@sequenceholdings/orm 2.6.2 → 2.7.0

package/README.md

@@ -191,7 +191,42 @@ matching acknowledgement. Existing calls without that option are unchanged.
 - `@sequenceholdings/orm/client` — persisted-operation client utilities
 - `@sequenceholdings/orm/drizzle` — supported Drizzle helpers for views
 - `@sequenceholdings/orm/codegen` — GraphQL Code Generator preset used by a
-  scaffolded namespace
+  scaffolded namespace. Custom scalars (`bigint`, `date`, `jsonb`, `numeric`,
+  `timestamptz`, `uuid`) and any other unmapped scalar are emitted as
+  TypeScript `unknown`, not `any`, so `generated/client.ts` and
+  `generated/server.ts` pass native `@typescript-eslint/no-explicit-any`.
+
+### Regenerating clients after upgrading
+
+Existing scaffolds that already committed generated clients need a regenerate.
+`any` on those scalars fails native lint; the files are checked, not ignored.
+
+1. Install the `@sequenceholdings/orm` release that contains this preset.
+2. Run `seq-studio orm generate .` in the namespace directory.
+3. Commit the rewritten `generated/client.ts` and `generated/server.ts`.
+4. Narrow call sites that treated those scalars as `any`. `unknown` has to be
+   checked before it is used.
+
+To keep a concrete type, set `config.scalars` on the `./generated/` output in
+`codegen.ts`. A consumer entry replaces the preset default for that scalar
+only. Lossless `numeric` and `bigint` transport should use `string`:
+
+```ts
+generates: {
+  './generated/': {
+    preset,
+    config: { scalars: { numeric: 'string', bigint: 'string' } },
+  },
+},
+```
+
+Then run `seq-studio orm generate .` again. Mapping a scalar to `any`, or
+eslint-ignoring `generated/client.ts` and `generated/server.ts`, fails the
+purpose of the check: an authored file that uses `any` must still fail.
+
+A scaffold that cannot regenerate should replace each custom scalar's `any`
+with `unknown` (or `string` for lossless numeric/bigint) in the `Scalars` map
+and in every inlined field of both generated files.
 
 The `@sequenceholdings/orm/client` entry point contains the persisted-operation
 executor and error types without importing compiler, migration, Node builtins,
@@ -208,3 +243,11 @@ For a function invocation with no human caller (a Lattice step), use
 service account. The host adapters supply authentication; they do not grant namespace access or
 register operations. Do not extract CLI credentials or invent a browser token
 provider to wire a generated client.
+
+### Verified service policies (planned 2.7.0)
+
+`servicePrincipal()` is a zero-argument Boolean row-policy predicate. Combine it with a private capability, for example `servicePrincipal() and capability('ticket-delivery')`. A role or a `service-account|` subject string does not establish this predicate. The executing runtime derives it afresh from verified service authentication or an attached service delegation; user, dev, console run-as, impersonated and external-borrower requests cannot satisfy it. It is not accepted through `claim()`, request variables or serialized data-token claims.
+
+Affected namespaces require IR v6, including namespaces that only declare a write policy and have no operations. `orm apply` first checks the authenticated target's `/api/orm/runtime-capabilities` response; a missing or older endpoint blocks registration. The compiler and executor also reject an incompatible IR version. Publish the matching ORM and deploy its runtime before activating these policies. Service identity does not grant namespace access, operation capability, declared data scope or row access by itself.
+
+ORM 2.7.0 and downstream Artifact Studio 0.10.0, Managed Functions 0.4.4, Pipeline Spec 0.2.6 and Studio CLI 0.6.6 remain prepared for the separate chain-release workflow and awaiting publication. Their workspace dependencies are pinned to this ORM version when packed; no candidate build constitutes registry evidence.

package/dist/cli.cjs

@@ -1462,14 +1462,21 @@ function normalizeCanonical(definition) {
 var BUILTIN_SQL_READ_HASH = "sha256:a50c477c952a5e0fe68ed158a4530e4aab573c09bcbb1a8ac454dc88a39a6258";
 
 // src/ir/index.ts
-var IR_VERSION = 5;
+var IR_VERSION = 6;
 var LEGACY_IR_VERSION = 1;
 var GUARDED_IR_VERSION = 2;
 var COMPOSED_IR_VERSION = 3;
 var SQL_IR_VERSION = 4;
 var RUNTIME_SQL_IR_VERSION = 5;
-var irVersionSchema = zod.z.union([zod.z.literal(LEGACY_IR_VERSION), zod.z.literal(GUARDED_IR_VERSION), zod.z.literal(COMPOSED_IR_VERSION), zod.z.literal(SQL_IR_VERSION), zod.z.literal(RUNTIME_SQL_IR_VERSION)]);
+var SERVICE_PRINCIPAL_IR_VERSION = 6;
+var irVersionSchema = zod.z.union([zod.z.literal(LEGACY_IR_VERSION), zod.z.literal(GUARDED_IR_VERSION), zod.z.literal(COMPOSED_IR_VERSION), zod.z.literal(SQL_IR_VERSION), zod.z.literal(RUNTIME_SQL_IR_VERSION), zod.z.literal(SERVICE_PRINCIPAL_IR_VERSION)]);
 var operationVersionSchema = zod.z.object({ irVersion: irVersionSchema });
+function usesServicePrincipal(value) {
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) return value.some(usesServicePrincipal);
+  const row = value;
+  return row.kind === "servicePrincipal" || Object.values(row).some(usesServicePrincipal);
+}
 function requiredArtifactIrVersion(operations) {
   let required = LEGACY_IR_VERSION;
   for (const operation of operations) {
@@ -1529,6 +1536,7 @@ var predIrSchema = zod.z.lazy(
     zod.z.object({ kind: zod.z.literal("capability"), key: zod.z.string(), namespace: zod.z.string().optional() }),
     zod.z.object({ kind: zod.z.literal("role"), key: zod.z.string(), namespace: zod.z.string().optional() }),
     zod.z.object({ kind: zod.z.literal("dynamicFilter"), slot: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("servicePrincipal") }).strict(),
     zod.z.object({ kind: zod.z.literal("const"), value: zod.z.boolean() })
   ])
 );
@@ -1754,7 +1762,7 @@ var variableIrSchema = zod.z.object({
   /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
   defaultValue: variableDefaultIrSchema.optional()
 });
-var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz"]), nullable: zod.z.boolean() });
+var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz", "jsonb"]), nullable: zod.z.boolean() });
 var compiledOperationSchema = zod.z.object({
   language: zod.z.literal("sql").optional(),
   /** Server-compiled object catalog and permission ceiling, never caller SQL. */
@@ -1792,6 +1800,9 @@ var compiledOperationSchema = zod.z.object({
   tableSet: zod.z.array(zod.z.string()).min(1),
   roots: zod.z.array(rootIrSchema)
 }).superRefine((operation, ctx) => {
+  if (operation.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(operation.roots)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (operation.language === "sql") {
     const validPlan = operation.sqlQuery ? !operation.sql && operation.irVersion === RUNTIME_SQL_IR_VERSION : !!operation.sql && operation.irVersion === SQL_IR_VERSION;
     const builtin = operation.name === "BuiltinSqlRead" && operation.opHash === BUILTIN_SQL_READ_HASH && operation.requires === null;
@@ -1924,6 +1935,9 @@ var compiledArtifactSchema = zod.z.object({
   tables: zod.z.record(zod.z.string(), tableMetaIrSchema),
   operations: zod.z.record(zod.z.string(), compiledOperationSchema)
 }).superRefine((artifact, ctx) => {
+  if (artifact.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(artifact)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (Object.keys(artifact.dependencies ?? {}).length > 0 && artifact.irVersion < COMPOSED_IR_VERSION) {
     ctx.addIssue({ code: "custom", path: ["irVersion"], message: "cross-namespace dependencies require IR v3" });
   }
@@ -2232,6 +2246,12 @@ var Parser2 = class {
       }
       return node;
     }
+    if (this.peekKeyword("servicePrincipal") && this.tokens[this.index + 1]?.kind === "lparen") {
+      this.advance();
+      this.expect("lparen", "'(' after servicePrincipal");
+      this.expect("rparen", "')' closing servicePrincipal()");
+      return { kind: "servicePrincipal" };
+    }
     if (this.peekKeyword("exists")) return this.parseExists();
     if (this.peekKeyword("visible") && this.tokens[this.index + 1]?.kind === "lparen") return this.parseVisible();
     return this.parseComparison();
@@ -2444,6 +2464,8 @@ var PolicyCompiler = class _PolicyCompiler {
         return { kind: "capability", key: node.key };
       case "role":
         return { kind: "role", key: node.key };
+      case "servicePrincipal":
+        return { kind: "servicePrincipal" };
       case "exists":
         return this.compileExists(node.path, node.where, table, depth);
       case "visible":
@@ -3108,7 +3130,10 @@ function platformUserMeta() {
     { name: "role", columnName: "role", type: "text", nullable: true },
     { name: "managerId", columnName: "manager_id", type: "text", nullable: true },
     // NOT NULL DEFAULT true on chat.users, so non-null through the view.
-    { name: "accountEnabled", columnName: "account_enabled", type: "boolean", nullable: false }
+    { name: "accountEnabled", columnName: "account_enabled", type: "boolean", nullable: false },
+    { name: "canonicalSub", columnName: "canonical_sub", type: "text", nullable: false },
+    { name: "normalizedEmail", columnName: "normalized_email", type: "text", nullable: true },
+    { name: "emailDomain", columnName: "email_domain", type: "text", nullable: true }
   ];
   return {
     table: "users_directory",
@@ -5095,7 +5120,7 @@ function compileNamespace({ canonical, sdl, documents }) {
           }
         }
         operations[restricted.name] = {
-          irVersion: canonical.imports?.length ? COMPOSED_IR_VERSION : roots.some((root) => root.kind === "mutation" && root.assertAffectedRows !== void 0) ? GUARDED_IR_VERSION : LEGACY_IR_VERSION,
+          irVersion: usesServicePrincipal(roots) ? SERVICE_PRINCIPAL_IR_VERSION : canonical.imports?.length ? COMPOSED_IR_VERSION : roots.some((root) => root.kind === "mutation" && root.assertAffectedRows !== void 0) ? GUARDED_IR_VERSION : LEGACY_IR_VERSION,
           name: restricted.name,
           opHash: computeOpHash({ definition: flattened, schemaHash }),
           kind: restricted.kind,
@@ -5122,7 +5147,7 @@ function compileNamespace({ canonical, sdl, documents }) {
   }
   if (diagnostics.some((d) => d.severity === "error")) return { ok: false, diagnostics };
   const artifact = {
-    irVersion: canonical.imports?.length ? COMPOSED_IR_VERSION : requiredArtifactIrVersion(Object.values(operations)),
+    irVersion: usesServicePrincipal([...ctx.readPolicies.values(), ...ctx.writePolicies.values(), ...ctx.insertPolicies.values(), ...ctx.updatePolicies.values(), ...Object.values(operations)]) ? SERVICE_PRINCIPAL_IR_VERSION : canonical.imports?.length ? COMPOSED_IR_VERSION : requiredArtifactIrVersion(Object.values(operations)),
     namespace: ctx.namespace,
     schemaHash,
     ownSchemaHash: computeSchemaHash(localContract(canonical)),
@@ -5176,6 +5201,8 @@ function compilePredIrToSql(pred, options = {}) {
       return `(NOT ${compilePredIrToSql(pred.operand, options)})`;
     case "cmp":
       return compileCmp(pred.op, pred.column, pred.value, options);
+    case "servicePrincipal":
+      return `coalesce(${claimExpression("servicePrincipal")} = 'true', false)`;
     case "capability":
       return `(${options.statementClaimChecks ? "SELECT " : ""}${capabilityExpression(pred.key, pred.namespace ?? options.namespace)})`;
     case "role":
@@ -5278,6 +5305,39 @@ function compileArrayValue(value, columnType, _options) {
   return columnType ? `${array}::${sqlTypeName(columnType)}[]` : array;
 }
 
+// src/compiler/static-policy-sql.ts
+function compileStaticPolicySql({ table, predicate, tables, namespace, alias, rootRelation, statementClaimChecks, onRead }) {
+  let sequence = 0;
+  const aliases = new Set([alias, rootRelation].filter((value) => value !== void 0));
+  const column = (meta, qualifier, name2) => {
+    const found = meta.columns.find((c) => c.name === name2 || c.columnName === name2);
+    if (!found) throw new OrmDefinitionError("Static policy relationship column is unavailable");
+    return `${quoteIdentifier(qualifier)}.${quoteIdentifier(found.columnName)}`;
+  };
+  const render = (meta, pred, qualifier, outerRelation) => compilePredIrToSql(pred, {
+    alias: qualifier,
+    namespace: meta.namespace ?? namespace,
+    statementClaimChecks,
+    columnNames: Object.fromEntries(meta.columns.map((c) => [c.name, c.columnName])),
+    columnTypes: Object.fromEntries(meta.columns.map((c) => [c.name, c.type])),
+    exists: (node) => {
+      const link = meta.links.find((candidate) => candidate.name === node.link);
+      const target = link?.target ? tables[link.target] : void 0;
+      const parent = qualifier ?? outerRelation;
+      if (!link || !target || !parent) throw new OrmDefinitionError("Static policy relationship metadata is unavailable");
+      onRead?.(target);
+      let child;
+      do {
+        child = `policy_${++sequence}`;
+      } while (aliases.has(child));
+      aliases.add(child);
+      const join5 = link.kind === "toMany" ? `${column(target, child, link.on)} = ${column(meta, parent, link.references)}` : `${column(meta, parent, link.on)} = ${column(target, child, link.references)}`;
+      return `EXISTS (SELECT 1 FROM ${quoteIdentifier(target.schema)}.${quoteIdentifier(target.table)} AS ${quoteIdentifier(child)} WHERE ${join5} AND (${render(target, node.where, child)}))`;
+    }
+  });
+  return render(table, predicate, alias, rootRelation);
+}
+
 // src/sql/catalog.ts
 function sqlHash(value) {
   return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`;
@@ -5298,27 +5358,6 @@ function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
     const meta = Object.values(ctx.tables).find((table) => refOf(table) === ref);
     if (!meta || internal.has(ref) || meta.namespace !== canonical.namespace && !meta.exportRead) throw new Error(`SQL object not published: ${ref}`);
     const reads = /* @__PURE__ */ new Set([ref]);
-    let sequence = 0;
-    const predicate = (table, pred, alias) => compilePredIrToSql(pred, {
-      alias,
-      namespace: table.namespace ?? canonical.namespace,
-      columnNames: Object.fromEntries(table.columns.map((c) => [c.name, c.columnName])),
-      columnTypes: Object.fromEntries(table.columns.map((c) => [c.name, c.type])),
-      exists: (node) => {
-        const link = table.links.find((candidate) => candidate.name === node.link);
-        const target = link?.target ? ctx.tables[link.target] : void 0;
-        if (!link || !target) throw new Error("SQL policy link is unavailable");
-        reads.add(refOf(target));
-        const child = `p${++sequence}`;
-        const col = (t2, a, name2) => {
-          const c = t2.columns.find((c2) => c2.name === name2 || c2.columnName === name2);
-          if (!c) throw new Error("SQL policy column is unavailable");
-          return `${quoteIdentifier(a)}.${quoteIdentifier(c.columnName)}`;
-        };
-        const join5 = link.kind === "toMany" ? `${col(target, child, link.on)} = ${col(table, alias, link.references)}` : `${col(table, alias, link.on)} = ${col(target, child, link.references)}`;
-        return `EXISTS (SELECT 1 FROM ${quoteIdentifier(target.schema)}.${quoteIdentifier(target.table)} AS ${quoteIdentifier(child)} WHERE ${join5} AND (${predicate(target, node.where, child)}))`;
-      }
-    });
     const columns = meta.columns.filter((c) => meta.filterable.includes(c.name)).map((c) => ({
       name: c.name,
       type: typeof c.type === "string" ? c.type : "text",
@@ -5329,7 +5368,7 @@ function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
       return `${quoteIdentifier("p0")}.${quoteIdentifier(physical.columnName)}${typeof physical.type === "object" ? "::text" : ""} AS ${quoteIdentifier(c.name)}`;
     }).join(", ");
     const policy = ctx.readPolicies.get(meta.table) ?? { kind: "const", value: true };
-    const scan = `SELECT ${projection} FROM ${quoteIdentifier(meta.schema)}.${quoteIdentifier(meta.table)} AS ${quoteIdentifier("p0")} WHERE ${predicate(meta, policy, "p0")}`;
+    const scan = `SELECT ${projection} FROM ${quoteIdentifier(meta.schema)}.${quoteIdentifier(meta.table)} AS ${quoteIdentifier("p0")} WHERE ${compileStaticPolicySql({ table: meta, predicate: policy, tables: ctx.tables, namespace: canonical.namespace, alias: "p0", onRead: (target) => reads.add(refOf(target)) })}`;
     return { ref, table: meta.table, columns, scan, read: [...reads].sort() };
   });
   return { identity, objects };
@@ -5953,7 +5992,7 @@ async function managedViewDiagnostics(canonical) {
 }
 
 // src/sql/codegen.ts
-var typeOf = (type) => ["integer", "double"].includes(type) ? "number" : type === "boolean" ? "boolean" : "string";
+var typeOf = (type) => ["integer", "double"].includes(type) ? "number" : type === "boolean" ? "boolean" : type === "jsonb" ? "unknown" : "string";
 function generateSqlOperations({ artifact }) {
   const dynamic = Object.values(artifact.operations).some((op) => op.sqlQuery);
   const lines = [
@@ -5990,6 +6029,15 @@ ${variables}
   return `${lines.join("\n").trimEnd()}
 `;
 }
+
+// src/runtime-capabilities.ts
+function assertServicePrincipalRuntime(value) {
+  const row = value !== null && typeof value === "object" ? value : {};
+  const predicates = row.policyPredicates;
+  if (typeof row.maxIrVersion !== "number" || row.maxIrVersion < 6 || !Array.isArray(predicates) || !predicates.includes("servicePrincipal")) {
+    throw new Error("The target ORM runtime does not support servicePrincipal() / IR v6; deploy the reviewed runtime before applying this namespace");
+  }
+}
 var ENUM_BRAND = "seq-enum";
 function isEnumRef(value) {
   return typeof value === "object" && value !== null && value.kind === ENUM_BRAND;
@@ -11965,6 +12013,10 @@ async function applyV2Command(rest, dir) {
   }
   const { loaded, sdl, documents, manifest } = compiled.project;
   const namespace = loaded.canonical.namespace;
+  if (compiled.project.artifact.irVersion >= SERVICE_PRINCIPAL_IR_VERSION || usesServicePrincipal(compiled.project.artifact)) {
+    const support = await apiRequestStrict("GET", "/api/orm/runtime-capabilities");
+    assertServicePrincipalRuntime(support);
+  }
   const workspace = await readMigrationWorkspace(dir, namespace);
   const migration = await loadCommittedTipMigrationV2({ dir, loaded, workspace });
   const registered = await apiRequestStrict("POST", "/api/orm/namespaces", {