@sequenceholdings/orm 2.4.0 → 2.6.0

package/dist/compiler.d.cts

@@ -6,7 +6,7 @@ export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_M
 import { z } from 'zod';
 export { P as PLATFORM_USER_TYPENAME, c as camelCase, g as enumTypeName, p as pascalCase } from './naming-CU9ThP_E.cjs';
 export { S as SqlOperationDefinition, d as defineOperation, s as sqlOperationDefinitionSchema } from './definition-DjfC7Lll.cjs';
-import './constants-C6EG6Wq7.cjs';
+import './constants-Dou1RkTo.cjs';
 import './policy-1iZbGnZZ.cjs';
 
 type DiagnosticSeverity = 'error' | 'warning';
@@ -318,6 +318,8 @@ interface RestrictedOperation {
     name: string;
     kind: 'query' | 'mutation';
     requires: CompiledOperation['requires'];
+    /** Literal namespace-author ceiling; never taken from execution variables. */
+    readBudget?: number;
     variables: VariableIr[];
     definition: OperationDefinitionNode;
 }
@@ -339,6 +341,7 @@ declare const MAX_LIMIT = 1000;
 declare class OperationLowerer {
     private readonly ctx;
     private readonly variables;
+    private readonly maxRows;
     constructor(ctx: CompileContext, restricted: RestrictedOperation);
     private meta;
     /** A data column — cell-metadata columns are reachable only through `cells { … }`. */
@@ -481,11 +484,34 @@ declare const sqlQueryInputSchema: z.ZodObject<{
 }, z.core.$strict>;
 type SqlQueryInput = z.infer<typeof sqlQueryInputSchema>;
 /** The returned plan contains no bound parameter values or caller identity. */
-declare function compileRuntimeSql({ operation, input }: {
+declare function compileRuntimeSql({ operation, input, qualified }: {
     operation: CompiledOperation;
     input: SqlQueryInput;
+    qualified?: boolean;
 }): Promise<CompiledOperation>;
 
+/** Discover identities from parsed syntax only; the closed compiler validates
+ * every clause before execution. Unqualified names may be CTEs, never objects. */
+declare function referencedSqlObjects({ sql }: {
+    sql: string;
+}): Promise<string[]>;
+
+/** Replace named binds only in SQL code, never strings, identifiers, or comments. */
+declare function bindNamedParameters({ sql, names }: {
+    sql: string;
+    names: string[];
+}): string;
+
+/** Compose SQL metadata by qualified identity. GraphQL's bare-name composition
+ * is deliberately not used across unrelated namespace catalogs. */
+declare function compileBuiltinSqlArtifact({ namespace, definitions, read, unbackedObjects, executionTarget }: {
+    namespace: string;
+    definitions: readonly CanonicalDefinition[];
+    read: readonly string[];
+    unbackedObjects?: readonly string[];
+    executionTarget?: string;
+}): CompiledArtifact;
+
 declare const DATASET_PREVIEW_LIMIT = 100;
 /**
  * Fixed runtime-owned reads, separate from the published operation manifest.
@@ -495,4 +521,14 @@ declare const DATASET_PREVIEW_LIMIT = 100;
  */
 declare function compileDatasetPreviews(input: CanonicalDefinition): Record<string, CompiledOperation>;
 
-export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlQueryInputSchema, typeNameForTable, walkPred };
+/**
+ * PostgreSQL omits pinned builtins from pg_depend, so catalog checks cannot
+ * enforce the function boundary alone. Parse every expression before either
+ * admission or DDL, including nested queries and aggregate/window clauses.
+ * Catalog validation remains responsible for resolved functions/operators.
+ */
+declare function validateManagedViewQueries({ canonical }: {
+    canonical: CanonicalDefinition;
+}): Promise<void>;
+
+export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, bindNamedParameters, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileBuiltinSqlArtifact, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, referencedSqlObjects, restrictOperation, sqlQueryInputSchema, typeNameForTable, validateManagedViewQueries, walkPred };

package/dist/compiler.d.ts

@@ -6,7 +6,7 @@ export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_M
 import { z } from 'zod';
 export { P as PLATFORM_USER_TYPENAME, c as camelCase, g as enumTypeName, p as pascalCase } from './naming-CPfx7EfF.js';
 export { S as SqlOperationDefinition, d as defineOperation, s as sqlOperationDefinitionSchema } from './definition-DjfC7Lll.js';
-import './constants-C6EG6Wq7.js';
+import './constants-Dou1RkTo.js';
 import './policy-1iZbGnZZ.js';
 
 type DiagnosticSeverity = 'error' | 'warning';
@@ -318,6 +318,8 @@ interface RestrictedOperation {
     name: string;
     kind: 'query' | 'mutation';
     requires: CompiledOperation['requires'];
+    /** Literal namespace-author ceiling; never taken from execution variables. */
+    readBudget?: number;
     variables: VariableIr[];
     definition: OperationDefinitionNode;
 }
@@ -339,6 +341,7 @@ declare const MAX_LIMIT = 1000;
 declare class OperationLowerer {
     private readonly ctx;
     private readonly variables;
+    private readonly maxRows;
     constructor(ctx: CompileContext, restricted: RestrictedOperation);
     private meta;
     /** A data column — cell-metadata columns are reachable only through `cells { … }`. */
@@ -481,11 +484,34 @@ declare const sqlQueryInputSchema: z.ZodObject<{
 }, z.core.$strict>;
 type SqlQueryInput = z.infer<typeof sqlQueryInputSchema>;
 /** The returned plan contains no bound parameter values or caller identity. */
-declare function compileRuntimeSql({ operation, input }: {
+declare function compileRuntimeSql({ operation, input, qualified }: {
     operation: CompiledOperation;
     input: SqlQueryInput;
+    qualified?: boolean;
 }): Promise<CompiledOperation>;
 
+/** Discover identities from parsed syntax only; the closed compiler validates
+ * every clause before execution. Unqualified names may be CTEs, never objects. */
+declare function referencedSqlObjects({ sql }: {
+    sql: string;
+}): Promise<string[]>;
+
+/** Replace named binds only in SQL code, never strings, identifiers, or comments. */
+declare function bindNamedParameters({ sql, names }: {
+    sql: string;
+    names: string[];
+}): string;
+
+/** Compose SQL metadata by qualified identity. GraphQL's bare-name composition
+ * is deliberately not used across unrelated namespace catalogs. */
+declare function compileBuiltinSqlArtifact({ namespace, definitions, read, unbackedObjects, executionTarget }: {
+    namespace: string;
+    definitions: readonly CanonicalDefinition[];
+    read: readonly string[];
+    unbackedObjects?: readonly string[];
+    executionTarget?: string;
+}): CompiledArtifact;
+
 declare const DATASET_PREVIEW_LIMIT = 100;
 /**
  * Fixed runtime-owned reads, separate from the published operation manifest.
@@ -495,4 +521,14 @@ declare const DATASET_PREVIEW_LIMIT = 100;
  */
 declare function compileDatasetPreviews(input: CanonicalDefinition): Record<string, CompiledOperation>;
 
-export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlQueryInputSchema, typeNameForTable, walkPred };
+/**
+ * PostgreSQL omits pinned builtins from pg_depend, so catalog checks cannot
+ * enforce the function boundary alone. Parse every expression before either
+ * admission or DDL, including nested queries and aggregate/window clauses.
+ * Catalog validation remains responsible for resolved functions/operators.
+ */
+declare function validateManagedViewQueries({ canonical }: {
+    canonical: CanonicalDefinition;
+}): Promise<void>;
+
+export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, bindNamedParameters, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileBuiltinSqlArtifact, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, referencedSqlObjects, restrictOperation, sqlQueryInputSchema, typeNameForTable, validateManagedViewQueries, walkPred };