@sequenceholdings/orm 2.1.1 → 2.3.0

package/dist/predicate-v2.cjs

@@ -34,6 +34,7 @@ var PolicyCompileError = class extends Error {
 var COLUMN_IDENTIFIER_PATTERN = /^_?[a-z][a-z0-9_]*$/;
 var MAX_IDENTIFIER_LENGTH = 63;
 var CAPABILITY_KEY_PATTERN = /^(?:org\/|app\/[a-z][a-z0-9-]{0,63}\/)?[a-z0-9-]{1,64}$/;
+var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]{0,62}\.[a-z][a-z0-9_]{0,62}$/;
 var CELL_PARTS = ["at", "by", "rev", "source", "conflicts"];
 var CELL_PART_SUFFIX = {
   at: "__at",
@@ -563,6 +564,8 @@ var canonicalLinkSchema = zod.z.object({
   kind: zod.z.enum(["toOne", "toMany", "toPlatformUser"]),
   /** Target table name (namespace-local). Absent for toPlatformUser. */
   target: identifier2.optional(),
+  /** Owning namespace of an imported target; omitted for local links. */
+  namespace: identifier2.max(41).optional(),
   /** FK column on the owning side (toOne/toPlatformUser: on this table; toMany: on the target). */
   on: columnIdentifier,
   /** Referenced column on the target (default: target's PK / platform user `sub`). */
@@ -664,11 +667,12 @@ var canonicalForeignKeySchema = zod.z.object({
 }).strict();
 var canonicalTableSchema = zod.z.object({
   table: identifier2,
+  displayName: zod.z.string().trim().min(1).max(120).optional(),
   description: zod.z.string().max(2e3).optional(),
   /** Table-level rename hint (new in v2). */
   renamedFrom: identifier2.optional(),
-  /** Synced/reflected read-only tables (`source: gold.*`) — v1 semantics. */
-  source: zod.z.string().regex(/^gold\.[a-z][a-z0-9_]*$/).optional(),
+  /** Synced/reflected read-only tables (`source: schema.table`) — v1 semantics. */
+  source: zod.z.string().regex(QUALIFIED_TABLE_PATTERN).optional(),
   columns: zod.z.array(canonicalColumnSchema).default([]),
   primaryKey: zod.z.array(columnIdentifier).min(1).max(8).optional(),
   links: zod.z.array(canonicalLinkSchema).default([]),
@@ -821,7 +825,9 @@ function validateCellMetadata(table, index, ctx) {
     }
   }
 }
-zod.z.object({
+var exportGateSchema = zod.z.union([zod.z.literal(true), zod.z.object({ capability: zod.z.string().min(1) }).strict(), zod.z.object({ role: zod.z.string().min(1) }).strict()]);
+var relationExportSchema = zod.z.object({ read: exportGateSchema, write: exportGateSchema.optional() }).strict();
+var localDefinitionSchema = zod.z.object({
   definition_format: zod.z.literal(CANONICAL_FORMAT),
   namespace: identifier2.max(41),
   description: zod.z.string().max(2e3).optional(),
@@ -829,6 +835,8 @@ zod.z.object({
   tables: zod.z.array(canonicalTableSchema).min(0).max(500),
   /** Optional to preserve byte-identical hashes for pre-view canonical v2 documents. */
   views: zod.z.array(canonicalViewSchema).max(500).optional(),
+  /** Target-owned cross-namespace access contract, using existing namespace grants. */
+  exports: zod.z.record(identifier2, relationExportSchema).optional(),
   /** Verbatim custom-roles grammar (@sequenceholdings/custom-roles-manifest). */
   capabilities: zod.z.object({
     roles: zod.z.unknown().optional(),
@@ -855,7 +863,16 @@ zod.z.object({
     }
   }
   const fkTables = new Map(definition.tables.map((table) => [table.table, table]));
+  const relations = /* @__PURE__ */ new Set([...fkTables.keys(), ...(definition.views ?? []).map((view) => view.view)]);
+  for (const name of Object.keys(definition.exports ?? {})) {
+    if (!relations.has(name)) ctx.addIssue({ code: "custom", path: ["exports", name], message: `export '${name}' is not a local object` });
+  }
   for (const [tableIndex, table] of definition.tables.entries()) {
+    for (const [linkIndex, link] of table.links.entries()) {
+      if (link.enforce && link.namespace !== void 0 && link.namespace !== definition.namespace) {
+        ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "links", linkIndex], message: "physical foreign keys require a local target; use an ORM link without enforce" });
+      }
+    }
     const names = /* @__PURE__ */ new Set([
       ...table.primaryKey?.length ? [`${table.table}_pkey`] : [],
       ...table.columns.filter((column) => column.unique && !(table.primaryKey?.length === 1 && table.primaryKey[0] === column.columnName)).map((column) => `${table.table}_${column.columnName}_unique`),
@@ -1025,23 +1042,36 @@ zod.z.object({
   };
   for (const view of views) visit(view.view, []);
 });
+localDefinitionSchema.safeExtend({
+  /** Flattened, pinned snapshots. Imported relations never participate in this namespace's DDL. */
+  imports: zod.z.array(localDefinitionSchema).max(32).optional()
+});
 
 // src/ir/index.ts
-var IR_VERSION = 2;
 var LEGACY_IR_VERSION = 1;
-var irVersionSchema = zod.z.union([zod.z.literal(LEGACY_IR_VERSION), zod.z.literal(IR_VERSION)]);
+var GUARDED_IR_VERSION = 2;
+var COMPOSED_IR_VERSION = 3;
+var SQL_IR_VERSION = 4;
+var RUNTIME_SQL_IR_VERSION = 5;
+var irVersionSchema = zod.z.union([zod.z.literal(LEGACY_IR_VERSION), zod.z.literal(GUARDED_IR_VERSION), zod.z.literal(COMPOSED_IR_VERSION), zod.z.literal(SQL_IR_VERSION), zod.z.literal(RUNTIME_SQL_IR_VERSION)]);
 zod.z.object({ irVersion: irVersionSchema });
 var CLAIMS_CONTRACT = {
   sub: "string",
   org: "string?",
+  ext_subject: "string?",
+  ext_email: "string?",
   roles: "string[]",
   capabilities: "string[]"
 };
+var EXTERNAL_POLICY_CLAIM_KEYS = ["ext_subject", "ext_email"];
+function isExternalPolicyClaimKey(key) {
+  return EXTERNAL_POLICY_CLAIM_KEYS.includes(key);
+}
 var scalarLiteral = zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean(), zod.z.null()]);
 var valueIrSchema = zod.z.discriminatedUnion("kind", [
   zod.z.object({ kind: zod.z.literal("literal"), value: zod.z.union([scalarLiteral, zod.z.array(scalarLiteral)]) }),
   zod.z.object({ kind: zod.z.literal("variable"), name: zod.z.string() }),
-  zod.z.object({ kind: zod.z.literal("claim"), key: zod.z.enum(["sub", "org"]) })
+  zod.z.object({ kind: zod.z.literal("claim"), key: zod.z.enum(["sub", "org", ...EXTERNAL_POLICY_CLAIM_KEYS]) })
 ]);
 var CMP_OPS = [
   "eq",
@@ -1073,8 +1103,8 @@ var predIrSchema = zod.z.lazy(
       value: zod.z.number(),
       where: predIrSchema.optional()
     }),
-    zod.z.object({ kind: zod.z.literal("capability"), key: zod.z.string() }),
-    zod.z.object({ kind: zod.z.literal("role"), key: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("capability"), key: zod.z.string(), namespace: zod.z.string().optional() }),
+    zod.z.object({ kind: zod.z.literal("role"), key: zod.z.string(), namespace: zod.z.string().optional() }),
     zod.z.object({ kind: zod.z.literal("dynamicFilter"), slot: zod.z.string() }),
     zod.z.object({ kind: zod.z.literal("const"), value: zod.z.boolean() })
   ])
@@ -1301,7 +1331,31 @@ var variableIrSchema = zod.z.object({
   /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
   defaultValue: variableDefaultIrSchema.optional()
 });
+var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz"]), nullable: zod.z.boolean() });
 var compiledOperationSchema = zod.z.object({
+  language: zod.z.literal("sql").optional(),
+  /** Server-compiled object catalog and permission ceiling, never caller SQL. */
+  sqlQuery: zod.z.object({
+    catalog: zod.z.object({
+      identity: zod.z.string(),
+      objects: zod.z.array(zod.z.object({
+        ref: zod.z.string(),
+        table: zod.z.string(),
+        columns: zod.z.array(sqlColumnSchema.extend({ type: zod.z.string() })).min(1),
+        scan: zod.z.string().min(1),
+        read: zod.z.array(zod.z.string()).min(1)
+      }).strict()).min(1).max(256)
+    }).strict(),
+    read: zod.z.array(zod.z.string()).min(1).max(256),
+    maxRows: zod.z.number().int().min(1).max(1e4)
+  }).strict().optional(),
+  sql: zod.z.object({
+    text: zod.z.string().min(1).max(1048576),
+    columns: zod.z.array(sqlColumnSchema).min(1).max(256),
+    parameters: zod.z.array(zod.z.string()).max(128),
+    read: zod.z.array(zod.z.string()).min(1).max(256),
+    maxRows: zod.z.number().int().min(1).max(1e4)
+  }).strict().optional(),
   irVersion: irVersionSchema,
   name: zod.z.string(),
   opHash: zod.z.string().regex(/^sha256:[0-9a-f]{64}$/),
@@ -1313,8 +1367,16 @@ var compiledOperationSchema = zod.z.object({
   variables: zod.z.array(variableIrSchema),
   /** Every table the op touches — data-token scoping + audit. */
   tableSet: zod.z.array(zod.z.string()).min(1),
-  roots: zod.z.array(rootIrSchema).min(1)
+  roots: zod.z.array(rootIrSchema)
 }).superRefine((operation, ctx) => {
+  if (operation.language === "sql") {
+    const validPlan = operation.sqlQuery ? !operation.sql && operation.irVersion === RUNTIME_SQL_IR_VERSION : !!operation.sql && operation.irVersion === SQL_IR_VERSION;
+    if (!validPlan || operation.kind !== "query" || operation.roots.length !== 0 || !operation.requires?.capability) {
+      ctx.addIssue({ code: "custom", message: "SQL operations require a query-only v4 plan or v5 runtime contract, capability, and no GraphQL roots" });
+    }
+  } else if (operation.sql || operation.sqlQuery || operation.roots.length === 0) {
+    ctx.addIssue({ code: "custom", message: "GraphQL operations require roots and cannot carry SQL" });
+  }
   for (const [index, root] of operation.roots.entries()) {
     if (root.kind !== "mutation" || root.assertAffectedRows === void 0) continue;
     if (operation.irVersion < 2 || operation.kind !== "mutation" || root.includeIf !== void 0) {
@@ -1361,11 +1423,16 @@ var resolvedMetaIrSchema = zod.z.object({
 });
 var tableMetaIrSchema = zod.z.object({
   table: zod.z.string(),
+  namespace: zod.z.string().optional(),
+  dependencies: zod.z.array(zod.z.string()).optional(),
+  foreignReferences: zod.z.array(zod.z.object({ column: zod.z.string(), target: zod.z.string(), targetColumn: zod.z.string() })).optional(),
+  exportRead: zod.z.union([zod.z.literal(true), zod.z.object({ capability: zod.z.string() }), zod.z.object({ role: zod.z.string() })]).optional(),
+  exportWrite: zod.z.union([zod.z.literal(true), zod.z.object({ capability: zod.z.string() }), zod.z.object({ role: zod.z.string() })]).optional(),
   schema: zod.z.string(),
   typename: zod.z.string(),
   /**
    * True when statements over this relation evaluate a claims-gated synced
-   * view: synced twins (`source: gold.*`) materialize as views whose baked
+   * view: synced twins (`source: schema.table`) materialize as views whose baked
    * policy reads `current_setting('request.jwt.claims')`, and namespace views
    * inherit the gate transitively through their declared dependencies. The
    * executor must stamp that GUC (transaction-scoped) before any statement
@@ -1424,10 +1491,18 @@ zod.z.object({
   irVersion: irVersionSchema,
   namespace: zod.z.string(),
   schemaHash: zod.z.string(),
+  ownSchemaHash: zod.z.string().optional(),
+  dependencies: zod.z.record(zod.z.string(), zod.z.string()).optional(),
+  readPolicies: zod.z.record(zod.z.string(), predIrSchema).optional(),
   opsHash: zod.z.string(),
+  /** Apply-observed synced objects without a serving backing; not part of the authored schema hash. */
+  unbackedTables: zod.z.array(zod.z.string()).optional(),
   tables: zod.z.record(zod.z.string(), tableMetaIrSchema),
   operations: zod.z.record(zod.z.string(), compiledOperationSchema)
 }).superRefine((artifact, ctx) => {
+  if (Object.keys(artifact.dependencies ?? {}).length > 0 && artifact.irVersion < COMPOSED_IR_VERSION) {
+    ctx.addIssue({ code: "custom", path: ["irVersion"], message: "cross-namespace dependencies require IR v3" });
+  }
   for (const [name, operation] of Object.entries(artifact.operations)) {
     if (operation.irVersion > artifact.irVersion) {
       ctx.addIssue({ code: "custom", path: ["operations", name, "irVersion"], message: "operation requires a newer IR version than its artifact" });
@@ -1746,6 +1821,7 @@ var PolicyCompiler = class {
       case "or":
         return { kind: node.kind, operands: node.operands.map((operand) => this.compile(operand, table, depth)) };
       case "not":
+        assertNoNegatedExternalClaim(node.operand);
         return { kind: "not", operand: this.compile(node.operand, table, depth) };
       case "capability":
         return { kind: "capability", key: node.key };
@@ -1825,6 +1901,9 @@ var PolicyCompiler = class {
         columnCandidates(info)
       );
     }
+    if (valueSide.kind === "claim" && isExternalPolicyClaimKey(valueSide.key)) {
+      assertExternalClaimComparison({ op, key: valueSide.key, column: info.columns.find((c) => c.name === column) });
+    }
     let cmp = this.buildCmp(op, column, valueSide);
     for (let i = links.length - 1; i >= 0; i -= 1) {
       cmp = { kind: "exists", link: links[i].name, where: cmp };
@@ -1845,6 +1924,33 @@ var PolicyCompiler = class {
     return { kind: "cmp", op: CMP_BY_OP[op], column, value };
   }
 };
+function assertExternalClaimComparison({ op, key, column }) {
+  if (op !== "=") {
+    throw new PolicyCompileError(
+      `claim('${key}') supports = comparisons only, got '${op}'`,
+      "unsupported-comparison"
+    );
+  }
+  if (column?.type !== "text") {
+    const actual = column?.type === void 0 ? "of unknown type" : typeof column.type === "string" ? column.type : "an enum";
+    throw new PolicyCompileError(
+      `claim('${key}') is text and compares to a text column only \u2014 '${column?.name ?? "?"}' is ${actual}`,
+      "claim-type-mismatch"
+    );
+  }
+}
+function assertNoNegatedExternalClaim(operand) {
+  walkPolicy(operand, (node) => {
+    if (node.kind !== "compare") return;
+    const claim = [node.left, node.right].find((side) => side.kind === "claim" && isExternalPolicyClaimKey(side.key));
+    if (claim?.kind === "claim") {
+      throw new PolicyCompileError(
+        `claim('${claim.key}') cannot appear under not(): a negated borrower comparison admits other borrowers' rows`,
+        "unsupported-comparison"
+      );
+    }
+  });
+}
 function compilePredicateV2({ expression, table, resolver, maxLinkDepth }) {
   const parsed = typeof expression === "string" ? parsePolicy(expression) : expression;
   const compiler = new PolicyCompiler({ resolver, maxLinkDepth: maxLinkDepth ?? POLICY_MAX_LINK_DEPTH });