@sequenceholdings/orm 2.6.1 → 2.7.0

package/dist/compiler.cjs

@@ -1314,14 +1314,21 @@ function normalizeCanonical(definition) {
 var BUILTIN_SQL_READ_HASH = "sha256:a50c477c952a5e0fe68ed158a4530e4aab573c09bcbb1a8ac454dc88a39a6258";
 
 // src/ir/index.ts
-var IR_VERSION = 5;
+var IR_VERSION = 6;
 var LEGACY_IR_VERSION = 1;
 var GUARDED_IR_VERSION = 2;
 var COMPOSED_IR_VERSION = 3;
 var SQL_IR_VERSION = 4;
 var RUNTIME_SQL_IR_VERSION = 5;
-var irVersionSchema = zod.z.union([zod.z.literal(LEGACY_IR_VERSION), zod.z.literal(GUARDED_IR_VERSION), zod.z.literal(COMPOSED_IR_VERSION), zod.z.literal(SQL_IR_VERSION), zod.z.literal(RUNTIME_SQL_IR_VERSION)]);
+var SERVICE_PRINCIPAL_IR_VERSION = 6;
+var irVersionSchema = zod.z.union([zod.z.literal(LEGACY_IR_VERSION), zod.z.literal(GUARDED_IR_VERSION), zod.z.literal(COMPOSED_IR_VERSION), zod.z.literal(SQL_IR_VERSION), zod.z.literal(RUNTIME_SQL_IR_VERSION), zod.z.literal(SERVICE_PRINCIPAL_IR_VERSION)]);
 var operationVersionSchema = zod.z.object({ irVersion: irVersionSchema });
+function usesServicePrincipal(value) {
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) return value.some(usesServicePrincipal);
+  const row = value;
+  return row.kind === "servicePrincipal" || Object.values(row).some(usesServicePrincipal);
+}
 function requiredArtifactIrVersion(operations) {
   let required = LEGACY_IR_VERSION;
   for (const operation of operations) {
@@ -1381,6 +1388,7 @@ var predIrSchema = zod.z.lazy(
     zod.z.object({ kind: zod.z.literal("capability"), key: zod.z.string(), namespace: zod.z.string().optional() }),
     zod.z.object({ kind: zod.z.literal("role"), key: zod.z.string(), namespace: zod.z.string().optional() }),
     zod.z.object({ kind: zod.z.literal("dynamicFilter"), slot: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("servicePrincipal") }).strict(),
     zod.z.object({ kind: zod.z.literal("const"), value: zod.z.boolean() })
   ])
 );
@@ -1606,7 +1614,7 @@ var variableIrSchema = zod.z.object({
   /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
   defaultValue: variableDefaultIrSchema.optional()
 });
-var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz"]), nullable: zod.z.boolean() });
+var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz", "jsonb"]), nullable: zod.z.boolean() });
 var compiledOperationSchema = zod.z.object({
   language: zod.z.literal("sql").optional(),
   /** Server-compiled object catalog and permission ceiling, never caller SQL. */
@@ -1644,6 +1652,9 @@ var compiledOperationSchema = zod.z.object({
   tableSet: zod.z.array(zod.z.string()).min(1),
   roots: zod.z.array(rootIrSchema)
 }).superRefine((operation, ctx) => {
+  if (operation.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(operation.roots)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (operation.language === "sql") {
     const validPlan = operation.sqlQuery ? !operation.sql && operation.irVersion === RUNTIME_SQL_IR_VERSION : !!operation.sql && operation.irVersion === SQL_IR_VERSION;
     const builtin = operation.name === "BuiltinSqlRead" && operation.opHash === BUILTIN_SQL_READ_HASH && operation.requires === null;
@@ -1776,6 +1787,9 @@ var compiledArtifactSchema = zod.z.object({
   tables: zod.z.record(zod.z.string(), tableMetaIrSchema),
   operations: zod.z.record(zod.z.string(), compiledOperationSchema)
 }).superRefine((artifact, ctx) => {
+  if (artifact.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(artifact)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (Object.keys(artifact.dependencies ?? {}).length > 0 && artifact.irVersion < COMPOSED_IR_VERSION) {
     ctx.addIssue({ code: "custom", path: ["irVersion"], message: "cross-namespace dependencies require IR v3" });
   }
@@ -2066,6 +2080,12 @@ var Parser2 = class {
       }
       return node;
     }
+    if (this.peekKeyword("servicePrincipal") && this.tokens[this.index + 1]?.kind === "lparen") {
+      this.advance();
+      this.expect("lparen", "'(' after servicePrincipal");
+      this.expect("rparen", "')' closing servicePrincipal()");
+      return { kind: "servicePrincipal" };
+    }
     if (this.peekKeyword("exists")) return this.parseExists();
     if (this.peekKeyword("visible") && this.tokens[this.index + 1]?.kind === "lparen") return this.parseVisible();
     return this.parseComparison();
@@ -2278,6 +2298,8 @@ var PolicyCompiler = class _PolicyCompiler {
         return { kind: "capability", key: node.key };
       case "role":
         return { kind: "role", key: node.key };
+      case "servicePrincipal":
+        return { kind: "servicePrincipal" };
       case "exists":
         return this.compileExists(node.path, node.where, table, depth);
       case "visible":
@@ -2973,7 +2995,10 @@ function platformUserMeta() {
     { name: "role", columnName: "role", type: "text", nullable: true },
     { name: "managerId", columnName: "manager_id", type: "text", nullable: true },
     // NOT NULL DEFAULT true on chat.users, so non-null through the view.
-    { name: "accountEnabled", columnName: "account_enabled", type: "boolean", nullable: false }
+    { name: "accountEnabled", columnName: "account_enabled", type: "boolean", nullable: false },
+    { name: "canonicalSub", columnName: "canonical_sub", type: "text", nullable: false },
+    { name: "normalizedEmail", columnName: "normalized_email", type: "text", nullable: true },
+    { name: "emailDomain", columnName: "email_domain", type: "text", nullable: true }
   ];
   return {
     table: "users_directory",
@@ -4960,7 +4985,7 @@ function compileNamespace({ canonical, sdl, documents }) {
           }
         }
         operations[restricted.name] = {
-          irVersion: canonical.imports?.length ? COMPOSED_IR_VERSION : roots.some((root) => root.kind === "mutation" && root.assertAffectedRows !== void 0) ? GUARDED_IR_VERSION : LEGACY_IR_VERSION,
+          irVersion: usesServicePrincipal(roots) ? SERVICE_PRINCIPAL_IR_VERSION : canonical.imports?.length ? COMPOSED_IR_VERSION : roots.some((root) => root.kind === "mutation" && root.assertAffectedRows !== void 0) ? GUARDED_IR_VERSION : LEGACY_IR_VERSION,
           name: restricted.name,
           opHash: computeOpHash({ definition: flattened, schemaHash }),
           kind: restricted.kind,
@@ -4987,7 +5012,7 @@ function compileNamespace({ canonical, sdl, documents }) {
   }
   if (diagnostics.some((d) => d.severity === "error")) return { ok: false, diagnostics };
   const artifact = {
-    irVersion: canonical.imports?.length ? COMPOSED_IR_VERSION : requiredArtifactIrVersion(Object.values(operations)),
+    irVersion: usesServicePrincipal([...ctx.readPolicies.values(), ...ctx.writePolicies.values(), ...ctx.insertPolicies.values(), ...ctx.updatePolicies.values(), ...Object.values(operations)]) ? SERVICE_PRINCIPAL_IR_VERSION : canonical.imports?.length ? COMPOSED_IR_VERSION : requiredArtifactIrVersion(Object.values(operations)),
     namespace: ctx.namespace,
     schemaHash,
     ownSchemaHash: computeSchemaHash(localContract(canonical)),
@@ -5424,6 +5449,8 @@ function compilePredIrToSql(pred, options = {}) {
       return `(NOT ${compilePredIrToSql(pred.operand, options)})`;
     case "cmp":
       return compileCmp(pred.op, pred.column, pred.value, options);
+    case "servicePrincipal":
+      return `coalesce(${claimExpression("servicePrincipal")} = 'true', false)`;
     case "capability":
       return `(${options.statementClaimChecks ? "SELECT " : ""}${capabilityExpression(pred.key, pred.namespace ?? options.namespace)})`;
     case "role":
@@ -5526,6 +5553,39 @@ function compileArrayValue(value, columnType, _options) {
   return columnType ? `${array}::${sqlTypeName(columnType)}[]` : array;
 }
 
+// src/compiler/static-policy-sql.ts
+function compileStaticPolicySql({ table, predicate, tables, namespace, alias, rootRelation, statementClaimChecks, onRead }) {
+  let sequence = 0;
+  const aliases = new Set([alias, rootRelation].filter((value) => value !== void 0));
+  const column = (meta, qualifier, name2) => {
+    const found = meta.columns.find((c) => c.name === name2 || c.columnName === name2);
+    if (!found) throw new OrmDefinitionError("Static policy relationship column is unavailable");
+    return `${quoteIdentifier(qualifier)}.${quoteIdentifier(found.columnName)}`;
+  };
+  const render = (meta, pred, qualifier, outerRelation) => compilePredIrToSql(pred, {
+    alias: qualifier,
+    namespace: meta.namespace ?? namespace,
+    statementClaimChecks,
+    columnNames: Object.fromEntries(meta.columns.map((c) => [c.name, c.columnName])),
+    columnTypes: Object.fromEntries(meta.columns.map((c) => [c.name, c.type])),
+    exists: (node) => {
+      const link = meta.links.find((candidate) => candidate.name === node.link);
+      const target = link?.target ? tables[link.target] : void 0;
+      const parent = qualifier ?? outerRelation;
+      if (!link || !target || !parent) throw new OrmDefinitionError("Static policy relationship metadata is unavailable");
+      onRead?.(target);
+      let child;
+      do {
+        child = `policy_${++sequence}`;
+      } while (aliases.has(child));
+      aliases.add(child);
+      const join = link.kind === "toMany" ? `${column(target, child, link.on)} = ${column(meta, parent, link.references)}` : `${column(meta, parent, link.on)} = ${column(target, child, link.references)}`;
+      return `EXISTS (SELECT 1 FROM ${quoteIdentifier(target.schema)}.${quoteIdentifier(target.table)} AS ${quoteIdentifier(child)} WHERE ${join} AND (${render(target, node.where, child)}))`;
+    }
+  });
+  return render(table, predicate, alias, rootRelation);
+}
+
 // src/sql/catalog.ts
 function sqlHash(value) {
   return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`;
@@ -5546,27 +5606,6 @@ function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
     const meta = Object.values(ctx.tables).find((table) => refOf(table) === ref);
     if (!meta || internal.has(ref) || meta.namespace !== canonical.namespace && !meta.exportRead) throw new Error(`SQL object not published: ${ref}`);
     const reads = /* @__PURE__ */ new Set([ref]);
-    let sequence = 0;
-    const predicate = (table, pred, alias) => compilePredIrToSql(pred, {
-      alias,
-      namespace: table.namespace ?? canonical.namespace,
-      columnNames: Object.fromEntries(table.columns.map((c) => [c.name, c.columnName])),
-      columnTypes: Object.fromEntries(table.columns.map((c) => [c.name, c.type])),
-      exists: (node) => {
-        const link = table.links.find((candidate) => candidate.name === node.link);
-        const target = link?.target ? ctx.tables[link.target] : void 0;
-        if (!link || !target) throw new Error("SQL policy link is unavailable");
-        reads.add(refOf(target));
-        const child = `p${++sequence}`;
-        const col = (t, a, name2) => {
-          const c = t.columns.find((c2) => c2.name === name2 || c2.columnName === name2);
-          if (!c) throw new Error("SQL policy column is unavailable");
-          return `${quoteIdentifier(a)}.${quoteIdentifier(c.columnName)}`;
-        };
-        const join = link.kind === "toMany" ? `${col(target, child, link.on)} = ${col(table, alias, link.references)}` : `${col(table, alias, link.on)} = ${col(target, child, link.references)}`;
-        return `EXISTS (SELECT 1 FROM ${quoteIdentifier(target.schema)}.${quoteIdentifier(target.table)} AS ${quoteIdentifier(child)} WHERE ${join} AND (${predicate(target, node.where, child)}))`;
-      }
-    });
     const columns = meta.columns.filter((c) => meta.filterable.includes(c.name)).map((c) => ({
       name: c.name,
       type: typeof c.type === "string" ? c.type : "text",
@@ -5577,7 +5616,7 @@ function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
       return `${quoteIdentifier("p0")}.${quoteIdentifier(physical.columnName)}${typeof physical.type === "object" ? "::text" : ""} AS ${quoteIdentifier(c.name)}`;
     }).join(", ");
     const policy = ctx.readPolicies.get(meta.table) ?? { kind: "const", value: true };
-    const scan = `SELECT ${projection} FROM ${quoteIdentifier(meta.schema)}.${quoteIdentifier(meta.table)} AS ${quoteIdentifier("p0")} WHERE ${predicate(meta, policy, "p0")}`;
+    const scan = `SELECT ${projection} FROM ${quoteIdentifier(meta.schema)}.${quoteIdentifier(meta.table)} AS ${quoteIdentifier("p0")} WHERE ${compileStaticPolicySql({ table: meta, predicate: policy, tables: ctx.tables, namespace: canonical.namespace, alias: "p0", onRead: (target) => reads.add(refOf(target)) })}`;
     return { ref, table: meta.table, columns, scan, read: [...reads].sort() };
   });
   return { identity, objects };
@@ -6370,7 +6409,7 @@ function compileDatasetPreviews(input) {
     }
     const hash = crypto.createHash("sha256").update("sequence-orm-dataset-preview-v1\0").update(stableJson({ schemaHash, roots, tableSet })).digest("hex");
     operations[relation.table] = compiledOperationSchema.parse({
-      irVersion: canonical.imports?.length ? COMPOSED_IR_VERSION : LEGACY_IR_VERSION,
+      irVersion: usesServicePrincipal(roots) ? SERVICE_PRINCIPAL_IR_VERSION : canonical.imports?.length ? COMPOSED_IR_VERSION : LEGACY_IR_VERSION,
       name: `DatasetPreview_${relation.table}`,
       opHash: `sha256:${hash}`,
       kind: "query",