@sequenceholdings/orm 2.6.2 → 2.7.1

package/dist/cli.cjs

@@ -1462,14 +1462,21 @@ function normalizeCanonical(definition) {
 var BUILTIN_SQL_READ_HASH = "sha256:a50c477c952a5e0fe68ed158a4530e4aab573c09bcbb1a8ac454dc88a39a6258";
 
 // src/ir/index.ts
-var IR_VERSION = 5;
+var IR_VERSION = 6;
 var LEGACY_IR_VERSION = 1;
 var GUARDED_IR_VERSION = 2;
 var COMPOSED_IR_VERSION = 3;
 var SQL_IR_VERSION = 4;
 var RUNTIME_SQL_IR_VERSION = 5;
-var irVersionSchema = zod.z.union([zod.z.literal(LEGACY_IR_VERSION), zod.z.literal(GUARDED_IR_VERSION), zod.z.literal(COMPOSED_IR_VERSION), zod.z.literal(SQL_IR_VERSION), zod.z.literal(RUNTIME_SQL_IR_VERSION)]);
+var SERVICE_PRINCIPAL_IR_VERSION = 6;
+var irVersionSchema = zod.z.union([zod.z.literal(LEGACY_IR_VERSION), zod.z.literal(GUARDED_IR_VERSION), zod.z.literal(COMPOSED_IR_VERSION), zod.z.literal(SQL_IR_VERSION), zod.z.literal(RUNTIME_SQL_IR_VERSION), zod.z.literal(SERVICE_PRINCIPAL_IR_VERSION)]);
 var operationVersionSchema = zod.z.object({ irVersion: irVersionSchema });
+function usesServicePrincipal(value) {
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) return value.some(usesServicePrincipal);
+  const row = value;
+  return row.kind === "servicePrincipal" || Object.values(row).some(usesServicePrincipal);
+}
 function requiredArtifactIrVersion(operations) {
   let required = LEGACY_IR_VERSION;
   for (const operation of operations) {
@@ -1529,6 +1536,7 @@ var predIrSchema = zod.z.lazy(
     zod.z.object({ kind: zod.z.literal("capability"), key: zod.z.string(), namespace: zod.z.string().optional() }),
     zod.z.object({ kind: zod.z.literal("role"), key: zod.z.string(), namespace: zod.z.string().optional() }),
     zod.z.object({ kind: zod.z.literal("dynamicFilter"), slot: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("servicePrincipal") }).strict(),
     zod.z.object({ kind: zod.z.literal("const"), value: zod.z.boolean() })
   ])
 );
@@ -1754,7 +1762,7 @@ var variableIrSchema = zod.z.object({
   /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
   defaultValue: variableDefaultIrSchema.optional()
 });
-var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz"]), nullable: zod.z.boolean() });
+var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz", "jsonb"]), nullable: zod.z.boolean() });
 var compiledOperationSchema = zod.z.object({
   language: zod.z.literal("sql").optional(),
   /** Server-compiled object catalog and permission ceiling, never caller SQL. */
@@ -1792,6 +1800,9 @@ var compiledOperationSchema = zod.z.object({
   tableSet: zod.z.array(zod.z.string()).min(1),
   roots: zod.z.array(rootIrSchema)
 }).superRefine((operation, ctx) => {
+  if (operation.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(operation.roots)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (operation.language === "sql") {
     const validPlan = operation.sqlQuery ? !operation.sql && operation.irVersion === RUNTIME_SQL_IR_VERSION : !!operation.sql && operation.irVersion === SQL_IR_VERSION;
     const builtin = operation.name === "BuiltinSqlRead" && operation.opHash === BUILTIN_SQL_READ_HASH && operation.requires === null;
@@ -1924,6 +1935,9 @@ var compiledArtifactSchema = zod.z.object({
   tables: zod.z.record(zod.z.string(), tableMetaIrSchema),
   operations: zod.z.record(zod.z.string(), compiledOperationSchema)
 }).superRefine((artifact, ctx) => {
+  if (artifact.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(artifact)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (Object.keys(artifact.dependencies ?? {}).length > 0 && artifact.irVersion < COMPOSED_IR_VERSION) {
     ctx.addIssue({ code: "custom", path: ["irVersion"], message: "cross-namespace dependencies require IR v3" });
   }
@@ -2232,6 +2246,12 @@ var Parser2 = class {
       }
       return node;
     }
+    if (this.peekKeyword("servicePrincipal") && this.tokens[this.index + 1]?.kind === "lparen") {
+      this.advance();
+      this.expect("lparen", "'(' after servicePrincipal");
+      this.expect("rparen", "')' closing servicePrincipal()");
+      return { kind: "servicePrincipal" };
+    }
     if (this.peekKeyword("exists")) return this.parseExists();
     if (this.peekKeyword("visible") && this.tokens[this.index + 1]?.kind === "lparen") return this.parseVisible();
     return this.parseComparison();
@@ -2444,6 +2464,8 @@ var PolicyCompiler = class _PolicyCompiler {
         return { kind: "capability", key: node.key };
       case "role":
         return { kind: "role", key: node.key };
+      case "servicePrincipal":
+        return { kind: "servicePrincipal" };
       case "exists":
         return this.compileExists(node.path, node.where, table, depth);
       case "visible":
@@ -3108,7 +3130,10 @@ function platformUserMeta() {
     { name: "role", columnName: "role", type: "text", nullable: true },
     { name: "managerId", columnName: "manager_id", type: "text", nullable: true },
     // NOT NULL DEFAULT true on chat.users, so non-null through the view.
-    { name: "accountEnabled", columnName: "account_enabled", type: "boolean", nullable: false }
+    { name: "accountEnabled", columnName: "account_enabled", type: "boolean", nullable: false },
+    { name: "canonicalSub", columnName: "canonical_sub", type: "text", nullable: false },
+    { name: "normalizedEmail", columnName: "normalized_email", type: "text", nullable: true },
+    { name: "emailDomain", columnName: "email_domain", type: "text", nullable: true }
   ];
   return {
     table: "users_directory",
@@ -5095,7 +5120,7 @@ function compileNamespace({ canonical, sdl, documents }) {
           }
         }
         operations[restricted.name] = {
-          irVersion: canonical.imports?.length ? COMPOSED_IR_VERSION : roots.some((root) => root.kind === "mutation" && root.assertAffectedRows !== void 0) ? GUARDED_IR_VERSION : LEGACY_IR_VERSION,
+          irVersion: usesServicePrincipal(roots) ? SERVICE_PRINCIPAL_IR_VERSION : canonical.imports?.length ? COMPOSED_IR_VERSION : roots.some((root) => root.kind === "mutation" && root.assertAffectedRows !== void 0) ? GUARDED_IR_VERSION : LEGACY_IR_VERSION,
           name: restricted.name,
           opHash: computeOpHash({ definition: flattened, schemaHash }),
           kind: restricted.kind,
@@ -5122,7 +5147,7 @@ function compileNamespace({ canonical, sdl, documents }) {
   }
   if (diagnostics.some((d) => d.severity === "error")) return { ok: false, diagnostics };
   const artifact = {
-    irVersion: canonical.imports?.length ? COMPOSED_IR_VERSION : requiredArtifactIrVersion(Object.values(operations)),
+    irVersion: usesServicePrincipal([...ctx.readPolicies.values(), ...ctx.writePolicies.values(), ...ctx.insertPolicies.values(), ...ctx.updatePolicies.values(), ...Object.values(operations)]) ? SERVICE_PRINCIPAL_IR_VERSION : canonical.imports?.length ? COMPOSED_IR_VERSION : requiredArtifactIrVersion(Object.values(operations)),
     namespace: ctx.namespace,
     schemaHash,
     ownSchemaHash: computeSchemaHash(localContract(canonical)),
@@ -5176,6 +5201,8 @@ function compilePredIrToSql(pred, options = {}) {
       return `(NOT ${compilePredIrToSql(pred.operand, options)})`;
     case "cmp":
       return compileCmp(pred.op, pred.column, pred.value, options);
+    case "servicePrincipal":
+      return `coalesce(${claimExpression("servicePrincipal")} = 'true', false)`;
     case "capability":
       return `(${options.statementClaimChecks ? "SELECT " : ""}${capabilityExpression(pred.key, pred.namespace ?? options.namespace)})`;
     case "role":
@@ -5278,6 +5305,39 @@ function compileArrayValue(value, columnType, _options) {
   return columnType ? `${array}::${sqlTypeName(columnType)}[]` : array;
 }
 
+// src/compiler/static-policy-sql.ts
+function compileStaticPolicySql({ table, predicate, tables, namespace, alias, rootRelation, statementClaimChecks, onRead }) {
+  let sequence = 0;
+  const aliases = new Set([alias, rootRelation].filter((value) => value !== void 0));
+  const column = (meta, qualifier, name2) => {
+    const found = meta.columns.find((c) => c.name === name2 || c.columnName === name2);
+    if (!found) throw new OrmDefinitionError("Static policy relationship column is unavailable");
+    return `${quoteIdentifier(qualifier)}.${quoteIdentifier(found.columnName)}`;
+  };
+  const render = (meta, pred, qualifier, outerRelation) => compilePredIrToSql(pred, {
+    alias: qualifier,
+    namespace: meta.namespace ?? namespace,
+    statementClaimChecks,
+    columnNames: Object.fromEntries(meta.columns.map((c) => [c.name, c.columnName])),
+    columnTypes: Object.fromEntries(meta.columns.map((c) => [c.name, c.type])),
+    exists: (node) => {
+      const link = meta.links.find((candidate) => candidate.name === node.link);
+      const target = link?.target ? tables[link.target] : void 0;
+      const parent = qualifier ?? outerRelation;
+      if (!link || !target || !parent) throw new OrmDefinitionError("Static policy relationship metadata is unavailable");
+      onRead?.(target);
+      let child;
+      do {
+        child = `policy_${++sequence}`;
+      } while (aliases.has(child));
+      aliases.add(child);
+      const join5 = link.kind === "toMany" ? `${column(target, child, link.on)} = ${column(meta, parent, link.references)}` : `${column(meta, parent, link.on)} = ${column(target, child, link.references)}`;
+      return `EXISTS (SELECT 1 FROM ${quoteIdentifier(target.schema)}.${quoteIdentifier(target.table)} AS ${quoteIdentifier(child)} WHERE ${join5} AND (${render(target, node.where, child)}))`;
+    }
+  });
+  return render(table, predicate, alias, rootRelation);
+}
+
 // src/sql/catalog.ts
 function sqlHash(value) {
   return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`;
@@ -5298,27 +5358,6 @@ function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
     const meta = Object.values(ctx.tables).find((table) => refOf(table) === ref);
     if (!meta || internal.has(ref) || meta.namespace !== canonical.namespace && !meta.exportRead) throw new Error(`SQL object not published: ${ref}`);
     const reads = /* @__PURE__ */ new Set([ref]);
-    let sequence = 0;
-    const predicate = (table, pred, alias) => compilePredIrToSql(pred, {
-      alias,
-      namespace: table.namespace ?? canonical.namespace,
-      columnNames: Object.fromEntries(table.columns.map((c) => [c.name, c.columnName])),
-      columnTypes: Object.fromEntries(table.columns.map((c) => [c.name, c.type])),
-      exists: (node) => {
-        const link = table.links.find((candidate) => candidate.name === node.link);
-        const target = link?.target ? ctx.tables[link.target] : void 0;
-        if (!link || !target) throw new Error("SQL policy link is unavailable");
-        reads.add(refOf(target));
-        const child = `p${++sequence}`;
-        const col = (t2, a, name2) => {
-          const c = t2.columns.find((c2) => c2.name === name2 || c2.columnName === name2);
-          if (!c) throw new Error("SQL policy column is unavailable");
-          return `${quoteIdentifier(a)}.${quoteIdentifier(c.columnName)}`;
-        };
-        const join5 = link.kind === "toMany" ? `${col(target, child, link.on)} = ${col(table, alias, link.references)}` : `${col(table, alias, link.on)} = ${col(target, child, link.references)}`;
-        return `EXISTS (SELECT 1 FROM ${quoteIdentifier(target.schema)}.${quoteIdentifier(target.table)} AS ${quoteIdentifier(child)} WHERE ${join5} AND (${predicate(target, node.where, child)}))`;
-      }
-    });
     const columns = meta.columns.filter((c) => meta.filterable.includes(c.name)).map((c) => ({
       name: c.name,
       type: typeof c.type === "string" ? c.type : "text",
@@ -5329,7 +5368,7 @@ function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
       return `${quoteIdentifier("p0")}.${quoteIdentifier(physical.columnName)}${typeof physical.type === "object" ? "::text" : ""} AS ${quoteIdentifier(c.name)}`;
     }).join(", ");
     const policy = ctx.readPolicies.get(meta.table) ?? { kind: "const", value: true };
-    const scan = `SELECT ${projection} FROM ${quoteIdentifier(meta.schema)}.${quoteIdentifier(meta.table)} AS ${quoteIdentifier("p0")} WHERE ${predicate(meta, policy, "p0")}`;
+    const scan = `SELECT ${projection} FROM ${quoteIdentifier(meta.schema)}.${quoteIdentifier(meta.table)} AS ${quoteIdentifier("p0")} WHERE ${compileStaticPolicySql({ table: meta, predicate: policy, tables: ctx.tables, namespace: canonical.namespace, alias: "p0", onRead: (target) => reads.add(refOf(target)) })}`;
     return { ref, table: meta.table, columns, scan, read: [...reads].sort() };
   });
   return { identity, objects };
@@ -5953,7 +5992,7 @@ async function managedViewDiagnostics(canonical) {
 }
 
 // src/sql/codegen.ts
-var typeOf = (type) => ["integer", "double"].includes(type) ? "number" : type === "boolean" ? "boolean" : "string";
+var typeOf = (type) => ["integer", "double"].includes(type) ? "number" : type === "boolean" ? "boolean" : type === "jsonb" ? "unknown" : "string";
 function generateSqlOperations({ artifact }) {
   const dynamic = Object.values(artifact.operations).some((op) => op.sqlQuery);
   const lines = [
@@ -5990,6 +6029,15 @@ ${variables}
   return `${lines.join("\n").trimEnd()}
 `;
 }
+
+// src/runtime-capabilities.ts
+function assertServicePrincipalRuntime(value) {
+  const row = value !== null && typeof value === "object" ? value : {};
+  const predicates = row.policyPredicates;
+  if (typeof row.maxIrVersion !== "number" || row.maxIrVersion < 6 || !Array.isArray(predicates) || !predicates.includes("servicePrincipal")) {
+    throw new Error("The target ORM runtime does not support servicePrincipal() / IR v6; deploy the reviewed runtime before applying this namespace");
+  }
+}
 var ENUM_BRAND = "seq-enum";
 function isEnumRef(value) {
   return typeof value === "object" && value !== null && value.kind === ENUM_BRAND;
@@ -6241,6 +6289,11 @@ function serializeNamespace(input) {
     enumsByName.set(ref.name, ref);
   }
   const canonicalTables = tables.map((table) => buildCanonicalTable({ table, relationsByName, enumsByName }));
+  for (const table of tables) {
+    if (table.source !== void 0 && table.config.internal === true && config.exports && Object.hasOwn(config.exports, table.tableName)) {
+      throw new OrmDefinitionError(`internal synced source "${table.tableName}" cannot be exported; export a permitted managed view instead`, table.file);
+    }
+  }
   const canonicalEnums = [...enumsByName.values()].map((ref) => ({
     name: ref.name,
     values: [...ref.values]
@@ -6574,6 +6627,9 @@ function buildCanonicalLink({
   if (!relationsByName.has(targetName)) {
     return fail4(`targets ${relationKind(target)} "${targetName}" which is not part of this namespace`);
   }
+  if (isSeqTable(target) && target.source !== void 0 && target.config.internal === true) {
+    return fail4(`targets internal synced source "${targetName}"; expose a permitted managed view instead`);
+  }
   if (link.enforce && (!isSeqTable(relation) || !isSeqTable(target))) {
     return fail4("cannot enforce a PostgreSQL foreign key involving a view");
   }
@@ -11965,6 +12021,10 @@ async function applyV2Command(rest, dir) {
   }
   const { loaded, sdl, documents, manifest } = compiled.project;
   const namespace = loaded.canonical.namespace;
+  if (compiled.project.artifact.irVersion >= SERVICE_PRINCIPAL_IR_VERSION || usesServicePrincipal(compiled.project.artifact)) {
+    const support = await apiRequestStrict("GET", "/api/orm/runtime-capabilities");
+    assertServicePrincipalRuntime(support);
+  }
   const workspace = await readMigrationWorkspace(dir, namespace);
   const migration = await loadCommittedTipMigrationV2({ dir, loaded, workspace });
   const registered = await apiRequestStrict("POST", "/api/orm/namespaces", {