@hypequery/deployment 0.9.6 → 0.10.0

package/dist/authorized-contract.d.ts

@@ -42,6 +42,14 @@ export interface AuthorizedDeploymentProjection {
      */
     readonly queryable: readonly string[];
 }
+export interface AuthorizedDeploymentProjectionOptions {
+    /**
+     * A `hypequery-field-visibility` record for this principal (RFC 0019),
+     * validated here exactly as the data plane validates it. A dataset it hides
+     * is not published; fields it hides are not offered.
+     */
+    readonly visibility?: unknown;
+}
 /**
  * Projects the contract down to what `principal` may see.
  *
@@ -68,5 +76,5 @@ export interface AuthorizedDeploymentProjection {
  * projection that could emit an invalid one would move that failure to whatever
  * read it next.
  */
-export declare function projectAuthorizedDeploymentContract(contract: ProtocolDeploymentContract, principal: DeploymentDataPlanePrincipal | null): AuthorizedDeploymentProjection;
+export declare function projectAuthorizedDeploymentContract(contract: ProtocolDeploymentContract, principal: DeploymentDataPlanePrincipal | null, options?: AuthorizedDeploymentProjectionOptions): AuthorizedDeploymentProjection;
 //# sourceMappingURL=authorized-contract.d.ts.map

package/dist/authorized-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorized-contract.d.ts","sourceRoot":"","sources":["../src/authorized-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAE1B,sBAAsB,EACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAGnE;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,oBAAoB,EAC5B,SAAS,EAAE,4BAA4B,GAAG,IAAI,GAC7C,OAAO,CAIT;AAED,mFAAmF;AACnF,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,sBAAsB,GAAG,SAAS,EAC5C,SAAS,EAAE,4BAA4B,GAAG,IAAI,GAC7C,OAAO,CAKT;AAkCD,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,0BAA0B,EACpC,SAAS,EAAE,4BAA4B,GAAG,IAAI,GAC7C,8BAA8B,CA2ChC"}
+{"version":3,"file":"authorized-contract.d.ts","sourceRoot":"","sources":["../src/authorized-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAE1B,sBAAsB,EAEvB,MAAM,qBAAqB,CAAC;AAM7B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAInE;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,oBAAoB,EAC5B,SAAS,EAAE,4BAA4B,GAAG,IAAI,GAC7C,OAAO,CAIT;AAED,mFAAmF;AACnF,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,sBAAsB,GAAG,SAAS,EAC5C,SAAS,EAAE,4BAA4B,GAAG,IAAI,GAC7C,OAAO,CAKT;AAwCD,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,qCAAqC;IACpD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,0BAA0B,EACpC,SAAS,EAAE,4BAA4B,GAAG,IAAI,EAC9C,OAAO,GAAE,qCAA0C,GAClD,8BAA8B,CA0EhC"}

package/dist/authorized-contract.js

@@ -12,8 +12,9 @@
  * catalog projection or schema compilation therefore cannot advertise something
  * execution would refuse.
  */
-import { validateProtocolDeploymentContract } from '@hypequery/protocol';
+import { resolveProtocolVisibleDatasetFields, validateProtocolDeploymentContract, validateProtocolFieldVisibility, } from '@hypequery/protocol';
 import { missing } from './utils/required-access.js';
+import { concealDimension, narrowDatasetToVisible } from './utils/visibility-projection.js';
 /**
  * Whether a principal satisfies an access policy.
  *
@@ -42,14 +43,15 @@ export function isDeploymentEndpointAuthorized(endpoint, principal) {
  * publish the name and type of every dimension, filter, and measure on it.
  * What a join actually reaches is the target's dimensions — `resolveDataset`
  * offers each groupable one as `<relationship>.<name>` and each filterable one
- * under the full operator set — so those stay and everything else goes.
+ * under the full operator set — so those stay and everything else goes. Under
+ * a visibility policy, only the dimensions the target's own entry shows stay.
  *
  * A dataset no queryable relationship reaches keeps nothing but its time field,
  * which the planner reads for every grained query. It is retained at all only
  * because a relationship names it and the contract would not validate without
  * it.
  */
-function narrowToJoin(dataset, reachable) {
+function narrowToJoin(dataset, reachable, joinable) {
     // `defaults` describes how to query the dataset directly, which is exactly
     // what this principal may not do.
     const { defaults: _defaults, endpoint: _endpoint, ...rest } = dataset;
@@ -57,7 +59,9 @@ function narrowToJoin(dataset, reachable) {
     return {
         ...rest,
         dimensions: reachable
-            ? dataset.dimensions
+            ? dataset.dimensions.map(dimension => (joinable === undefined || joinable.has(String(dimension.name))
+                ? dimension
+                : concealDimension(dimension)))
             : dataset.dimensions.filter(dimension => String(dimension.name) === timeField),
         measures: [],
         filters: [],
@@ -89,11 +93,27 @@ function narrowToJoin(dataset, reachable) {
  * projection that could emit an invalid one would move that failure to whatever
  * read it next.
  */
-export function projectAuthorizedDeploymentContract(contract, principal) {
+export function projectAuthorizedDeploymentContract(contract, principal, options = {}) {
     const byName = new Map(contract.datasets.map(dataset => [String(dataset.name), dataset]));
-    const published = new Set(contract.datasets
-        .filter(dataset => isDeploymentEndpointAuthorized(dataset.endpoint, principal))
-        .map(dataset => String(dataset.name)));
+    const visibility = options.visibility === undefined
+        ? undefined
+        : validateProtocolFieldVisibility(options.visibility);
+    const visibleIn = (dataset) => (visibility === undefined
+        ? undefined
+        : resolveProtocolVisibleDatasetFields(dataset, byName, visibility));
+    // Each published dataset as the principal sees it. Narrowing comes first,
+    // because a relationship it drops must not keep its target in the contract.
+    const projected = new Map();
+    for (const dataset of contract.datasets) {
+        if (!isDeploymentEndpointAuthorized(dataset.endpoint, principal))
+            continue;
+        const visible = visibleIn(dataset);
+        if (visible === null)
+            continue;
+        projected.set(String(dataset.name), visible ? narrowDatasetToVisible(dataset, visible) : dataset);
+    }
+    const published = new Set(projected.keys());
+    const relationshipsOf = (name) => (projected.get(name)?.relationships ?? byName.get(name).relationships);
     const required = new Set();
     const require = (name) => {
         if (required.has(name) || !byName.has(name))
@@ -101,7 +121,7 @@ export function projectAuthorizedDeploymentContract(contract, principal) {
         required.add(name);
         // Transitive: a retained target has relationships of its own, and every
         // target named in the contract has to still be there for it to validate.
-        for (const relationship of byName.get(name).relationships) {
+        for (const relationship of relationshipsOf(name)) {
             require(String(relationship.target));
         }
     };
@@ -113,16 +133,29 @@ export function projectAuthorizedDeploymentContract(contract, principal) {
     // validates passes none of it on.
     const reachable = new Set();
     for (const name of published) {
-        for (const relationship of byName.get(name).relationships) {
+        for (const relationship of relationshipsOf(name)) {
             if (relationship.queryable)
                 reachable.add(String(relationship.target));
         }
     }
+    // What a join may reach on a target: the dimensions its own policy entry
+    // shows. A relationship to a target without one was already dropped above.
+    const joinable = (dataset) => {
+        if (visibility === undefined)
+            return undefined;
+        const entry = Object.hasOwn(visibility.datasets, String(dataset.name))
+            ? visibility.datasets[String(dataset.name)]
+            : undefined;
+        if (entry === undefined)
+            return new Set();
+        return entry.dimensions === '*'
+            ? new Set(dataset.dimensions.map(dimension => String(dimension.name)))
+            : new Set(entry.dimensions);
+    };
     const datasets = contract.datasets
         .filter(dataset => required.has(String(dataset.name)))
-        .map(dataset => (published.has(String(dataset.name))
-        ? dataset
-        : narrowToJoin(dataset, reachable.has(String(dataset.name)))));
+        .map(dataset => (projected.get(String(dataset.name))
+        ?? narrowToJoin(dataset, reachable.has(String(dataset.name)), joinable(dataset))));
     return Object.freeze({
         contract: validateProtocolDeploymentContract({ ...contract, datasets }),
         queryable: Object.freeze(datasets

package/dist/index.d.ts

@@ -18,8 +18,9 @@ export type { DeploymentIntakeLimits } from './limits.js';
 export type { DeploymentAuthenticationInput, DeploymentAuthenticator, DeploymentAuthorizationInput, DeploymentAuthorizer, DeploymentIntake, DeploymentIntakeOptions, DeploymentIntakeRequest, DeploymentIntakeResponse, DeploymentSubmissionResponse, DeploymentSubmissionStore, VerifiedDeploymentSubmission, } from './types.js';
 export type { DeploymentDataPlanePrincipal } from './principal.js';
 export { createDeploymentSemanticDataPlane, DeploymentSemanticInvocationError, toProtocolSemanticInvocationFailure, } from './semantic-data-plane.js';
-export type { DeploymentSemanticAuthenticationInput, DeploymentSemanticBudget, DeploymentSemanticDataPlane, DeploymentSemanticDataPlaneOptions, DeploymentSemanticExecutionInput, DeploymentSemanticInvocationRequest, DeploymentSemanticTenantInput, } from './semantic-data-plane.js';
-export { validateSemanticOperation } from './semantic-operation-validation.js';
+export type { DeploymentSemanticAuthenticationInput, DeploymentSemanticBudget, DeploymentSemanticDataPlane, DeploymentSemanticDataPlaneOptions, DeploymentSemanticExecutionInput, DeploymentSemanticInvocationRequest, DeploymentSemanticContextInput, DeploymentSemanticTenantInput, } from './semantic-data-plane.js';
+export { validateSemanticConstraints, validateSemanticOperation, } from './semantic-operation-validation.js';
 export type { SemanticOperationLimits, SemanticOperationViolation, } from './semantic-operation-validation.js';
 export { isDeploymentEndpointAuthorized, projectAuthorizedDeploymentContract, satisfiesDeploymentAccess, } from './authorized-contract.js';
+export type { AuthorizedDeploymentProjection, AuthorizedDeploymentProjectionOptions, } from './authorized-contract.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAC5C,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,6BAA6B,EAC7B,+BAA+B,EAC/B,gCAAgC,EAChC,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6CAA6C,GAC9C,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,yCAAyC,EACzC,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,kCAAkC,EAClC,mCAAmC,EACnC,0CAA0C,EAC1C,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,wCAAwC,EACxC,uCAAuC,GACxC,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,wCAAwC,EACxC,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,EAC7B,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EACL,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC1D,YAAY,EACV,6BAA6B,EAC7B,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,mCAAmC,GACpC,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,qCAAqC,EACrC,wBAAwB,EACxB,2BAA2B,EAC3B,kCAAkC,EAClC,gCAAgC,EAChC,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,YAAY,EACV,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAI5C,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAC5C,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,6BAA6B,EAC7B,+BAA+B,EAC/B,gCAAgC,EAChC,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6CAA6C,GAC9C,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,yCAAyC,EACzC,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,kCAAkC,EAClC,mCAAmC,EACnC,0CAA0C,EAC1C,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,wCAAwC,EACxC,uCAAuC,GACxC,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,wCAAwC,EACxC,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,EAC7B,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EACL,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC1D,YAAY,EACV,6BAA6B,EAC7B,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,mCAAmC,GACpC,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,qCAAqC,EACrC,wBAAwB,EACxB,2BAA2B,EAC3B,kCAAkC,EAClC,gCAAgC,EAChC,mCAAmC,EACnC,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACV,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAI5C,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,8BAA8B,EAC9B,qCAAqC,GACtC,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -8,7 +8,7 @@ export { createDeploymentControlPlane, } from './control-plane.js';
 export { DEFAULT_DEPLOYMENT_CONTROL_PLANE_LIMITS, resolveDeploymentControlPlaneLimits, } from './control-plane-limits.js';
 export { DEFAULT_DEPLOYMENT_INTAKE_LIMITS, resolveDeploymentIntakeLimits, } from './limits.js';
 export { createDeploymentSemanticDataPlane, DeploymentSemanticInvocationError, toProtocolSemanticInvocationFailure, } from './semantic-data-plane.js';
-export { validateSemanticOperation } from './semantic-operation-validation.js';
+export { validateSemanticConstraints, validateSemanticOperation, } from './semantic-operation-validation.js';
 // What one principal may see of a contract, for a gateway listing targets
 // before any call exists (decision 0002, CLOUD-03).
 export { isDeploymentEndpointAuthorized, projectAuthorizedDeploymentContract, satisfiesDeploymentAccess, } from './authorized-contract.js';

package/dist/semantic-data-plane.d.ts

@@ -25,11 +25,14 @@ export interface DeploymentSemanticAuthenticationInput {
     readonly invocation: ProtocolSemanticInvocation;
     readonly dataset: ProtocolDeploymentDataset;
 }
-export interface DeploymentSemanticTenantInput {
+/** What a provider callback knows about the call it resolves context for. */
+export interface DeploymentSemanticContextInput {
     readonly principal: DeploymentDataPlanePrincipal | null;
     readonly invocation: ProtocolSemanticInvocation;
     readonly dataset: ProtocolDeploymentDataset;
 }
+/** The input `resolveTenant` receives; the same as every context resolver's. */
+export type DeploymentSemanticTenantInput = DeploymentSemanticContextInput;
 export interface DeploymentSemanticExecutionInput {
     readonly deployment: ProtocolDeploymentContract;
     readonly dataset: ProtocolDeploymentDataset;
@@ -56,6 +59,22 @@ export interface DeploymentSemanticDataPlaneOptions {
     readonly activationRevision: string;
     readonly authenticate?: (input: DeploymentSemanticAuthenticationInput) => Promise<DeploymentDataPlanePrincipal | null>;
     readonly resolveTenant?: (input: DeploymentSemanticTenantInput) => Promise<unknown>;
+    /**
+     * The datasets and fields this principal may see (RFC 0019), as an
+     * unvalidated `hypequery-field-visibility` record. Resolve to `undefined`
+     * for no restriction. A hidden dataset or field is refused exactly like an
+     * unknown one. Like the tenant, never taken from the invocation.
+     */
+    readonly resolveFieldVisibility?: (input: DeploymentSemanticContextInput) => Promise<unknown>;
+    /**
+     * Filters the provider enforces on this call, as unvalidated comparison
+     * expressions on the dataset's declared filters (RFC 0019), at most 32.
+     * They are ANDed onto the caller's filters and checked against the contract
+     * rather than the caller's visibility. They count toward the dataset's
+     * filter ceiling, since executors apply them as filters; the caller is told
+     * how many remain. A constraint the dataset can't enforce refuses the call.
+     */
+    readonly resolveConstraints?: (input: DeploymentSemanticContextInput) => Promise<unknown>;
     readonly execute: (input: DeploymentSemanticExecutionInput) => Promise<unknown>;
     /** Server-side ceilings, applied on top of contract and caller limits. */
     readonly limits?: Partial<SemanticOperationLimits> & {

package/dist/semantic-data-plane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"semantic-data-plane.d.ts","sourceRoot":"","sources":["../src/semantic-data-plane.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,0BAA0B,EAC1B,yBAAyB,EAEzB,0BAA0B,EAC1B,gCAAgC,EAChC,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oCAAoC,CAAC;AAM5C,OAAO,EAAE,iCAAiC,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEzH,iEAAiE;AACjE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;CAC7C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,4BAA4B,GAAG,IAAI,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;CAC7C;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,4BAA4B,GAAG,IAAI,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,mCAAmC;IAClD,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,uDAAuD;IACvD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,CACtB,KAAK,EAAE,qCAAqC,KACzC,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;IAClD,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,6BAA6B,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,gCAAgC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,GAAG;QACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KACpC,CAAC;CACH;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,OAAO,EAAE,mCAAmC,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAAC;CACjG;AAYD,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,2BAA2B,CA8O7B"}
+{"version":3,"file":"semantic-data-plane.d.ts","sourceRoot":"","sources":["../src/semantic-data-plane.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,0BAA0B,EAC1B,yBAAyB,EAGzB,0BAA0B,EAC1B,gCAAgC,EAChC,qBAAqB,EAEtB,MAAM,qBAAqB,CAAC;AAU7B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,oCAAoC,CAAC;AAO5C,OAAO,EAAE,iCAAiC,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEzH,iEAAiE;AACjE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;CAC7C;AAED,6EAA6E;AAC7E,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,SAAS,EAAE,4BAA4B,GAAG,IAAI,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;CAC7C;AAED,gFAAgF;AAChF,MAAM,MAAM,6BAA6B,GAAG,8BAA8B,CAAC;AAE3E,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,4BAA4B,GAAG,IAAI,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,mCAAmC;IAClD,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,uDAAuD;IACvD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,CACtB,KAAK,EAAE,qCAAqC,KACzC,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;IAClD,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,6BAA6B,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF;;;;;OAKG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9F;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,gCAAgC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,GAAG;QACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KACpC,CAAC;CACH;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,OAAO,EAAE,mCAAmC,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAAC;CACjG;AAeD,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,2BAA2B,CAsT7B"}

package/dist/semantic-data-plane.js

@@ -10,12 +10,13 @@
  * Execution itself is injected. This module decides whether a call is allowed
  * and what it is allowed to ask for.
  */
-import { ProtocolSemanticInvocationError, validateProtocolDeploymentContract, validateProtocolSemanticInvocation, validateProtocolSemanticInvocationResult, } from '@hypequery/protocol';
-import { validateSemanticOperation, } from './semantic-operation-validation.js';
+import { ProtocolSemanticInvocationError, resolveProtocolVisibleDatasetFields, validateProtocolDeploymentContract, validateProtocolExpression, validateProtocolFieldVisibility, validateProtocolSemanticInvocation, validateProtocolSemanticInvocationResult, } from '@hypequery/protocol';
+import { validateSemanticConstraints, validateSemanticOperation, } from './semantic-operation-validation.js';
 import { DeploymentSemanticInvocationError, fail, throwIfAborted } from './semantic-invocation-errors.js';
 import { missing } from './utils/required-access.js';
 import { definedLimits, lowest, tighten } from './utils/semantic-budget-limits.js';
 import { claimedFailure } from './utils/semantic-executor-failure.js';
+import { withVisibleDefaultMeasures } from './utils/visible-measure-selection.js';
 export { DeploymentSemanticInvocationError, toProtocolSemanticInvocationFailure } from './semantic-invocation-errors.js';
 const DEFAULT_LIMITS = Object.freeze({
     maxRows: 10_000,
@@ -25,6 +26,8 @@ const DEFAULT_LIMITS = Object.freeze({
     maxFilters: 100,
 });
 const REVISION_PATTERN = /^[0-9a-f]{64}$/;
+/** Provider constraints are policy, not queries; a handful per call is plenty. */
+const MAX_CONSTRAINTS = 32;
 export function createDeploymentSemanticDataPlane(options) {
     let deployment;
     try {
@@ -104,6 +107,37 @@ export function createDeploymentSemanticDataPlane(options) {
             }
         }
         throwIfAborted(request.signal);
+        // Before access and tenant checks: a dataset the principal can't see must
+        // fail exactly as one the contract doesn't have, not as a forbidden or
+        // tenant-required one, and no tenant is resolved for it.
+        let visible;
+        if (options.resolveFieldVisibility) {
+            let policy;
+            try {
+                policy = await options.resolveFieldVisibility({ principal, invocation, dataset });
+            }
+            catch (error) {
+                fail('forbidden', 'HQ_SEMANTIC_FORBIDDEN', 'Visibility resolution failed.', { cause: error });
+            }
+            if (policy !== undefined) {
+                let parsed;
+                try {
+                    parsed = validateProtocolFieldVisibility(policy);
+                }
+                catch (error) {
+                    fail('configuration-invalid', 'HQ_SEMANTIC_CONFIGURATION', 'The visibility policy is invalid.', { cause: error });
+                }
+                const resolved = resolveProtocolVisibleDatasetFields(dataset, datasets, parsed);
+                if (resolved === null) {
+                    // Indistinguishable from a dataset the contract never had.
+                    fail('not-found', 'HQ_SEMANTIC_DATASET_NOT_FOUND', 'The dataset was not found.', {
+                        path: '$.operation.dataset',
+                        relist: true,
+                    });
+                }
+                visible = resolved;
+            }
+        }
         if (endpoint.access.kind === 'authenticated') {
             if (!principal) {
                 fail('unauthenticated', 'HQ_SEMANTIC_UNAUTHENTICATED', 'Authentication is required.');
@@ -135,6 +169,34 @@ export function createDeploymentSemanticDataPlane(options) {
             }
         }
         throwIfAborted(request.signal);
+        let constraints = [];
+        if (options.resolveConstraints) {
+            let raw;
+            try {
+                raw = await options.resolveConstraints({ principal, invocation, dataset });
+            }
+            catch (error) {
+                fail('forbidden', 'HQ_SEMANTIC_FORBIDDEN', 'Constraint resolution failed.', { cause: error });
+            }
+            if (raw !== undefined) {
+                try {
+                    if (!Array.isArray(raw) || raw.length > MAX_CONSTRAINTS) {
+                        throw new TypeError(`Constraints must be an array of at most ${MAX_CONSTRAINTS}.`);
+                    }
+                    constraints = Object.freeze(raw.map(expression => validateProtocolExpression(expression)));
+                }
+                catch (error) {
+                    fail('configuration-invalid', 'HQ_SEMANTIC_CONFIGURATION', 'The enforced constraints are invalid.', { cause: error });
+                }
+                if (validateSemanticConstraints(constraints, dataset, datasets).length > 0
+                    || constraints.length > tighten(dataset.limits?.maxFilters, configured.maxFilters)) {
+                    // Not caller-correctable, and the constraint is the provider's
+                    // policy: say the target is forbidden without describing it.
+                    fail('forbidden', 'HQ_SEMANTIC_CONSTRAINT_UNENFORCEABLE', 'The principal lacks required access.');
+                }
+            }
+        }
+        throwIfAborted(request.signal);
         const budget = Object.freeze({
             maxRows: lowest(invocation.budget?.maxRows, endpoint.maxLimit, dataset.limits?.maxResultSize, configured.maxRows) ?? configured.maxRows,
             ...(lowest(invocation.budget?.deadlineMs, options.limits?.deadlineMs) === undefined
@@ -156,19 +218,28 @@ export function createDeploymentSemanticDataPlane(options) {
             maxOffset: configured.maxOffset,
             maxDimensions: tighten(dataset.limits?.maxDimensions, configured.maxDimensions),
             maxMeasures: tighten(dataset.limits?.maxMeasures, configured.maxMeasures),
-            maxFilters: tighten(dataset.limits?.maxFilters, configured.maxFilters),
-        });
+            maxFilters: tighten(dataset.limits?.maxFilters, configured.maxFilters) - constraints.length,
+        }, visible);
         if (violations.length > 0) {
             const [first] = violations;
             fail('input-invalid', 'HQ_SEMANTIC_INPUT_INVALID', first.message, { path: first.path });
         }
         throwIfAborted(request.signal);
+        const selected = withVisibleDefaultMeasures(operation, dataset, visible);
+        const maxMeasures = tighten(dataset.limits?.maxMeasures, configured.maxMeasures);
+        if (selected !== operation && selected.kind === 'dataset' && (selected.measures?.length ?? 0) > maxMeasures) {
+            // The caller asked for the default selection; it narrowed to more
+            // measures than one query may select, so the caller has to choose.
+            fail('input-invalid', 'HQ_SEMANTIC_INPUT_INVALID', `Select at most ${maxMeasures} measures explicitly.`, { path: '$.operation.measures' });
+        }
         let output;
         try {
             output = await options.execute({
                 deployment,
                 dataset,
-                operation,
+                operation: constraints.length === 0
+                    ? selected
+                    : Object.freeze({ ...selected, filters: [...(selected.filters ?? []), ...constraints] }),
                 principal,
                 tenant,
                 budget,

package/dist/semantic-operation-validation.d.ts

@@ -6,7 +6,7 @@
  * loading the authoring package. A gateway must be able to reject a bad
  * invocation without any of the deploying application's code.
  */
-import type { ProtocolDeploymentDataset, ProtocolSemanticQuery } from '@hypequery/protocol';
+import type { ProtocolDeploymentDataset, ProtocolExpression, ProtocolSemanticQuery, ProtocolVisibleDatasetFields } from '@hypequery/protocol';
 export interface SemanticOperationViolation {
     readonly message: string;
     readonly path: string;
@@ -25,5 +25,14 @@ export interface SemanticOperationLimits {
  * Returns every violation rather than the first, so a caller correcting an
  * agent-authored query sees the whole problem in one round trip.
  */
-export declare function validateSemanticOperation(operation: ProtocolSemanticQuery, dataset: ProtocolDeploymentDataset, datasets: ReadonlyMap<string, ProtocolDeploymentDataset>, limits: SemanticOperationLimits): readonly SemanticOperationViolation[];
+export declare function validateSemanticOperation(operation: ProtocolSemanticQuery, dataset: ProtocolDeploymentDataset, datasets: ReadonlyMap<string, ProtocolDeploymentDataset>, limits: SemanticOperationLimits, 
+/** What the principal may see; omitted means everything the contract publishes. */
+visible?: ProtocolVisibleDatasetFields): readonly SemanticOperationViolation[];
+/**
+ * Validates filters the provider enforces on every call, such as an embedded
+ * end user's account (RFC 0019). They are checked against what the contract
+ * publishes, not against the caller's visibility: a provider may constrain on
+ * a field the caller can't see.
+ */
+export declare function validateSemanticConstraints(constraints: readonly ProtocolExpression[], dataset: ProtocolDeploymentDataset, datasets: ReadonlyMap<string, ProtocolDeploymentDataset>): readonly SemanticOperationViolation[];
 //# sourceMappingURL=semantic-operation-validation.d.ts.map

package/dist/semantic-operation-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"semantic-operation-validation.d.ts","sourceRoot":"","sources":["../src/semantic-operation-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,yBAAyB,EAEzB,qBAAqB,EAEtB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AA8ED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,qBAAqB,EAChC,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,EACxD,MAAM,EAAE,uBAAuB,GAC9B,SAAS,0BAA0B,EAAE,CA0FvC"}
+{"version":3,"file":"semantic-operation-validation.d.ts","sourceRoot":"","sources":["../src/semantic-operation-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,EAErB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AA+FD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,qBAAqB,EAChC,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,EACxD,MAAM,EAAE,uBAAuB;AAC/B,mFAAmF;AACnF,OAAO,CAAC,EAAE,4BAA4B,GACrC,SAAS,0BAA0B,EAAE,CA2FvC;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,SAAS,kBAAkB,EAAE,EAC1C,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GACvD,SAAS,0BAA0B,EAAE,CAgBvC"}

package/dist/semantic-operation-validation.js

@@ -52,6 +52,20 @@ function resolveDataset(dataset, datasets) {
         grains: new Set(dataset.timeField === undefined ? [] : ALL_GRAINS),
     };
 }
+/**
+ * Narrows what a dataset exposes to what a visibility policy lets this
+ * principal see (RFC 0019). Hidden fields drop out of the same sets unknown
+ * ones are missing from, so a refusal reads exactly like an unknown field and
+ * does not confirm that the hidden one exists.
+ */
+function narrowResolvedToVisible(allowed, visible) {
+    return {
+        groupable: new Set([...allowed.groupable].filter(name => visible.dimensions.has(name))),
+        filters: new Map([...allowed.filters].filter(([name]) => (visible.filters.has(name) || (name.includes('.') && visible.dimensions.has(name))))),
+        measures: new Set([...allowed.measures].filter(name => visible.measures.has(name))),
+        grains: visible.timeField ? allowed.grains : new Set(),
+    };
+}
 /**
  * The field a filter expression addresses, or null when it is not a plain
  * comparison.
@@ -76,7 +90,9 @@ function comparisonField(expression) {
  * Returns every violation rather than the first, so a caller correcting an
  * agent-authored query sees the whole problem in one round trip.
  */
-export function validateSemanticOperation(operation, dataset, datasets, limits) {
+export function validateSemanticOperation(operation, dataset, datasets, limits, 
+/** What the principal may see; omitted means everything the contract publishes. */
+visible) {
     const violations = [];
     const fail = (message, path) => violations.push({ message, path });
     // A deployment carries no metric, so a metric operation addresses nothing the
@@ -85,7 +101,8 @@ export function validateSemanticOperation(operation, dataset, datasets, limits)
         fail(`Unknown metric "${String(operation.metric)}".`, '$.operation.metric');
         return violations;
     }
-    const allowed = resolveDataset(dataset, datasets);
+    const published = resolveDataset(dataset, datasets);
+    const allowed = visible === undefined ? published : narrowResolvedToVisible(published, visible);
     const dimensions = operation.dimensions ?? [];
     if (dimensions.length > limits.maxDimensions) {
         fail(`At most ${limits.maxDimensions} dimensions may be selected.`, '$.operation.dimensions');
@@ -155,3 +172,26 @@ export function validateSemanticOperation(operation, dataset, datasets, limits)
     }
     return violations;
 }
+/**
+ * Validates filters the provider enforces on every call, such as an embedded
+ * end user's account (RFC 0019). They are checked against what the contract
+ * publishes, not against the caller's visibility: a provider may constrain on
+ * a field the caller can't see.
+ */
+export function validateSemanticConstraints(constraints, dataset, datasets) {
+    const violations = [];
+    const allowed = resolveDataset(dataset, datasets);
+    constraints.forEach((expression, index) => {
+        const path = `$.constraints[${index}]`;
+        const comparison = comparisonField(expression);
+        if (comparison === null) {
+            violations.push({ message: 'A constraint must be a field/operator/value comparison.', path });
+            return;
+        }
+        const operators = allowed.filters.get(comparison.field);
+        if (operators === undefined || !operators.has(comparison.operator)) {
+            violations.push({ message: 'The constraint cannot be enforced on this dataset.', path });
+        }
+    });
+    return violations;
+}

package/dist/utils/visibility-projection.d.ts

@@ -0,0 +1,23 @@
+import type { ProtocolDeploymentDataset, ProtocolVisibleDatasetFields } from '@hypequery/protocol';
+type Dimension = ProtocolDeploymentDataset['dimensions'][number];
+/**
+ * A dimension the principal may neither group nor filter by, with its label,
+ * description and semantic metadata removed (RFC 0019).
+ *
+ * It stays in the contract because measures, relationships and the tenant key
+ * may reference it. The agent-safe catalog omits a dimension that is neither
+ * groupable nor filterable; a consumer serving the projected contract itself
+ * still sees its name, type and source, so that contract is not a
+ * disclosure-safe artifact on its own.
+ */
+export declare function concealDimension(dimension: Dimension): Dimension;
+/**
+ * A published dataset narrowed to what a visibility policy shows, from the
+ * same resolution the data plane enforces. Hidden measures and filters go;
+ * hidden dimensions are concealed; a relationship whose keys or target are
+ * hidden goes with every field it would contribute; a hidden time field and
+ * the defaults that depend on it go. The result is still a valid dataset.
+ */
+export declare function narrowDatasetToVisible(dataset: ProtocolDeploymentDataset, visible: ProtocolVisibleDatasetFields): ProtocolDeploymentDataset;
+export {};
+//# sourceMappingURL=visibility-projection.d.ts.map

package/dist/utils/visibility-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visibility-projection.d.ts","sourceRoot":"","sources":["../../src/utils/visibility-projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAC;AAE7B,KAAK,SAAS,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAQhE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,yBAAyB,EAClC,OAAO,EAAE,4BAA4B,GACpC,yBAAyB,CAuB3B"}

package/dist/utils/visibility-projection.js

@@ -0,0 +1,46 @@
+/**
+ * A dimension the principal may neither group nor filter by, with its label,
+ * description and semantic metadata removed (RFC 0019).
+ *
+ * It stays in the contract because measures, relationships and the tenant key
+ * may reference it. The agent-safe catalog omits a dimension that is neither
+ * groupable nor filterable; a consumer serving the projected contract itself
+ * still sees its name, type and source, so that contract is not a
+ * disclosure-safe artifact on its own.
+ */
+export function concealDimension(dimension) {
+    return {
+        name: dimension.name,
+        type: dimension.type,
+        source: dimension.source,
+        filterable: false,
+        groupable: false,
+    };
+}
+/**
+ * A published dataset narrowed to what a visibility policy shows, from the
+ * same resolution the data plane enforces. Hidden measures and filters go;
+ * hidden dimensions are concealed; a relationship whose keys or target are
+ * hidden goes with every field it would contribute; a hidden time field and
+ * the defaults that depend on it go. The result is still a valid dataset.
+ */
+export function narrowDatasetToVisible(dataset, visible) {
+    const { defaults, timeField, ...rest } = dataset;
+    const defaultDimensions = defaults?.dimensions?.filter(name => visible.dimensions.has(String(name)));
+    const narrowedDefaults = {
+        ...(defaultDimensions === undefined || defaultDimensions.length === 0
+            ? {}
+            : { dimensions: defaultDimensions }),
+        ...(defaults?.timeGrain === undefined || !visible.timeField ? {} : { timeGrain: defaults.timeGrain }),
+    };
+    return {
+        ...rest,
+        ...(visible.timeField && timeField !== undefined ? { timeField } : {}),
+        // An empty `defaults` object is not a valid contract value.
+        ...(Object.keys(narrowedDefaults).length === 0 ? {} : { defaults: narrowedDefaults }),
+        dimensions: dataset.dimensions.map(dimension => (visible.dimensions.has(String(dimension.name)) ? dimension : concealDimension(dimension))),
+        measures: dataset.measures.filter(measure => visible.measures.has(String(measure.name))),
+        filters: dataset.filters.filter(filter => visible.filters.has(String(filter.name))),
+        relationships: dataset.relationships.filter(relationship => (visible.relationships.has(String(relationship.name)))),
+    };
+}

package/dist/utils/visible-measure-selection.d.ts

@@ -0,0 +1,10 @@
+import type { ProtocolDeploymentDataset, ProtocolSemanticQuery, ProtocolVisibleDatasetFields } from '@hypequery/protocol';
+/**
+ * A dataset operation that omits `measures` asks the executor for every base
+ * measure of the full contract. When the visibility policy hides any of them,
+ * spell out the visible base measures instead, so the selection the executor
+ * runs is one the visibility check allows. When none is hidden the operation
+ * is returned unchanged and keeps the executor's default selection.
+ */
+export declare function withVisibleDefaultMeasures(operation: ProtocolSemanticQuery, dataset: ProtocolDeploymentDataset, visible: ProtocolVisibleDatasetFields | undefined): ProtocolSemanticQuery;
+//# sourceMappingURL=visible-measure-selection.d.ts.map

package/dist/utils/visible-measure-selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visible-measure-selection.d.ts","sourceRoot":"","sources":["../../src/utils/visible-measure-selection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAC;AAQ7B;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,qBAAqB,EAChC,OAAO,EAAE,yBAAyB,EAClC,OAAO,EAAE,4BAA4B,GAAG,SAAS,GAChD,qBAAqB,CAMvB"}

package/dist/utils/visible-measure-selection.js

@@ -0,0 +1,21 @@
+import { joinProtocolQualifiedIdentifier } from '@hypequery/protocol';
+/** A measure computed from no other measure: neither derived (`uses`) nor a time measure (`measure`). */
+function isBaseMeasure(measure) {
+    return !('uses' in measure) && !('measure' in measure);
+}
+/**
+ * A dataset operation that omits `measures` asks the executor for every base
+ * measure of the full contract. When the visibility policy hides any of them,
+ * spell out the visible base measures instead, so the selection the executor
+ * runs is one the visibility check allows. When none is hidden the operation
+ * is returned unchanged and keeps the executor's default selection.
+ */
+export function withVisibleDefaultMeasures(operation, dataset, visible) {
+    if (visible === undefined || operation.kind !== 'dataset' || operation.measures !== undefined)
+        return operation;
+    const base = dataset.measures.filter(isBaseMeasure);
+    const shown = base.filter(measure => visible.measures.has(String(measure.name)));
+    if (shown.length === base.length)
+        return operation;
+    return Object.freeze({ ...operation, measures: shown.map(measure => joinProtocolQualifiedIdentifier([measure.name])) });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypequery/deployment",
-  "version": "0.9.6",
+  "version": "0.10.0",
   "description": "Verified deployment intake, activation, and semantic invocation for Hypequery analytics",
   "keywords": [
     "hypequery",
@@ -26,13 +26,13 @@
     "README.md"
   ],
   "dependencies": {
-    "@hypequery/protocol": "0.20.0"
+    "@hypequery/protocol": "0.21.0"
   },
   "devDependencies": {
     "@types/node": "^22.5.0",
     "typescript": "^6.0.3",
-    "vitest": "^5.0.2",
-    "@hypequery/datasets": "0.23.1"
+    "vitest": "^5.0.5",
+    "@hypequery/datasets": "0.24.0"
   },
   "engines": {
     "node": ">=20"