@sequenceholdings/orm 2.2.0 → 2.3.0

package/dist/predicate-v2.d.cts

@@ -11,7 +11,7 @@ type PolicyOperand =
     kind: 'path';
     segments: readonly string[];
 }
-/** `claim('sub')` / `claim('org')` — the only claim() keys in CLAIMS_CONTRACT. */
+/** `claim('sub')` / `claim('org')` / `claim('ext_subject')` / `claim('ext_email')` — the scalar keys in CLAIMS_CONTRACT. */
  | {
     kind: 'claim';
     key: ClaimKey;
@@ -63,7 +63,7 @@ declare class PolicyParseError extends Error {
     readonly name = "PolicyParseError";
     constructor(message: string, position: number);
 }
-type PolicyCompileErrorCode = 'unknown-table' | 'unknown-column' | 'unknown-link' | 'not-to-one' | 'link-depth-exceeded' | 'unsupported-comparison' | 'invalid-null-comparison' | 'when-not-claims-only';
+type PolicyCompileErrorCode = 'unknown-table' | 'unknown-column' | 'unknown-link' | 'not-to-one' | 'link-depth-exceeded' | 'unsupported-comparison' | 'invalid-null-comparison' | 'when-not-claims-only' | 'claim-type-mismatch';
 /**
  * Compile-time failure — the parsed policy references something the table
  * doesn't declare, or uses a shape the v2.0 IR cannot represent. Carries
@@ -90,6 +90,9 @@ declare function parsePolicy(source: string): ParsedPolicy;
  *  - a comparison must reference exactly ONE column side (column↔column and
  *    claims↔literal comparisons have no PredIr shape in v2.0);
  *  - `col = null` / `col != null` normalize to the isNull operator;
+ *  - verified-borrower claims (`claim('ext_subject')`, `claim('ext_email')`)
+ *    are text: they compare to a text column with `=` only, never under
+ *    not(), so no negation, ordering or pattern can widen a borrower's rows;
  *  - variant `when` guards are claims-only: capability()/role() under
  *    and/or/not. (claim() comparisons in `when` are not representable in the
  *    v2.0 IR — a targeted error says so.)
@@ -99,6 +102,11 @@ declare const POLICY_MAX_LINK_DEPTH = 3;
 interface PolicyColumnInfo {
     readonly name: string;
     readonly columnName: string;
+    /**
+     * The column's IR type when the resolver knows it (TableMetaIr always does).
+     * Required for a verified-borrower claim comparison: unknown is refused.
+     */
+    readonly type?: unknown;
 }
 interface PolicyLinkInfo {
     readonly name: string;

package/dist/predicate-v2.d.ts

@@ -11,7 +11,7 @@ type PolicyOperand =
     kind: 'path';
     segments: readonly string[];
 }
-/** `claim('sub')` / `claim('org')` — the only claim() keys in CLAIMS_CONTRACT. */
+/** `claim('sub')` / `claim('org')` / `claim('ext_subject')` / `claim('ext_email')` — the scalar keys in CLAIMS_CONTRACT. */
  | {
     kind: 'claim';
     key: ClaimKey;
@@ -63,7 +63,7 @@ declare class PolicyParseError extends Error {
     readonly name = "PolicyParseError";
     constructor(message: string, position: number);
 }
-type PolicyCompileErrorCode = 'unknown-table' | 'unknown-column' | 'unknown-link' | 'not-to-one' | 'link-depth-exceeded' | 'unsupported-comparison' | 'invalid-null-comparison' | 'when-not-claims-only';
+type PolicyCompileErrorCode = 'unknown-table' | 'unknown-column' | 'unknown-link' | 'not-to-one' | 'link-depth-exceeded' | 'unsupported-comparison' | 'invalid-null-comparison' | 'when-not-claims-only' | 'claim-type-mismatch';
 /**
  * Compile-time failure — the parsed policy references something the table
  * doesn't declare, or uses a shape the v2.0 IR cannot represent. Carries
@@ -90,6 +90,9 @@ declare function parsePolicy(source: string): ParsedPolicy;
  *  - a comparison must reference exactly ONE column side (column↔column and
  *    claims↔literal comparisons have no PredIr shape in v2.0);
  *  - `col = null` / `col != null` normalize to the isNull operator;
+ *  - verified-borrower claims (`claim('ext_subject')`, `claim('ext_email')`)
+ *    are text: they compare to a text column with `=` only, never under
+ *    not(), so no negation, ordering or pattern can widen a borrower's rows;
  *  - variant `when` guards are claims-only: capability()/role() under
  *    and/or/not. (claim() comparisons in `when` are not representable in the
  *    v2.0 IR — a targeted error says so.)
@@ -99,6 +102,11 @@ declare const POLICY_MAX_LINK_DEPTH = 3;
 interface PolicyColumnInfo {
     readonly name: string;
     readonly columnName: string;
+    /**
+     * The column's IR type when the resolver knows it (TableMetaIr always does).
+     * Required for a verified-borrower claim comparison: unknown is refused.
+     */
+    readonly type?: unknown;
 }
 interface PolicyLinkInfo {
     readonly name: string;

package/dist/predicate-v2.js

@@ -1056,14 +1056,20 @@ z.object({ irVersion: irVersionSchema });
 var CLAIMS_CONTRACT = {
   sub: "string",
   org: "string?",
+  ext_subject: "string?",
+  ext_email: "string?",
   roles: "string[]",
   capabilities: "string[]"
 };
+var EXTERNAL_POLICY_CLAIM_KEYS = ["ext_subject", "ext_email"];
+function isExternalPolicyClaimKey(key) {
+  return EXTERNAL_POLICY_CLAIM_KEYS.includes(key);
+}
 var scalarLiteral = z.union([z.string(), z.number(), z.boolean(), z.null()]);
 var valueIrSchema = z.discriminatedUnion("kind", [
   z.object({ kind: z.literal("literal"), value: z.union([scalarLiteral, z.array(scalarLiteral)]) }),
   z.object({ kind: z.literal("variable"), name: z.string() }),
-  z.object({ kind: z.literal("claim"), key: z.enum(["sub", "org"]) })
+  z.object({ kind: z.literal("claim"), key: z.enum(["sub", "org", ...EXTERNAL_POLICY_CLAIM_KEYS]) })
 ]);
 var CMP_OPS = [
   "eq",
@@ -1813,6 +1819,7 @@ var PolicyCompiler = class {
       case "or":
         return { kind: node.kind, operands: node.operands.map((operand) => this.compile(operand, table, depth)) };
       case "not":
+        assertNoNegatedExternalClaim(node.operand);
         return { kind: "not", operand: this.compile(node.operand, table, depth) };
       case "capability":
         return { kind: "capability", key: node.key };
@@ -1892,6 +1899,9 @@ var PolicyCompiler = class {
         columnCandidates(info)
       );
     }
+    if (valueSide.kind === "claim" && isExternalPolicyClaimKey(valueSide.key)) {
+      assertExternalClaimComparison({ op, key: valueSide.key, column: info.columns.find((c) => c.name === column) });
+    }
     let cmp = this.buildCmp(op, column, valueSide);
     for (let i = links.length - 1; i >= 0; i -= 1) {
       cmp = { kind: "exists", link: links[i].name, where: cmp };
@@ -1912,6 +1922,33 @@ var PolicyCompiler = class {
     return { kind: "cmp", op: CMP_BY_OP[op], column, value };
   }
 };
+function assertExternalClaimComparison({ op, key, column }) {
+  if (op !== "=") {
+    throw new PolicyCompileError(
+      `claim('${key}') supports = comparisons only, got '${op}'`,
+      "unsupported-comparison"
+    );
+  }
+  if (column?.type !== "text") {
+    const actual = column?.type === void 0 ? "of unknown type" : typeof column.type === "string" ? column.type : "an enum";
+    throw new PolicyCompileError(
+      `claim('${key}') is text and compares to a text column only \u2014 '${column?.name ?? "?"}' is ${actual}`,
+      "claim-type-mismatch"
+    );
+  }
+}
+function assertNoNegatedExternalClaim(operand) {
+  walkPolicy(operand, (node) => {
+    if (node.kind !== "compare") return;
+    const claim = [node.left, node.right].find((side) => side.kind === "claim" && isExternalPolicyClaimKey(side.key));
+    if (claim?.kind === "claim") {
+      throw new PolicyCompileError(
+        `claim('${claim.key}') cannot appear under not(): a negated borrower comparison admits other borrowers' rows`,
+        "unsupported-comparison"
+      );
+    }
+  });
+}
 function compilePredicateV2({ expression, table, resolver, maxLinkDepth }) {
   const parsed = typeof expression === "string" ? parsePolicy(expression) : expression;
   const compiler = new PolicyCompiler({ resolver, maxLinkDepth: maxLinkDepth ?? POLICY_MAX_LINK_DEPTH });