@sequenceholdings/orm 2.3.0 → 2.5.0

package/dist/compiler.d.cts

@@ -2,11 +2,11 @@ import { CanonicalEnum, CanonicalDefinition } from './canonical.cjs';
 import { ClaimKey, PredIr, RootIr, InputRefKind, TableMetaIr, CompiledOperation, CompiledArtifact, VariableIr, OrderIr, SelectionIr } from './ir.cjs';
 import { DocumentNode, OperationDefinitionNode, FragmentDefinitionNode, GraphQLSchema, ValueNode, SelectionSetNode } from 'graphql';
 export { DynamicInputIssue, DynamicInputResult, NormalizedBoolExp, NormalizedOnConflict, NormalizedOrderBy, NormalizedRow, ORDER_BY_DIRECTIONS, ScalarKind, allowedBoolExpOperators, allowedOps, validateAppendInput, validateBoolExpInput, validateInsertInput, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput } from './dynamic-input.cjs';
-export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, ParsedPolicy, PolicyColumnInfo, PolicyCompareOp, PolicyCompileError, PolicyCompileErrorCode, PolicyLinkInfo, PolicyNode, PolicyOperand, PolicyParseError, PolicyResolver, PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy } from './predicate-v2.cjs';
+export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, ParsedPolicy, PolicyAccess, PolicyColumnInfo, PolicyCompareOp, PolicyCompileError, PolicyCompileErrorCode, PolicyLinkInfo, PolicyNode, PolicyOperand, PolicyParseError, PolicyResolver, PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy } from './predicate-v2.cjs';
 import { z } from 'zod';
 export { P as PLATFORM_USER_TYPENAME, c as camelCase, g as enumTypeName, p as pascalCase } from './naming-CU9ThP_E.cjs';
-export { S as SqlOperationDefinition, d as defineOperation, s as sqlOperationDefinitionSchema } from './definition-DjfC7Lll.cjs';
-import './constants-C6EG6Wq7.cjs';
+export { S as SqlOperationDefinition, d as defineOperation, s as sqlOperationDefinitionSchema } from './definition-B99BsOAO.cjs';
+import './constants-Dou1RkTo.cjs';
 import './policy-1iZbGnZZ.cjs';
 
 type DiagnosticSeverity = 'error' | 'warning';
@@ -50,9 +50,11 @@ declare class NamespaceCompileError extends Error {
  *  - document-authored relationship predicates (exists/aggPredicate) get the
  *    TARGET table's read policy injected too, so filtering through a link
  *    can't become an existence oracle on rows the caller can't read;
- *  - write policy AND-ed into update/delete row filters, and set as the
- *    insert check for inserts (claims + inserted-values only in v2.0 — an
- *    exists() write policy makes a table un-insertable, loudly);
+ *  - write policy AND-ed into update/delete row filters, set as the insert
+ *    check for inserts, and re-checked against the NEW rows of every update.
+ *    Link-traversing (exists/visible) write policies are evaluated by the data
+ *    plane against the proposed rows in the same statement, so "only on a
+ *    parent the caller can see" holds for inserts and FK-changing updates;
  *  - `col = claim(k)` AND-conjuncts of the write policy become pinned columns
  *    merged into every inserted row (and excluded from insertable/settable).
  */
@@ -316,6 +318,8 @@ interface RestrictedOperation {
     name: string;
     kind: 'query' | 'mutation';
     requires: CompiledOperation['requires'];
+    /** Literal namespace-author ceiling; never taken from execution variables. */
+    readBudget?: number;
     variables: VariableIr[];
     definition: OperationDefinitionNode;
 }
@@ -337,6 +341,7 @@ declare const MAX_LIMIT = 1000;
 declare class OperationLowerer {
     private readonly ctx;
     private readonly variables;
+    private readonly maxRows;
     constructor(ctx: CompileContext, restricted: RestrictedOperation);
     private meta;
     /** A data column — cell-metadata columns are reachable only through `cells { … }`. */
@@ -493,4 +498,14 @@ declare const DATASET_PREVIEW_LIMIT = 100;
  */
 declare function compileDatasetPreviews(input: CanonicalDefinition): Record<string, CompiledOperation>;
 
-export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlQueryInputSchema, typeNameForTable, walkPred };
+/**
+ * PostgreSQL omits pinned builtins from pg_depend, so catalog checks cannot
+ * enforce the function boundary alone. Parse every expression before either
+ * admission or DDL, including nested queries and aggregate/window clauses.
+ * Catalog validation remains responsible for resolved functions/operators.
+ */
+declare function validateManagedViewQueries({ canonical }: {
+    canonical: CanonicalDefinition;
+}): Promise<void>;
+
+export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlQueryInputSchema, typeNameForTable, validateManagedViewQueries, walkPred };

package/dist/compiler.d.ts

@@ -2,11 +2,11 @@ import { CanonicalEnum, CanonicalDefinition } from './canonical.js';
 import { ClaimKey, PredIr, RootIr, InputRefKind, TableMetaIr, CompiledOperation, CompiledArtifact, VariableIr, OrderIr, SelectionIr } from './ir.js';
 import { DocumentNode, OperationDefinitionNode, FragmentDefinitionNode, GraphQLSchema, ValueNode, SelectionSetNode } from 'graphql';
 export { DynamicInputIssue, DynamicInputResult, NormalizedBoolExp, NormalizedOnConflict, NormalizedOrderBy, NormalizedRow, ORDER_BY_DIRECTIONS, ScalarKind, allowedBoolExpOperators, allowedOps, validateAppendInput, validateBoolExpInput, validateInsertInput, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput } from './dynamic-input.js';
-export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, ParsedPolicy, PolicyColumnInfo, PolicyCompareOp, PolicyCompileError, PolicyCompileErrorCode, PolicyLinkInfo, PolicyNode, PolicyOperand, PolicyParseError, PolicyResolver, PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy } from './predicate-v2.js';
+export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, ParsedPolicy, PolicyAccess, PolicyColumnInfo, PolicyCompareOp, PolicyCompileError, PolicyCompileErrorCode, PolicyLinkInfo, PolicyNode, PolicyOperand, PolicyParseError, PolicyResolver, PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy } from './predicate-v2.js';
 import { z } from 'zod';
 export { P as PLATFORM_USER_TYPENAME, c as camelCase, g as enumTypeName, p as pascalCase } from './naming-CPfx7EfF.js';
-export { S as SqlOperationDefinition, d as defineOperation, s as sqlOperationDefinitionSchema } from './definition-DjfC7Lll.js';
-import './constants-C6EG6Wq7.js';
+export { S as SqlOperationDefinition, d as defineOperation, s as sqlOperationDefinitionSchema } from './definition-B99BsOAO.js';
+import './constants-Dou1RkTo.js';
 import './policy-1iZbGnZZ.js';
 
 type DiagnosticSeverity = 'error' | 'warning';
@@ -50,9 +50,11 @@ declare class NamespaceCompileError extends Error {
  *  - document-authored relationship predicates (exists/aggPredicate) get the
  *    TARGET table's read policy injected too, so filtering through a link
  *    can't become an existence oracle on rows the caller can't read;
- *  - write policy AND-ed into update/delete row filters, and set as the
- *    insert check for inserts (claims + inserted-values only in v2.0 — an
- *    exists() write policy makes a table un-insertable, loudly);
+ *  - write policy AND-ed into update/delete row filters, set as the insert
+ *    check for inserts, and re-checked against the NEW rows of every update.
+ *    Link-traversing (exists/visible) write policies are evaluated by the data
+ *    plane against the proposed rows in the same statement, so "only on a
+ *    parent the caller can see" holds for inserts and FK-changing updates;
  *  - `col = claim(k)` AND-conjuncts of the write policy become pinned columns
  *    merged into every inserted row (and excluded from insertable/settable).
  */
@@ -316,6 +318,8 @@ interface RestrictedOperation {
     name: string;
     kind: 'query' | 'mutation';
     requires: CompiledOperation['requires'];
+    /** Literal namespace-author ceiling; never taken from execution variables. */
+    readBudget?: number;
     variables: VariableIr[];
     definition: OperationDefinitionNode;
 }
@@ -337,6 +341,7 @@ declare const MAX_LIMIT = 1000;
 declare class OperationLowerer {
     private readonly ctx;
     private readonly variables;
+    private readonly maxRows;
     constructor(ctx: CompileContext, restricted: RestrictedOperation);
     private meta;
     /** A data column — cell-metadata columns are reachable only through `cells { … }`. */
@@ -493,4 +498,14 @@ declare const DATASET_PREVIEW_LIMIT = 100;
  */
 declare function compileDatasetPreviews(input: CanonicalDefinition): Record<string, CompiledOperation>;
 
-export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlQueryInputSchema, typeNameForTable, walkPred };
+/**
+ * PostgreSQL omits pinned builtins from pg_depend, so catalog checks cannot
+ * enforce the function boundary alone. Parse every expression before either
+ * admission or DDL, including nested queries and aggregate/window clauses.
+ * Catalog validation remains responsible for resolved functions/operators.
+ */
+declare function validateManagedViewQueries({ canonical }: {
+    canonical: CanonicalDefinition;
+}): Promise<void>;
+
+export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlQueryInputSchema, typeNameForTable, validateManagedViewQueries, walkPred };