@burojs/hasura 0.2.0

package/dist/index.d.ts

@@ -0,0 +1,466 @@
+import { DataOperationContext, DataProvider, FilterExpression, ErasedResourceHandle, DataLiveProvider } from '@burojs/core';
+
+interface HasuraDataProviderConfig {
+    /** Returns a fresh JWT or null if user is not authed. */
+    getToken: () => Promise<string | null>;
+    /**
+     * GraphQL endpoint every query/mutation is POSTed to, and the endpoint the
+     * live provider derives its WebSocket URL from. May be a same-origin path
+     * (`/gql/v1/graphql`, `/tandt/gql/v1/graphql`) or an absolute http(s) URL.
+     * Defaults to {@link DEFAULT_HASURA_ENDPOINT}.
+     */
+    endpoint?: string;
+    /**
+     * Hasura role sent as `X-Hasura-Role` for resources whose mapping does not
+     * declare a `role` of its own. `null` (the default) sends no role header at
+     * all, leaving the JWT's own default role in force.
+     *
+     * A resource mapping's `role` always wins when it is defined — including
+     * `role: null`, which suppresses the header for that one resource.
+     *
+     * `''` is treated as `null`, in both halves of the package: it is the shape
+     * of a missing env var, not a role. See {@link normalizeRole}.
+     */
+    defaultRole?: string | null;
+    /**
+     * Revalidates authentication after a request comes back with HTTP **401**.
+     * The callback owns any terminal sign-out; returning true permits one retry
+     * with a newly obtained token, while false preserves the original 401
+     * response.
+     *
+     * ⚠️ KNOWN GAP, stated here because this is where a consumer reads: HTTP 401
+     * is NOT how the Hasura deployment this provider was distilled from rejects
+     * a credential. The one capture in this repository of a real rejection
+     * (`packages/mock-kit/fixtures/hasura/error-unauthorized.json`, taken from
+     * the live backend with a deliberately malformed bearer token) came back
+     * **HTTP 200** with an `invalid-jwt` errors envelope. Replayed through this
+     * provider it surfaces as `{ kind: 'protocol', code: 'graphql-error' }` and
+     * `recoverAuth` is never consulted — no refresh, no retry, and app logic
+     * keyed on `kind: 'auth'` never fires either. Pinned by
+     * `tests/fixture-fidelity.test.ts`'s `error-unauthorized` case.
+     *
+     * So this callback fires only for a deployment that really answers 401 (a
+     * proxy or gateway in front of Hasura, typically). Keying recovery on the
+     * error envelope instead is a product decision, deliberately not taken here;
+     * the existing 401 tests use a FABRICATED 401 and must not be read as proof
+     * that recovery works against Hasura itself.
+     */
+    recoverAuth?: () => Promise<boolean>;
+    /** Map our resource name → table + field selection. */
+    resources: Record<string, ResourceMapping>;
+    /**
+     * Optional global scope read on every getList. Returns key → value pairs
+     * that get merged into the where clause as `{ <key>: { _eq: <value> } }`,
+     * but only for resources that whitelist the key in `scopeFields`.
+     *
+     * Example: `() => ({ pg: 'radio', location_id: 5 })` — applied to documents
+     * (which have both fields) but not products (which only have pg).
+     */
+    getScope?: (context: DataOperationContext) => Record<string, unknown>;
+    /**
+     * Closed, application-owned custom operation registry. A descriptor selects
+     * an entry by its already-declared `{ resource, operation }` binding; it can
+     * never supply a GraphQL document, URL, or result mapper itself.
+     */
+    operations?: HasuraOperationRegistry;
+    fetchImpl?: typeof fetch;
+}
+interface HasuraCustomOperation {
+    /** Which native provider slot may execute this declaration. */
+    readonly kind: 'query' | 'mutation';
+    /** Static GraphQL document owned by the application/provider integration. */
+    readonly document: string;
+    /** Maps the declared operation input to the document's variables. */
+    readonly variables: (input: unknown) => Record<string, unknown> | undefined;
+    /** Maps the full GraphQL response to the declared operation output. */
+    readonly mapResult?: (data: unknown) => unknown;
+    /** Overrides the mapped resource role; undefined keeps that mapped role. */
+    readonly role?: string | null;
+}
+/**
+ * Registry entries are keyed by the resource binding first, then the declared
+ * custom operation name. This makes cross-resource operation reuse explicit
+ * rather than allowing a descriptor to name an arbitrary backend operation.
+ */
+type HasuraOperationRegistry = Readonly<Record<string, Readonly<Record<string, HasuraCustomOperation>>>>;
+interface ResourceMapping {
+    table: string;
+    selectFields: string[];
+    /**
+     * GraphQL scalar name for this table's primary key, interpolated into the
+     * `$id` variable declaration of every by-pk query/mutation. Default
+     * `'bigint'`.
+     *
+     * DISTILLATION NOTE (divergence 3 of 7 — feature, additive, l2-web-ui only).
+     * l2-web-ui added `'String'` for tables whose pk is a genuine string
+     * business key (a GS1 marking code), not a uuid/Int/bigint
+     * wire type: Hasura's by-pk root for such a table is literally
+     * `<table>_by_pk(<pk>: $id)` with `$id: String!`, which none of the other
+     * three names can express (playground's union stopped at
+     * `'bigint' | 'uuid' | 'Int'`). Purely a type-union widening — no runtime
+     * branch reads `pkType` beyond interpolating it — so l2-web-ui's wider union
+     * is taken wholesale rather than forked.
+     */
+    pkType?: 'bigint' | 'uuid' | 'Int' | 'String';
+    /**
+     * Skip the aggregate on every `getList`. This is a COST decision, not a
+     * schema fact: the table has an `_aggregate` root but counting it on each
+     * page is too slow to pay for unprompted. (Measured in one of the apps this
+     * provider was distilled from: ~9.8M-row and ~28.9M-row tables, the latter
+     * taking ~55 s per count.) `total` is then omitted and the list renders the
+     * unknown-total shape.
+     *
+     * ⚠️ NOT the same thing as {@link ResourceMapping.aggregate} `: false`, and
+     * NOT a proxy for it — most `noAggregate` tables CAN be counted on demand,
+     * which is exactly what `getCount` is for. Deriving one from the other gets
+     * the flagship resources backwards.
+     */
+    noAggregate?: boolean;
+    /**
+     * Which aggregate root field backs this table, for the on-demand `getCount`
+     * (and for `getList`'s own count when it runs):
+     *  - absent  — derive `${table}_aggregate` (the Hasura default; today's behaviour);
+     *  - `false` — no aggregate root exists at all, under any name. `getCount`
+     *    answers `{ total: null }` without a round trip and the UI drops the
+     *    affordance for the session;
+     *  - a string — an explicitly-named root, for tables whose custom root fields
+     *    break the derivation.
+     *
+     * ⚠️ Establish this by introspecting the live schema under the role the app
+     * actually runs as, not by reading `noAggregate` or a code comment. Both
+     * have been wrong here.
+     */
+    aggregate?: false | string;
+    /**
+     * Root field for a single-row fetch by primary key. Defaults to the derived
+     * `${table}_by_pk`. Set `false` when the active role exposes only the
+     * collection root; `getOne` then queries it with pk `where` + `limit: 1`.
+     *
+     * ⚠️ Same class of fact as `aggregate`, and established the same way — by
+     * introspecting the live schema, not by reading a comment. In one of the
+     * source apps exactly one table of forty had a non-derivable by-pk root (a
+     * plural table whose root was singular), so the derived name 400'd and its
+     * Show page was a dead-end error reachable in two clicks from the sidebar.
+     */
+    byPkRoot?: string | false;
+    /** Field to order by in getList. Defaults to 'id'. */
+    orderByField?: string;
+    /** Name of the primary-key field in the row (for synthetic id in list rows). Defaults to 'id'. */
+    pkField?: string;
+    /**
+     * Hasura role for this resource. `null` (or `''`) means no role header (use
+     * the JWT's default role). Undefined falls back to
+     * {@link HasuraDataProviderConfig.defaultRole}.
+     */
+    role?: string | null;
+    /**
+     * Columns typed `int64` in a Hasura ClickHouse source. Hasura serialises
+     * int64 as a JSON STRING and REJECTS a numeric filter value with
+     * «expected a string for type 'int64'» — so a `document_id` filter sent as a
+     * number matched nothing and the affected list tabs came back empty.
+     * Filter values for these fields are coerced to strings before the where
+     * clause is built. (Verified live: numeric/int literal → error, string → rows.)
+     */
+    int64Fields?: string[];
+    /**
+     * Whitelist of scope keys this table actually has columns for. Only these
+     * keys from `getScope()` get injected into where clauses. Defaults to `[]`
+     * (no scope injection — useful for tables that lack the scope columns).
+     */
+    scopeFields?: string[];
+    /**
+     * JSONB-spill routing for tables whose forms submit a flat values record but
+     * whose real columns nest most of those keys inside JSONB blobs (e.g. a
+     * `documents` table where template head fields live inside `head`, a couple
+     * live inside `meta`, and only a handful — type/status/… — are real columns).
+     *
+     * When set, create/update partition the incoming flat `variables`:
+     *  - keys that ARE real columns (present in `selectFields`) stay top-level;
+     *  - keys listed in `metaKeys` nest under `metaColumn`;
+     *  - every OTHER key nests under `column` (the head spill).
+     * getOne does the inverse — it spreads the fetched `column`/`metaColumn`
+     * objects back onto the flat record so edit forms / show pages read those
+     * keys as flat fields (the raw blobs are kept too).
+     *
+     * SCOPE: scalar / relation / enum head+meta fields only. Data-body arrays
+     * (children) live in a sibling table — see `dataBody`.
+     */
+    jsonbSpill?: JsonbSpillConfig;
+    /**
+     * Data-body routing for resources whose heavy array payload lives in a
+     * SEPARATE 1:1 sibling table rather than a JSONB column on the row itself
+     * (e.g. a `documents.items[]` / `products[]` payload living in
+     * `documents_data.data`, keyed by `document_id`).
+     *
+     * When set, create/update peel the `keys` off the flat `variables` FIRST
+     * (before `jsonbSpill` runs, so they never leak into `head`), write the parent
+     * row, then upsert the sibling row (`insert_<table>_one … on_conflict`). getOne
+     * nested-selects the sibling via `relationship` and spreads its `column` blob
+     * back onto the flat record (so edit forms read `items` as a top-level field),
+     * dropping the raw relationship object so it can't round-trip into `head`.
+     * getList is left untouched — list columns are head/meta scalars, never the
+     * heavy data body.
+     */
+    dataBody?: DataBodyConfig;
+    /**
+     * Fixed, always-on Hasura `where` fragment ANDed into every getList /
+     * getOne query for this resource. Powers "per-type" / projection resources:
+     * several resource names can map to the SAME table, each scoped to a
+     * different slice — e.g. `fixedFilter: { type: { _eq: 'work_order' } }` turns
+     * a `work_orders` resource into a work-orders-only view of a shared
+     * `documents` table. The fragment is a raw Hasura `<table>_bool_exp` object
+     * (same shape `filtersToWhere` emits), so nested / `_and` / `_or` clauses are
+     * all valid. Merged with `mergeWhere` (AND) after user filters + scope, so
+     * the user can still filter/search WITHIN the fixed slice.
+     *
+     * getOne: because `<table>_by_pk` takes no `where`, a resource with a
+     * `fixedFilter` fetches its single row via a `where`-based `limit: 1` query
+     * (pk `_eq` id AND fixedFilter) instead — so the row is only returned when it
+     * actually belongs to the slice (a work-order id won't resolve under
+     * `movements`). Resources without a `fixedFilter` keep the `_by_pk` path.
+     */
+    fixedFilter?: Record<string, unknown>;
+    /**
+     * Opt this resource into real-time updates. The live provider then opens a
+     * cheap change-signal subscription for its list / single-record views and
+     * invalidates matching native runtime queries when the table changes.
+     *
+     * Off by default on purpose: every live resource holds an open server-side
+     * subscription, so it is a cost you opt into for data that actually moves
+     * (documents change constantly during processing; a country lookup does not).
+     */
+    live?: boolean;
+}
+/** @see ResourceMapping.jsonbSpill */
+interface JsonbSpillConfig {
+    /** JSONB column that catches every non-base, non-meta key (e.g. `head`). */
+    column: string;
+    /** JSONB column that catches the `metaKeys` (e.g. `meta`). */
+    metaColumn: string;
+    /** Flat keys routed to `metaColumn` instead of the `column` spill. */
+    metaKeys: string[];
+    /**
+     * Flat form key → dotted NESTED path inside the head `column`. Lets a flat
+     * field (e.g. `vsd_number`) persist to a nested head location (e.g.
+     * `regulator_data.crpt.vsd_number`) without dotted field keys. getOne reads
+     * the nested value back out to the flat key.
+     */
+    nestedKeys?: Record<string, string>;
+}
+/** @see ResourceMapping.dataBody */
+interface DataBodyConfig {
+    /** Sibling table holding the heavy data body, 1:1 with the parent (e.g. `documents_data`). */
+    table: string;
+    /** FK column on the sibling pointing back at the parent pk (e.g. `document_id`). */
+    fk: string;
+    /** JSONB column on the sibling that holds the whole data body (e.g. `data`). */
+    column: string;
+    /** Reverse object-relationship name on the PARENT row → sibling, for the getOne nested select (e.g. `document_data`). */
+    relationship: string;
+    /** `on_conflict` constraint enum for the upsert (e.g. `document_data_pkey`). */
+    constraint: string;
+    /** Flat value keys that belong to the data body — routed to the sibling `column` (e.g. `['items', 'products']`). */
+    keys: string[];
+}
+/**
+ * Split a flat `values` record for a data-body resource into the sibling-table
+ * payload and the remainder. Keys listed in `cfg.keys` whose value is defined
+ * are collected into `dataBody` (they become the sibling `column` blob); every
+ * other key passes through in `rest` (to be further partitioned by jsonbSpill).
+ * The raw `cfg.relationship` key (the nested object getOne leaves behind on a
+ * re-submitted record) is dropped from both so it can never leak into `head`.
+ *
+ * `hasDataBody` is true iff at least one data-body key was present — callers
+ * skip the sibling write entirely when false, so a document type WITHOUT a data
+ * body (e.g. a work order) never gets an empty sibling row.
+ *
+ * Exported for unit testing; the provider calls it with `m.dataBody`.
+ */
+declare function partitionDataBody(values: Record<string, unknown>, cfg: DataBodyConfig): {
+    dataBody: Record<string, unknown>;
+    rest: Record<string, unknown>;
+    hasDataBody: boolean;
+};
+/**
+ * Partition a flat `values` record for a jsonb-spill resource.
+ *
+ * Routing rule (first match wins per key):
+ *  1. `key === spill.column` / `key === spill.metaColumn` — an explicitly passed
+ *     JSONB object (e.g. an edit form re-submitting the raw `head` blob). Its
+ *     entries are merged UNDER any individually-spilled keys so freshly edited
+ *     flat values win over the stale blob, and un-modelled legacy keys survive.
+ *  2. `key ∈ metaKeys` — nests under `metaColumn`.
+ *  3. `key ∈ baseColumns` — stays a top-level column.
+ *  4. otherwise — nests under the `column` spill (head).
+ *
+ * `undefined` values are dropped (a never-set optional field must not clobber
+ * an existing column / blob key). Empty JSONB objects are omitted entirely.
+ *
+ * Exported for unit testing; the provider calls it with `baseColumns =
+ * m.selectFields` (the table's real columns, which include `column`/`metaColumn`
+ * themselves — handled by rule 1 before the base check).
+ */
+declare function partitionJsonbSpill(values: Record<string, unknown>, spill: JsonbSpillConfig, baseColumns: string[]): Record<string, unknown>;
+/**
+ * Inverse of {@link partitionJsonbSpill}: spread a fetched row's `head` / `meta`
+ * JSONB blobs back onto the flat record so head/meta keys (e.g. `batch_number`,
+ * `regulatory_system`) read as top-level fields on show pages, edit forms, AND
+ * per-type list columns. Base columns win on collision (`...rec` last), and the
+ * raw `head` / `meta` objects are preserved so tabs / re-submission still have
+ * them. A non-object / null blob is ignored.
+ *
+ * Shared by getOne (single record) and getList (each row) so the two stay in
+ * lockstep. Returns the input unchanged when it isn't an object.
+ */
+declare function flattenJsonbSpill(item: unknown, spill: JsonbSpillConfig): unknown;
+/**
+ * This provider's own code for "no token to send" — `getToken()` resolved `null`, so no
+ * request was ever attempted. Exported so downstream error-classification code can tell
+ * this apart from a genuine rejected-credentials answer (a real 401 the retry/`recoverAuth`
+ * path still couldn't clear) without inventing a parallel distinction of its own: a request
+ * that never left the client is the "we never asked" case, not a session failure.
+ *
+ * DISTILLATION NOTE (divergence 4 of 7 — hygiene, l2-web-ui only, zero
+ * behaviour change). playground inlined the literal `'not-authenticated'` at
+ * both throw sites; l2-web-ui extracted and exported this constant so its own
+ * `classify-data-error.ts` could match a symbol instead of a string. The STRING
+ * VALUE is identical either way — nothing observable differs — so l2-web-ui's
+ * exported form is taken purely because a published package owes consumers a
+ * stable symbol.
+ */
+declare const NOT_AUTHENTICATED_CODE = "not-authenticated";
+/**
+ * The shared refusal code for "this provider cannot express that filter
+ * operator". `@burojs/pocketbase` throws the SAME `kind` and the SAME code, so
+ * an application handling one handles the other — see
+ * {@link filtersToWhere} for why that agreement is load-bearing.
+ */
+declare const FILTER_OPERATOR_UNSUPPORTED_CODE = "filter-operator-unsupported";
+/**
+ * Filter `scope` to keys whitelisted by `scopeFields`, drop nullish/empty
+ * values, and translate to a Hasura where object using `_eq`.
+ * Returns `undefined` when nothing applies.
+ */
+declare function scopeToWhere(scope: Record<string, unknown>, scopeFields: string[]): Record<string, unknown> | undefined;
+/**
+ * Combine two where objects with `_and`. Either or both may be undefined.
+ */
+declare function mergeWhere(a: Record<string, unknown> | undefined, b: Record<string, unknown> | undefined): Record<string, unknown> | undefined;
+/** Translate the native filter AST into a Hasura bool expression. */
+declare function filtersToWhere(filter?: FilterExpression<ErasedResourceHandle>): Record<string, unknown> | undefined;
+/**
+ * Resolve the Hasura aggregate root field for a mapping, or `null` when the
+ * registry declares that none exists. Registry-driven on purpose: which tables
+ * can be counted is a per-resource FACT, so it is declared once on the mapping
+ * (`aggregate`) and read here — never a `if (resource === 'users')` chain in the
+ * provider, which is the shape this codebase has been deleting.
+ */
+declare function aggregateRoot(m: ResourceMapping): string | null;
+/**
+ * Root field for a by-pk read. Declarative per resource for the same reason
+ * {@link aggregateRoot} is: the name is a fact about the backend schema, not
+ * something to branch on by resource name inside the provider.
+ */
+declare function byPkRoot(m: ResourceMapping): string | null;
+declare function createHasuraDataProvider(config: HasuraDataProviderConfig): DataProvider;
+
+/**
+ * Same-origin GraphQL path Hasura serves by default. The single source for
+ * both halves of this package: `createHasuraDataProvider`'s POST target and
+ * `createHasuraLiveProvider`'s WebSocket derivation.
+ *
+ * It lives in its own module rather than in `data-provider.ts` because
+ * `live-provider.ts` needs it too, and `data-provider.ts` already imports
+ * `createHasuraLiveProvider` from `live-provider.ts`. `live-provider.ts`'s
+ * existing back-reference is `import type { ResourceMapping }` — TYPE-only, so
+ * it is erased and no runtime cycle exists. Importing a VALUE back across that
+ * edge would create a real one. This third module keeps the constant defined
+ * exactly once without introducing it.
+ *
+ * DISTILLATION NOTE (divergence 5 of 7 — deployment fact, neither side wins).
+ * The two source apps read this from their OWN `env.ts`: playground as
+ * `API_BASE_URL` (`import.meta.env.VITE_API_BASE_URL ?? ''`, an origin-root
+ * deployment), l2-web-ui as `API_PREFIX` (`?? '/tandt'`, a non-empty default
+ * that exists because every GraphQL call 404'd behind an nginx rule stripping
+ * that prefix while the dev proxy passed paths through unprefixed). Both
+ * defaults are correct FOR THEIR OWN DEPLOYMENT and neither belongs in a
+ * published package, so this package takes no opinion: it exposes the
+ * `endpoint` config field (the mechanism l2-web-ui had already added) and
+ * defaults to the bare same-origin path. An app behind a path prefix passes
+ * `endpoint: `${prefix}/gql/v1/graphql``.
+ */
+declare const DEFAULT_HASURA_ENDPOINT = "/gql/v1/graphql";
+
+interface SubscriptionPayload {
+    readonly query: string;
+    readonly variables?: Record<string, unknown>;
+}
+interface SubscriptionSink {
+    next(value: unknown): void;
+    error(error: unknown): void;
+    complete(): void;
+}
+interface GraphqlWsClient {
+    subscribe(payload: SubscriptionPayload, sink: SubscriptionSink): () => void;
+}
+interface GraphqlWsClientOptions {
+    readonly url: string;
+    readonly lazy: boolean;
+    readonly keepAlive: number;
+    readonly retryAttempts: number;
+    readonly shouldRetry: () => boolean;
+    readonly connectionParams: () => Promise<Record<string, unknown>>;
+    readonly on: {
+        connecting(): void;
+        connected(): void;
+        closed(): void;
+    };
+}
+interface HasuraLiveProviderConfig {
+    readonly resources: Record<string, ResourceMapping>;
+    readonly getToken: () => Promise<string | null>;
+    /**
+     * The SAME GraphQL endpoint the data provider POSTs to — Hasura serves
+     * subscriptions on that exact path. Converted to `ws(s)://` by
+     * {@link hasuraWsUrl}. Defaults to {@link DEFAULT_HASURA_ENDPOINT}.
+     *
+     * `createHasuraDataProvider` forwards its own resolved endpoint here, so the
+     * socket and the POST target can never drift apart.
+     */
+    readonly endpoint?: string;
+    /** `X-Hasura-Role` sent in the socket's connection params. `null`/omitted sends none. */
+    readonly role?: string | null;
+    /** Test seam; production uses graphql-ws directly. */
+    readonly clientFactory?: (options: GraphqlWsClientOptions) => GraphqlWsClient;
+}
+/**
+ * `https://host/path` → `wss://host/path` (Hasura serves subscriptions on the
+ * same path it serves queries on). `endpoint` may be `''`, a same-origin path
+ * (`/gql/v1/graphql`, `/tandt/gql/v1/graphql`) or an absolute http(s) URL.
+ *
+ * DISTILLATION NOTE (divergence 6 of 7 — NEITHER a bug fix, verified
+ * equivalent; playground's FORM taken, l2-web-ui's TESTS taken). The two apps
+ * implement this differently: playground resolves through
+ * `new URL(path, window.location.origin)` and flips the protocol; l2-web-ui
+ * string-concatenates `origin.replace(/^http/, 'ws') + prefix + path` under a
+ * comment warning about a "prior version" bug. That warning describes a
+ * since-superseded implementation in l2-web-ui's OWN history, NOT playground's
+ * current code — the research pass computed both functions for `('', https)`,
+ * `('/tandt', https)`, `('/tandt', http)` and `('', http)` and got
+ * byte-identical output every time. playground's `new URL()` form is taken
+ * because its input domain is strictly wider (it is also correct when handed
+ * an absolute `http(s)://` endpoint, which l2-web-ui's concat form explicitly
+ * is not designed for), and l2-web-ui's CONTRACT-level tests (scheme + host +
+ * prefix placement, never a literal echo of the implementation) are carried
+ * into this package's suite because that is the testing style which caught the
+ * original production regression.
+ */
+declare function hasuraWsUrl(endpoint: string): string;
+/**
+ * Native Hasura live provider. The socket transmits only a change signal; rows
+ * always come from the regular descriptor query, so mapping/pagination remain
+ * single-sourced in the data provider.
+ */
+declare function createHasuraLiveProvider(config: HasuraLiveProviderConfig): DataLiveProvider;
+
+export { DEFAULT_HASURA_ENDPOINT, type DataBodyConfig, FILTER_OPERATOR_UNSUPPORTED_CODE, type HasuraCustomOperation, type HasuraDataProviderConfig, type HasuraLiveProviderConfig, type HasuraOperationRegistry, type JsonbSpillConfig, NOT_AUTHENTICATED_CODE, type ResourceMapping, aggregateRoot, byPkRoot, createHasuraDataProvider, createHasuraLiveProvider, filtersToWhere, flattenJsonbSpill, hasuraWsUrl, mergeWhere, partitionDataBody, partitionJsonbSpill, scopeToWhere };