@sequenceholdings/orm 2.7.0 → 2.8.1

package/README.md

@@ -38,7 +38,7 @@ seq-studio orm apply . -e <environment-name>
 ```
 
 `generate` writes `schema.graphql`, `operations.manifest.json`, cache policies,
-and typed consumer modules. Generated SDL may contain up to 16 MiB of UTF-8
+typed operation modules. Generated SDL may contain up to 16 MiB of UTF-8
 text for the complete namespace; individual authored files retain a 1 MiB cap.
 Registration and reviewed migration exports are bounded to 64 MiB including
 canonical metadata, snapshots, documents, and migration statements.
@@ -127,9 +127,43 @@ seq-studio orm execute GetOpenDeals . \
 `variables.json` must contain a JSON object. The platform validates variables,
 operation requirements, and row policies as the signed-in caller.
 
-Execute uses the `/_data/v2` endpoint by default. Set
-`SEQUENCE_ORM_ATLAS_EXECUTE_V2=1` to opt into Atlas's `/api/data/v2` endpoint.
-This client rollout switch does not bypass server feature flags or authorization.
+Execute posts to Atlas's `/api/data/v2` endpoint. The hash comes from this
+checkout's `operations.manifest.json`, so when the deployed version hashes the
+operation differently the server answers 404. Execute then reports the local
+and deployed hashes and the deployed version. `seq-studio orm execute
+<namespace> <operation>` runs the deployed version's operation by name without a
+checkout.
+
+## Internal synced dependencies
+
+Use `internal: true` on a typed, keyed `defineSyncedTable` when its rows are
+inputs to a managed view and must not be queried directly. The reflected source
+and its read policy remain available inside the view. Internal sources are
+excluded from GraphQL roots and links, default SQL, and registered SQL object
+ceilings. A missing persisted operation alone does not make a source private.
+Authoring rejects declared links targeting an internal synced source and
+rejects exporting it. This also prevents dynamic predicates from reaching it
+through hidden intermediate relations or cross-namespace links.
+
+```ts
+const privacy = defineSyncedTable("privacy", {
+  uid: t.text().primaryKey(),
+  restricted: t.boolean().notNull(),
+}, { source: "gold.customer_privacy", internal: true, policies: { read: "true" } });
+if (privacy.config.internal !== true) {
+  throw new Error("Upgrade the ORM SDK: internal synced dependencies are required.");
+}
+```
+
+Publish only the permitted projection through `defineView`, with its own read
+policy. Declaring `internal` does not grant access to the source or change row
+policies. The existing unkeyed-source restrictions remain in force.
+
+This authoring addition needs a released SDK containing the option. The existing
+Atlas internal-object exclusion remains the runtime boundary; do not replace
+the declaration with casts or edits to generated canonical JSON. ORM releases
+use the separate [Studio CLI chain release workflow](https://github.com/sequenceholdings/studio/blob/main/.changeset/README.md#studio-cli-chain-releases);
+chain packages do not use Changesets.
 
 ## Default read-only SQL (introduced in 2.6.0)
 
@@ -251,3 +285,14 @@ provider to wire a generated client.
 Affected namespaces require IR v6, including namespaces that only declare a write policy and have no operations. `orm apply` first checks the authenticated target's `/api/orm/runtime-capabilities` response; a missing or older endpoint blocks registration. The compiler and executor also reject an incompatible IR version. Publish the matching ORM and deploy its runtime before activating these policies. Service identity does not grant namespace access, operation capability, declared data scope or row access by itself.
 
 ORM 2.7.0 and downstream Artifact Studio 0.10.0, Managed Functions 0.4.4, Pipeline Spec 0.2.6 and Studio CLI 0.6.6 remain prepared for the separate chain-release workflow and awaiting publication. Their workspace dependencies are pinned to this ORM version when packed; no candidate build constitutes registry evidence.
+
+## Default object operations
+
+Discover object-specific `GetCustomer`, `ListCustomers`, `CreateCustomer`,
+`UpdateCustomer`, and `DeleteCustomer` contracts through the ORM catalog, then
+execute their current hashes through the existing Data API. Read-only objects
+expose reads; writes retain the existing schema and policy requirements.
+Authored operations with matching names take precedence. No default count or
+link-traversal operation is added. TypeScript wrappers remain deferred.
+
+See [default object operations](../../../docs/platform/orm-default-operations.md).

package/dist/authoring.cjs

@@ -281,6 +281,22 @@ function toPlatformUser(options) {
 function isSeqLink(value) {
   return typeof value === "object" && value !== null && value.kind === LINK_BRAND;
 }
+var TABLE_CONFIG_KEYS = /* @__PURE__ */ new Set([
+  "displayName",
+  "description",
+  "renamedFrom",
+  "primaryKey",
+  "indexes",
+  "checks",
+  "foreignKeys",
+  "links",
+  "policies",
+  "cowMutations",
+  "cellMetadata",
+  "cellRevisions",
+  "materializes",
+  "internal"
+]);
 function isSeqTable(value) {
   return typeof value === "object" && value !== null && value.kind === TABLE_BRAND;
 }
@@ -295,6 +311,11 @@ function assertIdentifier({ value, what, file, pattern = IDENTIFIER_PATTERN }) {
 function defineTable(name2, columns, config = {}) {
   const file = activeAuthoringContext()?.currentFile;
   assertIdentifier({ value: name2, what: "table name", file });
+  for (const key of Object.keys(config)) {
+    if (!TABLE_CONFIG_KEYS.has(key)) {
+      throw new OrmDefinitionError(`table "${name2}": unknown defineTable option "${key}"`, file);
+    }
+  }
   const entries = Object.entries(columns);
   if (entries.length === 0) {
     throw new OrmDefinitionError(`table "${name2}" declares no columns`, file);
@@ -387,6 +408,7 @@ function defineSyncedTable(name2, columnsOrConfig, maybeConfig) {
   if (config.primaryKey !== void 0) tableConfig.primaryKey = config.primaryKey;
   if (config.links !== void 0) tableConfig.links = config.links;
   if (config.policies !== void 0) tableConfig.policies = { read: config.policies.read };
+  if (config.internal === true) tableConfig.internal = true;
   const table = {
     kind: TABLE_BRAND,
     tableName: name2,
@@ -2748,6 +2770,11 @@ function serializeNamespace(input) {
     enumsByName.set(ref.name, ref);
   }
   const canonicalTables = tables.map((table) => buildCanonicalTable({ table, relationsByName, enumsByName }));
+  for (const table of tables) {
+    if (table.source !== void 0 && table.config.internal === true && config.exports && Object.hasOwn(config.exports, table.tableName)) {
+      throw new OrmDefinitionError(`internal synced source "${table.tableName}" cannot be exported; export a permitted managed view instead`, table.file);
+    }
+  }
   const canonicalEnums = [...enumsByName.values()].map((ref) => ({
     name: ref.name,
     values: [...ref.values]
@@ -3081,6 +3108,9 @@ function buildCanonicalLink({
   if (!relationsByName.has(targetName)) {
     return fail(`targets ${relationKind(target)} "${targetName}" which is not part of this namespace`);
   }
+  if (isSeqTable(target) && target.source !== void 0 && target.config.internal === true) {
+    return fail(`targets internal synced source "${targetName}"; expose a permitted managed view instead`);
+  }
   if (link.enforce && (!isSeqTable(relation) || !isSeqTable(target))) {
     return fail("cannot enforce a PostgreSQL foreign key involving a view");
   }