@sequenceholdings/orm 2.3.0 → 2.5.0

package/dist/predicate-v2.d.cts

@@ -1,7 +1,7 @@
 import { ClaimKey, PredIr } from './ir.cjs';
 import { P as PolicyExpression } from './policy-1iZbGnZZ.cjs';
 import 'zod';
-import './constants-C6EG6Wq7.cjs';
+import './constants-Dou1RkTo.cjs';
 
 declare const POLICY_COMPARE_OPS: readonly ["=", "!=", "<", "<=", ">", ">="];
 type PolicyCompareOp = (typeof POLICY_COMPARE_OPS)[number];
@@ -50,6 +50,16 @@ type PolicyNode = {
     kind: 'exists';
     path: readonly string[];
     where: PolicyNode;
+}
+/**
+ * `visible(<link-path>)` — a related row exists AND the caller may read it:
+ * the final target's own read policy is compiled in as the inner predicate.
+ * Lets a write policy say "only on a parent you can see" without restating
+ * the parent's rule (and without drifting from it).
+ */
+ | {
+    kind: 'visible';
+    path: readonly string[];
 };
 interface ParsedPolicy {
     readonly source: string;
@@ -63,7 +73,7 @@ declare class PolicyParseError extends Error {
     readonly name = "PolicyParseError";
     constructor(message: string, position: number);
 }
-type PolicyCompileErrorCode = 'unknown-table' | 'unknown-column' | 'unknown-link' | 'not-to-one' | 'link-depth-exceeded' | 'unsupported-comparison' | 'invalid-null-comparison' | 'when-not-claims-only' | 'claim-type-mismatch';
+type PolicyCompileErrorCode = 'unknown-table' | 'unknown-column' | 'unknown-link' | 'not-to-one' | 'link-depth-exceeded' | 'unsupported-comparison' | 'invalid-null-comparison' | 'when-not-claims-only' | 'claim-type-mismatch' | 'visible-unresolvable' | 'visible-cycle';
 /**
  * Compile-time failure — the parsed policy references something the table
  * doesn't declare, or uses a shape the v2.0 IR cannot represent. Carries
@@ -96,6 +106,11 @@ declare function parsePolicy(source: string): ParsedPolicy;
  *  - variant `when` guards are claims-only: capability()/role() under
  *    and/or/not. (claim() comparisons in `when` are not representable in the
  *    v2.0 IR — a targeted error says so.)
+ *  - `visible(<link-path>)` lowers to `exists(<link-path>, <target read policy>)`,
+ *    compiled from the target's own read policy expression at the combined
+ *    depth. A read policy that reaches itself again through visible() is a
+ *    cycle and refused; a target with no read policy is readable to everyone
+ *    who may use the namespace, so visibility reduces to existence.
  */
 
 declare const POLICY_MAX_LINK_DEPTH = 3;
@@ -120,6 +135,19 @@ interface PolicyTableInfo {
 /** `{ tables }` keyed by table name — TableMetaIr's record is assignable. */
 interface PolicyResolver {
     readonly tables: Record<string, PolicyTableInfo>;
+    /**
+     * A table's read policy expression, for `visible()`. Return `undefined` when
+     * the table has none (readable to every namespace user). A resolver without
+     * this callback cannot compile `visible()`: it is refused, never guessed.
+     */
+    readonly readPolicy?: (table: string) => PolicyExpression | undefined;
+    /**
+     * The namespace that owns a table's policies, in a composed namespace. A
+     * visible() expansion of an imported table's read policy evaluates its
+     * capability() and role() checks in that namespace, not the importer's.
+     * Omitted (or undefined for a table) leaves them unscoped.
+     */
+    readonly policyNamespace?: (table: string) => string | undefined;
 }
 interface CompilePredicateInput {
     /** DSL source text, or an already-parsed policy. */
@@ -131,11 +159,20 @@ interface CompilePredicateInput {
 declare function compilePredicateV2({ expression, table, resolver, maxLinkDepth }: CompilePredicateInput): PredIr;
 /** Variant `when` guards may only test claims: capability()/role() under and/or/not. */
 declare function assertClaimsOnlyWhen(parsed: ParsedPolicy): void;
+/** Which of a table's policies is being compiled. */
+type PolicyAccess = 'read' | 'write' | 'insert' | 'update';
 interface CompilePolicyInput {
     expression: PolicyExpression;
     table: string;
     resolver: PolicyResolver;
     maxLinkDepth?: number;
+    /**
+     * Default 'read'. A read policy that reaches its own table through visible()
+     * is a cycle; a write policy that follows a self-link (a subtask written
+     * under a parent the caller can read) only expands the read policy, so it
+     * does not start the cycle check at its own table.
+     */
+    access?: PolicyAccess;
 }
 /**
  * Policy expression (string or `{default, variants}`) → one PredIr under §4c
@@ -146,6 +183,6 @@ interface CompilePolicyInput {
  * Granting a role/capability only ever widens access; `allow: true`
  * short-circuits its branch to the guard alone.
  */
-declare function compilePolicy({ expression, table, resolver, maxLinkDepth }: CompilePolicyInput): PredIr;
+declare function compilePolicy({ expression, table, resolver, maxLinkDepth, access }: CompilePolicyInput): PredIr;
 
-export { type CompilePolicyInput, type CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, type ParsedPolicy, type PolicyColumnInfo, type PolicyCompareOp, PolicyCompileError, type PolicyCompileErrorCode, type PolicyLinkInfo, type PolicyNode, type PolicyOperand, PolicyParseError, type PolicyResolver, type PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy };
+export { type CompilePolicyInput, type CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, type ParsedPolicy, type PolicyAccess, type PolicyColumnInfo, type PolicyCompareOp, PolicyCompileError, type PolicyCompileErrorCode, type PolicyLinkInfo, type PolicyNode, type PolicyOperand, PolicyParseError, type PolicyResolver, type PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy };

package/dist/predicate-v2.d.ts

@@ -1,7 +1,7 @@
 import { ClaimKey, PredIr } from './ir.js';
 import { P as PolicyExpression } from './policy-1iZbGnZZ.js';
 import 'zod';
-import './constants-C6EG6Wq7.js';
+import './constants-Dou1RkTo.js';
 
 declare const POLICY_COMPARE_OPS: readonly ["=", "!=", "<", "<=", ">", ">="];
 type PolicyCompareOp = (typeof POLICY_COMPARE_OPS)[number];
@@ -50,6 +50,16 @@ type PolicyNode = {
     kind: 'exists';
     path: readonly string[];
     where: PolicyNode;
+}
+/**
+ * `visible(<link-path>)` — a related row exists AND the caller may read it:
+ * the final target's own read policy is compiled in as the inner predicate.
+ * Lets a write policy say "only on a parent you can see" without restating
+ * the parent's rule (and without drifting from it).
+ */
+ | {
+    kind: 'visible';
+    path: readonly string[];
 };
 interface ParsedPolicy {
     readonly source: string;
@@ -63,7 +73,7 @@ declare class PolicyParseError extends Error {
     readonly name = "PolicyParseError";
     constructor(message: string, position: number);
 }
-type PolicyCompileErrorCode = 'unknown-table' | 'unknown-column' | 'unknown-link' | 'not-to-one' | 'link-depth-exceeded' | 'unsupported-comparison' | 'invalid-null-comparison' | 'when-not-claims-only' | 'claim-type-mismatch';
+type PolicyCompileErrorCode = 'unknown-table' | 'unknown-column' | 'unknown-link' | 'not-to-one' | 'link-depth-exceeded' | 'unsupported-comparison' | 'invalid-null-comparison' | 'when-not-claims-only' | 'claim-type-mismatch' | 'visible-unresolvable' | 'visible-cycle';
 /**
  * Compile-time failure — the parsed policy references something the table
  * doesn't declare, or uses a shape the v2.0 IR cannot represent. Carries
@@ -96,6 +106,11 @@ declare function parsePolicy(source: string): ParsedPolicy;
  *  - variant `when` guards are claims-only: capability()/role() under
  *    and/or/not. (claim() comparisons in `when` are not representable in the
  *    v2.0 IR — a targeted error says so.)
+ *  - `visible(<link-path>)` lowers to `exists(<link-path>, <target read policy>)`,
+ *    compiled from the target's own read policy expression at the combined
+ *    depth. A read policy that reaches itself again through visible() is a
+ *    cycle and refused; a target with no read policy is readable to everyone
+ *    who may use the namespace, so visibility reduces to existence.
  */
 
 declare const POLICY_MAX_LINK_DEPTH = 3;
@@ -120,6 +135,19 @@ interface PolicyTableInfo {
 /** `{ tables }` keyed by table name — TableMetaIr's record is assignable. */
 interface PolicyResolver {
     readonly tables: Record<string, PolicyTableInfo>;
+    /**
+     * A table's read policy expression, for `visible()`. Return `undefined` when
+     * the table has none (readable to every namespace user). A resolver without
+     * this callback cannot compile `visible()`: it is refused, never guessed.
+     */
+    readonly readPolicy?: (table: string) => PolicyExpression | undefined;
+    /**
+     * The namespace that owns a table's policies, in a composed namespace. A
+     * visible() expansion of an imported table's read policy evaluates its
+     * capability() and role() checks in that namespace, not the importer's.
+     * Omitted (or undefined for a table) leaves them unscoped.
+     */
+    readonly policyNamespace?: (table: string) => string | undefined;
 }
 interface CompilePredicateInput {
     /** DSL source text, or an already-parsed policy. */
@@ -131,11 +159,20 @@ interface CompilePredicateInput {
 declare function compilePredicateV2({ expression, table, resolver, maxLinkDepth }: CompilePredicateInput): PredIr;
 /** Variant `when` guards may only test claims: capability()/role() under and/or/not. */
 declare function assertClaimsOnlyWhen(parsed: ParsedPolicy): void;
+/** Which of a table's policies is being compiled. */
+type PolicyAccess = 'read' | 'write' | 'insert' | 'update';
 interface CompilePolicyInput {
     expression: PolicyExpression;
     table: string;
     resolver: PolicyResolver;
     maxLinkDepth?: number;
+    /**
+     * Default 'read'. A read policy that reaches its own table through visible()
+     * is a cycle; a write policy that follows a self-link (a subtask written
+     * under a parent the caller can read) only expands the read policy, so it
+     * does not start the cycle check at its own table.
+     */
+    access?: PolicyAccess;
 }
 /**
  * Policy expression (string or `{default, variants}`) → one PredIr under §4c
@@ -146,6 +183,6 @@ interface CompilePolicyInput {
  * Granting a role/capability only ever widens access; `allow: true`
  * short-circuits its branch to the guard alone.
  */
-declare function compilePolicy({ expression, table, resolver, maxLinkDepth }: CompilePolicyInput): PredIr;
+declare function compilePolicy({ expression, table, resolver, maxLinkDepth, access }: CompilePolicyInput): PredIr;
 
-export { type CompilePolicyInput, type CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, type ParsedPolicy, type PolicyColumnInfo, type PolicyCompareOp, PolicyCompileError, type PolicyCompileErrorCode, type PolicyLinkInfo, type PolicyNode, type PolicyOperand, PolicyParseError, type PolicyResolver, type PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy };
+export { type CompilePolicyInput, type CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, type ParsedPolicy, type PolicyAccess, type PolicyColumnInfo, type PolicyCompareOp, PolicyCompileError, type PolicyCompileErrorCode, type PolicyLinkInfo, type PolicyNode, type PolicyOperand, PolicyParseError, type PolicyResolver, type PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy };

package/dist/predicate-v2.js

@@ -29,9 +29,11 @@ var PolicyCompileError = class extends Error {
 };
 
 // src/constants.ts
+var NAMESPACE_PATTERN = /^(?!(?:events|native_sources)$)[a-z][a-z0-9_]{0,40}$/;
 var COLUMN_IDENTIFIER_PATTERN = /^_?[a-z][a-z0-9_]*$/;
 var MAX_IDENTIFIER_LENGTH = 63;
 var CAPABILITY_KEY_PATTERN = /^(?:org\/|app\/[a-z][a-z0-9-]{0,63}\/)?[a-z0-9-]{1,64}$/;
+var MAX_PERSISTED_READ_ROWS = 50001;
 var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]{0,62}\.[a-z][a-z0-9_]{0,62}$/;
 var CELL_PARTS = ["at", "by", "rev", "source", "conflicts"];
 var CELL_PART_SUFFIX = {
@@ -381,6 +383,7 @@ function validateResolvedView({ view, tables, views = [] }) {
 function validateSource({ scope, source, table }) {
   const { fail } = scope;
   if (source.kind === "etl" && table.source === void 0) fail(`etl source '${source.name}' must reference a synced table`);
+  if (source.kind === "etl" && table.primaryKey?.length === 0) fail(`etl source '${source.name}' cannot use an unkeyed synced table for resolved row identity`);
   if (source.kind !== "etl" && (table.internal !== true || table.cellMetadata !== true)) {
     fail(`${source.kind} source '${source.name}' must reference an internal table with cell metadata`);
   }
@@ -672,7 +675,7 @@ var canonicalTableSchema = z.object({
   /** Synced/reflected read-only tables (`source: schema.table`) — v1 semantics. */
   source: z.string().regex(QUALIFIED_TABLE_PATTERN).optional(),
   columns: z.array(canonicalColumnSchema).default([]),
-  primaryKey: z.array(columnIdentifier).min(1).max(8).optional(),
+  primaryKey: z.array(columnIdentifier).max(8).optional(),
   links: z.array(canonicalLinkSchema).default([]),
   indexes: z.array(canonicalIndexSchema).default([]),
   /** Omitted by old definitions, preserving their existing content hashes. */
@@ -708,6 +711,29 @@ var canonicalTableSchema = z.object({
    * data plane. Omitted otherwise.
    */
   materializes: identifier2.optional()
+}).superRefine((table, ctx) => {
+  if (table.primaryKey?.length !== 0) return;
+  const fail = (message, path = ["primaryKey"]) => ctx.addIssue({ code: "custom", path, message: `unkeyed table '${table.table}' ${message}` });
+  if (table.source === void 0 || table.columns.length === 0) {
+    fail("requires a typed synced source");
+  }
+  if ([table.policies.write, table.policies.insert, table.policies.update].some((policy) => policy !== void 0)) {
+    fail("is read-only and cannot declare write policies", ["policies"]);
+  }
+  const ownedCollections = [table.indexes, table.actions, table.checks, table.foreignKeys, table.cowMutations];
+  const ownedMetadata = [table.cellMetadata, table.internal, table.materializes, table.renamedFrom];
+  if (ownedCollections.some((items) => items !== void 0 && items.length > 0) || ownedMetadata.some((value) => value !== void 0)) {
+    fail("cannot declare owned storage, constraints or identity operations");
+  }
+  for (const [index, column] of table.columns.entries()) {
+    const ownedColumnMetadata = [column.default, column.defaultFn, column.onUpdateFn, column.renamedFrom, column.cast, column.cell];
+    if (column.unique || ownedColumnMetadata.some((value) => value !== void 0)) {
+      fail("cannot declare column uniqueness, mutation defaults or migration metadata", ["columns", index]);
+    }
+  }
+  for (const [index, link] of table.links.entries()) {
+    if (link.enforce || link.kind === "toMany") fail("cannot provide an identity for this link", ["links", index]);
+  }
 });
 var MAX_VIEW_QUERY = 1e5;
 var MAX_RESOLVED_VIEW_QUERY = 5e6;
@@ -764,6 +790,26 @@ var canonicalViewSchema = z.object({
     }
   }
 });
+function validateUnkeyedLinkIdentities({ definition, ctx }) {
+  const tables = new Map(definition.tables.map((table) => [table.table, table]));
+  const relations = [
+    ...definition.tables.map((table, index) => ({ kind: "tables", index, links: table.links })),
+    ...(definition.views ?? []).map((view, index) => ({ kind: "views", index, links: view.links }))
+  ];
+  for (const relation of relations) {
+    for (const [linkIndex, link] of relation.links.entries()) {
+      if (link.kind !== "toOne" || link.namespace !== void 0 && link.namespace !== definition.namespace) continue;
+      const target = link.target === void 0 ? void 0 : tables.get(link.target);
+      if (target?.source !== void 0 && target.primaryKey?.length === 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: [relation.kind, relation.index, "links", linkIndex],
+          message: `link '${link.name}' cannot use unkeyed table '${target.table}' as a to-one identity`
+        });
+      }
+    }
+  }
+}
 var CELL_PART_TYPES = {
   at: "timestamptz",
   by: "text",
@@ -827,7 +873,7 @@ var exportGateSchema = z.union([z.literal(true), z.object({ capability: z.string
 var relationExportSchema = z.object({ read: exportGateSchema, write: exportGateSchema.optional() }).strict();
 var localDefinitionSchema = z.object({
   definition_format: z.literal(CANONICAL_FORMAT),
-  namespace: identifier2.max(41),
+  namespace: identifier2.max(41).regex(NAMESPACE_PATTERN, "invalid or reserved ORM namespace"),
   description: z.string().max(2e3).optional(),
   enums: z.array(canonicalEnumSchema).default([]),
   tables: z.array(canonicalTableSchema).min(0).max(500),
@@ -861,6 +907,7 @@ var localDefinitionSchema = z.object({
     }
   }
   const fkTables = new Map(definition.tables.map((table) => [table.table, table]));
+  validateUnkeyedLinkIdentities({ definition, ctx });
   const relations = /* @__PURE__ */ new Set([...fkTables.keys(), ...(definition.views ?? []).map((view) => view.view)]);
   for (const name of Object.keys(definition.exports ?? {})) {
     if (!relations.has(name)) ctx.addIssue({ code: "custom", path: ["exports", name], message: `export '${name}' is not a local object` });
@@ -1124,7 +1171,7 @@ var limitIrSchema = z.object({
   variable: z.string().optional(),
   value: z.number().int().positive().optional(),
   default: z.number().int().positive(),
-  max: z.number().int().positive()
+  max: z.number().int().positive().max(MAX_PERSISTED_READ_ROWS)
 });
 var selectionIrSchema = z.lazy(
   () => z.object({
@@ -1640,6 +1687,7 @@ var Parser2 = class {
       return node;
     }
     if (this.peekKeyword("exists")) return this.parseExists();
+    if (this.peekKeyword("visible") && this.tokens[this.index + 1]?.kind === "lparen") return this.parseVisible();
     return this.parseComparison();
   }
   parseBooleanCall(fn) {
@@ -1659,6 +1707,13 @@ var Parser2 = class {
     this.expect("rparen", "')' closing exists(...)");
     return { kind: "exists", path, where };
   }
+  parseVisible() {
+    this.advance();
+    this.expect("lparen", "'(' after visible");
+    const path = this.parsePath("a link path in visible(...)");
+    this.expect("rparen", "')' closing visible(...)");
+    return { kind: "visible", path };
+  }
   parseComparison() {
     const left = this.parseOperand();
     const operator = this.expect("operator", "a comparison operator");
@@ -1774,6 +1829,24 @@ function parsePolicy(source) {
 
 // src/predicate-v2/compile.ts
 var POLICY_MAX_LINK_DEPTH = 3;
+function scopeToNamespace(pred, namespace) {
+  switch (pred.kind) {
+    case "capability":
+    case "role":
+      return pred.namespace ? pred : { ...pred, namespace };
+    case "and":
+    case "or":
+      return { ...pred, operands: pred.operands.map((operand) => scopeToNamespace(operand, namespace)) };
+    case "not":
+      return { ...pred, operand: scopeToNamespace(pred.operand, namespace) };
+    case "exists":
+      return { ...pred, where: scopeToNamespace(pred.where, namespace) };
+    case "aggPredicate":
+      return pred.where ? { ...pred, where: scopeToNamespace(pred.where, namespace) } : pred;
+    default:
+      return pred;
+  }
+}
 var CMP_BY_OP = {
   "=": "eq",
   "!=": "neq",
@@ -1807,7 +1880,7 @@ function resolveLink(info, ref) {
 function columnCandidates(info) {
   return [...info.columns.map((c) => c.name), ...info.links.map((l) => l.name)];
 }
-var PolicyCompiler = class {
+var PolicyCompiler = class _PolicyCompiler {
   constructor(ctx) {
     this.ctx = ctx;
   }
@@ -1820,13 +1893,15 @@ var PolicyCompiler = class {
         return { kind: node.kind, operands: node.operands.map((operand) => this.compile(operand, table, depth)) };
       case "not":
         assertNoNegatedExternalClaim(node.operand);
-        return { kind: "not", operand: this.compile(node.operand, table, depth) };
+        return { kind: "not", operand: new _PolicyCompiler({ ...this.ctx, negated: true }).compile(node.operand, table, depth) };
       case "capability":
         return { kind: "capability", key: node.key };
       case "role":
         return { kind: "role", key: node.key };
       case "exists":
         return this.compileExists(node.path, node.where, table, depth);
+      case "visible":
+        return this.compileVisible(node.path, table, depth);
       case "compare":
         return this.compileCompare(node, table, depth);
     }
@@ -1840,6 +1915,36 @@ var PolicyCompiler = class {
     }
     return pred;
   }
+  /** `visible(path)` → `exists(path, <final target's read policy>)`. */
+  compileVisible(path, table, depth) {
+    const { links, finalTable } = this.resolveLinkPath(path, table, depth, { toOneOnly: false });
+    const readPolicy = this.ctx.resolver.readPolicy;
+    if (!readPolicy) {
+      throw new PolicyCompileError(
+        `visible(${path.join(".")}) needs the target's read policy, which this compile context does not provide`,
+        "visible-unresolvable"
+      );
+    }
+    if (this.ctx.visiting.includes(finalTable)) {
+      throw new PolicyCompileError(
+        `visible(${path.join(".")}) on '${table}' reaches '${finalTable}' whose read policy is already being expanded (${[...this.ctx.visiting, finalTable].join(" \u2192 ")})`,
+        "visible-cycle"
+      );
+    }
+    const expression = readPolicy(finalTable);
+    let pred = expression === void 0 ? { kind: "const", value: true } : compilePolicyAt({
+      expression,
+      table: finalTable,
+      ctx: { ...this.ctx, visiting: [...this.ctx.visiting, finalTable] },
+      depth: depth + links.length
+    });
+    const owner = this.ctx.resolver.policyNamespace?.(finalTable);
+    if (owner) pred = scopeToNamespace(pred, owner);
+    for (let i = links.length - 1; i >= 0; i -= 1) {
+      pred = { kind: "exists", link: links[i].name, where: pred };
+    }
+    return pred;
+  }
   resolveLinkPath(path, table, depth, { toOneOnly }) {
     const links = [];
     let current = table;
@@ -1900,6 +2005,7 @@ var PolicyCompiler = class {
       );
     }
     if (valueSide.kind === "claim" && isExternalPolicyClaimKey(valueSide.key)) {
+      if (this.ctx.negated) throw negatedExternalClaim(valueSide.key);
       assertExternalClaimComparison({ op, key: valueSide.key, column: info.columns.find((c) => c.name === column) });
     }
     let cmp = this.buildCmp(op, column, valueSide);
@@ -1937,22 +2043,30 @@ function assertExternalClaimComparison({ op, key, column }) {
     );
   }
 }
+function negatedExternalClaim(key) {
+  return new PolicyCompileError(
+    `claim('${key}') cannot appear under not(): a negated borrower comparison admits other borrowers' rows`,
+    "unsupported-comparison"
+  );
+}
 function assertNoNegatedExternalClaim(operand) {
   walkPolicy(operand, (node) => {
     if (node.kind !== "compare") return;
     const claim = [node.left, node.right].find((side) => side.kind === "claim" && isExternalPolicyClaimKey(side.key));
-    if (claim?.kind === "claim") {
-      throw new PolicyCompileError(
-        `claim('${claim.key}') cannot appear under not(): a negated borrower comparison admits other borrowers' rows`,
-        "unsupported-comparison"
-      );
-    }
+    if (claim?.kind === "claim") throw negatedExternalClaim(claim.key);
   });
 }
 function compilePredicateV2({ expression, table, resolver, maxLinkDepth }) {
+  return compilePredicateAt({
+    expression,
+    table,
+    depth: 0,
+    ctx: { resolver, maxLinkDepth: maxLinkDepth ?? POLICY_MAX_LINK_DEPTH, visiting: [table] }
+  });
+}
+function compilePredicateAt({ expression, table, ctx, depth }) {
   const parsed = typeof expression === "string" ? parsePolicy(expression) : expression;
-  const compiler = new PolicyCompiler({ resolver, maxLinkDepth: maxLinkDepth ?? POLICY_MAX_LINK_DEPTH });
-  return compiler.compile(parsed.ast, table, 0);
+  return new PolicyCompiler(ctx).compile(parsed.ast, table, depth);
 }
 function assertClaimsOnlyWhen(parsed) {
   walkPolicy(parsed.ast, (node) => {
@@ -1969,25 +2083,34 @@ function assertClaimsOnlyWhen(parsed) {
         "when-not-claims-only"
       );
     }
-    if (node.kind === "exists") {
+    if (node.kind === "exists" || node.kind === "visible") {
       throw new PolicyCompileError(
-        "variant 'when' guards are claims-only \u2014 exists() is not allowed",
+        `variant 'when' guards are claims-only \u2014 ${node.kind}() is not allowed`,
         "when-not-claims-only"
       );
     }
   });
 }
-function compilePolicy({ expression, table, resolver, maxLinkDepth }) {
-  if (typeof expression === "string") {
-    return compilePredicateV2({ expression, table, resolver, maxLinkDepth });
-  }
-  const defaultPred = compilePredicateV2({ expression: expression.default, table, resolver, maxLinkDepth });
+function initialVisiting({ table, access }) {
+  return (access ?? "read") === "read" ? [table] : [];
+}
+function compilePolicy({ expression, table, resolver, maxLinkDepth, access }) {
+  return compilePolicyAt({
+    expression,
+    table,
+    depth: 0,
+    ctx: { resolver, maxLinkDepth: maxLinkDepth ?? POLICY_MAX_LINK_DEPTH, visiting: initialVisiting({ table, access }) }
+  });
+}
+function compilePolicyAt({ expression, table, ctx, depth }) {
+  if (typeof expression === "string") return compilePredicateAt({ expression, table, ctx, depth });
+  const defaultPred = compilePredicateAt({ expression: expression.default, table, ctx, depth });
   if (expression.variants.length === 0) return defaultPred;
   const branches = expression.variants.map((variant) => {
     const parsedWhen = parsePolicy(variant.when);
     assertClaimsOnlyWhen(parsedWhen);
-    const when = compilePredicateV2({ expression: parsedWhen, table, resolver, maxLinkDepth });
-    const grant = variant.allow === true ? { kind: "const", value: true } : compilePredicateV2({ expression: variant.policy, table, resolver, maxLinkDepth });
+    const when = compilePredicateAt({ expression: parsedWhen, table, ctx, depth });
+    const grant = variant.allow === true ? { kind: "const", value: true } : compilePredicateAt({ expression: variant.policy, table, ctx, depth });
     return { kind: "and", operands: [when, grant] };
   });
   return { kind: "or", operands: [defaultPred, ...branches] };