@sequenceholdings/orm 2.5.0 → 2.6.1

package/dist/compiler.d.cts

@@ -484,11 +484,34 @@ declare const sqlQueryInputSchema: z.ZodObject<{
 }, z.core.$strict>;
 type SqlQueryInput = z.infer<typeof sqlQueryInputSchema>;
 /** The returned plan contains no bound parameter values or caller identity. */
-declare function compileRuntimeSql({ operation, input }: {
+declare function compileRuntimeSql({ operation, input, qualified }: {
     operation: CompiledOperation;
     input: SqlQueryInput;
+    qualified?: boolean;
 }): Promise<CompiledOperation>;
 
+/** Discover identities from parsed syntax only; the closed compiler validates
+ * every clause before execution. Unqualified names may be CTEs, never objects. */
+declare function referencedSqlObjects({ sql }: {
+    sql: string;
+}): Promise<string[]>;
+
+/** Replace named binds only in SQL code, never strings, identifiers, or comments. */
+declare function bindNamedParameters({ sql, names }: {
+    sql: string;
+    names: string[];
+}): string;
+
+/** Compose SQL metadata by qualified identity. GraphQL's bare-name composition
+ * is deliberately not used across unrelated namespace catalogs. */
+declare function compileBuiltinSqlArtifact({ namespace, definitions, read, unbackedObjects, executionTarget }: {
+    namespace: string;
+    definitions: readonly CanonicalDefinition[];
+    read: readonly string[];
+    unbackedObjects?: readonly string[];
+    executionTarget?: string;
+}): CompiledArtifact;
+
 declare const DATASET_PREVIEW_LIMIT = 100;
 /**
  * Fixed runtime-owned reads, separate from the published operation manifest.
@@ -508,4 +531,4 @@ declare function validateManagedViewQueries({ canonical }: {
     canonical: CanonicalDefinition;
 }): Promise<void>;
 
-export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlQueryInputSchema, typeNameForTable, validateManagedViewQueries, walkPred };
+export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, bindNamedParameters, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileBuiltinSqlArtifact, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, referencedSqlObjects, restrictOperation, sqlQueryInputSchema, typeNameForTable, validateManagedViewQueries, walkPred };

package/dist/compiler.d.ts

@@ -484,11 +484,34 @@ declare const sqlQueryInputSchema: z.ZodObject<{
 }, z.core.$strict>;
 type SqlQueryInput = z.infer<typeof sqlQueryInputSchema>;
 /** The returned plan contains no bound parameter values or caller identity. */
-declare function compileRuntimeSql({ operation, input }: {
+declare function compileRuntimeSql({ operation, input, qualified }: {
     operation: CompiledOperation;
     input: SqlQueryInput;
+    qualified?: boolean;
 }): Promise<CompiledOperation>;
 
+/** Discover identities from parsed syntax only; the closed compiler validates
+ * every clause before execution. Unqualified names may be CTEs, never objects. */
+declare function referencedSqlObjects({ sql }: {
+    sql: string;
+}): Promise<string[]>;
+
+/** Replace named binds only in SQL code, never strings, identifiers, or comments. */
+declare function bindNamedParameters({ sql, names }: {
+    sql: string;
+    names: string[];
+}): string;
+
+/** Compose SQL metadata by qualified identity. GraphQL's bare-name composition
+ * is deliberately not used across unrelated namespace catalogs. */
+declare function compileBuiltinSqlArtifact({ namespace, definitions, read, unbackedObjects, executionTarget }: {
+    namespace: string;
+    definitions: readonly CanonicalDefinition[];
+    read: readonly string[];
+    unbackedObjects?: readonly string[];
+    executionTarget?: string;
+}): CompiledArtifact;
+
 declare const DATASET_PREVIEW_LIMIT = 100;
 /**
  * Fixed runtime-owned reads, separate from the published operation manifest.
@@ -508,4 +531,4 @@ declare function validateManagedViewQueries({ canonical }: {
     canonical: CanonicalDefinition;
 }): Promise<void>;
 
-export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlQueryInputSchema, typeNameForTable, validateManagedViewQueries, walkPred };
+export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, bindNamedParameters, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileBuiltinSqlArtifact, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, referencedSqlObjects, restrictOperation, sqlQueryInputSchema, typeNameForTable, validateManagedViewQueries, walkPred };

package/dist/compiler.js

@@ -1308,6 +1308,9 @@ function normalizeCanonical(definition) {
   return normalized;
 }
 
+// src/client/sql.ts
+var BUILTIN_SQL_READ_HASH = "sha256:a50c477c952a5e0fe68ed158a4530e4aab573c09bcbb1a8ac454dc88a39a6258";
+
 // src/ir/index.ts
 var IR_VERSION = 5;
 var LEGACY_IR_VERSION = 1;
@@ -1641,7 +1644,8 @@ var compiledOperationSchema = z.object({
 }).superRefine((operation, ctx) => {
   if (operation.language === "sql") {
     const validPlan = operation.sqlQuery ? !operation.sql && operation.irVersion === RUNTIME_SQL_IR_VERSION : !!operation.sql && operation.irVersion === SQL_IR_VERSION;
-    if (!validPlan || operation.kind !== "query" || operation.roots.length !== 0 || !operation.requires?.capability) {
+    const builtin = operation.name === "BuiltinSqlRead" && operation.opHash === BUILTIN_SQL_READ_HASH && operation.requires === null;
+    if (!validPlan || operation.kind !== "query" || operation.roots.length !== 0 || !builtin && !operation.requires?.capability) {
       ctx.addIssue({ code: "custom", message: "SQL operations require a query-only v4 plan or v5 runtime contract, capability, and no GraphQL roots" });
     }
   } else if (operation.sql || operation.sqlQuery || operation.roots.length === 0) {
@@ -5419,9 +5423,9 @@ function compilePredIrToSql(pred, options = {}) {
     case "cmp":
       return compileCmp(pred.op, pred.column, pred.value, options);
     case "capability":
-      return `(${capabilityExpression(pred.key, pred.namespace ?? options.namespace)})`;
+      return `(${options.statementClaimChecks ? "SELECT " : ""}${capabilityExpression(pred.key, pred.namespace ?? options.namespace)})`;
     case "role":
-      return `(${roleExpression(pred.key, pred.namespace ?? options.namespace)})`;
+      return `(${options.statementClaimChecks ? "SELECT " : ""}${roleExpression(pred.key, pred.namespace ?? options.namespace)})`;
     case "exists":
       if (options.exists) return options.exists(pred);
       throw new OrmDefinitionError("synced view read policy cannot use 'exists' without a relationship resolver");
@@ -5529,7 +5533,8 @@ function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
   const { ctx, diagnostics } = buildCompileContext(canonical);
   if (diagnostics.some((d) => d.severity === "error")) throw new Error(diagnostics.map((d) => d.message).join("; "));
   const identity = sqlHash(`ontology-sql-v1\0${computeSchemaHash(canonical)}\0${executionTarget}`);
-  const refOf = (meta) => `${meta.namespace ?? canonical.namespace}/${meta.table}`;
+  const logicalNames = new Map(Object.entries(ctx.tables).map(([key, meta]) => [meta, key]));
+  const refOf = (meta) => `${meta.namespace ?? canonical.namespace}/${logicalNames.get(meta)}`;
   const definitions = [canonical, ...canonical.imports ?? []];
   const internal = new Set(definitions.flatMap((owner) => [
     ...owner.tables.filter((t) => t.internal).map((t) => `${owner.namespace}/${t.table}`),
@@ -5605,15 +5610,48 @@ function only(node, keys) {
 var parser;
 var SQL_TYPES = ["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz"];
 var pgType = (type) => type === "double" ? "double precision" : SQL_TYPES.some((t) => t === type) ? type : fail3("unsupported SQL type");
-async function compileOntologySql({ catalog, sql, parameterTypes = [], maxRows = 1e3 }) {
-  if (!Number.isInteger(maxRows) || maxRows < 1 || maxRows > 1e4 || Buffer.byteLength(sql) > 65536) fail3("SQL limit exceeded");
+async function parseSelect(sql) {
+  if (Buffer.byteLength(sql) > 65536) fail3("SQL limit exceeded");
   parser ??= new PgParser({ version: 17 });
   const parsed = await parser.parse(sql);
   if (parsed.error || !parsed.tree) fail3("invalid SQL");
   const statements = list(obj(parsed.tree).stmts);
   if (statements.length !== 1) fail3("one SQL SELECT is required");
+  const statement = obj(obj(statements[0]).stmt);
+  if (!statement.SelectStmt) fail3("one SQL SELECT is required");
+  return statement;
+}
+async function referencedSqlObjects({ sql }) {
+  const objects = /* @__PURE__ */ new Set();
+  let nodes = 0;
+  function visit2(value, depth) {
+    if (++nodes > 1e4 || depth > 96) fail3("SQL complexity limit exceeded");
+    if (Array.isArray(value)) {
+      for (const child of value) visit2(child, depth + 1);
+      return;
+    }
+    if (!value || typeof value !== "object") return;
+    const node = obj(value);
+    if (node.RangeVar) {
+      const range = obj(node.RangeVar);
+      if (range.schemaname) {
+        const namespace = str(range.schemaname), name2 = str(range.relname);
+        if (!/^[a-z][a-z0-9_]{0,40}$/.test(namespace) || namespace === "pg_catalog" || namespace === "information_schema") fail3("invalid ontology namespace");
+        objects.add(`${namespace}/${name2}`);
+        if (objects.size > 256) fail3("too many SQL objects");
+      }
+    }
+    for (const child of Object.values(node)) visit2(child, depth + 1);
+  }
+  visit2(await parseSelect(sql), 0);
+  if (!objects.size) fail3("SQL operation must read an ontology object");
+  return [...objects].sort();
+}
+async function compileOntologySql({ catalog, sql, parameterTypes = [], maxRows = 1e3 }) {
+  if (!Number.isInteger(maxRows) || maxRows < 1 || maxRows > 1e4 || Buffer.byteLength(sql) > 65536) fail3("SQL limit exceeded");
+  const statement = await parseSelect(sql);
   const emitter = new SqlEmitter({ catalog, parameterTypes });
-  const result = emitter.select(obj(obj(statements[0]).stmt), { relations: [], ctes: /* @__PURE__ */ new Map() });
+  const result = emitter.select(statement, { relations: [], ctes: /* @__PURE__ */ new Map() });
   if (emitter.used.size !== parameterTypes.length) fail3("SQL parameters must be used exactly as declared");
   if (!emitter.read.size) fail3("SQL operation must read an ontology object");
   return {
@@ -6201,7 +6239,7 @@ var sqlQueryInputSchema = z.object({
   sql: z.string().min(1).max(65536).refine((value) => Buffer.byteLength(value) <= 65536, "SQL exceeds 64 KiB"),
   parameters: z.record(parameterName, parameter).refine((value) => Object.keys(value).length <= 128, "too many SQL parameters").default({})
 }).strict();
-async function compileRuntimeSql({ operation, input }) {
+async function compileRuntimeSql({ operation, input, qualified = false }) {
   const contract = operation.sqlQuery;
   if (!contract) throw new Error("missing runtime SQL contract");
   const names = Object.keys(input.parameters).sort();
@@ -6217,10 +6255,87 @@ async function compileRuntimeSql({ operation, input }) {
     sqlQuery: void 0,
     irVersion: SQL_IR_VERSION,
     variables: names.map((name2) => ({ name: name2, type: { kind: "scalar", scalar: input.parameters[name2].type }, nullable: true, list: false })),
-    tableSet: plan.read.map((ref) => ref.split("/")[1]).sort(),
+    tableSet: qualified ? plan.read : plan.read.map((ref) => ref.split("/")[1]).sort(),
     sql: { text: plan.text, columns: plan.columns, parameters: names, read: plan.read, maxRows: plan.maxRows }
   });
 }
+
+// src/sql/builtin.ts
+function localHash(definition) {
+  const { imports: _imports, ...local } = definition;
+  return computeSchemaHash(normalizeCanonical(local));
+}
+function compileBuiltinSqlArtifact({ namespace, definitions, read, unbackedObjects = [], executionTarget = "default" }) {
+  const anchor = definitions.find((definition) => definition.namespace === namespace);
+  if (!anchor) throw new Error("missing SQL namespace definition");
+  const tables = {};
+  const policies = {};
+  const objects = [];
+  for (const definition of definitions) {
+    const owner = definition.namespace;
+    const { ctx, diagnostics } = buildCompileContext(definition);
+    if (diagnostics.some((diagnostic) => diagnostic.severity === "error")) throw new Error("SQL namespace definition is invalid");
+    const ref = (key) => {
+      const meta = ctx.tables[key];
+      if (!meta) throw new Error("SQL dependency is unavailable");
+      return `${meta.namespace ?? owner}/${key}`;
+    };
+    for (const [key, meta] of Object.entries(ctx.tables)) {
+      if ((meta.namespace ?? owner) !== owner) continue;
+      const identity = ref(key);
+      tables[identity] = {
+        ...meta,
+        namespace: owner,
+        links: meta.links.map((link) => ({ ...link, ...link.target ? { target: ref(link.target) } : {} })),
+        ...meta.dependencies ? { dependencies: meta.dependencies.map(ref) } : {},
+        ...meta.foreignReferences ? { foreignReferences: meta.foreignReferences.map((link) => ({ ...link, target: ref(link.target) })) } : {}
+      };
+      const policy = ctx.readPolicies.get(key);
+      if (policy) policies[identity] = policy;
+    }
+    const selected = read.filter((identity) => identity.startsWith(`${owner}/`));
+    if (!selected.length) continue;
+    if (owner !== namespace && selected.some((identity) => !definition.exports?.[identity.slice(owner.length + 1)]?.read)) {
+      throw new Error("SQL object is not exported");
+    }
+    objects.push(...createSqlCatalog({ canonical: definition, publishedObjects: selected, executionTarget }).objects);
+  }
+  if (objects.length !== read.length) throw new Error("SQL object is unavailable");
+  const actualRead = [...new Set(objects.flatMap((object) => object.read))].sort();
+  const catalog = { objects, identity: sqlHash(JSON.stringify([
+    "builtin-sql-catalog-v1",
+    namespace,
+    executionTarget,
+    read,
+    definitions.map((definition) => [definition.namespace, computeSchemaHash(definition)]).sort()
+  ])) };
+  return normalizeIr({
+    irVersion: RUNTIME_SQL_IR_VERSION,
+    namespace,
+    schemaHash: catalog.identity,
+    ownSchemaHash: localHash(anchor),
+    opsHash: BUILTIN_SQL_READ_HASH,
+    dependencies: Object.fromEntries(definitions.filter((definition) => definition.namespace !== namespace).map((definition) => [definition.namespace, localHash(definition)])),
+    tables,
+    readPolicies: policies,
+    unbackedTables: [...unbackedObjects],
+    operations: { BuiltinSqlRead: {
+      irVersion: RUNTIME_SQL_IR_VERSION,
+      name: "BuiltinSqlRead",
+      opHash: BUILTIN_SQL_READ_HASH,
+      language: "sql",
+      kind: "query",
+      requires: null,
+      roots: [],
+      tableSet: actualRead,
+      variables: [
+        { name: "sql", type: { kind: "scalar", scalar: "text" }, nullable: false, list: false },
+        { name: "parameters", type: { kind: "scalar", scalar: "jsonb" }, nullable: true, list: false }
+      ],
+      sqlQuery: { catalog, read: actualRead, maxRows: 1e3 }
+    } }
+  });
+}
 var DATASET_PREVIEW_LIMIT = 100;
 function compileDatasetPreviews(input) {
   const canonical = normalizeCanonical(input);
@@ -6266,6 +6381,6 @@ function compileDatasetPreviews(input) {
   return operations;
 }
 
-export { COMPILER_MAJOR, CONST_TRUE, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, DocumentCompileError, MAX_LIMIT, NamespaceCompileError, ORDER_BY_DIRECTIONS, OperationLowerer, PLATFORM_USER_TABLE, PLATFORM_USER_TYPENAME, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, PolicyCompileError, PolicyParseError, allowedBoolExpOperators, allowedOps, andPred, assertClaimsOnlyWhen, buildCompileContext, camelCase, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compilePolicy, compilePredicateV2, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, defineOperation, enumTypeName, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parsePolicy, parseSdl, pascalCase, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlOperationDefinitionSchema, sqlQueryInputSchema, typeNameForTable, validateAppendInput, validateBoolExpInput, validateInsertInput, validateManagedViewQueries, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput, walkPolicy, walkPred };
+export { COMPILER_MAJOR, CONST_TRUE, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, DocumentCompileError, MAX_LIMIT, NamespaceCompileError, ORDER_BY_DIRECTIONS, OperationLowerer, PLATFORM_USER_TABLE, PLATFORM_USER_TYPENAME, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, PolicyCompileError, PolicyParseError, allowedBoolExpOperators, allowedOps, andPred, assertClaimsOnlyWhen, bindNamedParameters, buildCompileContext, camelCase, canonicalOperationText, classifyInputType, collectPinnedColumns, compileBuiltinSqlArtifact, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compilePolicy, compilePredicateV2, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, defineOperation, enumTypeName, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parsePolicy, parseSdl, pascalCase, platformUserMeta, predContains, predContainsExists, queryRootNames, referencedSqlObjects, restrictOperation, sqlOperationDefinitionSchema, sqlQueryInputSchema, typeNameForTable, validateAppendInput, validateBoolExpInput, validateInsertInput, validateManagedViewQueries, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput, walkPolicy, walkPred };
 //# sourceMappingURL=compiler.js.map
 //# sourceMappingURL=compiler.js.map