@loradb/lora-graphql 0.18.0 → 0.20.0

package/dist/driver.d.ts

@@ -27,10 +27,15 @@ export interface RunOptions {
     signal?: AbortSignal | undefined;
     /**
      * A read the library vouches for: generated, or a @cypher statement
-     * checked read-only at startup. The driver may stream it outside a
+     * checked read-only at startup. The driver may run it outside a
      * read-only transaction.
      */
     verified?: boolean;
+    /**
+     * A verified read of at most one row, by an exact @key seek, projecting
+     * only stored properties. Cheap enough to run synchronously.
+     */
+    bounded?: boolean;
 }
 /** An open interactive transaction: statements see earlier writes. */
 export interface DriverTransaction {
@@ -82,20 +87,24 @@ export interface LoraDatabaseLike {
         timeoutMs?: number;
         signal?: AbortSignal;
     }): Promise<QueryResult[]>;
-    explain?(query: string, params?: never): Promise<QueryPlan>;
-    changes?(options?: {
-        fromLsn?: number;
+    execute?(query: string, params?: never, options?: {
+        timeoutMs?: number;
         signal?: AbortSignal;
-    }): AsyncIterable<DriverChangeBatch> & {
-        ready: Promise<void>;
-    };
+    }): Promise<QueryResult>;
     stream?(query: string, params?: never, options?: {
         timeoutMs?: number;
         signal?: AbortSignal;
     }): {
-        columns(): string[];
+        columns(): string[] | Promise<string[]>;
         toArray(): Promise<Array<Record<string, unknown>>>;
     };
+    explain?(query: string, params?: never): Promise<QueryPlan>;
+    changes?(options?: {
+        fromLsn?: number;
+        signal?: AbortSignal;
+    }): AsyncIterable<DriverChangeBatch> & {
+        ready: Promise<void>;
+    };
     begin?(mode?: "read_write" | "read_only"): Promise<{
         execute(query: string, params?: never, options?: {
             timeoutMs?: number;

package/dist/errors.d.ts

@@ -15,6 +15,6 @@ export declare class ModelError extends Error {
     constructor(problems: ModelProblem[]);
 }
 export declare function formatProblem(p: ModelProblem): string;
-export type LoraGraphQLErrorCode = "BAD_USER_INPUT" | "INVALID_CURSOR" | "LIMIT_EXCEEDED" | "COST_EXCEEDED" | "UNAUTHENTICATED" | "FORBIDDEN" | "NOT_FOUND" | "CONSTRAINT_VIOLATION" | "DATABASE_ERROR" | "PERSISTED_QUERY_ONLY";
+export type LoraGraphQLErrorCode = "BAD_USER_INPUT" | "INVALID_CURSOR" | "LIMIT_EXCEEDED" | "COST_EXCEEDED" | "UNAUTHENTICATED" | "FORBIDDEN" | "NOT_FOUND" | "CONSTRAINT_VIOLATION" | "DATABASE_ERROR" | "PERSISTED_QUERY_ONLY" | "WRONG_OPERATION_TYPE";
 /** A request-time error with a stable `extensions.code`. */
 export declare function requestError(code: LoraGraphQLErrorCode, message: string, cause?: unknown, extensions?: Record<string, unknown>): GraphQLError;

package/dist/execute/feed.d.ts

@@ -3,7 +3,7 @@ import { GraphModel } from '../model/types.js';
 import { WriteChange } from './changes.js';
 export declare class EngineFeed {
     #private;
-    constructor(driver: LoraDriver, model: GraphModel, emit: (change: WriteChange) => void);
+    constructor(driver: LoraDriver, model: GraphModel, emit: (change: WriteChange) => void, onError?: (err: unknown) => void);
     /** Subscribe; resolves once every later commit will be delivered. */
     start(): Promise<void>;
     stop(): void;

package/dist/guards.d.ts

@@ -1,7 +1,18 @@
 import { ParseOptions, ValidationRule } from 'graphql';
 export interface DocumentGuards {
-    /** Deepest field nesting, fragments followed. Default 12. */
+    /**
+     * Deepest field nesting, fragments followed. Default 12. An
+     * introspection field (`__schema`, `__type`) counts as one level here:
+     * its subtree follows the type-reference chain, not the graph, and is
+     * bounded by `maxIntrospectionDepth`.
+     */
     maxDepth?: number;
+    /**
+     * Deepest nesting under `__schema` or `__type`, the field included.
+     * Default 20: the standard introspection query (every option on) needs
+     * 15, and a runaway `ofType { ofType … }` chain is still refused.
+     */
+    maxIntrospectionDepth?: number;
     /** Aliased fields in one document. Default 30. */
     maxAliases?: number;
     /** Root fields in one operation. Default 20. */
@@ -16,6 +27,7 @@ export interface DocumentGuards {
 }
 export declare const DEFAULT_GUARDS: {
     readonly maxDepth: 12;
+    readonly maxIntrospectionDepth: 20;
     readonly maxAliases: 30;
     readonly maxRootFields: 20;
     readonly maxTokens: 5000;

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export type * from './model/types.js';
 export { inferRequirements, requirementDdl, type SchemaRequirement, } from './analyze/indexes.js';
 export { checkPlans, scanExpands, type PlanFinding, type PlanReport, } from './analyze/plans.js';
 export type { DegreeStats, Statistics } from './analyze/statistics.js';
+export type { AccessEntry, AccessVerdict } from './analyze/access.js';
 export type { CypherFinding } from './analyze/cypher-check.js';
 export { diffSchemas, type ApiChange, type SchemaDiff, } from './analyze/diff.js';
 export type { CompiledRead, ReadSet, SeekExpectation } from './compile/read.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-import { D as e, L as r, a as o, M as l, b as i, c as d, d as n, e as t, f, g as m, i as p, l as c, p as h, r as D, s as b, h as u, t as v, v as L } from "./driver-CQj9gkvl.js";
-import { d as x } from "./diff-fpWH5KUa.js";
+import { D as e, L as r, a as o, M as l, b as i, c as d, d as n, e as t, f, g as m, i as p, l as c, p as h, r as D, s as b, h as u, t as v, v as L } from "./driver-C7a5NkfH.js";
+import { d as x } from "./diff-DUOLUgrI.js";
 export {
   e as DEFAULT_GUARDS,
   r as LoraGraphQL,

package/dist/lora-graphql.d.ts

@@ -2,6 +2,7 @@ import { DocumentNode, ExecutionResult, GraphQLSchema, GraphQLFieldResolver, Gra
 import { CypherFinding } from './analyze/cypher-check.js';
 import { SchemaRequirement } from './analyze/indexes.js';
 import { PlanReport } from './analyze/plans.js';
+import { AccessEntry } from './analyze/access.js';
 import { Statistics } from './analyze/statistics.js';
 import { CompiledRead, ReadSet } from './compile/read.js';
 import { LoraDriver, Statement } from './driver.js';
@@ -92,6 +93,17 @@ export interface LoraGraphQLOptions extends ModelOptions, ObservabilityOptions {
      * persisted operations by `id`. Default false.
      */
     persistedOnly?: boolean;
+    /**
+     * How `execute()` commits a mutation with several root fields.
+     * `"field"` (the default): each root field in its own transaction, so a
+     * later failure leaves the earlier ones committed. `"operation"`: every
+     * root field in one transaction, committed only when the operation
+     * reports no error, rolled back (with `data: null`) otherwise. A
+     * `transaction` in the context takes precedence. Servers that call
+     * graphql-js on `getSchema()` directly get per-operation atomicity by
+     * putting a `lora.begin()` transaction in the context.
+     */
+    mutationTransaction?: "field" | "operation";
 }
 export interface CostEvent {
     field: string;
@@ -106,7 +118,10 @@ export interface CostEvent {
 export interface DatabaseErrorEvent {
     /** Correlation id, also in the client error's `extensions.id`. */
     id: string;
-    /** The root field that failed. */
+    /**
+     * The root field that failed, or `changeFeed` for a failure of the
+     * change feed (it reopens from where it stopped after a backoff).
+     */
     field: string;
     /** The engine's message, which may name labels, properties and Cypher. */
     message: string;
@@ -176,6 +191,11 @@ export interface CheckReport {
     }>;
     /** Schema lint: valid but costly or risky choices (not failures). */
     lint: readonly ModelWarning[];
+    /**
+     * `@mutation` types with writes no rule guards (failures): declare them
+     * with `@authorization(public: [...])` when that is intended.
+     */
+    security: readonly ModelWarning[];
     /** Plan findings per operation and root field. */
     plans: Array<{
         operation: string;
@@ -230,6 +250,13 @@ export declare class LoraGraphQL {
      * The CI gate: @cypher statements plan, the database has what the API
      * needs, and each operation's statements seek where they should.
      */
+    /**
+     * Who may do what: for every type and guarded field, each operation as
+     * each kind of caller (anonymous, authenticated, and each role the rules
+     * test), with the verdict and the rules that decide it. Read off the
+     * model; stable, so it can be snapshotted and reviewed as a diff.
+     */
+    accessMatrix(): AccessEntry[];
     check(options?: CheckOptions): Promise<CheckReport>;
     /**
      * Compile a query without running it: one entry per root field, with its
@@ -273,7 +300,8 @@ export declare class LoraGraphQL {
     /**
      * Execute a query or mutation against the schema. Parsed and validated
      * documents are cached by source text; persisted ones by id. A
-     * subscription runs with {@link LoraGraphQL.subscribe}.
+     * subscription runs with {@link LoraGraphQL.subscribe}; given one, this
+     * returns a `WRONG_OPERATION_TYPE` error.
      */
     execute(args: ExecuteArgs): Promise<ExecutionResult>;
     /**
@@ -281,15 +309,19 @@ export declare class LoraGraphQL {
      * single result with the errors when it cannot start (an unknown id, a
      * validation error, a denied subscribe). Takes the same arguments as
      * {@link LoraGraphQL.execute}, a persisted id included, with the same
-     * document cache and guards. End it with `return()` on the iterator, or
-     * with an `AbortSignal` passed as `context.signal`.
+     * document cache and guards; a query or mutation gets a
+     * `WRONG_OPERATION_TYPE` error. End it with `return()` on the iterator
+     * or with an `AbortSignal` passed as `context.signal`: either ends it at
+     * once, without waiting for another event, and drops its listener. The
+     * cost limit applies to each event on its own.
      */
     subscribe(args: ExecuteArgs): Promise<AsyncIterableIterator<ExecutionResult> | ExecutionResult>;
     /** Called after every committed mutation with its exact write-set. */
     onWrite(listener: (change: WriteChange) => void): () => void;
     /**
      * Committed writes as an async iterator, e.g. for a subscription
-     * resolver. Only writes made through this instance are seen.
+     * resolver. Only writes made through this instance are seen. `return()`
+     * or aborting `signal` (already aborted included) ends it at once.
      */
     changes(options?: {
         signal?: AbortSignal;

package/dist/model/desugar.d.ts

@@ -0,0 +1,34 @@
+import { ModelProblem } from '../errors.js';
+import { AuthorizationWhere, NodeType, RelationshipPropertiesType } from './types.js';
+/** The `@viewer` claim: which node, by which unique field, is the caller. */
+export interface ViewerMapping {
+    claim: string;
+    type: string;
+    field: string;
+}
+/** Named rules: claims-only schema rules, and rules per node type. */
+export interface NamedRules {
+    schema: ReadonlyMap<string, AuthorizationWhere>;
+    byType: ReadonlyMap<string, ReadonlyMap<string, AuthorizationWhere>>;
+}
+export interface DesugarContext {
+    nodes: ReadonlyMap<string, NodeType>;
+    props: ReadonlyMap<string, RelationshipPropertiesType>;
+    viewer: ViewerMapping | undefined;
+    rules?: NamedRules;
+    /** Named rules being expanded, to report a cycle with its chain. */
+    expanding?: string[];
+    at: (message: string) => void;
+}
+/**
+ * A rule's where, sugar expanded. `owner` is the type the rule's `node`
+ * part tests (undefined on relationship properties: claims only).
+ */
+export declare function desugarRule(ctx: DesugarContext, owner: NodeType | undefined, where: AuthorizationWhere, ends?: {
+    source: NodeType;
+    target: NodeType;
+}): AuthorizationWhere;
+/** A `node` filter over `node`, sugar expanded, keys kept in order. */
+export declare function desugarNode(ctx: DesugarContext, node: NodeType, where: unknown): unknown;
+/** Model problems for a `@viewer` mapping, once the node types are built. */
+export declare function checkViewer(viewer: ViewerMapping, nodes: ReadonlyMap<string, NodeType>, jwtType: string, problems: ModelProblem[]): void;

package/dist/model/directives.d.ts

@@ -1,3 +1,3 @@
-export declare const directiveTypeDefs = "\n  \"A node label set. Defaults to the type name.\"\n  directive @node(labels: [String!], plural: String) on OBJECT\n\n  \"Natural key: required, unique and immutable; the tie-breaker of every sort and the anchor of cursors, global ids, updates and deletes. With generate: true, creates fill it with a UUID when the input leaves it out.\"\n  directive @key(generate: Boolean = false) on FIELD_DEFINITION\n\n  \"On an interface field: every implementation declares this relationship (with @relationship, possibly of different types or directions), so clients can select it on the interface.\"\n  directive @declareRelationship on FIELD_DEFINITION\n\n  \"Offer this field as a grouping key of <plural>Grouped (needs @query(aggregate: true)).\"\n  directive @groupBy on FIELD_DEFINITION\n\n  \"A field computed in JavaScript by the resolver passed in the resolvers option. requires is a selection on this type (for example name capacity) fetched in the same statement, so the resolver reads it from its source.\"\n  directive @customResolver(requires: String) on FIELD_DEFINITION\n\n  \"On a custom scalar: how its values are stored. Filters, sorts and indexes follow the storage type; the scalar is passed through unless the scalars option supplies an implementation.\"\n  directive @storedAs(type: StorageType!) on SCALAR\n\n  enum StorageType {\n    STRING\n    INT\n    FLOAT\n    BOOLEAN\n    DATETIME\n    DATE\n  }\n\n  \"A uniqueness constraint.\"\n  directive @unique on FIELD_DEFINITION\n\n  \"An explicit index. Usually unnecessary: inferred from @filterable and @sortable.\"\n  directive @index(kind: IndexKind!) on FIELD_DEFINITION\n\n  \"An edge. The target type is the field's type.\"\n  directive @relationship(\n    type: String!\n    direction: RelationshipDirection!\n    properties: String\n    \"UNDIRECTED reads follow the relationship both ways; writes use direction.\"\n    queryDirection: QueryDirection = DIRECTED\n    \"What deleting this node does to nodes reached through the field.\"\n    onDelete: OnDelete = DETACH\n    \"Which nested writes mutation inputs offer for the field.\"\n    nestedOperations: [NestedOperation!] = [\n      CREATE\n      CONNECT\n      DISCONNECT\n      UPDATE\n      DELETE\n    ]\n    \"false: no aggregate on the field's connection and no aggregate filter.\"\n    aggregate: Boolean = true\n  ) on FIELD_DEFINITION\n\n  enum NestedOperation {\n    CREATE\n    CONNECT\n    DISCONNECT\n    UPDATE\n    DELETE\n  }\n\n  enum QueryDirection {\n    DIRECTED\n    UNDIRECTED\n  }\n\n  \"DETACH removes the relationships; CASCADE deletes the related nodes too; RESTRICT refuses while any exist.\"\n  enum OnDelete {\n    DETACH\n    CASCADE\n    RESTRICT\n  }\n\n  \"Which mutations may set the field. @readonly is onCreate: false, onUpdate: false.\"\n  directive @settable(\n    onCreate: Boolean = true\n    onUpdate: Boolean = true\n  ) on FIELD_DEFINITION\n\n  \"Whether the field can be read (onRead: false makes it write-only) or aggregated.\"\n  directive @selectable(\n    onRead: Boolean = true\n    onAggregate: Boolean = true\n  ) on FIELD_DEFINITION\n\n  \"Set by a callback passed to LoraGraphQL({ callbacks }) on these operations; never client-settable.\"\n  directive @populatedBy(\n    callback: String!\n    operations: [TimestampOperation!]! = [CREATE, UPDATE]\n  ) on FIELD_DEFINITION\n\n  \"The shape of the request's claims. Rules may only test declared claims.\"\n  directive @jwt on OBJECT\n\n  \"Where a declared claim lives in the token, e.g. app_metadata.roles.\"\n  directive @jwtClaim(path: String!) on FIELD_DEFINITION\n\n  \"Properties carried by a relationship type.\"\n  directive @relationshipProperties on OBJECT\n\n  \"API name differs from the stored property.\"\n  directive @alias(property: String!) on FIELD_DEFINITION\n\n  \"Stored, never exposed.\"\n  directive @private on FIELD_DEFINITION\n\n  \"Declared upper bound on a relationship's fan-out, used by cost estimates.\"\n  directive @cardinality(max: Int!) on FIELD_DEFINITION\n\n  \"Generated read operations for a node type. Reads are on by default.\"\n  directive @query(\n    read: Boolean = true\n    aggregate: Boolean = false\n  ) on OBJECT | INTERFACE | UNION\n\n  \"The plural of an interface or union, for its root field.\"\n  directive @plural(value: String!) on INTERFACE | UNION\n\n  \"Filter operators for a field. Without arguments: EQ and IN. On a relationship field: enables relationship filters.\"\n  directive @filterable(byValue: [FilterOperator!]) on FIELD_DEFINITION\n\n  \"Sort and keyset-paginate on this field.\"\n  directive @sortable on FIELD_DEFINITION\n\n  \"Page size bounds for lists of this type.\"\n  directive @limit(\n    default: Int\n    max: Int\n  ) on OBJECT | INTERFACE | UNION | FIELD_DEFINITION\n\n  \"Expose an opaque global id derived from this @key field.\"\n  directive @relayId on FIELD_DEFINITION\n\n  \"Full-text search over String fields: a FULLTEXT index and a search root field per entry.\"\n  directive @fulltext(indexes: [FulltextIndex!]!) on OBJECT\n\n  \"A vector embedding ([Float!]): a VECTOR index and a similarity root field.\"\n  directive @vector(\n    dimensions: Int!\n    similarity: VectorSimilarity = COSINE\n    queryName: String\n  ) on FIELD_DEFINITION\n\n  input FulltextIndex {\n    \"Index name. Default: <label>_search for the first, required after.\"\n    name: String\n    fields: [String!]!\n    analyzer: FulltextAnalyzer = STANDARD\n    \"Root field name. Default: search<Plural>, or search<Plural>By<Name>.\"\n    queryName: String\n  }\n\n  enum FulltextAnalyzer {\n    STANDARD\n    SIMPLE\n  }\n\n  enum VectorSimilarity {\n    COSINE\n    EUCLIDEAN\n  }\n\n  \"Generated subscriptions to changes made through the library. None without this directive.\"\n  directive @subscription(\n    operations: [MutationOperation!]! = [CREATE, UPDATE, DELETE]\n    \"Also send CONNECT and DISCONNECT events for the type's relationships.\"\n    relationships: Boolean = false\n    \"Send the stored values before an update or delete (one extra read per write).\"\n    previousState: Boolean = false\n  ) on OBJECT\n\n  \"Generated mutations for a node type. None without this directive.\"\n  directive @mutation(\n    operations: [MutationOperation!]! = [CREATE, UPDATE, DELETE]\n  ) on OBJECT\n\n  \"Value stored on create when the input leaves the field out.\"\n  directive @default(value: DefaultValue!) on FIELD_DEFINITION\n\n  \"Set to the current time by the listed operations; never client-settable.\"\n  directive @timestamp(\n    operations: [TimestampOperation!]! = [CREATE, UPDATE]\n  ) on FIELD_DEFINITION\n\n  \"Readable but never client-settable.\"\n  directive @readonly on FIELD_DEFINITION\n\n  \"A field backed by a Cypher statement. `this` is the parent node; arguments are $parameters, and $jwt holds the request's claims.\"\n  directive @cypher(statement: String!, columnName: String) on FIELD_DEFINITION\n\n  \"Require an authenticated request (a jwt in the context) for these operations.\"\n  directive @authentication(\n    operations: [AuthOperation!]! = [\n      READ\n      CREATE\n      UPDATE\n      DELETE\n      CREATE_RELATIONSHIP\n      DELETE_RELATIONSHIP\n      SUBSCRIBE\n    ]\n    \"Claims the request must also satisfy, such as a role in roles.\"\n    jwt: AuthorizationWhere\n  ) on OBJECT | FIELD_DEFINITION\n\n  \"Row-level rules over the node and the request's claims, compiled into the statements.\"\n  directive @authorization(\n    filter: [AuthorizationFilterRule!]\n    validate: [AuthorizationValidateRule!]\n  ) on OBJECT | FIELD_DEFINITION\n\n  input AuthorizationFilterRule {\n    operations: [AuthOperation!]! = [READ, UPDATE, DELETE]\n    requireAuthentication: Boolean = true\n    where: AuthorizationWhere!\n  }\n\n  input AuthorizationValidateRule {\n    operations: [AuthOperation!]! = [READ, CREATE, UPDATE, DELETE]\n    when: [AuthorizationWhen!]! = [BEFORE, AFTER]\n    requireAuthentication: Boolean = true\n    where: AuthorizationWhere!\n  }\n\n  enum MutationOperation {\n    CREATE\n    UPDATE\n    DELETE\n  }\n\n  enum TimestampOperation {\n    CREATE\n    UPDATE\n  }\n\n  enum AuthOperation {\n    READ\n    CREATE\n    UPDATE\n    DELETE\n    CREATE_RELATIONSHIP\n    DELETE_RELATIONSHIP\n    SUBSCRIBE\n  }\n\n  enum AuthorizationWhen {\n    BEFORE\n    AFTER\n  }\n\n  \"Any literal.\"\n  scalar DefaultValue\n\n  \"{ node: <Type>Where-shaped filter, jwt: claim filter, AND, OR, NOT }. String values starting with $jwt. are replaced by claims.\"\n  scalar AuthorizationWhere\n\n  enum IndexKind {\n    RANGE\n    TEXT\n    POINT\n  }\n\n  enum RelationshipDirection {\n    IN\n    OUT\n  }\n\n  enum FilterOperator {\n    EQ\n    IN\n    LT\n    LTE\n    GT\n    GTE\n    CONTAINS\n    STARTS_WITH\n    ENDS_WITH\n    WITHIN_BBOX\n    DISTANCE\n    INCLUDES\n    IS_NULL\n    CASE_INSENSITIVE\n  }\n\n  scalar BigInt\n  scalar Date\n  scalar Time\n  scalar LocalTime\n  scalar DateTime\n  scalar LocalDateTime\n  scalar Duration\n\n  type Point {\n    longitude: Float!\n    latitude: Float!\n    height: Float\n    srid: Int!\n    crs: String!\n  }\n\n  type CartesianPoint {\n    x: Float!\n    y: Float!\n    z: Float\n    srid: Int!\n    crs: String!\n  }\n";
+export declare const directiveTypeDefs = "\n  \"A node label set. Defaults to the type name.\"\n  directive @node(labels: [String!], plural: String) on OBJECT\n\n  \"Natural key: required, unique and immutable; the tie-breaker of every sort and the anchor of cursors, global ids, updates and deletes. With generate: true, creates fill it with a UUID when the input leaves it out.\"\n  directive @key(\n    generate: Boolean = false\n    \"VIEWER: a created key must start with the caller's @viewer claim and the separator (lou:tomorrowland).\"\n    scope: KeyScope\n    separator: String = \":\"\n  ) on FIELD_DEFINITION\n\n  enum KeyScope {\n    VIEWER\n  }\n\n  \"On an interface field: every implementation declares this relationship (with @relationship, possibly of different types or directions), so clients can select it on the interface.\"\n  directive @declareRelationship on FIELD_DEFINITION\n\n  \"Offer this field as a grouping key of <plural>Grouped (needs @query(aggregate: true)).\"\n  directive @groupBy on FIELD_DEFINITION\n\n  \"A field computed in JavaScript by the resolver passed in the resolvers option. requires is a selection on this type (for example name capacity) fetched in the same statement, so the resolver reads it from its source.\"\n  directive @customResolver(requires: String) on FIELD_DEFINITION\n\n  \"On a custom scalar: how its values are stored. Filters, sorts and indexes follow the storage type; the scalar is passed through unless the scalars option supplies an implementation.\"\n  directive @storedAs(type: StorageType!) on SCALAR\n\n  enum StorageType {\n    STRING\n    INT\n    FLOAT\n    BOOLEAN\n    DATETIME\n    DATE\n  }\n\n  \"A uniqueness constraint.\"\n  directive @unique on FIELD_DEFINITION\n\n  \"An explicit index. Usually unnecessary: inferred from @filterable and @sortable.\"\n  directive @index(kind: IndexKind!) on FIELD_DEFINITION\n\n  \"An edge. The target type is the field's type.\"\n  directive @relationship(\n    type: String!\n    direction: RelationshipDirection!\n    properties: String\n    \"UNDIRECTED reads follow the relationship both ways; writes use direction.\"\n    queryDirection: QueryDirection = DIRECTED\n    \"What deleting this node does to nodes reached through the field.\"\n    onDelete: OnDelete = DETACH\n    \"Which nested writes mutation inputs offer for the field.\"\n    nestedOperations: [NestedOperation!] = [\n      CREATE\n      CONNECT\n      DISCONNECT\n      UPDATE\n      DELETE\n    ]\n    \"false: no aggregate on the field's connection and no aggregate filter.\"\n    aggregate: Boolean = true\n  ) on FIELD_DEFINITION\n\n  enum NestedOperation {\n    CREATE\n    CONNECT\n    DISCONNECT\n    UPDATE\n    DELETE\n  }\n\n  enum QueryDirection {\n    DIRECTED\n    UNDIRECTED\n  }\n\n  \"DETACH removes the relationships; CASCADE deletes the related nodes too; RESTRICT refuses while any exist.\"\n  enum OnDelete {\n    DETACH\n    CASCADE\n    RESTRICT\n  }\n\n  \"Which mutations may set the field. @readonly is onCreate: false, onUpdate: false.\"\n  directive @settable(\n    onCreate: Boolean = true\n    onUpdate: Boolean = true\n  ) on FIELD_DEFINITION\n\n  \"Whether the field can be read (onRead: false makes it write-only) or aggregated.\"\n  directive @selectable(\n    onRead: Boolean = true\n    onAggregate: Boolean = true\n  ) on FIELD_DEFINITION\n\n  \"Set by a callback passed to LoraGraphQL({ callbacks }) on these operations; never client-settable.\"\n  directive @populatedBy(\n    callback: String!\n    operations: [TimestampOperation!]! = [CREATE, UPDATE]\n  ) on FIELD_DEFINITION\n\n  \"The shape of the request's claims. Rules may only test declared claims.\"\n  directive @jwt on OBJECT\n\n  \"Where a declared claim lives in the token, e.g. app_metadata.roles.\"\n  directive @jwtClaim(path: String!) on FIELD_DEFINITION\n\n  \"The claim that identifies the caller: the node of `type` whose `field` (a @key or @unique field) equals it. Enables isViewer and viewer in rules.\"\n  directive @viewer(type: String!, field: String!) on FIELD_DEFINITION\n\n  \"Properties carried by a relationship type.\"\n  directive @relationshipProperties on OBJECT\n\n  \"API name differs from the stored property.\"\n  directive @alias(property: String!) on FIELD_DEFINITION\n\n  \"Stored, never exposed.\"\n  directive @private on FIELD_DEFINITION\n\n  \"Declared upper bound on a relationship's fan-out, used by cost estimates.\"\n  directive @cardinality(max: Int!) on FIELD_DEFINITION\n\n  \"Generated read operations for a node type. Reads are on by default.\"\n  directive @query(\n    read: Boolean = true\n    aggregate: Boolean = false\n  ) on OBJECT | INTERFACE | UNION\n\n  \"The plural of an interface or union, for its root field.\"\n  directive @plural(value: String!) on INTERFACE | UNION\n\n  \"Filter operators for a field. Without arguments: EQ and IN. On a relationship field: enables relationship filters.\"\n  directive @filterable(byValue: [FilterOperator!]) on FIELD_DEFINITION\n\n  \"Sort and keyset-paginate on this field.\"\n  directive @sortable on FIELD_DEFINITION\n\n  \"Page size bounds for lists of this type.\"\n  directive @limit(\n    default: Int\n    max: Int\n  ) on OBJECT | INTERFACE | UNION | FIELD_DEFINITION\n\n  \"Expose an opaque global id derived from this @key field.\"\n  directive @relayId on FIELD_DEFINITION\n\n  \"Full-text search over String fields: a FULLTEXT index and a search root field per entry.\"\n  directive @fulltext(indexes: [FulltextIndex!]!) on OBJECT\n\n  \"A vector embedding ([Float!]): a VECTOR index and a similarity root field.\"\n  directive @vector(\n    dimensions: Int!\n    similarity: VectorSimilarity = COSINE\n    queryName: String\n  ) on FIELD_DEFINITION\n\n  input FulltextIndex {\n    \"Index name. Default: <label>_search for the first, required after.\"\n    name: String\n    fields: [String!]!\n    analyzer: FulltextAnalyzer = STANDARD\n    \"Root field name. Default: search<Plural>, or search<Plural>By<Name>.\"\n    queryName: String\n  }\n\n  enum FulltextAnalyzer {\n    STANDARD\n    SIMPLE\n  }\n\n  enum VectorSimilarity {\n    COSINE\n    EUCLIDEAN\n  }\n\n  \"Generated subscriptions to changes made through the library. None without this directive.\"\n  directive @subscription(\n    operations: [MutationOperation!]! = [CREATE, UPDATE, DELETE]\n    \"Also send CONNECT and DISCONNECT events for the type's relationships.\"\n    relationships: Boolean = false\n    \"Send the stored values before an update or delete (one extra read per write).\"\n    previousState: Boolean = false\n  ) on OBJECT\n\n  \"Generated mutations for a node type. None without this directive.\"\n  directive @mutation(\n    operations: [MutationOperation!]! = [CREATE, UPDATE, DELETE]\n  ) on OBJECT\n\n  \"Value stored on create when the input leaves the field out.\"\n  directive @default(value: DefaultValue!) on FIELD_DEFINITION\n\n  \"Set to the current time by the listed operations; never client-settable.\"\n  directive @timestamp(\n    operations: [TimestampOperation!]! = [CREATE, UPDATE]\n  ) on FIELD_DEFINITION\n\n  \"Readable but never client-settable.\"\n  directive @readonly on FIELD_DEFINITION\n\n  \"A field backed by a Cypher statement. `this` is the parent node; arguments are $parameters, and $jwt holds the request's claims.\"\n  directive @cypher(statement: String!, columnName: String) on FIELD_DEFINITION\n\n  \"Require an authenticated request (a jwt in the context) for these operations.\"\n  directive @authentication(\n    operations: [AuthOperation!]! = [\n      READ\n      CREATE\n      UPDATE\n      DELETE\n      CREATE_RELATIONSHIP\n      DELETE_RELATIONSHIP\n      SUBSCRIBE\n    ]\n    \"Claims the request must also satisfy, such as a role in roles.\"\n    jwt: AuthorizationWhere\n  ) on OBJECT | FIELD_DEFINITION\n\n  \"Row-level rules over the node and the request's claims, compiled into the statements.\"\n  directive @authorization(\n    filter: [AuthorizationFilterRule!]\n    validate: [AuthorizationValidateRule!]\n    \"On a type: false keeps the schema's bypass (see @authorizationDefaults) from skipping this type's rules.\"\n    bypass: Boolean\n    \"On a @mutation type: operations deliberately open to every caller, so check() does not report them as unguarded.\"\n    public: [AuthOperation!]\n    \"On a scalar field: a row failing unless reads the field as value (null when left out) instead of failing the request.\"\n    mask: [AuthorizationMask!]\n  ) on OBJECT | FIELD_DEFINITION\n\n  \"Named rules over claims, usable in any rule as { rule: name }, on `extend schema`.\"\n  directive @authorizationRules(\n    rules: [AuthorizationRuleDefinition!]!\n  ) on SCHEMA\n\n  input AuthorizationRuleDefinition {\n    name: String!\n    where: AuthorizationWhere!\n  }\n\n  \"A named rule of this type, usable in its rules as { rule: name } and through a relationship to it as { rel: { rule: name } }.\"\n  directive @authorizationRule(\n    name: String!\n    where: AuthorizationWhere!\n  ) repeatable on OBJECT\n\n  \"Schema-wide authorization settings, on `extend schema`.\"\n  directive @authorizationDefaults(\n    \"A claims-only test (jwt, AND, OR, NOT): a request passing it skips every filter and validate rule (not @authentication).\"\n    bypass: AuthorizationWhere\n    \"The write rule of every @mutation type that declares no CREATE, UPDATE or DELETE rule of its own.\"\n    mutations: AuthorizationWhere\n  ) on SCHEMA\n\n  input AuthorizationMask {\n    unless: AuthorizationWhere!\n    value: DefaultValue\n  }\n\n  input AuthorizationFilterRule {\n    operations: [AuthOperation!]! = [READ, UPDATE, DELETE]\n    \"Default true: without a token the rule denies.\"\n    requireAuthentication: Boolean\n    where: AuthorizationWhere!\n  }\n\n  input AuthorizationValidateRule {\n    operations: [AuthOperation!]! = [READ, CREATE, UPDATE, DELETE]\n    when: [AuthorizationWhen!]! = [BEFORE, AFTER]\n    \"Default true: without a token the rule denies.\"\n    requireAuthentication: Boolean\n    where: AuthorizationWhere!\n  }\n\n  enum MutationOperation {\n    CREATE\n    UPDATE\n    DELETE\n  }\n\n  enum TimestampOperation {\n    CREATE\n    UPDATE\n  }\n\n  enum AuthOperation {\n    READ\n    CREATE\n    UPDATE\n    DELETE\n    CREATE_RELATIONSHIP\n    DELETE_RELATIONSHIP\n    SUBSCRIBE\n    \"On a relationship field: creating one of its relationships (connect, nested create).\"\n    CONNECT\n    \"On a relationship field: removing one of its relationships (disconnect).\"\n    DISCONNECT\n    \"On a relationship field: setting properties on an existing relationship (edge update, re-connect).\"\n    UPDATE_EDGE\n    \"On a relationship field: reading, filtering, sorting or aggregating its properties.\"\n    READ_EDGE\n  }\n\n  enum AuthorizationWhen {\n    BEFORE\n    AFTER\n  }\n\n  \"Any literal.\"\n  scalar DefaultValue\n\n  \"{ node: <Type>Where-shaped filter, jwt: claim filter, AND, OR, NOT }. String values starting with $jwt. are replaced by claims.\"\n  scalar AuthorizationWhere\n\n  enum IndexKind {\n    RANGE\n    TEXT\n    POINT\n  }\n\n  enum RelationshipDirection {\n    IN\n    OUT\n  }\n\n  enum FilterOperator {\n    EQ\n    IN\n    LT\n    LTE\n    GT\n    GTE\n    CONTAINS\n    STARTS_WITH\n    ENDS_WITH\n    WITHIN_BBOX\n    DISTANCE\n    INCLUDES\n    IS_NULL\n    CASE_INSENSITIVE\n  }\n\n  scalar BigInt\n  scalar Date\n  scalar Time\n  scalar LocalTime\n  scalar DateTime\n  scalar LocalDateTime\n  scalar Duration\n\n  type Point {\n    longitude: Float!\n    latitude: Float!\n    height: Float\n    srid: Int!\n    crs: String!\n  }\n\n  type CartesianPoint {\n    x: Float!\n    y: Float!\n    z: Float\n    srid: Int!\n    crs: String!\n  }\n";
 /** Names defined by the prelude; never treated as user types. */
 export declare const PRELUDE_TYPES: Set<string>;

package/dist/model/positions.d.ts

@@ -0,0 +1,22 @@
+import { GraphQLNamedType, GraphQLSchema } from 'graphql';
+import { ModelProblem } from '../errors.js';
+export type Position = "node type" | "relationship properties type" | "@jwt type" | "object type without @node" | "Query or Mutation type" | "interface" | "union" | "node field" | "relationship field" | "@cypher field" | "Query or Mutation field" | "@customResolver field" | "relationship property" | "interface field" | "interface relationship field" | "field of an object type without @node" | "@jwt claim";
+/**
+ * The directives each position applies, plus those it refuses with a more
+ * specific message elsewhere in the model build (listed so they are not
+ * reported twice).
+ */
+export declare const DIRECTIVE_POSITIONS: Readonly<Record<Position, readonly string[]>>;
+/** The directives this library defines (not graphql's built-ins). */
+export declare function libraryDirectives(): ReadonlySet<string>;
+export interface PositionContext {
+    schema: GraphQLSchema;
+    nodeNames: ReadonlySet<string>;
+    propsNames: ReadonlySet<string>;
+    jwtType: string | undefined;
+    /** @node types, interfaces and unions: what a relationship may target. */
+    targetNames: ReadonlySet<string>;
+    userTypes: readonly GraphQLNamedType[];
+}
+/** Report every library directive used where the model would ignore it. */
+export declare function checkDirectivePositions(ctx: PositionContext, problems: ModelProblem[]): void;

package/dist/model/types.d.ts

@@ -4,7 +4,10 @@ export type ScalarType = "String" | "ID" | "Int" | "Float" | "Boolean" | "BigInt
 export type FilterOperator = "EQ" | "IN" | "LT" | "LTE" | "GT" | "GTE" | "CONTAINS" | "STARTS_WITH" | "ENDS_WITH" | "WITHIN_BBOX" | "DISTANCE" | "INCLUDES" | "IS_NULL" | "CASE_INSENSITIVE";
 export type IndexKind = "RANGE" | "TEXT" | "POINT";
 export type MutationOperation = "CREATE" | "UPDATE" | "DELETE";
-export type AuthOperation = "READ" | MutationOperation | "CREATE_RELATIONSHIP" | "DELETE_RELATIONSHIP" | "SUBSCRIBE";
+export type AuthOperation = "READ" | MutationOperation | "CREATE_RELATIONSHIP" | "DELETE_RELATIONSHIP" | "SUBSCRIBE" | RelationshipOperation;
+/** Operations of rules on a relationship field, over `source`, `target`, `edge`. */
+export type RelationshipOperation = "CONNECT" | "DISCONNECT" | "UPDATE_EDGE" | "READ_EDGE";
+export declare const RELATIONSHIP_OPERATIONS: ReadonlySet<AuthOperation>;
 /** Field-level options shared by every field kind. */
 interface FieldBase {
     /** Operations on which reading this field needs an authenticated request. */
@@ -39,6 +42,13 @@ export interface ScalarField extends FieldBase {
     indexes: readonly IndexKind[];
     /** `@key(generate: true)`: creates fill a UUID when the input omits it. */
     generate: boolean;
+    /**
+     * `@key(scope: VIEWER)`: a created key starts with the caller's `@viewer`
+     * claim and `separator`.
+     */
+    keyScope?: {
+        separator: string;
+    } | undefined;
     /** `@default(value:)`, stored on create when the input omits the field. */
     defaultValue: {
         value: unknown;
@@ -177,17 +187,33 @@ export type AuthorizationWhere = Record<string, unknown>;
 export interface AuthorizationFilterRule {
     operations: ReadonlySet<AuthOperation>;
     requireAuthentication: boolean;
+    /** `requireAuthentication` was left to its default (true). */
+    requireAuthenticationDefaulted?: boolean;
     where: AuthorizationWhere;
 }
 export interface AuthorizationValidateRule {
     operations: ReadonlySet<AuthOperation>;
     when: ReadonlySet<"BEFORE" | "AFTER">;
     requireAuthentication: boolean;
+    /** `requireAuthentication` was left to its default (true). */
+    requireAuthenticationDefaulted?: boolean;
     where: AuthorizationWhere;
 }
 export interface Authorization {
     filter: readonly AuthorizationFilterRule[];
     validate: readonly AuthorizationValidateRule[];
+    /** `bypass: false`: the schema's bypass does not skip these rules. */
+    bypass?: boolean;
+    /** `public:` operations deliberately open to every caller. */
+    public?: ReadonlySet<AuthOperation>;
+    /**
+     * `mask:` on a scalar field: a row failing `unless` reads the field as
+     * `value`, in projections and filters alike.
+     */
+    mask?: ReadonlyArray<{
+        unless: AuthorizationWhere;
+        value: unknown;
+    }>;
 }
 export interface PageLimit {
     default: number;
@@ -307,6 +333,17 @@ export interface GraphModel {
     objects: ReadonlyMap<string, PlainObjectType>;
     /** The `@jwt` claims shape, when declared: claim name → token path. */
     jwt: ReadonlyMap<string, string> | undefined;
+    /**
+     * `@authorizationDefaults(bypass:)`: a claims-only test that, when a
+     * request passes it, skips every filter and validate rule.
+     */
+    bypass: AuthorizationWhere | undefined;
+    /** The `@viewer` claim: the caller's node type and identifying field. */
+    viewer: {
+        claim: string;
+        type: string;
+        field: string;
+    } | undefined;
     /** Secret cursors are signed with, when configured. */
     cursorSecret: string | undefined;
 }

package/dist/testing.d.ts

@@ -34,3 +34,30 @@ export declare function expectSeeks(lora: LoraGraphQL, document: string | Docume
     rowBudget?: number;
     context?: unknown;
 }): Promise<void>;
+/** The access `expectAccess` expects: entries allowed, and entries denied. */
+export interface AccessExpectations {
+    /** The claims to act as; undefined acts anonymously. */
+    as: Record<string, unknown> | undefined;
+    /** Other GraphQL context values the rules read (`$context.*`). */
+    context?: Record<string, unknown>;
+    allowed?: readonly string[];
+    denied?: readonly string[];
+}
+/**
+ * Assert who may do what, against the database: each entry runs as the
+ * caller in a transaction that is always rolled back, and every mismatch
+ * is reported at once. Entries:
+ *
+ * - `read Trip lou:tomorrowland` (denied: not visible, or refused)
+ * - `create Trip lou:x {"name": "X"}` (other input fields as JSON)
+ * - `update Trip lou:x {"name": "Y"}` and `delete Trip lou:x`
+ * - `connect Trip.members lou:tomorrowland → f1` (also `->`)
+ * - `disconnect Trip.members lou:tomorrowland → f1`
+ * - `update-edge Trip.members lou:tomorrowland → f1 {"rsvp": "GOING"}`
+ *
+ * Denied means `FORBIDDEN`, `UNAUTHENTICATED` or `NOT_FOUND` (a node the
+ * caller cannot see); any other error is reported as a mismatch either way.
+ */
+export declare function expectAccess(target: LoraGraphQL | {
+    lora: LoraGraphQL;
+}, expectations: AccessExpectations): Promise<void>;

package/dist/testing.js

@@ -1,56 +1,173 @@
 import { graphql as h } from "graphql";
-import { L as w, l as u } from "./driver-CQj9gkvl.js";
-async function L(l) {
-  let s;
+import { L as w, l as g } from "./driver-C7a5NkfH.js";
+async function _(d) {
+  let l;
   try {
-    ({ createDatabase: s } = await import("@loradb/lora-node"));
+    ({ createDatabase: l } = await import("@loradb/lora-node"));
   } catch {
     throw new Error(
       "createTestLoraGraphQL needs @loradb/lora-node: npm install --save-dev @loradb/lora-node"
     );
   }
-  const t = await s(), n = [], { seed: a, onStatement: i, ...c } = l, r = new w({
+  const i = await l(), e = [], { seed: t, onStatement: a, ...c } = d, n = new w({
     ...c,
-    driver: u(t),
-    onStatement: (e) => {
-      n.push(e), i?.(e);
+    driver: g(i),
+    onStatement: (r) => {
+      e.push(r), a?.(r);
     }
   });
-  if (await r.assertSchema({ create: !0 }), typeof a == "function") await a(t);
+  if (await n.assertSchema({ create: !0 }), typeof t == "function") await t(i);
   else
-    for (const e of typeof a == "string" ? [a] : a ?? [])
-      await t.execute(e);
-  const o = r.getSchema(), m = (e, p = {}, d = {}) => h({ schema: o, source: e, variableValues: p, contextValue: d });
+    for (const r of typeof t == "string" ? [t] : t ?? [])
+      await i.execute(r);
+  const o = n.getSchema(), s = (r, u = {}, p = {}) => h({ schema: o, source: r, variableValues: u, contextValue: p });
   return {
-    lora: r,
-    db: t,
+    lora: n,
+    db: i,
     schema: o,
-    statements: n,
-    run: m,
-    data: async (e, p, d) => {
-      const f = await m(e, p, d);
-      if (f.errors) throw f.errors[0];
-      return f.data;
+    statements: e,
+    run: s,
+    data: async (r, u, p) => {
+      const $ = await s(r, u, p);
+      if ($.errors) throw $.errors[0];
+      return $.data;
     },
-    close: () => t.dispose?.()
+    close: () => i.dispose?.()
   };
 }
-async function b(l, s, t = {}, n = {}) {
-  const i = (await l.explain(s, t, n)).flatMap(
+async function N(d, l, i = {}, e = {}) {
+  const a = (await d.explain(l, i, e)).flatMap(
     (c) => c.reports.flatMap(
-      (r) => r.findings.map((o) => `${c.field}: ${o.message}
+      (n) => n.findings.map((o) => `${c.field}: ${o.message}
   ${o.statement}`)
     )
   );
-  if (i.length > 0)
+  if (a.length > 0)
     throw new Error(
       `expected every root field to seek:
-${i.join(`
+${a.join(`
 `)}`
     );
 }
+async function x(d, l) {
+  const i = d instanceof w ? d : d.lora, e = [], t = async (a, c) => {
+    let n;
+    try {
+      n = await b(i, a, l);
+    } catch (o) {
+      e.push(
+        `${a}: ${o instanceof Error ? o.message : String(o)}`
+      );
+      return;
+    }
+    n.kind === "error" ? e.push(`${a}: failed with ${n.message}`) : c && n.kind === "denied" ? e.push(
+      `expected allowed, was denied: ${a} (${n.message})`
+    ) : !c && n.kind === "allowed" && e.push(`expected denied, was allowed: ${a}`);
+  };
+  for (const a of l.allowed ?? []) await t(a, !0);
+  for (const a of l.denied ?? []) await t(a, !1);
+  if (e.length > 0) {
+    const a = l.as ? JSON.stringify(l.as) : "anonymous";
+    throw new Error(
+      `access as ${a} differs in ${e.length} ${e.length === 1 ? "entry" : "entries"}:
+  ${e.join(`
+  `)}`
+    );
+  }
+}
+const v = /* @__PURE__ */ new Set(["FORBIDDEN", "UNAUTHENTICATED", "NOT_FOUND"]);
+async function b(d, l, i) {
+  const { source: e, variables: t, isRead: a, root: c } = E(d, l), n = await d.begin();
+  try {
+    const o = await d.execute({
+      source: e,
+      variables: t,
+      context: {
+        ...i.context,
+        ...i.as ? { jwt: i.as } : {},
+        transaction: n
+      }
+    }), s = o.errors?.[0];
+    if (s) {
+      const r = s.extensions?.code;
+      return typeof r == "string" && v.has(r) ? { kind: "denied", message: `${r}: ${s.message}` } : {
+        kind: "error",
+        message: `${String(r ?? "error")}: ${s.message}`
+      };
+    }
+    return a && o.data?.[c] == null ? { kind: "denied", message: "not visible" } : { kind: "allowed" };
+  } finally {
+    await n.rollback();
+  }
+}
+function E(d, l) {
+  const i = /^\s*(read|create|update|delete|connect|disconnect|update-edge)\s+([A-Za-z_][\w]*)(?:\.([A-Za-z_]\w*))?\s+(\S+)(?:\s*(?:→|->)\s*(\S+))?\s*(\{.*\})?\s*$/s.exec(
+    l
+  );
+  if (!i)
+    throw new Error(
+      "expected `<read|create|update|delete> Type key [json]` or `<connect|disconnect|update-edge> Type.field key → key [json]`"
+    );
+  const [, e, t, a, c, n, o] = i, s = d.model.nodes.get(t);
+  if (!s) throw new Error(`${t} is not a @node type`);
+  const r = o ? JSON.parse(o) : {}, u = `${s.key.customScalar ?? s.key.type}!`, p = t.charAt(0).toLowerCase() + t.slice(1), $ = s.plural.charAt(0).toUpperCase() + s.plural.slice(1), m = ["connect", "disconnect", "update-edge"].includes(
+    e
+  );
+  if (m !== (a !== void 0 && n !== void 0))
+    throw new Error(
+      m ? `${e} takes Type.field key → key` : `${e} takes Type key`
+    );
+  switch (e) {
+    case "read":
+      return {
+        operation: e,
+        source: `query($key: ${u}) { ${p}(${s.key.name}: $key) { ${s.key.name} } }`,
+        variables: { key: c },
+        isRead: !0,
+        root: p
+      };
+    case "create":
+      return {
+        operation: e,
+        source: `mutation($input: [${t}CreateInput!]!) { create${$}(input: $input) { __typename } }`,
+        variables: { input: [{ ...r, [s.key.name]: c }] },
+        isRead: !1,
+        root: `create${$}`
+      };
+    case "update":
+      return {
+        operation: e,
+        source: `mutation($key: ${u}, $update: ${t}UpdateInput!) { update${t}(${s.key.name}: $key, update: $update) { __typename } }`,
+        variables: { key: c, update: r },
+        isRead: !1,
+        root: `update${t}`
+      };
+    case "delete":
+      return {
+        operation: e,
+        source: `mutation($key: ${u}) { delete${t}(${s.key.name}: $key) { __typename } }`,
+        variables: { key: c },
+        isRead: !1,
+        root: `delete${t}`
+      };
+  }
+  const f = s.fields.get(a);
+  if (f?.kind !== "relationship")
+    throw new Error(`${t}.${a} is not a relationship field`);
+  const y = d.model.nodes.get(f.target)?.key.name ?? "key", k = e === "connect" ? {
+    connect: f.list ? [{ [y]: n, ...o ? { edge: r } : {} }] : { [y]: n, ...o ? { edge: r } : {} }
+  } : e === "disconnect" ? { disconnect: f.list ? [n] : !0 } : { update: [{ [y]: n, edge: r }] };
+  return {
+    operation: e,
+    source: `mutation($key: ${u}, $update: ${t}UpdateInput!) { update${t}(${s.key.name}: $key, update: $update) { __typename } }`,
+    variables: { key: c, update: { [a]: k } },
+    isRead: !1,
+    root: `update${t}`
+  };
+}
 export {
-  L as createTestLoraGraphQL,
-  b as expectSeeks
+  _ as createTestLoraGraphQL,
+  x as expectAccess,
+  N as expectSeeks
 };
 //# sourceMappingURL=testing.js.map