@sequenceholdings/orm 2.6.2 → 2.7.1

package/dist/predicate-v2.d.cts

@@ -45,6 +45,10 @@ type PolicyNode = {
     kind: 'role';
     key: string;
 }
+/** Verified machine identity, independent of role or subject spelling. */
+ | {
+    kind: 'servicePrincipal';
+}
 /** `exists(<link-path>, <pred>)` — the inner predicate runs against the final target. */
  | {
     kind: 'exists';

package/dist/predicate-v2.d.ts

@@ -45,6 +45,10 @@ type PolicyNode = {
     kind: 'role';
     key: string;
 }
+/** Verified machine identity, independent of role or subject spelling. */
+ | {
+    kind: 'servicePrincipal';
+}
 /** `exists(<link-path>, <pred>)` — the inner predicate runs against the final target. */
  | {
     kind: 'exists';

package/dist/predicate-v2.js

@@ -1101,8 +1101,15 @@ var GUARDED_IR_VERSION = 2;
 var COMPOSED_IR_VERSION = 3;
 var SQL_IR_VERSION = 4;
 var RUNTIME_SQL_IR_VERSION = 5;
-var irVersionSchema = z.union([z.literal(LEGACY_IR_VERSION), z.literal(GUARDED_IR_VERSION), z.literal(COMPOSED_IR_VERSION), z.literal(SQL_IR_VERSION), z.literal(RUNTIME_SQL_IR_VERSION)]);
+var SERVICE_PRINCIPAL_IR_VERSION = 6;
+var irVersionSchema = z.union([z.literal(LEGACY_IR_VERSION), z.literal(GUARDED_IR_VERSION), z.literal(COMPOSED_IR_VERSION), z.literal(SQL_IR_VERSION), z.literal(RUNTIME_SQL_IR_VERSION), z.literal(SERVICE_PRINCIPAL_IR_VERSION)]);
 z.object({ irVersion: irVersionSchema });
+function usesServicePrincipal(value) {
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) return value.some(usesServicePrincipal);
+  const row = value;
+  return row.kind === "servicePrincipal" || Object.values(row).some(usesServicePrincipal);
+}
 var CLAIMS_CONTRACT = {
   sub: "string",
   org: "string?",
@@ -1154,6 +1161,7 @@ var predIrSchema = z.lazy(
     z.object({ kind: z.literal("capability"), key: z.string(), namespace: z.string().optional() }),
     z.object({ kind: z.literal("role"), key: z.string(), namespace: z.string().optional() }),
     z.object({ kind: z.literal("dynamicFilter"), slot: z.string() }),
+    z.object({ kind: z.literal("servicePrincipal") }).strict(),
     z.object({ kind: z.literal("const"), value: z.boolean() })
   ])
 );
@@ -1379,7 +1387,7 @@ var variableIrSchema = z.object({
   /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
   defaultValue: variableDefaultIrSchema.optional()
 });
-var sqlColumnSchema = z.object({ name: z.string(), type: z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz"]), nullable: z.boolean() });
+var sqlColumnSchema = z.object({ name: z.string(), type: z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz", "jsonb"]), nullable: z.boolean() });
 var compiledOperationSchema = z.object({
   language: z.literal("sql").optional(),
   /** Server-compiled object catalog and permission ceiling, never caller SQL. */
@@ -1417,6 +1425,9 @@ var compiledOperationSchema = z.object({
   tableSet: z.array(z.string()).min(1),
   roots: z.array(rootIrSchema)
 }).superRefine((operation, ctx) => {
+  if (operation.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(operation.roots)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (operation.language === "sql") {
     const validPlan = operation.sqlQuery ? !operation.sql && operation.irVersion === RUNTIME_SQL_IR_VERSION : !!operation.sql && operation.irVersion === SQL_IR_VERSION;
     const builtin = operation.name === "BuiltinSqlRead" && operation.opHash === BUILTIN_SQL_READ_HASH && operation.requires === null;
@@ -1549,6 +1560,9 @@ z.object({
   tables: z.record(z.string(), tableMetaIrSchema),
   operations: z.record(z.string(), compiledOperationSchema)
 }).superRefine((artifact, ctx) => {
+  if (artifact.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(artifact)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (Object.keys(artifact.dependencies ?? {}).length > 0 && artifact.irVersion < COMPOSED_IR_VERSION) {
     ctx.addIssue({ code: "custom", path: ["irVersion"], message: "cross-namespace dependencies require IR v3" });
   }
@@ -1690,6 +1704,12 @@ var Parser2 = class {
       }
       return node;
     }
+    if (this.peekKeyword("servicePrincipal") && this.tokens[this.index + 1]?.kind === "lparen") {
+      this.advance();
+      this.expect("lparen", "'(' after servicePrincipal");
+      this.expect("rparen", "')' closing servicePrincipal()");
+      return { kind: "servicePrincipal" };
+    }
     if (this.peekKeyword("exists")) return this.parseExists();
     if (this.peekKeyword("visible") && this.tokens[this.index + 1]?.kind === "lparen") return this.parseVisible();
     return this.parseComparison();
@@ -1902,6 +1922,8 @@ var PolicyCompiler = class _PolicyCompiler {
         return { kind: "capability", key: node.key };
       case "role":
         return { kind: "role", key: node.key };
+      case "servicePrincipal":
+        return { kind: "servicePrincipal" };
       case "exists":
         return this.compileExists(node.path, node.where, table, depth);
       case "visible":