@nanobpm/urban 0.81.0 → 0.82.0

package/dist/runtime/index.d.ts

@@ -40,8 +40,8 @@ export { applyAmbientLineage, buildLineageTree, deriveLineage, LINEAGE_KEY, LINE
 export type { ApplyLineageOptions, LineageAttachment, LineageEdge, LineageEdgeType, LineageEnvelope, LineageNode, LineageTree, } from "./core/lineage.ts";
 export { LINEAGE_ATTACHMENTS_TABLE, LINEAGE_EDGES_TABLE, LINEAGE_SCHEMA_SQL, LineageStore, systemClock as lineageSystemClock, } from "./core/modules/lineage-store.ts";
 export type { Clock as LineageClock, LineageJobLike, LineageStoreOptions, } from "./core/modules/lineage-store.ts";
-export { and, assertReadModelParity, assertSqlIdentifier, caseWhen, col, compileToFn, compileToSqlSelect, defineReadModel, deriveReadModelViewDdl, eq, exists, gt, gte, lit, lt, lte, neq, not, or, pcol, ProjectionRegistry, projectionRegistry, ReadModelRegistry, readModelRegistry, when, } from "./core/read-model.ts";
-export type { AndExpr, BaseRow, CaseExpr, ColExpr, CompareExpr, CompareOp, DerivationFn, ExistsExpr, Expr, Literal, LitExpr, NotExpr, OrExpr, ParityDb, ParityOptions, ParitySample, ProjColExpr, ProjectionRows, ProjectionSource, ReadModel, ReadModelDecl, SqlCompileOptions, WhenClause, } from "./core/read-model.ts";
+export { add, and, assertReadModelParity, assertRollupParity, assertSqlIdentifier, caseWhen, coalesce, col, compileToFn, compileToSqlSelect, count, countWhere, defineReadModel, defineRollup, deriveReadModelViewDdl, eq, exists, fromProjection, fromRollup, fromTable, gt, gte, isNotNull, isNull, joinSource, lit, lt, lte, max, minWhere, neq, not, or, pcol, ProjectionRegistry, projectionRegistry, rcol, ReadModelRegistry, readModelRegistry, RollupRegistry, rollupRegistry, when, } from "./core/read-model.ts";
+export type { AddAgg, AggExpr, AndExpr, BaseRow, CaseExpr, ColExpr, CoalesceAgg, CompareExpr, CompareOp, CountAgg, CountWhereAgg, DerivationFn, ExistsExpr, Expr, IsNullExpr, Literal, LitExpr, LookupRows, MaxAgg, MinWhereAgg, NotExpr, OrExpr, ParityDb, ParityOptions, ParitySample, ProjColExpr, ProjectionRows, ProjectionSource, ReadModel, ReadModelDecl, RollupColExpr, Rollup, RollupDecl, RollupInputs, RollupJoinSource, RollupLookupDecl, RollupParityOptions, RollupProjectionSource, RollupRelation, RollupRollupSource, RollupSource, RollupTableSource, SqlCompileOptions, WhenClause, } from "./core/read-model.ts";
 export { CANONICAL_PROJECTIONS, registerCanonicalProjections, } from "./core/modules/canonical-projections.ts";
 export { OPEN_USER_TASKS_PROJECTION, OPEN_USER_TASKS_SCHEMA_SQL, OPEN_USER_TASKS_TABLE, OpenUserTasksStore, } from "./core/modules/open-user-tasks-store.ts";
 export type { OpenUserTaskRow, OpenUserTasksStoreOptions, } from "./core/modules/open-user-tasks-store.ts";

package/dist/runtime/index.js

@@ -52,7 +52,12 @@ export { LINEAGE_ATTACHMENTS_TABLE, LINEAGE_EDGES_TABLE, LINEAGE_SCHEMA_SQL, Lin
 //     workers.ts) applies its managed VIEW. The `writer-source-inversion` task registers here.
 //   • `projectionRegistry` — register a canonical engine-truth projection NAME usable in `exists(...)`.
 //     The `canonical-projections` task registers `urban_open_user_tasks` / `urban_instance_state`.
-export { and, assertReadModelParity, assertSqlIdentifier, caseWhen, col, compileToFn, compileToSqlSelect, defineReadModel, deriveReadModelViewDdl, eq, exists, gt, gte, lit, lt, lte, neq, not, or, pcol, ProjectionRegistry, projectionRegistry, ReadModelRegistry, readModelRegistry, when, } from "./core/read-model.js";
+// The GROUP-BY sibling `defineRollup` (ADR 0065, #468): a declare-once aggregate rollup compiled to
+// BOTH a managed `*_counts` VIEW and a TS group-reduce (closed aggregate op set: `count`/`countWhere`/
+// `max`/`minWhere`/`coalesce`/`add`), registered as a canonical projection via `rollupRegistry` and
+// parity-guarded by `assertRollupParity`. `defineReadModel` gains a key-correlated rollup lookup
+// (`ReadModelDecl.lookups` + `rcol`) so per-row derivations read a rollup's columns for the base row.
+export { add, and, assertReadModelParity, assertRollupParity, assertSqlIdentifier, caseWhen, coalesce, col, compileToFn, compileToSqlSelect, count, countWhere, defineReadModel, defineRollup, deriveReadModelViewDdl, eq, exists, fromProjection, fromRollup, fromTable, gt, gte, isNotNull, isNull, joinSource, lit, lt, lte, max, minWhere, neq, not, or, pcol, ProjectionRegistry, projectionRegistry, rcol, ReadModelRegistry, readModelRegistry, RollupRegistry, rollupRegistry, when, } from "./core/read-model.js";
 // Canonical engine-truth projection sidecars (ADR 0065, proposal point #1): two framework-owned,
 // per-source projections the DSL `exists(...)` derives over — `urban_open_user_tasks` (which instances
 // are parked on a human) and `urban_instance_state` (per-instance engine lifecycle state). Provisioned

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nanobpm/urban",
-	"version": "0.81.0",
+	"version": "0.82.0",
 	"description": "Urban: build and run code-first apps on Nano — runtime, derivation toolkit, and CLI in one. Author durable processes with @nanobpm/workflow (defineFlow), a typed datasource, forms, triggers and surfaces from a nano.app.json manifest, on Node or Deno.",
 	"license": "Apache-2.0",
 	"type": "module",

package/src/runtime/core/modules/workers.ts

@@ -11,7 +11,7 @@ import { runInJobContext } from "../execContext.ts";
 import type { JobExecContext } from "../execContext.ts";
 import { readLineage } from "../lineage.ts";
 import { LineageStore } from "./lineage-store.ts";
-import { readModelRegistry } from "../read-model.ts";
+import { readModelRegistry, rollupRegistry } from "../read-model.ts";
 import { registerCanonicalProjections } from "./canonical-projections.ts";
 import { InstanceStateStore } from "./instance-state-store.ts";
 import { OpenUserTasksStore } from "./open-user-tasks-store.ts";
@@ -139,6 +139,25 @@ function tryLineageStore(app: AppApi, log: RuntimeContext["host"]["log"]): Linea
   }
 }
 
+/**
+ * Apply every managed rollup VIEW registered in the process-wide `rollupRegistry` (ADR 0065, #468) to
+ * the app's DEFAULT data source, in dependency order (a composed rollup after the rollup it reads).
+ * Mirrors {@link tryProvisionReadModelViews}: empty until a sibling task registers a rollup, and
+ * absent-/error-safe so a missing datasource or a VIEW-provisioning failure never breaks a worker mount.
+ */
+function tryProvisionRollupViews(app: AppApi, log: RuntimeContext["host"]["log"]): void {
+  if (rollupRegistry.all().length === 0) return;
+  if (!app.data.hasDefaultSource()) {
+    log("debug", "rollups: no default data source; managed VIEW provisioning skipped");
+    return;
+  }
+  try {
+    rollupRegistry.ensureViews(app.data.source().db);
+  } catch (err) {
+    log("warn", "rollups: failed to provision managed VIEWs", { error: String(err) });
+  }
+}
+
 /**
  * Apply every managed read-model VIEW registered in the process-wide `readModelRegistry` to the app's
  * DEFAULT data source (ADR 0065, surface #3). A `defineReadModel(...)` declaration compiles to a
@@ -251,6 +270,10 @@ export async function mountWorkers(
   // provision the projection tables per source (absent-safe), and finally the read-model VIEWs.
   registerCanonicalProjections();
   tryProvisionCanonicalProjections(app, ctx.host.log);
+  // Rollup VIEWs (ADR 0065, #468) BEFORE the read-model VIEWs: a read model's key-correlated rollup
+  // lookup `LEFT JOIN`s a rollup's `*_counts` VIEW, and a composed rollup reads another rollup's VIEW,
+  // so every rollup VIEW (in dependency order) must exist before any dependent VIEW compiles.
+  tryProvisionRollupViews(app, ctx.host.log);
   tryProvisionReadModelViews(app, ctx.host.log);
 
   // Cache module loads so a multi-type handler module is imported once.

package/src/runtime/core/read-model.test.ts

@@ -24,6 +24,7 @@ import {
   pcol,
   ProjectionRegistry,
   projectionRegistry,
+  rcol,
   ReadModelRegistry,
   isReservedObjectName,
   RESERVED_OBJECT_PREFIXES,
@@ -247,8 +248,32 @@ test("compileToFn resolves col/pcol identifiers case-insensitively (SQLite ident
   assert.equal(corr({ key: "pi-1" }, { p: [{ process_instance_key: "pi-2" }] }), false);
 });
 
-test("mixed-case col/pcol identifiers: the VIEW and TS backends agree (VIEW/TS parity on the no-edge fallback)", async () => {
-  // End-to-end guard for the case-fold fix: author a model with mixed-case identifiers over lowercase
+test("compileToFn / rcol reads the resolved lookup row by OWN property (a `__proto__` alias can't resolve Object.prototype)", () => {
+  // Lookup aliases are only identifier-validated, so `__proto__` is a legal alias. A bare `fnFor` caller
+  // supplies a plain `{}` for `lookups`; a raw `lookups["__proto__"]` resolves the inherited
+  // `Object.prototype` (truthy), bypassing the "missing lookup row → throw" guard and reading NULLs off the
+  // prototype chain. Reading by OWN property keeps the guard fail-loud on the bare-caller path.
+  const fn = compileToFn(rcol("__proto__", "amount"));
+  assert.throws(() => fn({}), /without a resolved lookup row/);
+  // A genuinely-supplied own `__proto__` row still resolves (null-prototype dict, an own property).
+  const lookups: Record<string, Record<string, unknown>> = Object.create(null);
+  lookups.__proto__ = { amount: 7 };
+  assert.equal(fn({}, {}, lookups), 7);
+});
+
+test("compileToFn / exists reads projections by OWN property (a `__proto__` projection can't resolve Object.prototype)", () => {
+  // Projection names are user-controlled, so `__proto__` is legal. A bare `fnFor` caller passes a plain
+  // `{}` for projections; a raw `projections["__proto__"]` resolves the inherited `Object.prototype`
+  // (truthy, non-array), so `.some(...)` throws a TypeError. Reading by OWN property yields an empty EXISTS.
+  const fn = compileToFn(exists("__proto__", eq(col("k"), lit(1))));
+  assert.equal(fn({ k: 1 }), false); // no such projection → empty EXISTS, not a prototype read
+  // A genuinely-supplied own `__proto__` projection still matches.
+  const projections: Record<string, ReadonlyArray<Record<string, unknown>>> = Object.create(null);
+  projections.__proto__ = [{ k: 1 }];
+  assert.equal(fn({ k: 1 }, projections), true);
+});
+
+test("mixed-case col/pcol identifiers: the VIEW and TS backends agree (VIEW/TS parity on the no-edge fallback)", async () => {  // End-to-end guard for the case-fold fix: author a model with mixed-case identifiers over lowercase
   // columns and confirm the SQLite VIEW and the TS backend derive the SAME value — including the
   // parity-critical no-edge fallback that passes the stored status through.
   const mixed: ReadModel = defineReadModel({