@sequenceholdings/orm 2.0.0 → 2.1.1

package/dist/constants-YoFGjIBM.d.cts

@@ -0,0 +1,99 @@
+/** Shared grammar for namespace identifiers; never interpolate arbitrary paths. */
+declare const NAMESPACE_PATTERN: RegExp;
+/** Caller-scoped delegated data credential, supplied by an authenticated host. */
+declare const ORM_DATA_TOKEN_HEADER = "x-sequence-data-token";
+/** Separate service-identity credential; never used as an implicit fallback. */
+declare const ORM_SERVICE_DATA_TOKEN_HEADER = "x-sequence-data-token-service";
+declare const IDENTIFIER_PATTERN: RegExp;
+/** Native source columns may have one leading underscore; relation names may not. */
+declare const COLUMN_IDENTIFIER_PATTERN: RegExp;
+declare const MAX_IDENTIFIER_LENGTH = 63;
+/**
+ * Custom Roles & Capabilities claim keys as policies reference them: a
+ * host-scoped registry key, an org pin's `org/<key>`, or an Application
+ * capability pin's `app/<application-id>/<key>`. Matches the registry
+ * key grammar EXACTLY (`[a-z0-9-]`, 1–64 chars, no `_` — the FGA object-id
+ * delimiter) so any capability that's declarable/attachable in namespace.yaml
+ * can also be referenced here — a stricter pattern would let a valid key
+ * register yet fail at apply (e.g. `org/2fa`, a one-char or digit-led key).
+ */
+declare const CAPABILITY_KEY_PATTERN: RegExp;
+declare const CLAIM_KEY_PATTERN: RegExp;
+/** Qualified reference to a table outside the defining file: `<schema>.<table>`. */
+declare const QUALIFIED_TABLE_PATTERN: RegExp;
+/** Synced reflected sources are restricted to the gold layer. */
+declare const SYNCED_SOURCE_PATTERN: RegExp;
+declare const ORM_SCHEMA_PREFIX = "orm_";
+declare const CONSUMER_ROLE_SUFFIX = "_consumer";
+declare const ormSchemaName: (namespace: string) => string;
+declare const consumerRoleName: (namespace: string) => string;
+declare const DEFINITION_FILE_EXTENSIONS: readonly [".yml", ".yaml"];
+/** Reserved basenames for the namespace-level config file (description, org capability pins). */
+declare const NAMESPACE_CONFIG_FILENAMES: Set<string>;
+declare const HASH_DOMAIN = "sequence-orm-definitions\0";
+/**
+ * A per-file byte cap where the loader reads untrusted YAML into memory — a real failure mode, not a product
+ * limit. Counts of tables/indexes/params and policy/SQL lengths are
+ * deliberately uncapped; Postgres enforces its own limits loudly at apply.
+ */
+declare const MAX_DEFINITION_FILE_BYTES: number;
+/** Generated SDL aggregates every table/view; it is not an individual source file. */
+declare const MAX_GENERATED_SDL_BYTES: number;
+/** Registration and reviewed exports carry SDL, canonical metadata, snapshots and migrations. */
+declare const ORM_REGISTRATION_MAX_BYTES: number;
+/** `/api/data/<ns>/actions/…` and `/api/data/<ns>/query` share the table path segment. */
+declare const RESERVED_TABLE_NAMES: Set<string>;
+/**
+ * The Data API's query-string grammar owns these parameter names — a column
+ * with one of them could never be filtered over the wire, so definitions
+ * refuse it up front ("validate rejects only what can never work").
+ */
+declare const RESERVED_COLUMN_NAMES: Set<string>;
+/**
+ * Per-cell metadata (`cellMetadata: true`, and every resolved-table source) is
+ * stored as typed system columns beside each tracked column `c`:
+ *
+ *  - `c__at`  timestamptz — when the cell was last written (NULL: never / no opinion)
+ *  - `c__by`  text        — who wrote it
+ *  - `c__rev` uuid        — a resolved table's manual source only: the edit's
+ *                           identity, so an async writeback confirmation clears
+ *                           only the exact edit it delivered
+ *
+ * A resolved view additionally exposes, per resolved column, the winner's
+ * `c__src` (source name) and `c__lost` (newer candidates that lost, jsonb).
+ * None of these are GraphQL columns: they surface through the typed `cells`
+ * object and are never client-writable.
+ */
+declare const CELL_PARTS: readonly ["at", "by", "rev", "source", "conflicts"];
+type CellPart = (typeof CELL_PARTS)[number];
+declare const CELL_PART_SUFFIX: Readonly<Record<CellPart, string>>;
+/** Longest physical column name that can carry cell parts (63 minus the longest suffix). */
+declare const MAX_TRACKED_COLUMN_NAME: number;
+/** GraphQL field carrying a row's per-cell metadata object. */
+declare const CELLS_FIELD = "cells";
+/** Physical (and logical) name of one cell part of a column. */
+declare function cellColumnName(column: string, part: CellPart): string;
+/**
+ * Actor recorded when the data plane computes a materialized resolved table's
+ * rows for every caller. Its claims are what the compute view's synced
+ * sources see (materialized ETL sources must be readable by anyone).
+ */
+declare const MATERIALIZE_ACTOR = "orm:materialize";
+declare const MATERIALIZE_CLAIMS_JSON: string;
+/**
+ * Apply-generated function that reconciles a materialized resolved table with
+ * its compute view: `SELECT * FROM orm_<ns>."<table>__refresh"(wait)` returns
+ * `(upserted, deleted, locked)`; without `wait` it skips when another refresh
+ * holds the table's lock. The one refresh implementation — the Atlas
+ * reconcile, the post-ETL hook, and an operator in psql all call it.
+ */
+declare function materializedRefreshFunctionName(table: string): string;
+/**
+ * Advisory-lock key serializing a materialized table's refreshes (hashed with
+ * `hashtext`). A full refresh holds it exclusively and every ORM write's
+ * per-row refresh holds it shared, both before reading the compute view — so
+ * a full refresh never reads a snapshot older than a write it then overwrites.
+ */
+declare function materializeLockKey(schema: string, table: string): string;
+
+export { CELLS_FIELD as C, DEFINITION_FILE_EXTENSIONS as D, HASH_DOMAIN as H, IDENTIFIER_PATTERN as I, MATERIALIZE_ACTOR as M, NAMESPACE_PATTERN as N, ORM_DATA_TOKEN_HEADER as O, QUALIFIED_TABLE_PATTERN as Q, RESERVED_COLUMN_NAMES as R, SYNCED_SOURCE_PATTERN as S, CELL_PARTS as a, type CellPart as b, cellColumnName as c, ORM_SERVICE_DATA_TOKEN_HEADER as d, CAPABILITY_KEY_PATTERN as e, CELL_PART_SUFFIX as f, CLAIM_KEY_PATTERN as g, COLUMN_IDENTIFIER_PATTERN as h, CONSUMER_ROLE_SUFFIX as i, MATERIALIZE_CLAIMS_JSON as j, MAX_DEFINITION_FILE_BYTES as k, MAX_GENERATED_SDL_BYTES as l, MAX_IDENTIFIER_LENGTH as m, MAX_TRACKED_COLUMN_NAME as n, NAMESPACE_CONFIG_FILENAMES as o, ORM_REGISTRATION_MAX_BYTES as p, ORM_SCHEMA_PREFIX as q, RESERVED_TABLE_NAMES as r, consumerRoleName as s, materializeLockKey as t, materializedRefreshFunctionName as u, ormSchemaName as v };

package/dist/constants-YoFGjIBM.d.ts

@@ -0,0 +1,99 @@
+/** Shared grammar for namespace identifiers; never interpolate arbitrary paths. */
+declare const NAMESPACE_PATTERN: RegExp;
+/** Caller-scoped delegated data credential, supplied by an authenticated host. */
+declare const ORM_DATA_TOKEN_HEADER = "x-sequence-data-token";
+/** Separate service-identity credential; never used as an implicit fallback. */
+declare const ORM_SERVICE_DATA_TOKEN_HEADER = "x-sequence-data-token-service";
+declare const IDENTIFIER_PATTERN: RegExp;
+/** Native source columns may have one leading underscore; relation names may not. */
+declare const COLUMN_IDENTIFIER_PATTERN: RegExp;
+declare const MAX_IDENTIFIER_LENGTH = 63;
+/**
+ * Custom Roles & Capabilities claim keys as policies reference them: a
+ * host-scoped registry key, an org pin's `org/<key>`, or an Application
+ * capability pin's `app/<application-id>/<key>`. Matches the registry
+ * key grammar EXACTLY (`[a-z0-9-]`, 1–64 chars, no `_` — the FGA object-id
+ * delimiter) so any capability that's declarable/attachable in namespace.yaml
+ * can also be referenced here — a stricter pattern would let a valid key
+ * register yet fail at apply (e.g. `org/2fa`, a one-char or digit-led key).
+ */
+declare const CAPABILITY_KEY_PATTERN: RegExp;
+declare const CLAIM_KEY_PATTERN: RegExp;
+/** Qualified reference to a table outside the defining file: `<schema>.<table>`. */
+declare const QUALIFIED_TABLE_PATTERN: RegExp;
+/** Synced reflected sources are restricted to the gold layer. */
+declare const SYNCED_SOURCE_PATTERN: RegExp;
+declare const ORM_SCHEMA_PREFIX = "orm_";
+declare const CONSUMER_ROLE_SUFFIX = "_consumer";
+declare const ormSchemaName: (namespace: string) => string;
+declare const consumerRoleName: (namespace: string) => string;
+declare const DEFINITION_FILE_EXTENSIONS: readonly [".yml", ".yaml"];
+/** Reserved basenames for the namespace-level config file (description, org capability pins). */
+declare const NAMESPACE_CONFIG_FILENAMES: Set<string>;
+declare const HASH_DOMAIN = "sequence-orm-definitions\0";
+/**
+ * A per-file byte cap where the loader reads untrusted YAML into memory — a real failure mode, not a product
+ * limit. Counts of tables/indexes/params and policy/SQL lengths are
+ * deliberately uncapped; Postgres enforces its own limits loudly at apply.
+ */
+declare const MAX_DEFINITION_FILE_BYTES: number;
+/** Generated SDL aggregates every table/view; it is not an individual source file. */
+declare const MAX_GENERATED_SDL_BYTES: number;
+/** Registration and reviewed exports carry SDL, canonical metadata, snapshots and migrations. */
+declare const ORM_REGISTRATION_MAX_BYTES: number;
+/** `/api/data/<ns>/actions/…` and `/api/data/<ns>/query` share the table path segment. */
+declare const RESERVED_TABLE_NAMES: Set<string>;
+/**
+ * The Data API's query-string grammar owns these parameter names — a column
+ * with one of them could never be filtered over the wire, so definitions
+ * refuse it up front ("validate rejects only what can never work").
+ */
+declare const RESERVED_COLUMN_NAMES: Set<string>;
+/**
+ * Per-cell metadata (`cellMetadata: true`, and every resolved-table source) is
+ * stored as typed system columns beside each tracked column `c`:
+ *
+ *  - `c__at`  timestamptz — when the cell was last written (NULL: never / no opinion)
+ *  - `c__by`  text        — who wrote it
+ *  - `c__rev` uuid        — a resolved table's manual source only: the edit's
+ *                           identity, so an async writeback confirmation clears
+ *                           only the exact edit it delivered
+ *
+ * A resolved view additionally exposes, per resolved column, the winner's
+ * `c__src` (source name) and `c__lost` (newer candidates that lost, jsonb).
+ * None of these are GraphQL columns: they surface through the typed `cells`
+ * object and are never client-writable.
+ */
+declare const CELL_PARTS: readonly ["at", "by", "rev", "source", "conflicts"];
+type CellPart = (typeof CELL_PARTS)[number];
+declare const CELL_PART_SUFFIX: Readonly<Record<CellPart, string>>;
+/** Longest physical column name that can carry cell parts (63 minus the longest suffix). */
+declare const MAX_TRACKED_COLUMN_NAME: number;
+/** GraphQL field carrying a row's per-cell metadata object. */
+declare const CELLS_FIELD = "cells";
+/** Physical (and logical) name of one cell part of a column. */
+declare function cellColumnName(column: string, part: CellPart): string;
+/**
+ * Actor recorded when the data plane computes a materialized resolved table's
+ * rows for every caller. Its claims are what the compute view's synced
+ * sources see (materialized ETL sources must be readable by anyone).
+ */
+declare const MATERIALIZE_ACTOR = "orm:materialize";
+declare const MATERIALIZE_CLAIMS_JSON: string;
+/**
+ * Apply-generated function that reconciles a materialized resolved table with
+ * its compute view: `SELECT * FROM orm_<ns>."<table>__refresh"(wait)` returns
+ * `(upserted, deleted, locked)`; without `wait` it skips when another refresh
+ * holds the table's lock. The one refresh implementation — the Atlas
+ * reconcile, the post-ETL hook, and an operator in psql all call it.
+ */
+declare function materializedRefreshFunctionName(table: string): string;
+/**
+ * Advisory-lock key serializing a materialized table's refreshes (hashed with
+ * `hashtext`). A full refresh holds it exclusively and every ORM write's
+ * per-row refresh holds it shared, both before reading the compute view — so
+ * a full refresh never reads a snapshot older than a write it then overwrites.
+ */
+declare function materializeLockKey(schema: string, table: string): string;
+
+export { CELLS_FIELD as C, DEFINITION_FILE_EXTENSIONS as D, HASH_DOMAIN as H, IDENTIFIER_PATTERN as I, MATERIALIZE_ACTOR as M, NAMESPACE_PATTERN as N, ORM_DATA_TOKEN_HEADER as O, QUALIFIED_TABLE_PATTERN as Q, RESERVED_COLUMN_NAMES as R, SYNCED_SOURCE_PATTERN as S, CELL_PARTS as a, type CellPart as b, cellColumnName as c, ORM_SERVICE_DATA_TOKEN_HEADER as d, CAPABILITY_KEY_PATTERN as e, CELL_PART_SUFFIX as f, CLAIM_KEY_PATTERN as g, COLUMN_IDENTIFIER_PATTERN as h, CONSUMER_ROLE_SUFFIX as i, MATERIALIZE_CLAIMS_JSON as j, MAX_DEFINITION_FILE_BYTES as k, MAX_GENERATED_SDL_BYTES as l, MAX_IDENTIFIER_LENGTH as m, MAX_TRACKED_COLUMN_NAME as n, NAMESPACE_CONFIG_FILENAMES as o, ORM_REGISTRATION_MAX_BYTES as p, ORM_SCHEMA_PREFIX as q, RESERVED_TABLE_NAMES as r, consumerRoleName as s, materializeLockKey as t, materializedRefreshFunctionName as u, ormSchemaName as v };

package/dist/dynamic-input.d.cts

@@ -1,5 +1,6 @@
 import { CmpOp, TableMetaIr } from './ir.cjs';
 import 'zod';
+import './constants-YoFGjIBM.cjs';
 
 /**
  * §4f dynamic-input validators — PURE, data-only functions the data plane

package/dist/dynamic-input.d.ts

@@ -1,5 +1,6 @@
 import { CmpOp, TableMetaIr } from './ir.js';
 import 'zod';
+import './constants-YoFGjIBM.js';
 
 /**
  * §4f dynamic-input validators — PURE, data-only functions the data plane