@sequenceholdings/orm 2.7.0 → 2.7.1

package/README.md

@@ -131,6 +131,37 @@ Execute uses the `/_data/v2` endpoint by default. Set
 `SEQUENCE_ORM_ATLAS_EXECUTE_V2=1` to opt into Atlas's `/api/data/v2` endpoint.
 This client rollout switch does not bypass server feature flags or authorization.
 
+## Internal synced dependencies
+
+Use `internal: true` on a typed, keyed `defineSyncedTable` when its rows are
+inputs to a managed view and must not be queried directly. The reflected source
+and its read policy remain available inside the view. Internal sources are
+excluded from GraphQL roots and links, default SQL, and registered SQL object
+ceilings. A missing persisted operation alone does not make a source private.
+Authoring rejects declared links targeting an internal synced source and
+rejects exporting it. This also prevents dynamic predicates from reaching it
+through hidden intermediate relations or cross-namespace links.
+
+```ts
+const privacy = defineSyncedTable("privacy", {
+  uid: t.text().primaryKey(),
+  restricted: t.boolean().notNull(),
+}, { source: "gold.customer_privacy", internal: true, policies: { read: "true" } });
+if (privacy.config.internal !== true) {
+  throw new Error("Upgrade the ORM SDK: internal synced dependencies are required.");
+}
+```
+
+Publish only the permitted projection through `defineView`, with its own read
+policy. Declaring `internal` does not grant access to the source or change row
+policies. The existing unkeyed-source restrictions remain in force.
+
+This authoring addition needs a released SDK containing the option. The existing
+Atlas internal-object exclusion remains the runtime boundary; do not replace
+the declaration with casts or edits to generated canonical JSON. ORM releases
+use the separate [Studio CLI chain release workflow](https://github.com/sequenceholdings/studio/blob/main/.changeset/README.md#studio-cli-chain-releases);
+chain packages do not use Changesets.
+
 ## Default read-only SQL (introduced in 2.6.0)
 
 With the matching SDK and Atlas rollout, every active v2 namespace supports

package/dist/authoring.cjs

@@ -387,6 +387,7 @@ function defineSyncedTable(name2, columnsOrConfig, maybeConfig) {
   if (config.primaryKey !== void 0) tableConfig.primaryKey = config.primaryKey;
   if (config.links !== void 0) tableConfig.links = config.links;
   if (config.policies !== void 0) tableConfig.policies = { read: config.policies.read };
+  if (config.internal === true) tableConfig.internal = true;
   const table = {
     kind: TABLE_BRAND,
     tableName: name2,
@@ -2748,6 +2749,11 @@ function serializeNamespace(input) {
     enumsByName.set(ref.name, ref);
   }
   const canonicalTables = tables.map((table) => buildCanonicalTable({ table, relationsByName, enumsByName }));
+  for (const table of tables) {
+    if (table.source !== void 0 && table.config.internal === true && config.exports && Object.hasOwn(config.exports, table.tableName)) {
+      throw new OrmDefinitionError(`internal synced source "${table.tableName}" cannot be exported; export a permitted managed view instead`, table.file);
+    }
+  }
   const canonicalEnums = [...enumsByName.values()].map((ref) => ({
     name: ref.name,
     values: [...ref.values]
@@ -3081,6 +3087,9 @@ function buildCanonicalLink({
   if (!relationsByName.has(targetName)) {
     return fail(`targets ${relationKind(target)} "${targetName}" which is not part of this namespace`);
   }
+  if (isSeqTable(target) && target.source !== void 0 && target.config.internal === true) {
+    return fail(`targets internal synced source "${targetName}"; expose a permitted managed view instead`);
+  }
   if (link.enforce && (!isSeqTable(relation) || !isSeqTable(target))) {
     return fail("cannot enforce a PostgreSQL foreign key involving a view");
   }