@sequenceholdings/orm 2.2.0 → 2.4.0

package/dist/compiler.d.cts

@@ -2,7 +2,7 @@ import { CanonicalEnum, CanonicalDefinition } from './canonical.cjs';
 import { ClaimKey, PredIr, RootIr, InputRefKind, TableMetaIr, CompiledOperation, CompiledArtifact, VariableIr, OrderIr, SelectionIr } from './ir.cjs';
 import { DocumentNode, OperationDefinitionNode, FragmentDefinitionNode, GraphQLSchema, ValueNode, SelectionSetNode } from 'graphql';
 export { DynamicInputIssue, DynamicInputResult, NormalizedBoolExp, NormalizedOnConflict, NormalizedOrderBy, NormalizedRow, ORDER_BY_DIRECTIONS, ScalarKind, allowedBoolExpOperators, allowedOps, validateAppendInput, validateBoolExpInput, validateInsertInput, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput } from './dynamic-input.cjs';
-export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, ParsedPolicy, PolicyColumnInfo, PolicyCompareOp, PolicyCompileError, PolicyCompileErrorCode, PolicyLinkInfo, PolicyNode, PolicyOperand, PolicyParseError, PolicyResolver, PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy } from './predicate-v2.cjs';
+export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, ParsedPolicy, PolicyAccess, PolicyColumnInfo, PolicyCompareOp, PolicyCompileError, PolicyCompileErrorCode, PolicyLinkInfo, PolicyNode, PolicyOperand, PolicyParseError, PolicyResolver, PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy } from './predicate-v2.cjs';
 import { z } from 'zod';
 export { P as PLATFORM_USER_TYPENAME, c as camelCase, g as enumTypeName, p as pascalCase } from './naming-CU9ThP_E.cjs';
 export { S as SqlOperationDefinition, d as defineOperation, s as sqlOperationDefinitionSchema } from './definition-DjfC7Lll.cjs';
@@ -50,9 +50,11 @@ declare class NamespaceCompileError extends Error {
  *  - document-authored relationship predicates (exists/aggPredicate) get the
  *    TARGET table's read policy injected too, so filtering through a link
  *    can't become an existence oracle on rows the caller can't read;
- *  - write policy AND-ed into update/delete row filters, and set as the
- *    insert check for inserts (claims + inserted-values only in v2.0 — an
- *    exists() write policy makes a table un-insertable, loudly);
+ *  - write policy AND-ed into update/delete row filters, set as the insert
+ *    check for inserts, and re-checked against the NEW rows of every update.
+ *    Link-traversing (exists/visible) write policies are evaluated by the data
+ *    plane against the proposed rows in the same statement, so "only on a
+ *    parent the caller can see" holds for inserts and FK-changing updates;
  *  - `col = claim(k)` AND-conjuncts of the write policy become pinned columns
  *    merged into every inserted row (and excluded from insertable/settable).
  */

package/dist/compiler.d.ts

@@ -2,7 +2,7 @@ import { CanonicalEnum, CanonicalDefinition } from './canonical.js';
 import { ClaimKey, PredIr, RootIr, InputRefKind, TableMetaIr, CompiledOperation, CompiledArtifact, VariableIr, OrderIr, SelectionIr } from './ir.js';
 import { DocumentNode, OperationDefinitionNode, FragmentDefinitionNode, GraphQLSchema, ValueNode, SelectionSetNode } from 'graphql';
 export { DynamicInputIssue, DynamicInputResult, NormalizedBoolExp, NormalizedOnConflict, NormalizedOrderBy, NormalizedRow, ORDER_BY_DIRECTIONS, ScalarKind, allowedBoolExpOperators, allowedOps, validateAppendInput, validateBoolExpInput, validateInsertInput, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput } from './dynamic-input.js';
-export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, ParsedPolicy, PolicyColumnInfo, PolicyCompareOp, PolicyCompileError, PolicyCompileErrorCode, PolicyLinkInfo, PolicyNode, PolicyOperand, PolicyParseError, PolicyResolver, PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy } from './predicate-v2.js';
+export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, ParsedPolicy, PolicyAccess, PolicyColumnInfo, PolicyCompareOp, PolicyCompileError, PolicyCompileErrorCode, PolicyLinkInfo, PolicyNode, PolicyOperand, PolicyParseError, PolicyResolver, PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy } from './predicate-v2.js';
 import { z } from 'zod';
 export { P as PLATFORM_USER_TYPENAME, c as camelCase, g as enumTypeName, p as pascalCase } from './naming-CPfx7EfF.js';
 export { S as SqlOperationDefinition, d as defineOperation, s as sqlOperationDefinitionSchema } from './definition-DjfC7Lll.js';
@@ -50,9 +50,11 @@ declare class NamespaceCompileError extends Error {
  *  - document-authored relationship predicates (exists/aggPredicate) get the
  *    TARGET table's read policy injected too, so filtering through a link
  *    can't become an existence oracle on rows the caller can't read;
- *  - write policy AND-ed into update/delete row filters, and set as the
- *    insert check for inserts (claims + inserted-values only in v2.0 — an
- *    exists() write policy makes a table un-insertable, loudly);
+ *  - write policy AND-ed into update/delete row filters, set as the insert
+ *    check for inserts, and re-checked against the NEW rows of every update.
+ *    Link-traversing (exists/visible) write policies are evaluated by the data
+ *    plane against the proposed rows in the same statement, so "only on a
+ *    parent the caller can see" holds for inserts and FK-changing updates;
  *  - `col = claim(k)` AND-conjuncts of the write policy become pinned columns
  *    merged into every inserted row (and excluded from insertable/settable).
  */

package/dist/compiler.js

@@ -1121,14 +1121,20 @@ function requiredArtifactIrVersion(operations) {
 var CLAIMS_CONTRACT = {
   sub: "string",
   org: "string?",
+  ext_subject: "string?",
+  ext_email: "string?",
   roles: "string[]",
   capabilities: "string[]"
 };
+var EXTERNAL_POLICY_CLAIM_KEYS = ["ext_subject", "ext_email"];
+function isExternalPolicyClaimKey(key) {
+  return EXTERNAL_POLICY_CLAIM_KEYS.includes(key);
+}
 var scalarLiteral = z.union([z.string(), z.number(), z.boolean(), z.null()]);
 var valueIrSchema = z.discriminatedUnion("kind", [
   z.object({ kind: z.literal("literal"), value: z.union([scalarLiteral, z.array(scalarLiteral)]) }),
   z.object({ kind: z.literal("variable"), name: z.string() }),
-  z.object({ kind: z.literal("claim"), key: z.enum(["sub", "org"]) })
+  z.object({ kind: z.literal("claim"), key: z.enum(["sub", "org", ...EXTERNAL_POLICY_CLAIM_KEYS]) })
 ]);
 var CMP_OPS = [
   "eq",
@@ -1848,6 +1854,7 @@ var Parser2 = class {
       return node;
     }
     if (this.peekKeyword("exists")) return this.parseExists();
+    if (this.peekKeyword("visible") && this.tokens[this.index + 1]?.kind === "lparen") return this.parseVisible();
     return this.parseComparison();
   }
   parseBooleanCall(fn) {
@@ -1867,6 +1874,13 @@ var Parser2 = class {
     this.expect("rparen", "')' closing exists(...)");
     return { kind: "exists", path, where };
   }
+  parseVisible() {
+    this.advance();
+    this.expect("lparen", "'(' after visible");
+    const path = this.parsePath("a link path in visible(...)");
+    this.expect("rparen", "')' closing visible(...)");
+    return { kind: "visible", path };
+  }
   parseComparison() {
     const left = this.parseOperand();
     const operator = this.expect("operator", "a comparison operator");
@@ -1982,6 +1996,24 @@ function parsePolicy(source) {
 
 // src/predicate-v2/compile.ts
 var POLICY_MAX_LINK_DEPTH = 3;
+function scopeToNamespace(pred, namespace) {
+  switch (pred.kind) {
+    case "capability":
+    case "role":
+      return pred.namespace ? pred : { ...pred, namespace };
+    case "and":
+    case "or":
+      return { ...pred, operands: pred.operands.map((operand) => scopeToNamespace(operand, namespace)) };
+    case "not":
+      return { ...pred, operand: scopeToNamespace(pred.operand, namespace) };
+    case "exists":
+      return { ...pred, where: scopeToNamespace(pred.where, namespace) };
+    case "aggPredicate":
+      return pred.where ? { ...pred, where: scopeToNamespace(pred.where, namespace) } : pred;
+    default:
+      return pred;
+  }
+}
 var CMP_BY_OP = {
   "=": "eq",
   "!=": "neq",
@@ -2015,7 +2047,7 @@ function resolveLink(info, ref) {
 function columnCandidates(info) {
   return [...info.columns.map((c) => c.name), ...info.links.map((l) => l.name)];
 }
-var PolicyCompiler = class {
+var PolicyCompiler = class _PolicyCompiler {
   constructor(ctx) {
     this.ctx = ctx;
   }
@@ -2027,13 +2059,16 @@ var PolicyCompiler = class {
       case "or":
         return { kind: node.kind, operands: node.operands.map((operand) => this.compile(operand, table, depth)) };
       case "not":
-        return { kind: "not", operand: this.compile(node.operand, table, depth) };
+        assertNoNegatedExternalClaim(node.operand);
+        return { kind: "not", operand: new _PolicyCompiler({ ...this.ctx, negated: true }).compile(node.operand, table, depth) };
       case "capability":
         return { kind: "capability", key: node.key };
       case "role":
         return { kind: "role", key: node.key };
       case "exists":
         return this.compileExists(node.path, node.where, table, depth);
+      case "visible":
+        return this.compileVisible(node.path, table, depth);
       case "compare":
         return this.compileCompare(node, table, depth);
     }
@@ -2047,6 +2082,36 @@ var PolicyCompiler = class {
     }
     return pred;
   }
+  /** `visible(path)` → `exists(path, <final target's read policy>)`. */
+  compileVisible(path, table, depth) {
+    const { links, finalTable } = this.resolveLinkPath(path, table, depth, { toOneOnly: false });
+    const readPolicy = this.ctx.resolver.readPolicy;
+    if (!readPolicy) {
+      throw new PolicyCompileError(
+        `visible(${path.join(".")}) needs the target's read policy, which this compile context does not provide`,
+        "visible-unresolvable"
+      );
+    }
+    if (this.ctx.visiting.includes(finalTable)) {
+      throw new PolicyCompileError(
+        `visible(${path.join(".")}) on '${table}' reaches '${finalTable}' whose read policy is already being expanded (${[...this.ctx.visiting, finalTable].join(" \u2192 ")})`,
+        "visible-cycle"
+      );
+    }
+    const expression = readPolicy(finalTable);
+    let pred = expression === void 0 ? { kind: "const", value: true } : compilePolicyAt({
+      expression,
+      table: finalTable,
+      ctx: { ...this.ctx, visiting: [...this.ctx.visiting, finalTable] },
+      depth: depth + links.length
+    });
+    const owner = this.ctx.resolver.policyNamespace?.(finalTable);
+    if (owner) pred = scopeToNamespace(pred, owner);
+    for (let i = links.length - 1; i >= 0; i -= 1) {
+      pred = { kind: "exists", link: links[i].name, where: pred };
+    }
+    return pred;
+  }
   resolveLinkPath(path, table, depth, { toOneOnly }) {
     const links = [];
     let current = table;
@@ -2106,6 +2171,10 @@ var PolicyCompiler = class {
         columnCandidates(info)
       );
     }
+    if (valueSide.kind === "claim" && isExternalPolicyClaimKey(valueSide.key)) {
+      if (this.ctx.negated) throw negatedExternalClaim(valueSide.key);
+      assertExternalClaimComparison({ op, key: valueSide.key, column: info.columns.find((c) => c.name === column) });
+    }
     let cmp = this.buildCmp(op, column, valueSide);
     for (let i = links.length - 1; i >= 0; i -= 1) {
       cmp = { kind: "exists", link: links[i].name, where: cmp };
@@ -2126,10 +2195,45 @@ var PolicyCompiler = class {
     return { kind: "cmp", op: CMP_BY_OP[op], column, value };
   }
 };
+function assertExternalClaimComparison({ op, key, column }) {
+  if (op !== "=") {
+    throw new PolicyCompileError(
+      `claim('${key}') supports = comparisons only, got '${op}'`,
+      "unsupported-comparison"
+    );
+  }
+  if (column?.type !== "text") {
+    const actual = column?.type === void 0 ? "of unknown type" : typeof column.type === "string" ? column.type : "an enum";
+    throw new PolicyCompileError(
+      `claim('${key}') is text and compares to a text column only \u2014 '${column?.name ?? "?"}' is ${actual}`,
+      "claim-type-mismatch"
+    );
+  }
+}
+function negatedExternalClaim(key) {
+  return new PolicyCompileError(
+    `claim('${key}') cannot appear under not(): a negated borrower comparison admits other borrowers' rows`,
+    "unsupported-comparison"
+  );
+}
+function assertNoNegatedExternalClaim(operand) {
+  walkPolicy(operand, (node) => {
+    if (node.kind !== "compare") return;
+    const claim = [node.left, node.right].find((side) => side.kind === "claim" && isExternalPolicyClaimKey(side.key));
+    if (claim?.kind === "claim") throw negatedExternalClaim(claim.key);
+  });
+}
 function compilePredicateV2({ expression, table, resolver, maxLinkDepth }) {
+  return compilePredicateAt({
+    expression,
+    table,
+    depth: 0,
+    ctx: { resolver, maxLinkDepth: maxLinkDepth ?? POLICY_MAX_LINK_DEPTH, visiting: [table] }
+  });
+}
+function compilePredicateAt({ expression, table, ctx, depth }) {
   const parsed = typeof expression === "string" ? parsePolicy(expression) : expression;
-  const compiler = new PolicyCompiler({ resolver, maxLinkDepth: maxLinkDepth ?? POLICY_MAX_LINK_DEPTH });
-  return compiler.compile(parsed.ast, table, 0);
+  return new PolicyCompiler(ctx).compile(parsed.ast, table, depth);
 }
 function assertClaimsOnlyWhen(parsed) {
   walkPolicy(parsed.ast, (node) => {
@@ -2146,25 +2250,34 @@ function assertClaimsOnlyWhen(parsed) {
         "when-not-claims-only"
       );
     }
-    if (node.kind === "exists") {
+    if (node.kind === "exists" || node.kind === "visible") {
       throw new PolicyCompileError(
-        "variant 'when' guards are claims-only \u2014 exists() is not allowed",
+        `variant 'when' guards are claims-only \u2014 ${node.kind}() is not allowed`,
         "when-not-claims-only"
       );
     }
   });
 }
-function compilePolicy({ expression, table, resolver, maxLinkDepth }) {
-  if (typeof expression === "string") {
-    return compilePredicateV2({ expression, table, resolver, maxLinkDepth });
-  }
-  const defaultPred = compilePredicateV2({ expression: expression.default, table, resolver, maxLinkDepth });
+function initialVisiting({ table, access }) {
+  return (access ?? "read") === "read" ? [table] : [];
+}
+function compilePolicy({ expression, table, resolver, maxLinkDepth, access }) {
+  return compilePolicyAt({
+    expression,
+    table,
+    depth: 0,
+    ctx: { resolver, maxLinkDepth: maxLinkDepth ?? POLICY_MAX_LINK_DEPTH, visiting: initialVisiting({ table, access }) }
+  });
+}
+function compilePolicyAt({ expression, table, ctx, depth }) {
+  if (typeof expression === "string") return compilePredicateAt({ expression, table, ctx, depth });
+  const defaultPred = compilePredicateAt({ expression: expression.default, table, ctx, depth });
   if (expression.variants.length === 0) return defaultPred;
   const branches = expression.variants.map((variant) => {
     const parsedWhen = parsePolicy(variant.when);
     assertClaimsOnlyWhen(parsedWhen);
-    const when = compilePredicateV2({ expression: parsedWhen, table, resolver, maxLinkDepth });
-    const grant = variant.allow === true ? { kind: "const", value: true } : compilePredicateV2({ expression: variant.policy, table, resolver, maxLinkDepth });
+    const when = compilePredicateAt({ expression: parsedWhen, table, ctx, depth });
+    const grant = variant.allow === true ? { kind: "const", value: true } : compilePredicateAt({ expression: variant.policy, table, ctx, depth });
     return { kind: "and", operands: [when, grant] };
   });
   return { kind: "or", operands: [defaultPred, ...branches] };
@@ -2380,12 +2493,6 @@ var PolicyInjector = class {
     if (root.op === "resolvedWrite") return this.injectResolvedWrite(root, returning);
     if (root.op === "insert" || root.op === "insertOne") {
       const insertPolicy = this.insert(table);
-      if (predContainsExists(insertPolicy)) {
-        throw new DocumentCompileError(
-          `table '${table}' cannot be inserted into: v2.0 insert checks are claims + inserted-values only, but its insert policy traverses a link (exists)`,
-          "insert-check-unrepresentable"
-        );
-      }
       const pins = (this.ctx.pins.get(table) ?? []).map(
         (pin) => ({ column: pin.column, value: { kind: "claim", key: pin.claim } })
       );
@@ -2400,22 +2507,14 @@ var PolicyInjector = class {
     const updatePolicy = this.update(table);
     const where = andPred(updatePolicy, root.where ? this.injectDocPred(root.where, table) : void 0);
     if (root.op === "update" || root.op === "updateByPk") {
-      const check = predContainsExists(updatePolicy) && !this.ctx.composed ? {} : { insertCheck: updatePolicy };
-      return { ...root, where, ...check, returning };
+      return { ...root, where, insertCheck: updatePolicy, returning };
     }
     if (root.op === "cowOverride") {
       const insertPolicy = this.insert(table);
-      if (predContainsExists(insertPolicy)) {
-        throw new DocumentCompileError(
-          `table '${table}' cannot be copy-on-write overridden: v2.0 insert checks are claims + inserted-values only, but its insert policy traverses a link (exists)`,
-          "insert-check-unrepresentable"
-        );
-      }
       const pins = (this.ctx.pins.get(table) ?? []).map(
         (pin) => ({ column: pin.column, value: { kind: "claim", key: pin.claim } })
       );
-      const check = predContainsExists(updatePolicy) && !this.ctx.composed ? {} : { insertCheck: updatePolicy };
-      return { ...root, pinnedColumns: pins, cowCopyCheck: insertPolicy, where, ...check, returning };
+      return { ...root, pinnedColumns: pins, cowCopyCheck: insertPolicy, where, insertCheck: updatePolicy, returning };
     }
     return { ...root, where, returning };
   }
@@ -2637,7 +2736,7 @@ function scopePolicy(pred, namespace) {
   switch (pred.kind) {
     case "capability":
     case "role":
-      return { ...pred, namespace };
+      return pred.namespace ? pred : { ...pred, namespace };
     case "and":
     case "or":
       return { ...pred, operands: pred.operands.map((p) => scopePolicy(p, namespace)) };
@@ -2846,7 +2945,14 @@ function buildCompileContext(rawCanonical) {
   const updatePolicies = /* @__PURE__ */ new Map();
   const pins = /* @__PURE__ */ new Map();
   const splitWritePolicyTables = /* @__PURE__ */ new Set();
-  const resolver = { tables };
+  const readPolicyExpressions = new Map(relations.map((relation) => [relation.table, relation.policies.read]));
+  const resolver = {
+    tables,
+    readPolicy: (table) => readPolicyExpressions.get(table),
+    // In a composed namespace, an imported table's read policy (inlined by
+    // visible()) is checked against the namespace that owns it.
+    ...normalized.imports?.length ? { policyNamespace: (table) => owners.get(table)?.namespace } : {}
+  };
   for (const table of relations) {
     const isView = viewNames.has(table.table);
     const compilePolicyFor = (access, store) => {
@@ -2855,7 +2961,7 @@ function buildCompileContext(rawCanonical) {
         return;
       }
       try {
-        const pred = compilePolicy({ expression, table: table.table, resolver });
+        const pred = compilePolicy({ expression, table: table.table, resolver, access });
         store.set(table.table, normalized.imports?.length ? scopePolicy(pred, owners.get(table.table).namespace) : pred);
       } catch (error) {
         if (error instanceof PolicyCompileError || error instanceof PolicyParseError) {