@sequenceholdings/orm 0.1.2 → 0.1.3

package/dist/predicate-v2.cjs

@@ -0,0 +1,1093 @@
+'use strict';
+
+var zod = require('zod');
+
+// src/predicate-v2/ast.ts
+var POLICY_COMPARE_OPS = ["=", "!=", "<", "<=", ">", ">="];
+function walkPolicy(node, visit) {
+  visit(node);
+  if (node.kind === "and" || node.kind === "or") {
+    for (const operand of node.operands) walkPolicy(operand, visit);
+  }
+  if (node.kind === "not") walkPolicy(node.operand, visit);
+  if (node.kind === "exists") walkPolicy(node.where, visit);
+}
+
+// src/predicate-v2/errors.ts
+var PolicyParseError = class extends Error {
+  constructor(message, position) {
+    super(`${message} (at position ${position})`);
+    this.position = position;
+  }
+  name = "PolicyParseError";
+};
+var PolicyCompileError = class extends Error {
+  constructor(message, code, candidates = []) {
+    super(candidates.length > 0 ? `${message} (candidates: ${candidates.join(", ")})` : message);
+    this.code = code;
+    this.candidates = candidates;
+  }
+  name = "PolicyCompileError";
+};
+
+// src/constants.ts
+var CAPABILITY_KEY_PATTERN = /^(?:org\/)?[a-z0-9-]{1,64}$/;
+var CANONICAL_FORMAT = 2;
+var IDENTIFIER_RE = /^[a-z][a-z0-9_]*$/;
+var identifier = zod.z.string().min(1).max(63).regex(IDENTIFIER_RE);
+var COLUMN_TYPES = [
+  "uuid",
+  "text",
+  "integer",
+  "bigint",
+  "numeric",
+  "double",
+  "boolean",
+  "timestamptz",
+  "date",
+  "jsonb"
+];
+var columnTypeSchema = zod.z.enum(COLUMN_TYPES);
+var canonicalEnumSchema = zod.z.object({
+  name: identifier,
+  values: zod.z.array(zod.z.string().min(1).max(63)).min(1).max(100)
+});
+var canonicalColumnSchema = zod.z.object({
+  /** Property name in TS (camelCase); columnName is the Postgres name. */
+  name: zod.z.string().min(1).max(63),
+  columnName: identifier,
+  type: zod.z.union([columnTypeSchema, zod.z.object({ enum: identifier })]),
+  nullable: zod.z.boolean().default(true),
+  unique: zod.z.boolean().default(false),
+  /** Literal default, or one of the allowlisted SQL functions. */
+  default: zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean(), zod.z.null()]).optional(),
+  defaultFn: zod.z.enum(["gen_random_uuid()", "now()"]).optional(),
+  description: zod.z.string().max(500).optional(),
+  /** Migration hints — same semantics as v1. */
+  renamedFrom: identifier.optional(),
+  cast: zod.z.string().max(200).optional(),
+  deprecated: zod.z.boolean().default(false)
+});
+var canonicalLinkSchema = zod.z.object({
+  name: zod.z.string().min(1).max(63),
+  kind: zod.z.enum(["toOne", "toMany", "toPlatformUser"]),
+  /** Target table name (namespace-local). Absent for toPlatformUser. */
+  target: identifier.optional(),
+  /** FK column on the owning side (toOne/toPlatformUser: on this table; toMany: on the target). */
+  on: identifier,
+  /** Referenced column on the target (default: target's PK / platform user `sub`). */
+  references: identifier.optional(),
+  /** enforce: true emits a real FK constraint (same-namespace toOne only). */
+  enforce: zod.z.boolean().default(false),
+  description: zod.z.string().max(500).optional()
+});
+var canonicalIndexSchema = zod.z.object({
+  columns: zod.z.array(identifier).min(1),
+  unique: zod.z.boolean().default(false),
+  name: identifier.optional()
+});
+var policyVariantSchema = zod.z.object({
+  /** Claims-only guard (capability()/role()/claim() comparisons — no columns). */
+  when: zod.z.string().min(1).max(1e3),
+  /** Exactly one of: allow-all bypass, or a row predicate. */
+  allow: zod.z.literal(true).optional(),
+  policy: zod.z.string().min(1).max(2e3).optional()
+}).refine((v) => v.allow === true !== (typeof v.policy === "string"), {
+  message: "A variant declares exactly one of allow: true or policy"
+});
+var policyExpressionSchema = zod.z.union([
+  zod.z.string().min(1).max(2e3),
+  zod.z.object({
+    default: zod.z.string().min(1).max(2e3),
+    variants: zod.z.array(policyVariantSchema).max(10).default([])
+  })
+]);
+var canonicalPoliciesSchema = zod.z.object({
+  read: policyExpressionSchema.optional(),
+  write: policyExpressionSchema.optional(),
+  insert: policyExpressionSchema.optional(),
+  update: policyExpressionSchema.optional()
+});
+function isSingleViewQuerySql(value) {
+  const query = value.trim();
+  if (!/^\(*(?:select|with)\b/i.test(query) || query.includes("\0")) return false;
+  let state = "normal";
+  for (let index = 0; index < query.length; index += 1) {
+    const char = query[index];
+    const next = query[index + 1];
+    if (state === "single") {
+      if (char === "'" && next === "'") index += 1;
+      else if (char === "'") state = "normal";
+      continue;
+    }
+    if (state === "double") {
+      if (char === '"' && next === '"') index += 1;
+      else if (char === '"') state = "normal";
+      continue;
+    }
+    if (char === "'") state = "single";
+    else if (char === '"') state = "double";
+    else if (char === ";" || char === "-" && next === "-" || char === "/" && next === "*") return false;
+  }
+  return state === "normal" && !/\$[a-z_0-9]*\$/i.test(query);
+}
+var canonicalActionSchema = zod.z.object({
+  name: identifier,
+  requires: zod.z.string().max(1e3).optional(),
+  params: zod.z.record(zod.z.string(), zod.z.object({
+    type: columnTypeSchema,
+    nullable: zod.z.boolean().default(false)
+  })).default({}),
+  executes: zod.z.string().min(1).max(1e4),
+  returns: zod.z.enum(["rows", "rowsAffected", "scalar"]).default("rowsAffected"),
+  audit: zod.z.object({ action: zod.z.string(), resource: zod.z.string() }).optional()
+});
+var canonicalCowMutationSchema = zod.z.object({
+  kind: zod.z.enum(["override", "revert"]),
+  name: identifier,
+  /** Synced table (same namespace) the overlay copies from / falls back to. */
+  synced: identifier,
+  /** Single-column primary key PROPERTY (TS camelCase, like column `name`) shared by overlay and synced. */
+  pk: zod.z.string().min(1).max(63),
+  /** Override: contract properties copied INSERT…SELECT from synced (pk included). Empty for revert. */
+  copy: zod.z.array(zod.z.string().min(1).max(63)).default([]),
+  /** Override: overlay properties written by the UPDATE (never the pk). Empty for revert. */
+  set: zod.z.array(zod.z.string().min(1).max(63)).default([])
+}).superRefine((mutation, ctx) => {
+  if (mutation.kind === "override") {
+    if (mutation.set.length === 0) {
+      ctx.addIssue({ code: "custom", path: ["set"], message: "override mutations must set at least one column" });
+    }
+    if (!mutation.copy.includes(mutation.pk)) {
+      ctx.addIssue({ code: "custom", path: ["copy"], message: "override copy list must include the pk" });
+    }
+  } else if (mutation.set.length > 0 || mutation.copy.length > 0) {
+    ctx.addIssue({ code: "custom", path: ["set"], message: "revert mutations take no copy/set columns" });
+  }
+  if (mutation.set.includes(mutation.pk)) {
+    ctx.addIssue({ code: "custom", path: ["set"], message: "set must not include the pk \u2014 identity columns are pinned" });
+  }
+  for (const [field, values] of [["copy", mutation.copy], ["set", mutation.set]]) {
+    if (new Set(values).size !== values.length) {
+      ctx.addIssue({ code: "custom", path: [field], message: `${field} must not contain duplicate columns` });
+    }
+  }
+});
+var canonicalTableSchema = zod.z.object({
+  table: identifier,
+  description: zod.z.string().max(2e3).optional(),
+  /** Table-level rename hint (new in v2). */
+  renamedFrom: identifier.optional(),
+  /** Synced/reflected read-only tables (`source: gold.*`) — v1 semantics. */
+  source: zod.z.string().regex(/^gold\.[a-z][a-z0-9_]*$/).optional(),
+  columns: zod.z.array(canonicalColumnSchema).default([]),
+  primaryKey: zod.z.array(identifier).min(1).max(8).optional(),
+  links: zod.z.array(canonicalLinkSchema).default([]),
+  indexes: zod.z.array(canonicalIndexSchema).default([]),
+  policies: canonicalPoliciesSchema.default({}),
+  /**
+   * v1-conversion carry-over only. v2 has no action surface — the runtime
+   * neither compiles nor executes these; writes are mutations. Kept parseable
+   * so stored definitions and their content hashes stay stable.
+   */
+  actions: zod.z.array(canonicalActionSchema).default([]),
+  /** Optional (not defaulted) so pre-CoW canonical documents keep byte-identical hashes. */
+  cowMutations: zod.z.array(canonicalCowMutationSchema).optional()
+});
+var canonicalViewSchema = zod.z.object({
+  view: identifier,
+  description: zod.z.string().max(2e3).optional(),
+  columns: zod.z.array(canonicalColumnSchema).min(1),
+  /** Logical identity for GraphQL only; PostgreSQL views have no PK constraint. */
+  primaryKey: zod.z.array(identifier).min(1).max(8).optional(),
+  links: zod.z.array(canonicalLinkSchema).default([]),
+  policies: zod.z.object({ read: policyExpressionSchema }).strict(),
+  query: zod.z.string().min(1).max(1e5).refine(isSingleViewQuerySql, {
+    message: "view query must be one SELECT/WITH statement without comments or dollar-quoted bodies"
+  }),
+  /** Namespace-local logical relation names, sorted for deterministic hashing. */
+  dependencies: zod.z.array(identifier).max(500)
+}).superRefine((view, ctx) => {
+  for (const [index, column] of view.columns.entries()) {
+    if (column.default !== void 0 || column.defaultFn !== void 0) {
+      ctx.addIssue({ code: "custom", path: ["columns", index], message: `view column '${column.name}' cannot declare a default` });
+    }
+    if (column.unique) {
+      ctx.addIssue({ code: "custom", path: ["columns", index], message: `view column '${column.name}' cannot declare unique` });
+    }
+    if (column.renamedFrom !== void 0 || column.cast !== void 0) {
+      ctx.addIssue({ code: "custom", path: ["columns", index], message: `view column '${column.name}' cannot declare migration hints` });
+    }
+  }
+  for (const [index, link] of view.links.entries()) {
+    if (link.enforce) {
+      ctx.addIssue({ code: "custom", path: ["links", index, "enforce"], message: `view link '${link.name}' cannot enforce a foreign key` });
+    }
+  }
+});
+zod.z.object({
+  definition_format: zod.z.literal(CANONICAL_FORMAT),
+  namespace: identifier.max(41),
+  description: zod.z.string().max(2e3).optional(),
+  enums: zod.z.array(canonicalEnumSchema).default([]),
+  tables: zod.z.array(canonicalTableSchema).min(0).max(500),
+  /** Optional to preserve byte-identical hashes for pre-view canonical v2 documents. */
+  views: zod.z.array(canonicalViewSchema).max(500).optional(),
+  /** Verbatim custom-roles grammar (@sequenceholdings/custom-roles-manifest). */
+  capabilities: zod.z.object({
+    roles: zod.z.unknown().optional(),
+    uses: zod.z.array(zod.z.string()).default([])
+  }).default({ uses: [] })
+}).superRefine((definition, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, table] of definition.tables.entries()) {
+    if (seen.has(table.table)) {
+      ctx.addIssue({ code: "custom", path: ["tables", index, "table"], message: `duplicate relation '${table.table}'` });
+    }
+    seen.add(table.table);
+  }
+  const tableByName = new Map(definition.tables.map((table) => [table.table, table]));
+  for (const [tableIndex, table] of definition.tables.entries()) {
+    const cowMutations = table.cowMutations ?? [];
+    if (cowMutations.length === 0) continue;
+    const path = (index, ...rest) => ["tables", tableIndex, "cowMutations", index, ...rest];
+    if (table.source !== void 0) {
+      ctx.addIssue({ code: "custom", path: path(0), message: `synced table '${table.table}' cannot declare cow mutations \u2014 it is read-only` });
+      continue;
+    }
+    for (const [index, mutation] of cowMutations.entries()) {
+      const synced = tableByName.get(mutation.synced);
+      if (!synced || synced.source === void 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: path(index, "synced"),
+          message: `cow mutation '${mutation.name}' references '${mutation.synced}', which is not a synced table in this namespace`
+        });
+        continue;
+      }
+      const overlayColumnsByName = new Map(table.columns.map((column) => [column.name, column]));
+      const syncedColumnsByName = new Map(synced.columns.map((column) => [column.name, column]));
+      let columnsExist = true;
+      for (const property of [mutation.pk, ...mutation.copy, ...mutation.set]) {
+        if (!overlayColumnsByName.has(property)) {
+          columnsExist = false;
+          ctx.addIssue({ code: "custom", path: path(index), message: `cow mutation '${mutation.name}': column '${property}' does not exist on overlay '${table.table}'` });
+        }
+      }
+      for (const property of [mutation.pk, ...mutation.copy]) {
+        if (!syncedColumnsByName.has(property)) {
+          columnsExist = false;
+          ctx.addIssue({ code: "custom", path: path(index), message: `cow mutation '${mutation.name}': column '${property}' does not exist on synced '${mutation.synced}'` });
+        }
+      }
+      if (!columnsExist) continue;
+      const overlayPk = table.primaryKey ?? [];
+      const syncedPk = synced.primaryKey ?? [];
+      if (overlayPk.length !== 1 || overlayPk[0] !== mutation.pk || syncedPk.length !== 1 || syncedPk[0] !== mutation.pk) {
+        ctx.addIssue({
+          code: "custom",
+          path: path(index, "pk"),
+          message: `cow mutation '${mutation.name}': pk '${mutation.pk}' must be the single-column primary key on both '${table.table}' and '${mutation.synced}'`
+        });
+      }
+      for (const property of [mutation.pk, ...mutation.copy]) {
+        const overlayColumn = overlayColumnsByName.get(property);
+        const syncedColumn = syncedColumnsByName.get(property);
+        if (!overlayColumn || !syncedColumn) continue;
+        if (JSON.stringify(overlayColumn.type) !== JSON.stringify(syncedColumn.type)) {
+          ctx.addIssue({
+            code: "custom",
+            path: path(index),
+            message: `cow mutation '${mutation.name}': column '${property}' must have the same type on overlay and synced`
+          });
+        }
+        if (overlayColumn.columnName !== syncedColumn.columnName) {
+          ctx.addIssue({
+            code: "custom",
+            path: path(index),
+            message: `cow mutation '${mutation.name}': column '${property}' maps to different Postgres names on overlay ('${overlayColumn.columnName}') and synced ('${syncedColumn.columnName}')`
+          });
+        }
+        if (syncedColumn.nullable !== false && overlayColumn.nullable === false) {
+          ctx.addIssue({
+            code: "custom",
+            path: path(index),
+            message: `cow mutation '${mutation.name}': column '${property}' is nullable on synced but NOT NULL on overlay \u2014 a NULL synced value would fail the copy`
+          });
+        }
+      }
+    }
+  }
+  for (const [index, view] of (definition.views ?? []).entries()) {
+    if (seen.has(view.view)) {
+      ctx.addIssue({ code: "custom", path: ["views", index, "view"], message: `duplicate relation '${view.view}'` });
+    }
+    seen.add(view.view);
+  }
+  const views = definition.views ?? [];
+  const viewByName = new Map(views.map((view) => [view.view, view]));
+  for (const [viewIndex, view] of views.entries()) {
+    for (const [dependencyIndex, dependency] of view.dependencies.entries()) {
+      if (!seen.has(dependency)) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["views", viewIndex, "dependencies", dependencyIndex],
+          message: `view '${view.view}' depends on unknown relation '${dependency}'`
+        });
+      }
+    }
+  }
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  let cycleReported = false;
+  const visit = (name, path) => {
+    if (visited.has(name) || cycleReported) return;
+    if (visiting.has(name)) {
+      cycleReported = true;
+      ctx.addIssue({
+        code: "custom",
+        path: ["views"],
+        message: `view dependencies form a cycle: ${[...path, name].join(" -> ")}`
+      });
+      return;
+    }
+    visiting.add(name);
+    const view = viewByName.get(name);
+    for (const dependency of view?.dependencies ?? []) {
+      if (viewByName.has(dependency)) visit(dependency, [...path, name]);
+    }
+    visiting.delete(name);
+    visited.add(name);
+  };
+  for (const view of views) visit(view.view, []);
+});
+
+// src/ir/index.ts
+var IR_VERSION = 1;
+var CLAIMS_CONTRACT = {
+  sub: "string",
+  org: "string?",
+  roles: "string[]",
+  capabilities: "string[]"
+};
+var scalarLiteral = zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean(), zod.z.null()]);
+var valueIrSchema = zod.z.discriminatedUnion("kind", [
+  zod.z.object({ kind: zod.z.literal("literal"), value: zod.z.union([scalarLiteral, zod.z.array(scalarLiteral)]) }),
+  zod.z.object({ kind: zod.z.literal("variable"), name: zod.z.string() }),
+  zod.z.object({ kind: zod.z.literal("claim"), key: zod.z.enum(["sub", "org"]) })
+]);
+var CMP_OPS = [
+  "eq",
+  "neq",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "in",
+  "nin",
+  "like",
+  "ilike",
+  "isNull",
+  "contains",
+  "hasKey"
+];
+var predIrSchema = zod.z.lazy(
+  () => zod.z.discriminatedUnion("kind", [
+    zod.z.object({ kind: zod.z.literal("and"), operands: zod.z.array(predIrSchema).min(1) }),
+    zod.z.object({ kind: zod.z.literal("or"), operands: zod.z.array(predIrSchema).min(1) }),
+    zod.z.object({ kind: zod.z.literal("not"), operand: predIrSchema }),
+    zod.z.object({ kind: zod.z.literal("cmp"), op: zod.z.enum(CMP_OPS), column: zod.z.string(), value: valueIrSchema }),
+    zod.z.object({ kind: zod.z.literal("exists"), link: zod.z.string(), where: predIrSchema }),
+    zod.z.object({
+      kind: zod.z.literal("aggPredicate"),
+      link: zod.z.string(),
+      fn: zod.z.literal("count"),
+      op: zod.z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]),
+      value: zod.z.number(),
+      where: predIrSchema.optional()
+    }),
+    zod.z.object({ kind: zod.z.literal("capability"), key: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("role"), key: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("dynamicFilter"), slot: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("const"), value: zod.z.boolean() })
+  ])
+);
+var orderIrSchema = zod.z.discriminatedUnion("kind", [
+  zod.z.object({
+    kind: zod.z.literal("column"),
+    column: zod.z.string(),
+    /** Order through a to-one link: `link` is set and `column` is on the target. */
+    link: zod.z.string().optional(),
+    direction: zod.z.enum(["asc", "desc"]),
+    nulls: zod.z.enum(["first", "last"]).optional()
+  }),
+  /** §4f: `$orderBy: [FooOrderBy!]` variable — validated + lowered at runtime. */
+  zod.z.object({ kind: zod.z.literal("dynamic"), slot: zod.z.string() })
+]);
+var limitIrSchema = zod.z.object({
+  /** Fixed value or a variable, clamped to [1, max]; absent → default. */
+  variable: zod.z.string().optional(),
+  value: zod.z.number().int().positive().optional(),
+  default: zod.z.number().int().positive(),
+  max: zod.z.number().int().positive()
+});
+var selectionIrSchema = zod.z.lazy(
+  () => zod.z.object({
+    typename: zod.z.string(),
+    columns: zod.z.array(zod.z.object({ alias: zod.z.string(), column: zod.z.string() })),
+    relations: zod.z.array(zod.z.object({
+      alias: zod.z.string(),
+      link: zod.z.string(),
+      selection: selectionIrSchema,
+      where: predIrSchema.optional(),
+      orderBy: zod.z.array(orderIrSchema).optional(),
+      limit: limitIrSchema.optional(),
+      offset: zod.z.object({ variable: zod.z.string().optional(), value: zod.z.number().int().optional() }).optional()
+    })),
+    aggregates: zod.z.array(zod.z.object({
+      alias: zod.z.string(),
+      link: zod.z.string().optional(),
+      where: predIrSchema.optional(),
+      count: zod.z.object({ columns: zod.z.array(zod.z.string()).optional(), distinct: zod.z.boolean().optional() }).optional(),
+      sum: zod.z.array(zod.z.string()).optional(),
+      avg: zod.z.array(zod.z.string()).optional(),
+      nodes: selectionIrSchema.optional()
+    }))
+  })
+);
+var includeIfSchema = zod.z.object({ variable: zod.z.string(), negated: zod.z.boolean() });
+var selectRootSchema = zod.z.object({
+  kind: zod.z.literal("select"),
+  alias: zod.z.string(),
+  table: zod.z.string(),
+  selection: selectionIrSchema,
+  /** Composed at compile time: AND(policy, documentWhere?, dynamicFilter?). */
+  where: predIrSchema,
+  orderBy: zod.z.array(orderIrSchema).default([]),
+  distinctOn: zod.z.union([zod.z.array(zod.z.string()), zod.z.object({ slot: zod.z.string() })]).optional(),
+  limit: limitIrSchema,
+  offset: zod.z.object({ variable: zod.z.string().optional(), value: zod.z.number().int().optional() }).optional(),
+  includeIf: includeIfSchema.optional()
+});
+var byPkRootSchema = zod.z.object({
+  kind: zod.z.literal("byPk"),
+  alias: zod.z.string(),
+  table: zod.z.string(),
+  selection: selectionIrSchema,
+  pk: zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema })).min(1),
+  /** Policy predicate — ANDed with the PK match. */
+  where: predIrSchema,
+  includeIf: includeIfSchema.optional()
+});
+var aggregateRootSchema = zod.z.object({
+  kind: zod.z.literal("aggregate"),
+  alias: zod.z.string(),
+  table: zod.z.string(),
+  where: predIrSchema,
+  count: zod.z.object({ columns: zod.z.array(zod.z.string()).optional(), distinct: zod.z.boolean().optional() }).optional(),
+  sum: zod.z.array(zod.z.string()).optional(),
+  avg: zod.z.array(zod.z.string()).optional(),
+  nodes: selectionIrSchema.optional(),
+  includeIf: includeIfSchema.optional()
+});
+var writeValuesSchema = zod.z.union([
+  zod.z.object({ slot: zod.z.string() }),
+  zod.z.object({ entries: zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema })) })
+]);
+var onConflictIrSchema = zod.z.union([
+  zod.z.object({ slot: zod.z.string() }),
+  zod.z.object({ constraint: zod.z.string(), updateColumns: zod.z.array(zod.z.string()) })
+]);
+var mutationRootSchema = zod.z.object({
+  kind: zod.z.literal("mutation"),
+  /**
+   * CRUD verbs plus the structured copy-on-write ops. `cowOverride` copies the
+   * synced row into the overlay (INSERT…SELECT, ON CONFLICT DO NOTHING) then
+   * applies `set` — both statements generated by the executor from this
+   * metadata, never authored SQL. `cowRevert` deletes the override so the
+   * coalesce view falls back to synced. Both are gated on a matching synced
+   * row and carry the write policy in `where` like update/delete.
+   */
+  op: zod.z.enum(["insert", "insertOne", "update", "updateByPk", "delete", "deleteByPk", "cowOverride", "cowRevert"]),
+  alias: zod.z.string(),
+  table: zod.z.string(),
+  /** CoW ops: logical name of the synced twin (read through its policy-filtered view). */
+  cowSynced: zod.z.string().optional(),
+  /** cowOverride: logical properties copied INSERT…SELECT from synced (pk included). */
+  cowCopyColumns: zod.z.array(zod.z.string()).optional(),
+  /** cowOverride: insert-policy WITH CHECK evaluated over the copied rows. */
+  cowCopyCheck: predIrSchema.optional(),
+  /** insert/insertOne: rows come from a slot ($object/$objects) or literals. */
+  objects: zod.z.union([
+    zod.z.object({ slot: zod.z.string() }),
+    zod.z.object({ rows: zod.z.array(zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema }))) })
+  ]).optional(),
+  /** Server-pinned columns (e.g. author_sub ← claim('sub')) merged into every inserted row. */
+  pinnedColumns: zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema })).default([]),
+  onConflict: onConflictIrSchema.optional(),
+  set: writeValuesSchema.optional(),
+  append: writeValuesSchema.optional(),
+  inc: writeValuesSchema.optional(),
+  /** update/delete row filter: AND(writePolicy, documentWhere/pk, dynamicFilter?). */
+  where: predIrSchema.optional(),
+  pk: zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema })).optional(),
+  /** WITH CHECK analogue evaluated against NEW row values (insert/update). */
+  insertCheck: predIrSchema.optional(),
+  returning: selectionIrSchema.nullable(),
+  affectedRows: zod.z.boolean().default(false),
+  includeIf: includeIfSchema.optional()
+});
+var rootIrSchema = zod.z.discriminatedUnion("kind", [
+  selectRootSchema,
+  byPkRootSchema,
+  aggregateRootSchema,
+  mutationRootSchema
+]);
+var INPUT_REF_KINDS = [
+  "boolExp",
+  "orderBy",
+  "selectColumn",
+  "insertInput",
+  "setInput",
+  "appendInput",
+  "onConflict"
+];
+var variableDefaultIrSchema = zod.z.object({
+  value: zod.z.union([scalarLiteral, zod.z.array(scalarLiteral)])
+});
+var variableIrSchema = zod.z.object({
+  name: zod.z.string(),
+  type: zod.z.union([
+    zod.z.object({ kind: zod.z.literal("scalar"), scalar: zod.z.enum(COLUMN_TYPES) }),
+    /** `values` is the declared membership whitelist — the executor validates against it. */
+    zod.z.object({ kind: zod.z.literal("enum"), name: zod.z.string(), values: zod.z.array(zod.z.string()).min(1) }),
+    /** §4f dynamic slot: validated against `tables[table]` whitelists at runtime. */
+    zod.z.object({ kind: zod.z.literal("inputRef"), input: zod.z.enum(INPUT_REF_KINDS), table: zod.z.string() })
+  ]),
+  nullable: zod.z.boolean(),
+  list: zod.z.boolean(),
+  /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
+  defaultValue: variableDefaultIrSchema.optional()
+});
+var compiledOperationSchema = zod.z.object({
+  irVersion: zod.z.literal(IR_VERSION),
+  name: zod.z.string(),
+  opHash: zod.z.string().regex(/^sha256:[0-9a-f]{64}$/),
+  kind: zod.z.enum(["query", "mutation"]),
+  requires: zod.z.object({
+    capability: zod.z.string().optional(),
+    role: zod.z.string().optional()
+  }).nullable(),
+  variables: zod.z.array(variableIrSchema),
+  /** Every table the op touches — data-token scoping + audit. */
+  tableSet: zod.z.array(zod.z.string()).min(1),
+  roots: zod.z.array(rootIrSchema).min(1)
+});
+var tableMetaIrSchema = zod.z.object({
+  table: zod.z.string(),
+  schema: zod.z.string(),
+  typename: zod.z.string(),
+  /**
+   * True when statements over this relation evaluate a claims-gated synced
+   * view: synced twins (`source: gold.*`) materialize as views whose baked
+   * policy reads `current_setting('request.jwt.claims')`, and namespace views
+   * inherit the gate transitively through their declared dependencies. The
+   * executor must stamp that GUC (transaction-scoped) before any statement
+   * touching such a relation, or the synced arm yields zero rows regardless
+   * of the compiled predicates.
+   */
+  claimsGated: zod.z.boolean().default(false),
+  columns: zod.z.array(zod.z.object({
+    name: zod.z.string(),
+    columnName: zod.z.string(),
+    type: zod.z.union([zod.z.enum(COLUMN_TYPES), zod.z.object({ enum: zod.z.string(), values: zod.z.array(zod.z.string()) })]),
+    nullable: zod.z.boolean()
+  })),
+  /** Empty for keyless read-only views; keyed tables and views list logical columns. */
+  primaryKey: zod.z.array(zod.z.string()),
+  links: zod.z.array(zod.z.object({
+    name: zod.z.string(),
+    kind: zod.z.enum(["toOne", "toMany", "toPlatformUser"]),
+    target: zod.z.string(),
+    on: zod.z.string(),
+    references: zod.z.string()
+  })),
+  /** §4f whitelists: what dynamic inputs may reference. */
+  filterable: zod.z.array(zod.z.string()),
+  orderable: zod.z.array(zod.z.string()),
+  insertable: zod.z.array(zod.z.string()),
+  settable: zod.z.array(zod.z.string()),
+  appendable: zod.z.array(zod.z.string()),
+  constraints: zod.z.array(zod.z.object({ name: zod.z.string(), columns: zod.z.array(zod.z.string()) })),
+  /** Depth/node caps for dynamic filter trees on this table. */
+  dynamicFilterMaxDepth: zod.z.number().int().positive().default(6),
+  dynamicFilterMaxNodes: zod.z.number().int().positive().default(64)
+});
+zod.z.object({
+  irVersion: zod.z.literal(IR_VERSION),
+  namespace: zod.z.string(),
+  schemaHash: zod.z.string(),
+  opsHash: zod.z.string(),
+  tables: zod.z.record(zod.z.string(), tableMetaIrSchema),
+  operations: zod.z.record(zod.z.string(), compiledOperationSchema)
+});
+
+// src/predicate-v2/parse.ts
+var KEYWORDS = /* @__PURE__ */ new Set(["and", "or", "not", "true", "false", "null", "claim", "capability", "role", "exists"]);
+var OPERATOR_PATTERN = /^(!=|<=|>=|<>|=|<|>)/;
+var IDENTIFIER_START = /[a-zA-Z_]/;
+var IDENTIFIER_CHAR = /[a-zA-Z0-9_]/;
+var NUMBER_PATTERN = /^-?\d+(\.\d+)?/;
+var SCALAR_CLAIM_KEYS = Object.entries(CLAIMS_CONTRACT).filter(([, type]) => !type.endsWith("[]")).map(([key]) => key);
+var ARRAY_CLAIM_KEYS = Object.entries(CLAIMS_CONTRACT).filter(([, type]) => type.endsWith("[]")).map(([key]) => key);
+function tokenize(source) {
+  const tokens = [];
+  let position = 0;
+  while (position < source.length) {
+    const char = source[position];
+    if (/\s/.test(char)) {
+      position += 1;
+      continue;
+    }
+    if (char === "(") {
+      tokens.push({ kind: "lparen", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === ")") {
+      tokens.push({ kind: "rparen", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === ",") {
+      tokens.push({ kind: "comma", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === ".") {
+      tokens.push({ kind: "dot", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === "'") {
+      const { value, end } = readString(source, position);
+      tokens.push({ kind: "string", value, position });
+      position = end;
+      continue;
+    }
+    const operator = OPERATOR_PATTERN.exec(source.slice(position));
+    if (operator) {
+      const value = operator[0] === "<>" ? "!=" : operator[0];
+      tokens.push({ kind: "operator", value, position });
+      position += operator[0].length;
+      continue;
+    }
+    const number = NUMBER_PATTERN.exec(source.slice(position));
+    if (number && !IDENTIFIER_START.test(char)) {
+      tokens.push({ kind: "number", value: number[0], position });
+      position += number[0].length;
+      continue;
+    }
+    if (IDENTIFIER_START.test(char)) {
+      let end = position;
+      while (end < source.length && IDENTIFIER_CHAR.test(source[end])) end += 1;
+      tokens.push({ kind: "identifier", value: source.slice(position, end), position });
+      position = end;
+      continue;
+    }
+    throw new PolicyParseError(`unexpected character '${char}'`, position);
+  }
+  tokens.push({ kind: "end", value: "", position: source.length });
+  return tokens;
+}
+function readString(source, start) {
+  let value = "";
+  let position = start + 1;
+  while (position < source.length) {
+    const char = source[position];
+    if (char !== "'") {
+      value += char;
+      position += 1;
+      continue;
+    }
+    if (source[position + 1] === "'") {
+      value += "'";
+      position += 2;
+      continue;
+    }
+    return { value, end: position + 1 };
+  }
+  throw new PolicyParseError("unterminated string literal", start);
+}
+var Parser = class {
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  index = 0;
+  parse() {
+    const node = this.parseOr();
+    this.expect("end", "end of expression");
+    return node;
+  }
+  parseOr() {
+    const operands = [this.parseAnd()];
+    while (this.matchKeyword("or")) operands.push(this.parseAnd());
+    return operands.length === 1 ? operands[0] : { kind: "or", operands };
+  }
+  parseAnd() {
+    const operands = [this.parseNot()];
+    while (this.matchKeyword("and")) operands.push(this.parseNot());
+    return operands.length === 1 ? operands[0] : { kind: "and", operands };
+  }
+  parseNot() {
+    if (this.matchKeyword("not")) return { kind: "not", operand: this.parseNot() };
+    return this.parsePrimary();
+  }
+  parsePrimary() {
+    if (this.peek().kind === "lparen") {
+      this.advance();
+      const inner = this.parseOr();
+      this.expect("rparen", "')'");
+      return inner;
+    }
+    if (this.peekKeyword("capability") || this.peekKeyword("role")) {
+      const fn = this.peek().value;
+      const node = this.parseBooleanCall(fn);
+      const next = this.peek();
+      if (next.kind === "operator") {
+        throw new PolicyParseError(`${fn}() is boolean-valued and cannot appear in a comparison`, next.position);
+      }
+      return node;
+    }
+    if (this.peekKeyword("exists")) return this.parseExists();
+    return this.parseComparison();
+  }
+  parseBooleanCall(fn) {
+    this.advance();
+    const key = this.parseCallArgument(fn);
+    if (!CAPABILITY_KEY_PATTERN.test(key)) {
+      throw new PolicyParseError(`invalid ${fn} key '${key}'`, this.peek().position);
+    }
+    return { kind: fn, key };
+  }
+  parseExists() {
+    this.advance();
+    this.expect("lparen", "'(' after exists");
+    const path = this.parsePath("a link path in exists(...)");
+    this.expect("comma", "',' between the exists link path and its predicate");
+    const where = this.parseOr();
+    this.expect("rparen", "')' closing exists(...)");
+    return { kind: "exists", path, where };
+  }
+  parseComparison() {
+    const left = this.parseOperand();
+    const operator = this.expect("operator", "a comparison operator");
+    if (!POLICY_COMPARE_OPS.includes(operator.value)) {
+      throw new PolicyParseError(`unsupported operator '${operator.value}'`, operator.position);
+    }
+    const right = this.parseOperand();
+    return { kind: "compare", op: operator.value, left, right };
+  }
+  parseOperand() {
+    const token = this.peek();
+    if (token.kind === "string") {
+      this.advance();
+      return { kind: "literal", value: token.value };
+    }
+    if (token.kind === "number") {
+      this.advance();
+      const value = Number(token.value);
+      if (!Number.isFinite(value) || Number.isInteger(value) && !Number.isSafeInteger(value)) {
+        throw new PolicyParseError(
+          `numeric literal '${token.value}' exceeds safe integer precision \u2014 quote it as a string`,
+          token.position
+        );
+      }
+      return { kind: "literal", value };
+    }
+    if (token.kind !== "identifier") {
+      throw new PolicyParseError(`expected an operand, got '${token.value || "end"}'`, token.position);
+    }
+    if (token.value === "true" || token.value === "false") {
+      this.advance();
+      return { kind: "literal", value: token.value === "true" };
+    }
+    if (token.value === "null") {
+      this.advance();
+      return { kind: "literal", value: null };
+    }
+    if (token.value === "claim") {
+      this.advance();
+      const key = this.parseCallArgument("claim");
+      return { kind: "claim", key: this.validateClaimKey(key, token.position) };
+    }
+    if (token.value === "capability" || token.value === "role") {
+      throw new PolicyParseError(`${token.value}() is boolean-valued and cannot appear in a comparison`, token.position);
+    }
+    return { kind: "path", segments: this.parsePath("a column or link path") };
+  }
+  validateClaimKey(key, position) {
+    if (SCALAR_CLAIM_KEYS.includes(key)) return key;
+    if (ARRAY_CLAIM_KEYS.includes(key)) {
+      const fn = key === "roles" ? "role('\u2026')" : "capability('\u2026')";
+      throw new PolicyParseError(
+        `claim('${key}') is not reachable \u2014 '${key}' is an array claim; use ${fn} instead`,
+        position
+      );
+    }
+    throw new PolicyParseError(
+      `unknown claim key '${key}' \u2014 valid claim() keys are: ${SCALAR_CLAIM_KEYS.map((k) => `'${k}'`).join(", ")}`,
+      position
+    );
+  }
+  /** `ident(.ident)*` — first segment must not be a keyword; later segments may be (e.g. `author.role`). */
+  parsePath(description) {
+    const first = this.peek();
+    if (first.kind !== "identifier" || KEYWORDS.has(first.value)) {
+      throw new PolicyParseError(`expected ${description}, got '${first.value || "end"}'`, first.position);
+    }
+    this.advance();
+    const segments = [first.value];
+    while (this.peek().kind === "dot") {
+      this.advance();
+      const segment = this.expect("identifier", "a path segment after .");
+      segments.push(segment.value);
+    }
+    return segments;
+  }
+  parseCallArgument(fn) {
+    this.expect("lparen", `'(' after ${fn}`);
+    const argument = this.expect("string", `a quoted key in ${fn}(...)`);
+    this.expect("rparen", `')' after ${fn} key`);
+    return argument.value;
+  }
+  peek() {
+    return this.tokens[this.index];
+  }
+  peekKeyword(keyword) {
+    const token = this.peek();
+    return token.kind === "identifier" && token.value === keyword;
+  }
+  matchKeyword(keyword) {
+    if (!this.peekKeyword(keyword)) return false;
+    this.advance();
+    return true;
+  }
+  advance() {
+    const token = this.peek();
+    if (token.kind !== "end") this.index += 1;
+    return token;
+  }
+  expect(kind, description) {
+    const token = this.peek();
+    if (token.kind !== kind) {
+      throw new PolicyParseError(`expected ${description}, got '${token.value || "end"}'`, token.position);
+    }
+    return this.advance();
+  }
+};
+function parsePolicy(source) {
+  const trimmed = source.trim();
+  if (trimmed.length === 0) throw new PolicyParseError("empty policy expression", 0);
+  return { source: trimmed, ast: new Parser(tokenize(trimmed)).parse() };
+}
+
+// src/predicate-v2/compile.ts
+var POLICY_MAX_LINK_DEPTH = 3;
+var CMP_BY_OP = {
+  "=": "eq",
+  "!=": "neq",
+  "<": "lt",
+  "<=": "lte",
+  ">": "gt",
+  ">=": "gte"
+};
+var FLIPPED = {
+  "=": "=",
+  "!=": "!=",
+  "<": ">",
+  "<=": ">=",
+  ">": "<",
+  ">=": "<="
+};
+function resolveTable(resolver, table) {
+  const info = resolver.tables[table];
+  if (!info) {
+    throw new PolicyCompileError(`unknown table '${table}'`, "unknown-table", Object.keys(resolver.tables));
+  }
+  return info;
+}
+function resolveColumn(info, ref) {
+  const column = info.columns.find((c) => c.name === ref || c.columnName === ref);
+  return column?.name;
+}
+function resolveLink(info, ref) {
+  return info.links.find((l) => l.name === ref);
+}
+function columnCandidates(info) {
+  return [...info.columns.map((c) => c.name), ...info.links.map((l) => l.name)];
+}
+var PolicyCompiler = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  compile(node, table, depth) {
+    switch (node.kind) {
+      case "and":
+      case "or":
+        return { kind: node.kind, operands: node.operands.map((operand) => this.compile(operand, table, depth)) };
+      case "not":
+        return { kind: "not", operand: this.compile(node.operand, table, depth) };
+      case "capability":
+        return { kind: "capability", key: node.key };
+      case "role":
+        return { kind: "role", key: node.key };
+      case "exists":
+        return this.compileExists(node.path, node.where, table, depth);
+      case "compare":
+        return this.compileCompare(node, table, depth);
+    }
+  }
+  /** Traverse link path segments (any cardinality), then compile the inner predicate against the final target. */
+  compileExists(path, where, table, depth) {
+    const { links, finalTable } = this.resolveLinkPath(path, table, depth, { toOneOnly: false });
+    let pred = this.compile(where, finalTable, depth + links.length);
+    for (let i = links.length - 1; i >= 0; i -= 1) {
+      pred = { kind: "exists", link: links[i].name, where: pred };
+    }
+    return pred;
+  }
+  resolveLinkPath(path, table, depth, { toOneOnly }) {
+    const links = [];
+    let current = table;
+    for (const segment of path) {
+      const info = resolveTable(this.ctx.resolver, current);
+      const link = resolveLink(info, segment);
+      if (!link) {
+        throw new PolicyCompileError(
+          `unknown link '${segment}' on table '${current}'`,
+          "unknown-link",
+          info.links.map((l) => l.name)
+        );
+      }
+      if (toOneOnly && link.kind === "toMany") {
+        throw new PolicyCompileError(
+          `dotted paths traverse to-one links only \u2014 '${segment}' on '${current}' is to-many; use exists(${path.join(".")}, \u2026)`,
+          "not-to-one"
+        );
+      }
+      links.push(link);
+      current = link.target;
+      if (depth + links.length > this.ctx.maxLinkDepth) {
+        throw new PolicyCompileError(
+          `link traversal depth exceeds ${this.ctx.maxLinkDepth} (at '${segment}')`,
+          "link-depth-exceeded"
+        );
+      }
+    }
+    return { links, finalTable: current };
+  }
+  compileCompare(node, table, depth) {
+    const leftIsPath = node.left.kind === "path";
+    const rightIsPath = node.right.kind === "path";
+    if (leftIsPath && rightIsPath) {
+      throw new PolicyCompileError(
+        "column-to-column comparisons are not supported in v2.0 policies",
+        "unsupported-comparison"
+      );
+    }
+    if (!leftIsPath && !rightIsPath) {
+      throw new PolicyCompileError(
+        "a comparison must reference a column \u2014 claims-to-literal comparisons are not representable in v2.0; use capability() or role()",
+        "unsupported-comparison"
+      );
+    }
+    const [pathSide, valueSide, op] = leftIsPath ? [node.left, node.right, node.op] : [node.right, node.left, FLIPPED[node.op]];
+    const segments = pathSide.segments;
+    const linkSegments = segments.slice(0, -1);
+    const columnRef = segments[segments.length - 1];
+    const { links, finalTable } = this.resolveLinkPath(linkSegments, table, depth, { toOneOnly: true });
+    const info = resolveTable(this.ctx.resolver, finalTable);
+    const column = resolveColumn(info, columnRef);
+    if (!column) {
+      throw new PolicyCompileError(
+        `unknown column '${columnRef}' on table '${finalTable}'`,
+        "unknown-column",
+        columnCandidates(info)
+      );
+    }
+    let cmp = this.buildCmp(op, column, valueSide);
+    for (let i = links.length - 1; i >= 0; i -= 1) {
+      cmp = { kind: "exists", link: links[i].name, where: cmp };
+    }
+    return cmp;
+  }
+  buildCmp(op, column, valueSide) {
+    if (valueSide.kind === "literal" && valueSide.value === null) {
+      if (op !== "=" && op !== "!=") {
+        throw new PolicyCompileError(
+          `null only supports = and != comparisons, got '${op}'`,
+          "invalid-null-comparison"
+        );
+      }
+      return { kind: "cmp", op: "isNull", column, value: { kind: "literal", value: op === "=" } };
+    }
+    const value = valueSide.kind === "claim" ? { kind: "claim", key: valueSide.key } : { kind: "literal", value: valueSide.value };
+    return { kind: "cmp", op: CMP_BY_OP[op], column, value };
+  }
+};
+function compilePredicateV2({ expression, table, resolver, maxLinkDepth }) {
+  const parsed = typeof expression === "string" ? parsePolicy(expression) : expression;
+  const compiler = new PolicyCompiler({ resolver, maxLinkDepth: maxLinkDepth ?? POLICY_MAX_LINK_DEPTH });
+  return compiler.compile(parsed.ast, table, 0);
+}
+function assertClaimsOnlyWhen(parsed) {
+  walkPolicy(parsed.ast, (node) => {
+    if (node.kind === "compare") {
+      const columnRef = [node.left, node.right].find((operand) => operand.kind === "path");
+      if (columnRef) {
+        throw new PolicyCompileError(
+          `variant 'when' guards are claims-only \u2014 column reference '${columnRef.segments.join(".")}' is not allowed`,
+          "when-not-claims-only"
+        );
+      }
+      throw new PolicyCompileError(
+        "variant 'when' guards support capability() and role() checks only in v2.0",
+        "when-not-claims-only"
+      );
+    }
+    if (node.kind === "exists") {
+      throw new PolicyCompileError(
+        "variant 'when' guards are claims-only \u2014 exists() is not allowed",
+        "when-not-claims-only"
+      );
+    }
+  });
+}
+function compilePolicy({ expression, table, resolver, maxLinkDepth }) {
+  if (typeof expression === "string") {
+    return compilePredicateV2({ expression, table, resolver, maxLinkDepth });
+  }
+  const defaultPred = compilePredicateV2({ expression: expression.default, table, resolver, maxLinkDepth });
+  if (expression.variants.length === 0) return defaultPred;
+  const branches = expression.variants.map((variant) => {
+    const parsedWhen = parsePolicy(variant.when);
+    assertClaimsOnlyWhen(parsedWhen);
+    const when = compilePredicateV2({ expression: parsedWhen, table, resolver, maxLinkDepth });
+    const grant = variant.allow === true ? { kind: "const", value: true } : compilePredicateV2({ expression: variant.policy, table, resolver, maxLinkDepth });
+    return { kind: "and", operands: [when, grant] };
+  });
+  return { kind: "or", operands: [defaultPred, ...branches] };
+}
+
+exports.POLICY_COMPARE_OPS = POLICY_COMPARE_OPS;
+exports.POLICY_MAX_LINK_DEPTH = POLICY_MAX_LINK_DEPTH;
+exports.PolicyCompileError = PolicyCompileError;
+exports.PolicyParseError = PolicyParseError;
+exports.assertClaimsOnlyWhen = assertClaimsOnlyWhen;
+exports.compilePolicy = compilePolicy;
+exports.compilePredicateV2 = compilePredicateV2;
+exports.parsePolicy = parsePolicy;
+exports.walkPolicy = walkPolicy;
+//# sourceMappingURL=predicate-v2.cjs.map
+//# sourceMappingURL=predicate-v2.cjs.map