@sequenceholdings/orm 2.6.2 → 2.7.0

package/dist/ir.d.cts

@@ -24,14 +24,17 @@ export { C as CELLS_FIELD, a as CELL_PARTS, b as CellPart, c as cellColumnName }
  */
 
 /** Maximum supported version; emit the oldest version that preserves semantics. */
-declare const IR_VERSION: 5;
+declare const IR_VERSION: 6;
 declare const LEGACY_IR_VERSION: 1;
 declare const GUARDED_IR_VERSION: 2;
 /** Older v2 executors must not strip namespace-scoped authorization. */
 declare const COMPOSED_IR_VERSION: 3;
 declare const SQL_IR_VERSION: 4;
 declare const RUNTIME_SQL_IR_VERSION: 5;
-declare const irVersionSchema: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>]>;
+declare const SERVICE_PRINCIPAL_IR_VERSION: 6;
+declare const irVersionSchema: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>, z.ZodLiteral<6>]>;
+/** Every carrier of a service identity predicate must require the new executor. */
+declare function usesServicePrincipal(value: unknown): boolean;
 /** Keep v1 artifact identity when assembling only legacy operations from registry rows. */
 declare function requiredArtifactIrVersion(operations: readonly unknown[]): z.infer<typeof irVersionSchema>;
 /**
@@ -113,6 +116,8 @@ type PredIr = {
     kind: 'role';
     key: string;
     namespace?: string;
+} | {
+    kind: 'servicePrincipal';
 }
 /** §4f: a client-supplied BoolExp variable lands here, validated + lowered at runtime. */
  | {
@@ -733,6 +738,7 @@ declare const compiledOperationSchema: z.ZodObject<{
                 date: "date";
                 text: "text";
                 timestamptz: "timestamptz";
+                jsonb: "jsonb";
                 uuid: "uuid";
                 integer: "integer";
                 numeric: "numeric";
@@ -744,7 +750,7 @@ declare const compiledOperationSchema: z.ZodObject<{
         read: z.ZodArray<z.ZodString>;
         maxRows: z.ZodNumber;
     }, z.core.$strict>>;
-    irVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>]>;
+    irVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>, z.ZodLiteral<6>]>;
     name: z.ZodString;
     opHash: z.ZodString;
     kind: z.ZodEnum<{
@@ -1391,7 +1397,7 @@ declare const tableMetaIrSchema: z.ZodObject<{
 }, z.core.$strip>;
 type TableMetaIr = z.infer<typeof tableMetaIrSchema>;
 declare const compiledArtifactSchema: z.ZodObject<{
-    irVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>]>;
+    irVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>, z.ZodLiteral<6>]>;
     namespace: z.ZodString;
     schemaHash: z.ZodString;
     ownSchemaHash: z.ZodOptional<z.ZodString>;
@@ -1553,6 +1559,7 @@ declare const compiledArtifactSchema: z.ZodObject<{
                     date: "date";
                     text: "text";
                     timestamptz: "timestamptz";
+                    jsonb: "jsonb";
                     uuid: "uuid";
                     integer: "integer";
                     numeric: "numeric";
@@ -1564,7 +1571,7 @@ declare const compiledArtifactSchema: z.ZodObject<{
             read: z.ZodArray<z.ZodString>;
             maxRows: z.ZodNumber;
         }, z.core.$strict>>;
-        irVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>]>;
+        irVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>, z.ZodLiteral<6>]>;
         name: z.ZodString;
         opHash: z.ZodString;
         kind: z.ZodEnum<{
@@ -2001,4 +2008,4 @@ declare function normalizeIr(raw: unknown): CompiledArtifact;
 /** Index an artifact's operations by opHash (the wire selector). */
 declare function indexByHash(artifact: CompiledArtifact): Map<string, CompiledOperation>;
 
-export { CLAIMS_CONTRACT, CMP_OPS, COMPOSED_IR_VERSION, type CellSelectionIr, type ClaimKey, type CmpOp, type CompiledArtifact, type CompiledOperation, DATE_BUCKETS, type DateBucket, EXTERNAL_POLICY_CLAIM_KEYS, type ExternalPolicyClaimKey, GUARDED_IR_VERSION, type GroupByKeyIr, INPUT_REF_KINDS, IR_VERSION, type InputRefKind, IrVersionError, LEGACY_IR_VERSION, type LimitIr, type OrderIr, type PredIr, type PrefetchPlanIr, RUNTIME_SQL_IR_VERSION, type ResolvedMetaIr, type ResolvedSourceIr, type RootIr, SQL_IR_VERSION, type SelectionIr, type TableMetaIr, type ValueIr, type VariableDefaultIr, type VariableIr, compiledArtifactSchema, compiledOperationSchema, indexByHash, isExternalPolicyClaimKey, limitIrSchema, normalizeIr, orderIrSchema, predIrSchema, prefetchPlanIrSchema, requiredArtifactIrVersion, resolvedMetaIrSchema, resolvedSourceIrSchema, rootIrSchema, selectionIrSchema, tableMetaIrSchema, valueIrSchema, variableDefaultIrSchema, variableIrSchema };
+export { CLAIMS_CONTRACT, CMP_OPS, COMPOSED_IR_VERSION, type CellSelectionIr, type ClaimKey, type CmpOp, type CompiledArtifact, type CompiledOperation, DATE_BUCKETS, type DateBucket, EXTERNAL_POLICY_CLAIM_KEYS, type ExternalPolicyClaimKey, GUARDED_IR_VERSION, type GroupByKeyIr, INPUT_REF_KINDS, IR_VERSION, type InputRefKind, IrVersionError, LEGACY_IR_VERSION, type LimitIr, type OrderIr, type PredIr, type PrefetchPlanIr, RUNTIME_SQL_IR_VERSION, type ResolvedMetaIr, type ResolvedSourceIr, type RootIr, SERVICE_PRINCIPAL_IR_VERSION, SQL_IR_VERSION, type SelectionIr, type TableMetaIr, type ValueIr, type VariableDefaultIr, type VariableIr, compiledArtifactSchema, compiledOperationSchema, indexByHash, isExternalPolicyClaimKey, limitIrSchema, normalizeIr, orderIrSchema, predIrSchema, prefetchPlanIrSchema, requiredArtifactIrVersion, resolvedMetaIrSchema, resolvedSourceIrSchema, rootIrSchema, selectionIrSchema, tableMetaIrSchema, usesServicePrincipal, valueIrSchema, variableDefaultIrSchema, variableIrSchema };

package/dist/ir.d.ts

@@ -24,14 +24,17 @@ export { C as CELLS_FIELD, a as CELL_PARTS, b as CellPart, c as cellColumnName }
  */
 
 /** Maximum supported version; emit the oldest version that preserves semantics. */
-declare const IR_VERSION: 5;
+declare const IR_VERSION: 6;
 declare const LEGACY_IR_VERSION: 1;
 declare const GUARDED_IR_VERSION: 2;
 /** Older v2 executors must not strip namespace-scoped authorization. */
 declare const COMPOSED_IR_VERSION: 3;
 declare const SQL_IR_VERSION: 4;
 declare const RUNTIME_SQL_IR_VERSION: 5;
-declare const irVersionSchema: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>]>;
+declare const SERVICE_PRINCIPAL_IR_VERSION: 6;
+declare const irVersionSchema: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>, z.ZodLiteral<6>]>;
+/** Every carrier of a service identity predicate must require the new executor. */
+declare function usesServicePrincipal(value: unknown): boolean;
 /** Keep v1 artifact identity when assembling only legacy operations from registry rows. */
 declare function requiredArtifactIrVersion(operations: readonly unknown[]): z.infer<typeof irVersionSchema>;
 /**
@@ -113,6 +116,8 @@ type PredIr = {
     kind: 'role';
     key: string;
     namespace?: string;
+} | {
+    kind: 'servicePrincipal';
 }
 /** §4f: a client-supplied BoolExp variable lands here, validated + lowered at runtime. */
  | {
@@ -733,6 +738,7 @@ declare const compiledOperationSchema: z.ZodObject<{
                 date: "date";
                 text: "text";
                 timestamptz: "timestamptz";
+                jsonb: "jsonb";
                 uuid: "uuid";
                 integer: "integer";
                 numeric: "numeric";
@@ -744,7 +750,7 @@ declare const compiledOperationSchema: z.ZodObject<{
         read: z.ZodArray<z.ZodString>;
         maxRows: z.ZodNumber;
     }, z.core.$strict>>;
-    irVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>]>;
+    irVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>, z.ZodLiteral<6>]>;
     name: z.ZodString;
     opHash: z.ZodString;
     kind: z.ZodEnum<{
@@ -1391,7 +1397,7 @@ declare const tableMetaIrSchema: z.ZodObject<{
 }, z.core.$strip>;
 type TableMetaIr = z.infer<typeof tableMetaIrSchema>;
 declare const compiledArtifactSchema: z.ZodObject<{
-    irVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>]>;
+    irVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>, z.ZodLiteral<6>]>;
     namespace: z.ZodString;
     schemaHash: z.ZodString;
     ownSchemaHash: z.ZodOptional<z.ZodString>;
@@ -1553,6 +1559,7 @@ declare const compiledArtifactSchema: z.ZodObject<{
                     date: "date";
                     text: "text";
                     timestamptz: "timestamptz";
+                    jsonb: "jsonb";
                     uuid: "uuid";
                     integer: "integer";
                     numeric: "numeric";
@@ -1564,7 +1571,7 @@ declare const compiledArtifactSchema: z.ZodObject<{
             read: z.ZodArray<z.ZodString>;
             maxRows: z.ZodNumber;
         }, z.core.$strict>>;
-        irVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>]>;
+        irVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>, z.ZodLiteral<6>]>;
         name: z.ZodString;
         opHash: z.ZodString;
         kind: z.ZodEnum<{
@@ -2001,4 +2008,4 @@ declare function normalizeIr(raw: unknown): CompiledArtifact;
 /** Index an artifact's operations by opHash (the wire selector). */
 declare function indexByHash(artifact: CompiledArtifact): Map<string, CompiledOperation>;
 
-export { CLAIMS_CONTRACT, CMP_OPS, COMPOSED_IR_VERSION, type CellSelectionIr, type ClaimKey, type CmpOp, type CompiledArtifact, type CompiledOperation, DATE_BUCKETS, type DateBucket, EXTERNAL_POLICY_CLAIM_KEYS, type ExternalPolicyClaimKey, GUARDED_IR_VERSION, type GroupByKeyIr, INPUT_REF_KINDS, IR_VERSION, type InputRefKind, IrVersionError, LEGACY_IR_VERSION, type LimitIr, type OrderIr, type PredIr, type PrefetchPlanIr, RUNTIME_SQL_IR_VERSION, type ResolvedMetaIr, type ResolvedSourceIr, type RootIr, SQL_IR_VERSION, type SelectionIr, type TableMetaIr, type ValueIr, type VariableDefaultIr, type VariableIr, compiledArtifactSchema, compiledOperationSchema, indexByHash, isExternalPolicyClaimKey, limitIrSchema, normalizeIr, orderIrSchema, predIrSchema, prefetchPlanIrSchema, requiredArtifactIrVersion, resolvedMetaIrSchema, resolvedSourceIrSchema, rootIrSchema, selectionIrSchema, tableMetaIrSchema, valueIrSchema, variableDefaultIrSchema, variableIrSchema };
+export { CLAIMS_CONTRACT, CMP_OPS, COMPOSED_IR_VERSION, type CellSelectionIr, type ClaimKey, type CmpOp, type CompiledArtifact, type CompiledOperation, DATE_BUCKETS, type DateBucket, EXTERNAL_POLICY_CLAIM_KEYS, type ExternalPolicyClaimKey, GUARDED_IR_VERSION, type GroupByKeyIr, INPUT_REF_KINDS, IR_VERSION, type InputRefKind, IrVersionError, LEGACY_IR_VERSION, type LimitIr, type OrderIr, type PredIr, type PrefetchPlanIr, RUNTIME_SQL_IR_VERSION, type ResolvedMetaIr, type ResolvedSourceIr, type RootIr, SERVICE_PRINCIPAL_IR_VERSION, SQL_IR_VERSION, type SelectionIr, type TableMetaIr, type ValueIr, type VariableDefaultIr, type VariableIr, compiledArtifactSchema, compiledOperationSchema, indexByHash, isExternalPolicyClaimKey, limitIrSchema, normalizeIr, orderIrSchema, predIrSchema, prefetchPlanIrSchema, requiredArtifactIrVersion, resolvedMetaIrSchema, resolvedSourceIrSchema, rootIrSchema, selectionIrSchema, tableMetaIrSchema, usesServicePrincipal, valueIrSchema, variableDefaultIrSchema, variableIrSchema };

package/dist/ir.js

@@ -1070,14 +1070,21 @@ localDefinitionSchema.safeExtend({
 var BUILTIN_SQL_READ_HASH = "sha256:a50c477c952a5e0fe68ed158a4530e4aab573c09bcbb1a8ac454dc88a39a6258";
 
 // src/ir/index.ts
-var IR_VERSION = 5;
+var IR_VERSION = 6;
 var LEGACY_IR_VERSION = 1;
 var GUARDED_IR_VERSION = 2;
 var COMPOSED_IR_VERSION = 3;
 var SQL_IR_VERSION = 4;
 var RUNTIME_SQL_IR_VERSION = 5;
-var irVersionSchema = z.union([z.literal(LEGACY_IR_VERSION), z.literal(GUARDED_IR_VERSION), z.literal(COMPOSED_IR_VERSION), z.literal(SQL_IR_VERSION), z.literal(RUNTIME_SQL_IR_VERSION)]);
+var SERVICE_PRINCIPAL_IR_VERSION = 6;
+var irVersionSchema = z.union([z.literal(LEGACY_IR_VERSION), z.literal(GUARDED_IR_VERSION), z.literal(COMPOSED_IR_VERSION), z.literal(SQL_IR_VERSION), z.literal(RUNTIME_SQL_IR_VERSION), z.literal(SERVICE_PRINCIPAL_IR_VERSION)]);
 var operationVersionSchema = z.object({ irVersion: irVersionSchema });
+function usesServicePrincipal(value) {
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) return value.some(usesServicePrincipal);
+  const row = value;
+  return row.kind === "servicePrincipal" || Object.values(row).some(usesServicePrincipal);
+}
 function requiredArtifactIrVersion(operations) {
   let required = LEGACY_IR_VERSION;
   for (const operation of operations) {
@@ -1137,6 +1144,7 @@ var predIrSchema = z.lazy(
     z.object({ kind: z.literal("capability"), key: z.string(), namespace: z.string().optional() }),
     z.object({ kind: z.literal("role"), key: z.string(), namespace: z.string().optional() }),
     z.object({ kind: z.literal("dynamicFilter"), slot: z.string() }),
+    z.object({ kind: z.literal("servicePrincipal") }).strict(),
     z.object({ kind: z.literal("const"), value: z.boolean() })
   ])
 );
@@ -1362,7 +1370,7 @@ var variableIrSchema = z.object({
   /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
   defaultValue: variableDefaultIrSchema.optional()
 });
-var sqlColumnSchema = z.object({ name: z.string(), type: z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz"]), nullable: z.boolean() });
+var sqlColumnSchema = z.object({ name: z.string(), type: z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz", "jsonb"]), nullable: z.boolean() });
 var compiledOperationSchema = z.object({
   language: z.literal("sql").optional(),
   /** Server-compiled object catalog and permission ceiling, never caller SQL. */
@@ -1400,6 +1408,9 @@ var compiledOperationSchema = z.object({
   tableSet: z.array(z.string()).min(1),
   roots: z.array(rootIrSchema)
 }).superRefine((operation, ctx) => {
+  if (operation.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(operation.roots)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (operation.language === "sql") {
     const validPlan = operation.sqlQuery ? !operation.sql && operation.irVersion === RUNTIME_SQL_IR_VERSION : !!operation.sql && operation.irVersion === SQL_IR_VERSION;
     const builtin = operation.name === "BuiltinSqlRead" && operation.opHash === BUILTIN_SQL_READ_HASH && operation.requires === null;
@@ -1532,6 +1543,9 @@ var compiledArtifactSchema = z.object({
   tables: z.record(z.string(), tableMetaIrSchema),
   operations: z.record(z.string(), compiledOperationSchema)
 }).superRefine((artifact, ctx) => {
+  if (artifact.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(artifact)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (Object.keys(artifact.dependencies ?? {}).length > 0 && artifact.irVersion < COMPOSED_IR_VERSION) {
     ctx.addIssue({ code: "custom", path: ["irVersion"], message: "cross-namespace dependencies require IR v3" });
   }
@@ -1559,6 +1573,6 @@ function indexByHash(artifact) {
   return map;
 }
 
-export { CELLS_FIELD, CELL_PARTS, CLAIMS_CONTRACT, CMP_OPS, COMPOSED_IR_VERSION, DATE_BUCKETS, EXTERNAL_POLICY_CLAIM_KEYS, GUARDED_IR_VERSION, INPUT_REF_KINDS, IR_VERSION, IrVersionError, LEGACY_IR_VERSION, RUNTIME_SQL_IR_VERSION, SQL_IR_VERSION, cellColumnName, compiledArtifactSchema, compiledOperationSchema, indexByHash, isExternalPolicyClaimKey, limitIrSchema, normalizeIr, orderIrSchema, predIrSchema, prefetchPlanIrSchema, requiredArtifactIrVersion, resolvedMetaIrSchema, resolvedSourceIrSchema, rootIrSchema, selectionIrSchema, tableMetaIrSchema, valueIrSchema, variableDefaultIrSchema, variableIrSchema };
+export { CELLS_FIELD, CELL_PARTS, CLAIMS_CONTRACT, CMP_OPS, COMPOSED_IR_VERSION, DATE_BUCKETS, EXTERNAL_POLICY_CLAIM_KEYS, GUARDED_IR_VERSION, INPUT_REF_KINDS, IR_VERSION, IrVersionError, LEGACY_IR_VERSION, RUNTIME_SQL_IR_VERSION, SERVICE_PRINCIPAL_IR_VERSION, SQL_IR_VERSION, cellColumnName, compiledArtifactSchema, compiledOperationSchema, indexByHash, isExternalPolicyClaimKey, limitIrSchema, normalizeIr, orderIrSchema, predIrSchema, prefetchPlanIrSchema, requiredArtifactIrVersion, resolvedMetaIrSchema, resolvedSourceIrSchema, rootIrSchema, selectionIrSchema, tableMetaIrSchema, usesServicePrincipal, valueIrSchema, variableDefaultIrSchema, variableIrSchema };
 //# sourceMappingURL=ir.js.map
 //# sourceMappingURL=ir.js.map