } naming two relations on this model.`, { code: 'schema_grants_shape_invalid', param: `${name}.grants` });
-        }
-        const relations = def.relations;
-        for (const role of ['subject', 'scope']) {
-            const relName = def.grants[role];
-            const rel = relations?.[relName];
-            if (!rel) {
-                throw new AbloValidationError(`Model "${name}": grants.${role} "${relName}" is not a relation on this model. ` +
-                    `Declare a \`belongsTo\` relation named "${relName}" first.`, { code: 'schema_grants_relation_missing', param: `${name}.grants.${role}` });
-            }
-            if (rel.type !== 'belongsTo') {
-                throw new AbloValidationError(`Model "${name}": grants.${role} "${relName}" must be a \`belongsTo\` relation ` +
-                    `(got "${rel.type}"). A membership edge points at a single subject/scope row.`, { code: 'schema_grants_relation_kind', param: `${name}.grants.${role}` });
-            }
-        }
-        // The scope edge must target a model that is actually a scope root —
-        // otherwise the resolved `<kind>:<id>` group is one nothing fans into.
-        const scopeRel = relations[def.grants.scope];
-        // Unreachable: the role loop above already threw if the scope relation
-        // is missing — this narrows the indexed access for the checks below.
-        if (!scopeRel)
-            continue;
-        const target = models[scopeRel.target];
-        if (target && !target.scope) {
-            throw new AbloValidationError(`Model "${name}": grants.scope "${def.grants.scope}" targets "${scopeRel.target}", ` +
-                `which is not a scope root. Add \`scope: true\` to the "${scopeRel.target}" model.`, { code: 'schema_grants_target_not_scope_root', param: `${scopeRel.target}.scope` });
-        }
-    }
-}

package/dist/transaction/schema/tenancy.d.ts

@@ -1,139 +0,0 @@
-/**
- * Defines how a model's rows are scoped to a tenant. Two forms live here, and the
- * separation between them is deliberate:
- *
- *   1. The canonical form, {@link Tenancy} — a discriminated union that every
- *      consumer reads (provisioning and row-level security, introspection, the
- *      runtime, and the CLI) and the shape that crosses the wire in `ModelJSON`.
- *      One exhaustively switchable shape, so the type system enforces the isolation
- *      boundary.
- *   2. The authoring form, {@link PolicyInput} — the `policy: { by }` option a
- *      schema author writes. The name follows SQL row-level security, where a
- *      policy is the rule that decides which rows a tenant may read.
- *      {@link resolvePolicy} converts it to the canonical {@link Tenancy} when the
- *      model is built, so the authoring vocabulary never reaches the wire or any
- *      consumer.
- *
- * The canonical form is an exhaustively switchable discriminated union, so the type
- * system enforces the isolation boundary at every consumer. The authoring form is a
- * flat object whose `by` names the choice and whose per-branch rules are checked by a
- * refinement — the opt-out from tenant scoping (`{ by: 'none' }`) and the
- * source-derived case (`{ by: 'source' }`) are explicit, named values rather than
- * falsy flags, important because `none` makes an entire table readable across tenants.
- */
-import { z } from 'zod';
-/** The default physical tenancy column. This is the single canonical definition of that column name. */
-export declare const DEFAULT_ORG_COLUMN = "organization_id";
-/**
- * Scopes a table's rows through a parent table, for rows that carry no tenancy
- * column of their own (for example, blocks scoped through their section, report,
- * and organization). This is the canonical `parent` payload; authors write the
- * friendlier {@link PolicyInput} `{ by: 'parent', fk, parent }` form, which
- * {@link resolvePolicy} normalizes into this.
- */
-export declare const scopedViaRefSchema: z.ZodObject<{
-    localKey: z.ZodString;
-    parentTable: z.ZodString;
-    parentKey: z.ZodOptional<z.ZodString>;
-    parentOrgColumn: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type ScopedViaRef = z.infer<typeof scopedViaRefSchema>;
-/** How a model's rows are scoped to a tenant — the canonical, wire-facing form. */
-export declare const tenancySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    kind: z.ZodLiteral<"column">;
-    column: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"parent">;
-    via: z.ZodObject<{
-        localKey: z.ZodString;
-        parentTable: z.ZodString;
-        parentKey: z.ZodOptional<z.ZodString>;
-        parentOrgColumn: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>;
-}, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"none">;
-}, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"source">;
-}, z.core.$strip>], "kind">;
-export type Tenancy = z.infer<typeof tenancySchema>;
-/**
- * The authoring form of tenancy — what a schema author writes as the model's
- * `policy` option. The name follows SQL row-level security, where a policy is the
- * rule that decides which rows a tenant may read.
- *
- * The four choices `by` can take:
- *
- * - `{ by: 'column' }` — a row-local tenancy column (the default). `column`
- *   overrides the name (default {@link DEFAULT_ORG_COLUMN}).
- * - `{ by: 'parent', fk, parent }` — inherit tenancy through a foreign key when
- *   this table has no tenancy column of its own. `parentKey` (default `'id'`) and
- *   `parentTenantColumn` (default {@link DEFAULT_ORG_COLUMN}) are optional overrides.
- * - `{ by: 'source' }` — derive the organization from the connected source that
- *   registered the model, for a single-tenant connected database that carries no
- *   `organization_id` column. The registration is the tenant boundary.
- * - `{ by: 'none' }` — genuinely global or reference data. This makes the whole
- *   table readable across tenants, so it is correct only for tables that have no tenant.
- *
- * The runtime schema is one flat object rather than a discriminated union: `by`
- * selects the branch, and the {@link https://zod.dev | superRefine} pass enforces
- * the per-branch field rules (`parent` requires `fk` and `parent`; the other three
- * take no branch fields). The exported {@link PolicyInput} type is hand-written as a
- * precise union so the compiler still requires the right fields per `by` — the flat
- * schema validates at runtime, the union guides at author time, and the type guard
- * below keeps the two from drifting.
- */
-export declare const policyInputSchema: z.ZodObject<{
-    by: z.ZodEnum<{
-        none: "none";
-        source: "source";
-        column: "column";
-        parent: "parent";
-    }>;
-    column: z.ZodOptional<z.ZodString>;
-    fk: z.ZodOptional<z.ZodString>;
-    parent: z.ZodOptional<z.ZodString>;
-    parentKey: z.ZodOptional<z.ZodString>;
-    parentTenantColumn: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-/**
- * The precise authoring type. Hand-written rather than inferred from
- * {@link policyInputSchema} so the compiler enforces the per-branch fields the flat
- * runtime schema can only check at parse time — an author writing `{ by: 'parent' }`
- * gets a type error for the missing `fk`/`parent`, not a runtime one.
- */
-export type PolicyInput = {
-    by: 'column';
-    column?: string;
-} | {
-    by: 'parent';
-    fk: string;
-    parent: string;
-    parentKey?: string;
-    parentTenantColumn?: string;
-} | {
-    by: 'source';
-} | {
-    by: 'none';
-};
-/**
- * Normalizes the authoring {@link PolicyInput} into the canonical {@link Tenancy}.
- * Called once, when the model is built, so that `ModelDef`, `ModelJSON`, and every
- * consumer see only the canonical union. Omitting `policy` defaults to a row-local
- * `organization_id` column.
- */
-export declare function resolvePolicy(input?: PolicyInput): Tenancy;
-/**
- * Reads the canonical {@link Tenancy} off an already-built model definition (or a
- * parsed `ModelJSON`), defaulting to a row-local `organization_id` column when it is
- * absent.
- *
- * This is the read-side helper. Consumers — provisioning and row-level security, the
- * membership resolver, DDL generation, and the CLI — call it to get a model's
- * tenancy without re-deriving the default each time. It is not the authoring
- * normalizer; that is {@link resolvePolicy}.
- */
-export declare function resolveTenancy(def: {
-    tenancy?: Tenancy;
-}): Tenancy;
-/** The physical tenancy column for a column-scoped model, else `null`. */
-export declare function tenancyColumn(t: Tenancy): string | null;

package/dist/transaction/schema/tenancy.js

@@ -1,190 +0,0 @@
-/**
- * Defines how a model's rows are scoped to a tenant. Two forms live here, and the
- * separation between them is deliberate:
- *
- *   1. The canonical form, {@link Tenancy} — a discriminated union that every
- *      consumer reads (provisioning and row-level security, introspection, the
- *      runtime, and the CLI) and the shape that crosses the wire in `ModelJSON`.
- *      One exhaustively switchable shape, so the type system enforces the isolation
- *      boundary.
- *   2. The authoring form, {@link PolicyInput} — the `policy: { by }` option a
- *      schema author writes. The name follows SQL row-level security, where a
- *      policy is the rule that decides which rows a tenant may read.
- *      {@link resolvePolicy} converts it to the canonical {@link Tenancy} when the
- *      model is built, so the authoring vocabulary never reaches the wire or any
- *      consumer.
- *
- * The canonical form is an exhaustively switchable discriminated union, so the type
- * system enforces the isolation boundary at every consumer. The authoring form is a
- * flat object whose `by` names the choice and whose per-branch rules are checked by a
- * refinement — the opt-out from tenant scoping (`{ by: 'none' }`) and the
- * source-derived case (`{ by: 'source' }`) are explicit, named values rather than
- * falsy flags, important because `none` makes an entire table readable across tenants.
- */
-import { z } from 'zod';
-/** The default physical tenancy column. This is the single canonical definition of that column name. */
-export const DEFAULT_ORG_COLUMN = 'organization_id';
-/**
- * Scopes a table's rows through a parent table, for rows that carry no tenancy
- * column of their own (for example, blocks scoped through their section, report,
- * and organization). This is the canonical `parent` payload; authors write the
- * friendlier {@link PolicyInput} `{ by: 'parent', fk, parent }` form, which
- * {@link resolvePolicy} normalizes into this.
- */
-export const scopedViaRefSchema = z.object({
-    /** Column on this table that points at the parent (for example, `'team_id'`). */
-    localKey: z.string().min(1),
-    /** Parent table name (e.g. `'team'`). */
-    parentTable: z.string().min(1),
-    /** Column on the parent that `localKey` references. Default `'id'`. */
-    parentKey: z.string().min(1).optional(),
-    /** Column on the parent holding the tenant id. Default {@link DEFAULT_ORG_COLUMN}. */
-    parentOrgColumn: z.string().min(1).optional(),
-});
-/** How a model's rows are scoped to a tenant — the canonical, wire-facing form. */
-export const tenancySchema = z.discriminatedUnion('kind', [
-    /** Row-local tenancy column (default name `organization_id`, overridable). */
-    z.object({ kind: z.literal('column'), column: z.string().min(1) }),
-    /** Scoped through a parent table's tenancy. */
-    z.object({ kind: z.literal('parent'), via: scopedViaRefSchema }),
-    /** Not tenant-scoped (global / reference data). */
-    z.object({ kind: z.literal('none') }),
-    /**
-     * Scoped by the data source itself: the model carries no tenancy column, and the
-     * owning organization is derived from the connected source that registered it — the
-     * registration is the tenant boundary. This is the natural default for a
-     * single-tenant connected database (`ablo connect`), which holds one org's rows and
-     * so has no per-row `organization_id` to read. Carries no payload for the same
-     * reason `none` does: the binding lives in the source registration, not the model.
-     */
-    z.object({ kind: z.literal('source') }),
-]);
-/**
- * The authoring form of tenancy — what a schema author writes as the model's
- * `policy` option. The name follows SQL row-level security, where a policy is the
- * rule that decides which rows a tenant may read.
- *
- * The four choices `by` can take:
- *
- * - `{ by: 'column' }` — a row-local tenancy column (the default). `column`
- *   overrides the name (default {@link DEFAULT_ORG_COLUMN}).
- * - `{ by: 'parent', fk, parent }` — inherit tenancy through a foreign key when
- *   this table has no tenancy column of its own. `parentKey` (default `'id'`) and
- *   `parentTenantColumn` (default {@link DEFAULT_ORG_COLUMN}) are optional overrides.
- * - `{ by: 'source' }` — derive the organization from the connected source that
- *   registered the model, for a single-tenant connected database that carries no
- *   `organization_id` column. The registration is the tenant boundary.
- * - `{ by: 'none' }` — genuinely global or reference data. This makes the whole
- *   table readable across tenants, so it is correct only for tables that have no tenant.
- *
- * The runtime schema is one flat object rather than a discriminated union: `by`
- * selects the branch, and the {@link https://zod.dev | superRefine} pass enforces
- * the per-branch field rules (`parent` requires `fk` and `parent`; the other three
- * take no branch fields). The exported {@link PolicyInput} type is hand-written as a
- * precise union so the compiler still requires the right fields per `by` — the flat
- * schema validates at runtime, the union guides at author time, and the type guard
- * below keeps the two from drifting.
- */
-export const policyInputSchema = z
-    .object({
-    by: z.enum(['column', 'parent', 'none', 'source']),
-    /** `by: 'column'` — override the physical tenancy column name. Default {@link DEFAULT_ORG_COLUMN}. */
-    column: z.string().min(1).optional(),
-    /** `by: 'parent'` — column on this table that points at the parent (for example, `'sectionId'`). */
-    fk: z.string().min(1).optional(),
-    /** `by: 'parent'` — parent table name (e.g. `'sections'`). */
-    parent: z.string().min(1).optional(),
-    /** `by: 'parent'` — column on the parent that `fk` references. Default `'id'`. */
-    parentKey: z.string().min(1).optional(),
-    /** `by: 'parent'` — column on the parent holding the tenant id. Default {@link DEFAULT_ORG_COLUMN}. */
-    parentTenantColumn: z.string().min(1).optional(),
-})
-    .superRefine((policy, ctx) => {
-    if (policy.by === 'parent') {
-        if (!policy.fk) {
-            ctx.addIssue({
-                code: z.ZodIssueCode.custom,
-                path: ['fk'],
-                message: "A `by: 'parent'` policy needs `fk` — the column on this table that points at the parent row whose tenancy it inherits.",
-            });
-        }
-        if (!policy.parent) {
-            ctx.addIssue({
-                code: z.ZodIssueCode.custom,
-                path: ['parent'],
-                message: "A `by: 'parent'` policy needs `parent` — the name of the parent table this table is scoped through.",
-            });
-        }
-    }
-    // A `column` policy may carry `column`; the parent fields belong only to `parent`.
-    // Flag a field that landed on the wrong branch so a typo doesn't silently no-op.
-    const parentOnly = ['fk', 'parent', 'parentKey', 'parentTenantColumn'];
-    if (policy.by !== 'parent') {
-        for (const field of parentOnly) {
-            if (policy[field] !== undefined) {
-                ctx.addIssue({
-                    code: z.ZodIssueCode.custom,
-                    path: [field],
-                    message: `\`${field}\` only applies to a \`by: 'parent'\` policy; remove it or set \`by: 'parent'\`.`,
-                });
-            }
-        }
-    }
-    if (policy.by !== 'column' && policy.column !== undefined) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            path: ['column'],
-            message: "`column` only applies to a `by: 'column'` policy; remove it or set `by: 'column'`.",
-        });
-    }
-});
-const _policyInputAssignable = [
-    true,
-    true,
-];
-void _policyInputAssignable;
-/**
- * Normalizes the authoring {@link PolicyInput} into the canonical {@link Tenancy}.
- * Called once, when the model is built, so that `ModelDef`, `ModelJSON`, and every
- * consumer see only the canonical union. Omitting `policy` defaults to a row-local
- * `organization_id` column.
- */
-export function resolvePolicy(input) {
-    if (!input)
-        return { kind: 'column', column: DEFAULT_ORG_COLUMN };
-    switch (input.by) {
-        case 'column':
-            return { kind: 'column', column: input.column ?? DEFAULT_ORG_COLUMN };
-        case 'parent':
-            return {
-                kind: 'parent',
-                via: {
-                    localKey: input.fk,
-                    parentTable: input.parent,
-                    parentKey: input.parentKey,
-                    parentOrgColumn: input.parentTenantColumn,
-                },
-            };
-        case 'source':
-            return { kind: 'source' };
-        case 'none':
-            return { kind: 'none' };
-    }
-}
-/**
- * Reads the canonical {@link Tenancy} off an already-built model definition (or a
- * parsed `ModelJSON`), defaulting to a row-local `organization_id` column when it is
- * absent.
- *
- * This is the read-side helper. Consumers — provisioning and row-level security, the
- * membership resolver, DDL generation, and the CLI — call it to get a model's
- * tenancy without re-deriving the default each time. It is not the authoring
- * normalizer; that is {@link resolvePolicy}.
- */
-export function resolveTenancy(def) {
-    return def.tenancy ?? { kind: 'column', column: DEFAULT_ORG_COLUMN };
-}
-/** The physical tenancy column for a column-scoped model, else `null`. */
-export function tenancyColumn(t) {
-    return t.kind === 'column' ? t.column : null;
-}