@sequenceholdings/orm 2.7.1 → 2.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sequenceholdings/orm",
-  "version": "2.7.1",
+  "version": "2.8.1",
   "description": "Sequence ORM v2 — TypeScript-defined governed tables and persisted GraphQL operations",
   "license": "UNLICENSED",
   "repository": {

package/templates/orm-namespace/graphql/example/queries.ts

@@ -1,13 +1,17 @@
 /**
  * Handwritten GraphQL operations. `seq-studio orm apply` compiles every
- * exported document at push time; the wire carries only `{ op: <hash>,
- * variables }` — never query text, never SQL. Type names come from the
- * generated `schema.graphql` (`seq-studio orm generate`).
+ * exported document at push time; the wire carries only `{ op, variables }`
+ * (`op` is the operation's hash or its name) — never query text, never SQL.
+ * Type names come from the generated `schema.graphql` (`seq-studio orm generate`).
  *
  * Gate an operation with `@requires(capability: "…")` — checked before
  * execution, on top of the table policies that are always compiled in.
- * Check capabilities, not roles: roles are created in Atlas and can change
- * there.
+ * Check capabilities, not roles: roles are created and edited in Atlas
+ * (`seq-studio access`), and grant the capabilities your code checks.
+ *
+ * Optional variables follow GraphQL input rules: leave one out and its field is
+ * omitted (the column default applies on insert; the column is left alone on
+ * update); pass `null` to write NULL.
  */
 
 export const GetOpenDeals = /* GraphQL */ `
@@ -55,3 +59,46 @@ export const AddComment = /* GraphQL */ `
     }
   }
 `
+
+/** Create, read, update, and delete one deal by primary key. The table's write policy governs every write. */
+export const CreateDeal = /* GraphQL */ `
+  mutation CreateDeal($title: String!, $status: DealStatus, $amount: numeric) {
+    insertDealsOne(object: { title: $title, status: $status, amount: $amount }) {
+      id
+      title
+      status
+      amount
+    }
+  }
+`
+
+export const GetDeal = /* GraphQL */ `
+  query GetDeal($id: uuid!) {
+    dealsByPk(id: $id) {
+      id
+      title
+      status
+      amount
+      createdAt
+    }
+  }
+`
+
+export const UpdateDeal = /* GraphQL */ `
+  mutation UpdateDeal($id: uuid!, $title: String, $status: DealStatus, $amount: numeric) {
+    updateDealsByPk(pkColumns: { id: $id }, _set: { title: $title, status: $status, amount: $amount }) {
+      id
+      title
+      status
+      amount
+    }
+  }
+`
+
+export const DeleteDeal = /* GraphQL */ `
+  mutation DeleteDeal($id: uuid!) {
+    deleteDealsByPk(id: $id) {
+      id
+    }
+  }
+`

package/templates/orm-namespace/schema/tables.ts

@@ -11,7 +11,8 @@ import {
  * Every table carries its own row-level policies. The policy DSL:
  *   - `claim('sub')` / `claim('org')` — the caller's identity claims
  *   - `capability('x')` — boolean grant, resolved per caller (check
- *     capabilities, not roles: roles are created in Atlas and can change)
+ *     capabilities, not roles: roles are created and edited in Atlas with
+ *     `seq-studio access`, and grant the capabilities declared in code)
  *   - `exists(link, <predicate>)` — traverse a declared link
  *   - variants: `default` applies to everyone; each variant WIDENS access
  *     when its `when` guard matches (permissive union — grants only ever
@@ -47,7 +48,9 @@ export const deals: SeqTable = defineTable(
           { when: "capability('deals-admin')", allow: true },
         ],
       },
-      write: "author_sub = claim('sub')",
+      // Equalities to claims pin those columns: inserts stamp them from the
+      // caller, so CreateDeal never takes an org or author.
+      write: "author_sub = claim('sub') and org = claim('org')",
     },
   },
 )

package/templates/orm-namespace/sequence.config.ts

@@ -3,10 +3,12 @@ import { defineNamespace } from '@sequenceholdings/orm/authoring'
 /**
  * The namespace config — exactly one per directory.
  *
- * Capabilities are DECLARED here (verbatim custom-roles grammar) — the
- * contract your policies check with `capability('…')`. Roles that bundle
- * them are created in Atlas (the namespace's Roles tab), and who HOLDS them
- * is granted there too, never in code.
+ * Capabilities are code: DECLARE them here (verbatim custom-roles grammar) —
+ * the contract your policies and `@requires` check with `capability('…')`.
+ * Roles are data: create and edit the roles that bundle these capabilities in
+ * Atlas (`seq-studio access`, or the namespace's Roles tab), and grant who
+ * holds them there too. Don't define roles here — `definitions` is a
+ * deprecated one-time seed that later applies never update.
  */
 export default defineNamespace({
   // Rename me: the namespace becomes your Postgres schema (orm_<namespace>).

package/dist/{definition-DjfC7Lll.d.cts → definition-B99BsOAO.d.cts}

@@ -17,12 +17,12 @@ declare const fixed: z.ZodObject<{
             bigint: "bigint";
             boolean: "boolean";
             date: "date";
-            text: "text";
-            timestamptz: "timestamptz";
             uuid: "uuid";
+            text: "text";
             integer: "integer";
             numeric: "numeric";
             double: "double";
+            timestamptz: "timestamptz";
         }>;
         required: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strict>>>;
@@ -59,12 +59,12 @@ declare const sqlOperationDefinitionSchema: z.ZodUnion<readonly [z.ZodObject<{
             bigint: "bigint";
             boolean: "boolean";
             date: "date";
-            text: "text";
-            timestamptz: "timestamptz";
             uuid: "uuid";
+            text: "text";
             integer: "integer";
             numeric: "numeric";
             double: "double";
+            timestamptz: "timestamptz";
         }>;
         required: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strict>>>;

package/dist/{definition-DjfC7Lll.d.ts → definition-B99BsOAO.d.ts}

@@ -17,12 +17,12 @@ declare const fixed: z.ZodObject<{
             bigint: "bigint";
             boolean: "boolean";
             date: "date";
-            text: "text";
-            timestamptz: "timestamptz";
             uuid: "uuid";
+            text: "text";
             integer: "integer";
             numeric: "numeric";
             double: "double";
+            timestamptz: "timestamptz";
         }>;
         required: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strict>>>;
@@ -59,12 +59,12 @@ declare const sqlOperationDefinitionSchema: z.ZodUnion<readonly [z.ZodObject<{
             bigint: "bigint";
             boolean: "boolean";
             date: "date";
-            text: "text";
-            timestamptz: "timestamptz";
             uuid: "uuid";
+            text: "text";
             integer: "integer";
             numeric: "numeric";
             double: "double";
+            timestamptz: "timestamptz";
         }>;
         required: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strict>>>;