@sequenceholdings/orm 2.0.0 → 2.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sequenceholdings/orm",
-  "version": "2.0.0",
+  "version": "2.1.1",
   "description": "Sequence ORM v2 — TypeScript-defined governed tables and persisted GraphQL operations",
   "license": "UNLICENSED",
   "repository": {
@@ -28,9 +28,14 @@
       "require": "./dist/cli.cjs"
     },
     "./client": {
-      "types": "./dist/client.d.ts",
-      "import": "./dist/client.js",
-      "require": "./dist/client.cjs"
+      "import": {
+        "types": "./dist/client.d.ts",
+        "default": "./dist/client.js"
+      },
+      "require": {
+        "types": "./dist/client.d.cts",
+        "default": "./dist/client.cjs"
+      }
     },
     "./ir": {
       "types": "./dist/ir.d.ts",
@@ -89,7 +94,7 @@
     "jiti": "^2.4.2",
     "drizzle-kit": "^0.31.9",
     "drizzle-orm": "^0.45.2",
-    "js-yaml": "^4.3.1",
+    "js-yaml": "^4.3.2",
     "zod": "^4.1.13",
     "@sequenceholdings/custom-roles-manifest": "0.1.0"
   },
@@ -98,7 +103,7 @@
     "@types/node": "^22.0.0",
     "tsup": "^8.3.0",
     "typescript": "^5.3.3",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.11"
   },
   "engines": {
     "node": ">=20"

package/templates/orm-namespace/CLAUDE.md

@@ -42,7 +42,9 @@ applies it. Your app never talks to Postgres — it calls the data plane with
   `.renamedFrom('old_name')` (column) / `renamedFrom` (table config) is a
   DROP + CREATE — data loss. The diff will refuse ambiguous renames; add the
   hint instead of forcing.
-- **Capabilities/roles are declared here, granted in the Permissions UI.**
+- **Capabilities are code, roles are data.** Capabilities are declared here; roles that bundle them are
+  created in Atlas and granted in the Permissions UI. Don't add role `definitions`
+  (a deprecated one-time seed) or check `role('…')` — check capabilities.
   Never hardcode user identities in policies; use `claim('sub')` /
   `claim('org')` and grants.
 
@@ -53,7 +55,6 @@ author_sub = claim('sub')                 -- row value vs caller claim
 org = claim('org') and status = 'open'    -- boolean algebra
 exists(deal, org = claim('org'))          -- traverse a declared link
 capability('deals-read')                  -- boolean grant check
-role('deal-manager')                      -- boolean role check
 ```
 
 Variants widen access per grant (permissive union):
@@ -64,7 +65,7 @@ policies: {
     default: "author_sub = claim('sub')",
     variants: [
       { when: "capability('deals-read')", policy: "org = claim('org')" },
-      { when: "role('deal-manager')", allow: true },
+      { when: "capability('deals-admin')", allow: true },
     ],
   },
 }
@@ -73,7 +74,8 @@ policies: {
 ## GraphQL operations
 
 - Named operations only; one export per document; gate with
-  `@requires(capability: "…")` / `@requires(role: "…")`.
+  `@requires(capability: "…")`. Check capabilities, not roles — roles are
+  created in Atlas and can change there.
 - Dynamic filters are policy-bounded: `$where: <Table>BoolExp` /
   `$orderBy` / whole-input write objects are validated against a
   schema-derived whitelist and AND-ed with the table policy at runtime —

package/templates/orm-namespace/codegen.preset.d.cts

@@ -0,0 +1,7 @@
+import type { CodegenConfig } from '@graphql-codegen/cli'
+
+// The runtime shim loads the package's preset object. Derive its type from the
+// installed CLI so this declaration follows the consumer's codegen contract.
+type ConfiguredOutput = Exclude<CodegenConfig['generates'][string], unknown[]>
+declare const preset: Exclude<ConfiguredOutput['preset'], string | undefined>
+export = preset

package/templates/orm-namespace/codegen.ts

@@ -1,4 +1,5 @@
 import type { CodegenConfig } from '@graphql-codegen/cli'
+import preset from './codegen.preset.cjs'
 
 /**
  * graphql-codegen config. `seq-studio orm generate` writes ./schema.graphql
@@ -14,7 +15,7 @@ const config: CodegenConfig = {
   documents: ['graphql/**/*.ts'],
   generates: {
     './generated/': {
-      preset: './codegen.preset.cjs',
+      preset,
     },
   },
 }

package/templates/orm-namespace/graphql/example/queries.ts

@@ -4,9 +4,10 @@
  * variables }` — never query text, never SQL. Type names come from the
  * generated `schema.graphql` (`seq-studio orm generate`).
  *
- * Gate an operation with `@requires(capability: "…")` or
- * `@requires(role: "…")` — checked before execution, on top of the
- * table policies that are always compiled in.
+ * Gate an operation with `@requires(capability: "…")` — checked before
+ * execution, on top of the table policies that are always compiled in.
+ * Check capabilities, not roles: roles are created in Atlas and can change
+ * there.
  */
 
 export const GetOpenDeals = /* GraphQL */ `

package/templates/orm-namespace/package.json

@@ -11,7 +11,8 @@
   },
   "dependencies": {
     "@apollo/client": "^3.11.0",
-    "@sequenceholdings/orm": "^2.0.0",
+    "@graphql-typed-document-node/core": "^3.2.0",
+    "@sequenceholdings/orm": "^2.1.1",
     "graphql": "^16.11.0"
   },
   "devDependencies": {

package/templates/orm-namespace/schema/tables.ts

@@ -8,7 +8,8 @@ import { defineEnum, defineTable, t, toMany, toOne, toPlatformUser } from '@sequ
  *
  * Every table carries its own row-level policies. The policy DSL:
  *   - `claim('sub')` / `claim('org')` — the caller's identity claims
- *   - `capability('x')` / `role('y')` — boolean grants, resolved per caller
+ *   - `capability('x')` — boolean grant, resolved per caller (check
+ *     capabilities, not roles: roles are created in Atlas and can change)
  *   - `exists(link, <predicate>)` — traverse a declared link
  *   - variants: `default` applies to everyone; each variant WIDENS access
  *     when its `when` guard matches (permissive union — grants only ever
@@ -39,7 +40,7 @@ export const deals = defineTable(
         default: "author_sub = claim('sub')",
         variants: [
           { when: "capability('deals-read')", policy: "org = claim('org')" },
-          { when: "role('deal-manager')", allow: true },
+          { when: "capability('deals-admin')", allow: true },
         ],
       },
       write: "author_sub = claim('sub')",

package/templates/orm-namespace/sequence.config.ts

@@ -3,9 +3,10 @@ import { defineNamespace } from '@sequenceholdings/orm/authoring'
 /**
  * The namespace config — exactly one per directory.
  *
- * Capabilities and roles are DECLARED here (verbatim custom-roles grammar);
- * who HOLDS them is granted later in the Permissions UI (FGA), never in code.
- * Table policies reference them with `capability('…')` / `role('…')`.
+ * Capabilities are DECLARED here (verbatim custom-roles grammar) — the
+ * contract your policies check with `capability('…')`. Roles that bundle
+ * them are created in Atlas (the namespace's Roles tab), and who HOLDS them
+ * is granted there too, never in code.
  */
 export default defineNamespace({
   // Rename me: the namespace becomes your Postgres schema (orm_<namespace>).
@@ -13,18 +14,13 @@ export default defineNamespace({
   description: 'Describe what this namespace stores and who uses it.',
   capabilities: {
     roles: {
-      definitions: {
-        'deal-manager': {
-          description: 'Full access to every deal in the namespace',
-          default: false,
-          inherits: [],
-          grants: ['deals-read'],
-        },
-      },
       capabilities: {
         'deals-read': {
           description: 'Read all deals in the caller org (instead of author-only)',
         },
+        'deals-admin': {
+          description: 'Read every deal in the namespace, in any org',
+        },
       },
     },
     uses: [],