@sequenceholdings/orm 2.6.2 → 2.7.1

package/dist/index.cjs

@@ -423,6 +423,7 @@ function defineSyncedTable(name2, columnsOrConfig, maybeConfig) {
   if (config.primaryKey !== void 0) tableConfig.primaryKey = config.primaryKey;
   if (config.links !== void 0) tableConfig.links = config.links;
   if (config.policies !== void 0) tableConfig.policies = { read: config.policies.read };
+  if (config.internal === true) tableConfig.internal = true;
   const table = {
     kind: TABLE_BRAND,
     tableName: name2,
@@ -2889,6 +2890,11 @@ function serializeNamespace(input) {
     enumsByName.set(ref.name, ref);
   }
   const canonicalTables = tables.map((table) => buildCanonicalTable({ table, relationsByName, enumsByName }));
+  for (const table of tables) {
+    if (table.source !== void 0 && table.config.internal === true && config.exports && Object.hasOwn(config.exports, table.tableName)) {
+      throw new OrmDefinitionError(`internal synced source "${table.tableName}" cannot be exported; export a permitted managed view instead`, table.file);
+    }
+  }
   const canonicalEnums = [...enumsByName.values()].map((ref) => ({
     name: ref.name,
     values: [...ref.values]
@@ -3222,6 +3228,9 @@ function buildCanonicalLink({
   if (!relationsByName.has(targetName)) {
     return fail3(`targets ${relationKind(target)} "${targetName}" which is not part of this namespace`);
   }
+  if (isSeqTable(target) && target.source !== void 0 && target.config.internal === true) {
+    return fail3(`targets internal synced source "${targetName}"; expose a permitted managed view instead`);
+  }
   if (link.enforce && (!isSeqTable(relation) || !isSeqTable(target))) {
     return fail3("cannot enforce a PostgreSQL foreign key involving a view");
   }
@@ -4220,6 +4229,8 @@ function compilePredIrToSql(pred, options = {}) {
       return `(NOT ${compilePredIrToSql(pred.operand, options)})`;
     case "cmp":
       return compileCmp(pred.op, pred.column, pred.value, options);
+    case "servicePrincipal":
+      return `coalesce(${claimExpression("servicePrincipal")} = 'true', false)`;
     case "capability":
       return `(${options.statementClaimChecks ? "SELECT " : ""}${capabilityExpression(pred.key, pred.namespace ?? options.namespace)})`;
     case "role":
@@ -4447,6 +4458,39 @@ function resolveValidatesTarget(definition, entry) {
   }
   return { schema: ormSchemaName(definition.namespace), table: entry.table, key };
 }
+
+// src/compiler/static-policy-sql.ts
+function compileStaticPolicySql({ table, predicate, tables, namespace, alias, rootRelation, statementClaimChecks, onRead }) {
+  let sequence = 0;
+  const aliases = new Set([alias, rootRelation].filter((value) => value !== void 0));
+  const column = (meta, qualifier, name2) => {
+    const found = meta.columns.find((c) => c.name === name2 || c.columnName === name2);
+    if (!found) throw new OrmDefinitionError("Static policy relationship column is unavailable");
+    return `${quoteIdentifier(qualifier)}.${quoteIdentifier(found.columnName)}`;
+  };
+  const render = (meta, pred, qualifier, outerRelation) => compilePredIrToSql(pred, {
+    alias: qualifier,
+    namespace: meta.namespace ?? namespace,
+    statementClaimChecks,
+    columnNames: Object.fromEntries(meta.columns.map((c) => [c.name, c.columnName])),
+    columnTypes: Object.fromEntries(meta.columns.map((c) => [c.name, c.type])),
+    exists: (node) => {
+      const link = meta.links.find((candidate) => candidate.name === node.link);
+      const target = link?.target ? tables[link.target] : void 0;
+      const parent = qualifier ?? outerRelation;
+      if (!link || !target || !parent) throw new OrmDefinitionError("Static policy relationship metadata is unavailable");
+      onRead?.(target);
+      let child;
+      do {
+        child = `policy_${++sequence}`;
+      } while (aliases.has(child));
+      aliases.add(child);
+      const join4 = link.kind === "toMany" ? `${column(target, child, link.on)} = ${column(meta, parent, link.references)}` : `${column(meta, parent, link.on)} = ${column(target, child, link.references)}`;
+      return `EXISTS (SELECT 1 FROM ${quoteIdentifier(target.schema)}.${quoteIdentifier(target.table)} AS ${quoteIdentifier(child)} WHERE ${join4} AND (${render(target, node.where, child)}))`;
+    }
+  });
+  return render(table, predicate, alias, rootRelation);
+}
 var linkSchema = zod.z.strictObject({
   to: tableReferenceSchema,
   on: identifierSchema,
@@ -4796,6 +4840,7 @@ function syncedViewStatements({
   definition,
   backings,
   readPolicyIrByTable,
+  policyTables,
   columnNamesByTable,
   columnTypesByTable,
   executionOwnerRole = SYNCED_VIEW_EXECUTION_OWNER_ROLE,
@@ -4842,7 +4887,15 @@ function syncedViewStatements({
     });
     const readPolicyIr = readPolicyIrByTable?.get(table.table);
     const readPolicy = table.policies?.read;
-    const policyClause = readPolicyIr ? ` WHERE ${compilePredIrToSql(readPolicyIr, {
+    const policyTable = policyTables?.[table.table];
+    const policyClause = readPolicyIr ? ` WHERE ${policyTable && policyTables ? compileStaticPolicySql({
+      table: policyTable,
+      predicate: readPolicyIr,
+      tables: policyTables,
+      namespace: definition.namespace,
+      rootRelation: physical2.table,
+      statementClaimChecks
+    }) : compilePredIrToSql(readPolicyIr, {
       namespace: definition.namespace,
       statementClaimChecks,
       columnTypes,
@@ -6427,6 +6480,15 @@ function correctIntrospectionQuery(query) {
   if (!drizzleOrm.is(query, drizzleOrm.SQL)) return query;
   const compiled = new pgCore.PgDialect().sqlToQuery(query);
   let text4 = compiled.sql;
+  if (text4.includes("JOIN information_schema.constraint_column_usage AS ccu USING (constraint_schema, constraint_name)")) {
+    text4 = text4.replace(/;\s*$/, "") + ` ORDER BY tc.constraint_name,
+      (SELECT key_usage.ordinal_position FROM information_schema.key_column_usage AS key_usage
+        WHERE key_usage.constraint_schema = tc.constraint_schema
+          AND key_usage.constraint_name = tc.constraint_name
+          AND key_usage.table_schema = tc.table_schema
+          AND key_usage.table_name = tc.table_name
+          AND key_usage.column_name = c.column_name)`;
+  }
   const indexJoin = "pg_constraint con ON con.conindid = idx.indexrelid";
   if (text4.includes("AS generated_by_constraint") && text4.includes(indexJoin)) {
     text4 = text4.replace(indexJoin, `${indexJoin} AND con.contype IN ('p', 'u', 'x')`);
@@ -6659,14 +6721,21 @@ function renderOrmMigrationExport(exported) {
 var BUILTIN_SQL_READ_HASH = "sha256:a50c477c952a5e0fe68ed158a4530e4aab573c09bcbb1a8ac454dc88a39a6258";
 
 // src/ir/index.ts
-var IR_VERSION = 5;
+var IR_VERSION = 6;
 var LEGACY_IR_VERSION = 1;
 var GUARDED_IR_VERSION = 2;
 var COMPOSED_IR_VERSION = 3;
 var SQL_IR_VERSION = 4;
 var RUNTIME_SQL_IR_VERSION = 5;
-var irVersionSchema = zod.z.union([zod.z.literal(LEGACY_IR_VERSION), zod.z.literal(GUARDED_IR_VERSION), zod.z.literal(COMPOSED_IR_VERSION), zod.z.literal(SQL_IR_VERSION), zod.z.literal(RUNTIME_SQL_IR_VERSION)]);
+var SERVICE_PRINCIPAL_IR_VERSION = 6;
+var irVersionSchema = zod.z.union([zod.z.literal(LEGACY_IR_VERSION), zod.z.literal(GUARDED_IR_VERSION), zod.z.literal(COMPOSED_IR_VERSION), zod.z.literal(SQL_IR_VERSION), zod.z.literal(RUNTIME_SQL_IR_VERSION), zod.z.literal(SERVICE_PRINCIPAL_IR_VERSION)]);
 var operationVersionSchema = zod.z.object({ irVersion: irVersionSchema });
+function usesServicePrincipal(value) {
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) return value.some(usesServicePrincipal);
+  const row = value;
+  return row.kind === "servicePrincipal" || Object.values(row).some(usesServicePrincipal);
+}
 function requiredArtifactIrVersion(operations) {
   let required = LEGACY_IR_VERSION;
   for (const operation of operations) {
@@ -6726,6 +6795,7 @@ var predIrSchema = zod.z.lazy(
     zod.z.object({ kind: zod.z.literal("capability"), key: zod.z.string(), namespace: zod.z.string().optional() }),
     zod.z.object({ kind: zod.z.literal("role"), key: zod.z.string(), namespace: zod.z.string().optional() }),
     zod.z.object({ kind: zod.z.literal("dynamicFilter"), slot: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("servicePrincipal") }).strict(),
     zod.z.object({ kind: zod.z.literal("const"), value: zod.z.boolean() })
   ])
 );
@@ -6951,7 +7021,7 @@ var variableIrSchema = zod.z.object({
   /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
   defaultValue: variableDefaultIrSchema.optional()
 });
-var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz"]), nullable: zod.z.boolean() });
+var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz", "jsonb"]), nullable: zod.z.boolean() });
 var compiledOperationSchema = zod.z.object({
   language: zod.z.literal("sql").optional(),
   /** Server-compiled object catalog and permission ceiling, never caller SQL. */
@@ -6989,6 +7059,9 @@ var compiledOperationSchema = zod.z.object({
   tableSet: zod.z.array(zod.z.string()).min(1),
   roots: zod.z.array(rootIrSchema)
 }).superRefine((operation, ctx) => {
+  if (operation.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(operation.roots)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (operation.language === "sql") {
     const validPlan = operation.sqlQuery ? !operation.sql && operation.irVersion === RUNTIME_SQL_IR_VERSION : !!operation.sql && operation.irVersion === SQL_IR_VERSION;
     const builtin = operation.name === "BuiltinSqlRead" && operation.opHash === BUILTIN_SQL_READ_HASH && operation.requires === null;
@@ -7121,6 +7194,9 @@ var compiledArtifactSchema = zod.z.object({
   tables: zod.z.record(zod.z.string(), tableMetaIrSchema),
   operations: zod.z.record(zod.z.string(), compiledOperationSchema)
 }).superRefine((artifact, ctx) => {
+  if (artifact.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(artifact)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (Object.keys(artifact.dependencies ?? {}).length > 0 && artifact.irVersion < COMPOSED_IR_VERSION) {
     ctx.addIssue({ code: "custom", path: ["irVersion"], message: "cross-namespace dependencies require IR v3" });
   }
@@ -8445,6 +8521,7 @@ exports.RESERVED_TABLE_NAMES = RESERVED_TABLE_NAMES;
 exports.ROLES_CLAIM_KEY = ROLES_CLAIM_KEY;
 exports.RUNTIME_SQL_IR_VERSION = RUNTIME_SQL_IR_VERSION;
 exports.SCHEMA_DIR = SCHEMA_DIR;
+exports.SERVICE_PRINCIPAL_IR_VERSION = SERVICE_PRINCIPAL_IR_VERSION;
 exports.SQL_IR_VERSION = SQL_IR_VERSION;
 exports.STATEMENT_KINDS = STATEMENT_KINDS;
 exports.SYNCED_CONTRACT_HASH_DOMAIN = SYNCED_CONTRACT_HASH_DOMAIN;
@@ -8619,6 +8696,7 @@ exports.toMany = toMany;
 exports.toOne = toOne;
 exports.toPlatformUser = toPlatformUser;
 exports.typesInterfaceName = typesInterfaceName;
+exports.usesServicePrincipal = usesServicePrincipal;
 exports.validateNamespaceCatalog = validateNamespaceCatalog;
 exports.validateViewCatalogStatement = validateViewCatalogStatement;
 exports.valueIrSchema = valueIrSchema;