@sequenceholdings/orm 2.8.5 → 2.10.0

package/dist/cli.d.cts

@@ -1,6 +1,22 @@
 /** Set by the seq-studio delegate; direct users export them. */
 declare const BASE_URL_ENV = "SEQUENCE_ORM_BASE_URL";
 declare const TOKEN_ENV = "SEQUENCE_ORM_TOKEN";
+/** JSON `{repository_id, commit, path, dirty?}` naming the Git Service source of this apply; set by the seq-studio delegate. */
+declare const SOURCE_ENV = "SEQUENCE_ORM_SOURCE";
+/** Namespace-admin override reason for an apply whose source does not verify; set by `seq-studio orm apply --unverified-source`. */
+declare const UNVERIFIED_SOURCE_REASON_ENV = "SEQUENCE_ORM_UNVERIFIED_SOURCE_REASON";
+/**
+ * The caller's token for the source claim's `source_environment`; set by `seq-studio orm apply --source-env`.
+ * Only the apply request carries it (as `x-sequence-source-authorization`), so Atlas can read the source there.
+ */
+declare const SOURCE_AUTHORIZATION_ENV = "SEQUENCE_ORM_SOURCE_AUTHORIZATION";
+/** The apply request's source environment credential header, when the delegate supplied one. */
+declare function applySourceHeaders(env?: NodeJS.ProcessEnv): Record<string, string>;
+/** The apply body's `source` claim, when the delegate supplied one. Atlas verifies it; it never authorizes anything. */
+declare function applySourceFromEnv(env?: NodeJS.ProcessEnv): {
+    source?: Record<string, unknown>;
+    unverified_source_reason?: string;
+};
 /**
  * Test/dev hook mirroring `LoadNamespaceOptions.ormModulePath`: when set, bare
  * `'@sequenceholdings/orm'` imports in consumer files resolve to this path
@@ -12,6 +28,8 @@ type TokenProvider = () => Promise<string | null>;
 /** Hand the CLI a refreshing token source (used by the seq-studio delegate). */
 declare function setTokenProvider(provider: TokenProvider): void;
 declare function runCli(argv: readonly string[]): Promise<number>;
+/** Where the live version came from: `live since <time> from <commit> on <branch> at <path> by <actor>`. */
+declare function describeActivation(activation: RegistryActivation): string;
 interface ApplyWait {
     wait: boolean;
     timeoutMs: number;
@@ -24,5 +42,18 @@ declare function parseApplyWait(rest: readonly string[]): ApplyWait;
  * details name the variable, column, constraint, or requirement at fault.
  */
 declare function errorDetail(payload: unknown): string | null;
+/** One row of the namespace's activation history, as the detail route returns it (absent on older Atlas). */
+interface RegistryActivation {
+    id: string;
+    provenance_class: string;
+    /** Absent on an older Atlas; null for this deployment's own Git Service. */
+    source_environment?: string | null;
+    source_commit: string | null;
+    source_branch: string | null;
+    source_path: string | null;
+    reported_source: Record<string, unknown> | null;
+    actor_sub: string;
+    activated_at: string;
+}
 
-export { BASE_URL_ENV, ORM_MODULE_PATH_ENV, TOKEN_ENV, errorDetail, parseApplyWait, runCli, setTokenProvider };
+export { BASE_URL_ENV, ORM_MODULE_PATH_ENV, type RegistryActivation, SOURCE_AUTHORIZATION_ENV, SOURCE_ENV, TOKEN_ENV, UNVERIFIED_SOURCE_REASON_ENV, applySourceFromEnv, applySourceHeaders, describeActivation, errorDetail, parseApplyWait, runCli, setTokenProvider };

package/dist/cli.d.ts

@@ -1,6 +1,22 @@
 /** Set by the seq-studio delegate; direct users export them. */
 declare const BASE_URL_ENV = "SEQUENCE_ORM_BASE_URL";
 declare const TOKEN_ENV = "SEQUENCE_ORM_TOKEN";
+/** JSON `{repository_id, commit, path, dirty?}` naming the Git Service source of this apply; set by the seq-studio delegate. */
+declare const SOURCE_ENV = "SEQUENCE_ORM_SOURCE";
+/** Namespace-admin override reason for an apply whose source does not verify; set by `seq-studio orm apply --unverified-source`. */
+declare const UNVERIFIED_SOURCE_REASON_ENV = "SEQUENCE_ORM_UNVERIFIED_SOURCE_REASON";
+/**
+ * The caller's token for the source claim's `source_environment`; set by `seq-studio orm apply --source-env`.
+ * Only the apply request carries it (as `x-sequence-source-authorization`), so Atlas can read the source there.
+ */
+declare const SOURCE_AUTHORIZATION_ENV = "SEQUENCE_ORM_SOURCE_AUTHORIZATION";
+/** The apply request's source environment credential header, when the delegate supplied one. */
+declare function applySourceHeaders(env?: NodeJS.ProcessEnv): Record<string, string>;
+/** The apply body's `source` claim, when the delegate supplied one. Atlas verifies it; it never authorizes anything. */
+declare function applySourceFromEnv(env?: NodeJS.ProcessEnv): {
+    source?: Record<string, unknown>;
+    unverified_source_reason?: string;
+};
 /**
  * Test/dev hook mirroring `LoadNamespaceOptions.ormModulePath`: when set, bare
  * `'@sequenceholdings/orm'` imports in consumer files resolve to this path
@@ -12,6 +28,8 @@ type TokenProvider = () => Promise<string | null>;
 /** Hand the CLI a refreshing token source (used by the seq-studio delegate). */
 declare function setTokenProvider(provider: TokenProvider): void;
 declare function runCli(argv: readonly string[]): Promise<number>;
+/** Where the live version came from: `live since <time> from <commit> on <branch> at <path> by <actor>`. */
+declare function describeActivation(activation: RegistryActivation): string;
 interface ApplyWait {
     wait: boolean;
     timeoutMs: number;
@@ -24,5 +42,18 @@ declare function parseApplyWait(rest: readonly string[]): ApplyWait;
  * details name the variable, column, constraint, or requirement at fault.
  */
 declare function errorDetail(payload: unknown): string | null;
+/** One row of the namespace's activation history, as the detail route returns it (absent on older Atlas). */
+interface RegistryActivation {
+    id: string;
+    provenance_class: string;
+    /** Absent on an older Atlas; null for this deployment's own Git Service. */
+    source_environment?: string | null;
+    source_commit: string | null;
+    source_branch: string | null;
+    source_path: string | null;
+    reported_source: Record<string, unknown> | null;
+    actor_sub: string;
+    activated_at: string;
+}
 
-export { BASE_URL_ENV, ORM_MODULE_PATH_ENV, TOKEN_ENV, errorDetail, parseApplyWait, runCli, setTokenProvider };
+export { BASE_URL_ENV, ORM_MODULE_PATH_ENV, type RegistryActivation, SOURCE_AUTHORIZATION_ENV, SOURCE_ENV, TOKEN_ENV, UNVERIFIED_SOURCE_REASON_ENV, applySourceFromEnv, applySourceHeaders, describeActivation, errorDetail, parseApplyWait, runCli, setTokenProvider };

package/dist/cli.js

@@ -102,6 +102,8 @@ function materializedRefreshFunctionName(table) {
 function materializeLockKey(schema, table) {
   return `orm:materialize:${schema}.${table}`;
 }
+var OPERATION_DOCUMENTS_FILE = "operations.documents.json";
+var OPERATION_DOCUMENTS_VERSION = 1;
 
 // src/hash.ts
 function stableJson(value) {
@@ -1811,19 +1813,20 @@ var variableIrSchema = z.object({
   defaultValue: variableDefaultIrSchema.optional()
 });
 var sqlColumnSchema = z.object({ name: z.string(), type: z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz", "jsonb"]), nullable: z.boolean() });
+var sqlObjectIrSchema = z.object({
+  ref: z.string(),
+  table: z.string(),
+  columns: z.array(sqlColumnSchema.extend({ type: z.string() })).min(1),
+  scan: z.string().min(1),
+  read: z.array(z.string()).min(1)
+}).strict();
 var compiledOperationSchema = z.object({
   language: z.literal("sql").optional(),
   /** Server-compiled object catalog and permission ceiling, never caller SQL. */
   sqlQuery: z.object({
     catalog: z.object({
       identity: z.string(),
-      objects: z.array(z.object({
-        ref: z.string(),
-        table: z.string(),
-        columns: z.array(sqlColumnSchema.extend({ type: z.string() })).min(1),
-        scan: z.string().min(1),
-        read: z.array(z.string()).min(1)
-      }).strict()).min(1).max(256)
+      objects: z.array(sqlObjectIrSchema).min(1).max(256)
     }).strict(),
     read: z.array(z.string()).min(1).max(256),
     maxRows: z.number().int().min(1).max(1e4)
@@ -2483,6 +2486,7 @@ var FLIPPED = {
   ">=": "<="
 };
 function resolveTable(resolver, table) {
+  resolver.onTable?.(table);
   const info = resolver.tables[table];
   if (!info) {
     throw new PolicyCompileError(`unknown table '${table}'`, "unknown-table", Object.keys(resolver.tables));
@@ -5398,10 +5402,13 @@ function sqlHash(value) {
   return `sha256:${createHash("sha256").update(value).digest("hex")}`;
 }
 function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
-  if (!publishedObjects.length || new Set(publishedObjects).size !== publishedObjects.length) throw new Error("SQL objects must be explicitly declared and unique");
   const { ctx, diagnostics } = buildCompileContext(canonical);
   if (diagnostics.some((d) => d.severity === "error")) throw new Error(diagnostics.map((d) => d.message).join("; "));
-  const identity = sqlHash(`ontology-sql-v1\0${computeSchemaHash(canonical)}\0${executionTarget}`);
+  return createSqlCatalogFromContext({ canonical, publishedObjects, executionTarget, ctx });
+}
+function createSqlCatalogFromContext({ canonical, publishedObjects, executionTarget, ctx, identity: suppliedIdentity }) {
+  if (!publishedObjects.length || new Set(publishedObjects).size !== publishedObjects.length) throw new Error("SQL objects must be explicitly declared and unique");
+  const identity = suppliedIdentity ?? sqlHash(`ontology-sql-v1\0${computeSchemaHash(canonical)}\0${executionTarget}`);
   const logicalNames = new Map(Object.entries(ctx.tables).map(([key, meta]) => [meta, key]));
   const refOf = (meta) => `${meta.namespace ?? canonical.namespace}/${logicalNames.get(meta)}`;
   const definitions = [canonical, ...canonical.imports ?? []];
@@ -5512,9 +5519,10 @@ var SqlEmitter = class {
         only(cte, ["ctename", "ctequery", "ctematerialized", "location"]);
         const name2 = str(cte.ctename);
         if (scope.ctes.has(name2)) fail3("duplicate CTE");
+        const materialization = cte.ctematerialized === "CTEMaterializeAlways" ? "MATERIALIZED " : cte.ctematerialized === "CTEMaterializeNever" ? "NOT MATERIALIZED " : cte.ctematerialized === "CTEMaterializeDefault" ? "" : fail3("unsupported CTE materialization");
         const result2 = this.select(obj(cte.ctequery), { ...parent, ctes: scope.ctes });
         scope.ctes.set(name2, result2);
-        ctes.push(`${quoteIdentifier(name2)} AS (${result2.text})`);
+        ctes.push(`${quoteIdentifier(name2)} AS ${materialization}(${result2.text})`);
       }
     }
     const result = node.op === "SETOP_UNION" ? this.union(node, scope) : this.projection(node, scope);
@@ -10343,6 +10351,42 @@ async function readSnapshot(dir, ordinal) {
   const path = join(dir, MIGRATIONS_DIRNAME, META_DIRNAME, `${pad(ordinal)}.snapshot.json`);
   return parseJson(path, await readSnapshotText(dir, ordinal));
 }
+async function verifyCommittedLedger(dir, entries) {
+  const firstRequiredSnapshot = entries.length - 2;
+  let previousId3;
+  let previousSnapshotPresent = false;
+  let previousHash = null;
+  for (const [index3, entry] of entries.entries()) {
+    const sql4 = await readMigrationSql(dir, entry);
+    if (checksumOf(sql4) !== entry.checksum) {
+      return `${MIGRATIONS_DIRNAME}/${entry.name}.sql does not match its journal checksum \u2014 committed migrations must not be edited`;
+    }
+    const snapshotText = index3 >= firstRequiredSnapshot ? await readSnapshotText(dir, entry.ordinal) : await readPrunableSnapshotText(dir, entry.ordinal);
+    if (snapshotText !== void 0) {
+      if (checksumOf(snapshotText) !== entry.snapshot_checksum) {
+        return `the snapshot for ${entry.name} does not match its journal checksum \u2014 committed snapshots must not be edited (the next diff builds on it)`;
+      }
+      const snapshot = JSON.parse(snapshotText);
+      if (previousSnapshotPresent && snapshot.prevId !== previousId3) {
+        return `snapshot chain broken at ${entry.name} \u2014 regenerate the workspace with \`seq-studio orm diff\``;
+      }
+      previousId3 = snapshot.id;
+    }
+    previousSnapshotPresent = snapshotText !== void 0;
+    if (entry.previous_content_hash !== previousHash) {
+      return `content-hash chain broken at ${entry.name} \u2014 migrations must be appended in order by \`seq-studio orm diff\``;
+    }
+    previousHash = entry.content_hash;
+  }
+  return void 0;
+}
+async function readPrunableSnapshotText(dir, ordinal) {
+  const path = join(dir, MIGRATIONS_DIRNAME, META_DIRNAME, `${pad(ordinal)}.snapshot.json`);
+  return readFile(path, "utf8").catch((error) => {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") return void 0;
+    throw error;
+  });
+}
 async function readMigrationSql(dir, entry) {
   const path = join(dir, MIGRATIONS_DIRNAME, `${entry.name}.sql`);
   return readFile(path, "utf8").catch(() => {
@@ -10503,30 +10547,10 @@ async function checkWorkspace({
     log(`no committed migrations for '${loaded.definition.namespace}' \u2014 run \`seq-studio orm diff\` and commit the result`);
     return 1;
   }
-  let previousId3;
-  let previousHash = null;
-  for (const entry of workspace.journal.entries) {
-    const sql4 = await readMigrationSql(dir, entry);
-    if (checksumOf(sql4) !== entry.checksum) {
-      log(`${MIGRATIONS_DIRNAME}/${entry.name}.sql does not match its journal checksum \u2014 committed migrations must not be edited`);
-      return 1;
-    }
-    const snapshotText = await readSnapshotText(dir, entry.ordinal);
-    if (checksumOf(snapshotText) !== entry.snapshot_checksum) {
-      log(`the snapshot for ${entry.name} does not match its journal checksum \u2014 committed snapshots must not be edited (the next diff builds on it)`);
-      return 1;
-    }
-    const snapshot = JSON.parse(snapshotText);
-    if (entry.ordinal > 1 && snapshot.prevId !== previousId3) {
-      log(`snapshot chain broken at ${entry.name} \u2014 regenerate the workspace with \`seq-studio orm diff\``);
-      return 1;
-    }
-    if (entry.previous_content_hash !== previousHash) {
-      log(`content-hash chain broken at ${entry.name} \u2014 migrations must be appended in order by \`seq-studio orm diff\``);
-      return 1;
-    }
-    previousId3 = snapshot.id;
-    previousHash = entry.content_hash;
+  const broken = await verifyCommittedLedger(dir, workspace.journal.entries);
+  if (broken) {
+    log(broken);
+    return 1;
   }
   if (tip.content_hash !== loaded.contentHash) {
     log(`definitions changed since ${tip.name} \u2014 run \`seq-studio orm diff\` and commit the new migration`);
@@ -11405,6 +11429,27 @@ function parseArgs(argv) {
 // src/cli.ts
 var BASE_URL_ENV = "SEQUENCE_ORM_BASE_URL";
 var TOKEN_ENV = "SEQUENCE_ORM_TOKEN";
+var SOURCE_ENV = "SEQUENCE_ORM_SOURCE";
+var UNVERIFIED_SOURCE_REASON_ENV = "SEQUENCE_ORM_UNVERIFIED_SOURCE_REASON";
+var SOURCE_AUTHORIZATION_ENV = "SEQUENCE_ORM_SOURCE_AUTHORIZATION";
+function applySourceHeaders(env = process.env) {
+  const token = env[SOURCE_AUTHORIZATION_ENV]?.trim();
+  return token ? { "x-sequence-source-authorization": `Bearer ${token}` } : {};
+}
+function applySourceFromEnv(env = process.env) {
+  const reason = env[UNVERIFIED_SOURCE_REASON_ENV]?.trim();
+  const override = reason ? { unverified_source_reason: reason } : {};
+  const raw = env[SOURCE_ENV];
+  if (!raw) return override;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`${SOURCE_ENV} is not valid JSON`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error(`${SOURCE_ENV} must be a JSON object`);
+  return { source: Object.fromEntries(Object.entries(parsed)), ...override };
+}
 var ORM_MODULE_PATH_ENV = "SEQUENCE_ORM_MODULE_PATH";
 var USAGE = `usage:
   seq-studio orm init <dir>              scaffold a namespace package (v2: TypeScript schema + persisted operations)
@@ -11722,15 +11767,21 @@ async function generateCommand(rest) {
   await writeGenerateOutputs(dir, compiled.project);
   const { loaded, manifest } = compiled.project;
   console.log(
-    `wrote ${SCHEMA_GRAPHQL_FILE}, ${OPERATIONS_MANIFEST_FILE}, ${TYPE_POLICIES_FILE}, sql-operations.gen.ts, namespace.contract.json (${loaded.canonical.tables.length} table(s), ${loaded.canonical.views?.length ?? 0} view(s), ${Object.keys(manifest.operations).length} operation(s))`
+    `wrote ${SCHEMA_GRAPHQL_FILE}, ${OPERATIONS_MANIFEST_FILE}, ${OPERATION_DOCUMENTS_FILE}, ${TYPE_POLICIES_FILE}, sql-operations.gen.ts, namespace.contract.json (${loaded.canonical.tables.length} table(s), ${loaded.canonical.views?.length ?? 0} view(s), ${Object.keys(manifest.operations).length} operation(s))`
   );
   return runConsumerCodegen(dir);
 }
 async function writeGenerateOutputs(dir, project) {
-  const { loaded, sdl, manifest } = project;
+  const { loaded, sdl, manifest, documents } = project;
   await writeFile(join(dir, SCHEMA_GRAPHQL_FILE), sdl);
   await writeFile(join(dir, "namespace.contract.json"), `${JSON.stringify(loaded.canonical, null, 2)}
 `);
+  const sortedDocuments = [...documents].sort((a, b) => a.path.localeCompare(b.path)).map(({ path, contents }) => ({ path, contents }));
+  await writeFile(
+    join(dir, OPERATION_DOCUMENTS_FILE),
+    `${JSON.stringify({ documentsVersion: OPERATION_DOCUMENTS_VERSION, documents: sortedDocuments }, null, 2)}
+`
+  );
   const operations = Object.entries(manifest.operations).map(([name2, op]) => ({
     name: name2,
     kind: op.kind,
@@ -11936,8 +11987,21 @@ function reportRegistryState(registry) {
   if (match && match.id === registry.activeVersionId) console.log("-- registry: this content is the ACTIVE version");
   else if (match) console.log(`-- registry: registered (status ${match.status}), not active`);
   else console.log(`-- registry: new content (active is ${active ? active.content_hash.slice(0, 12) : "none"})`);
+  if (registry.activeActivation) console.log(`-- registry: ${describeActivation(registry.activeActivation)}`);
   return 0;
 }
+function describeActivation(activation) {
+  const since = `live since ${activation.activated_at.slice(0, 16).replace("T", " ")}Z`;
+  const by = `by ${activation.actor_sub.replace(/^google-apps\|/, "")}`;
+  if (activation.source_commit && activation.source_branch) {
+    const at = activation.source_path ? ` at ${activation.source_path}` : "";
+    const branch = activation.source_environment ? `${activation.source_environment}:${activation.source_branch}` : activation.source_branch;
+    return `${since} from ${activation.source_commit.slice(0, 12)} on ${branch}${at} (${activation.provenance_class}) ${by}`;
+  }
+  const failure = activation.reported_source?.verification_failure;
+  const why = typeof failure === "string" ? `: ${failure}` : "";
+  return `${since} from an untraced source (${activation.provenance_class}${why}) ${by}`;
+}
 var META_DIRNAME2 = "meta";
 var JOURNAL_FILENAME2 = "journal.json";
 var padOrdinal = (ordinal) => String(ordinal).padStart(4, "0");
@@ -12025,30 +12089,10 @@ async function checkWorkspaceV2({
     log(`no committed migrations for '${namespace}' \u2014 run \`seq-studio orm diff\` and commit the result`);
     return 1;
   }
-  let previousId3;
-  let previousHash = null;
-  for (const entry of workspace.journal.entries) {
-    const sql4 = await readMigrationSql(dir, entry);
-    if (checksumOf(sql4) !== entry.checksum) {
-      log(`${MIGRATIONS_DIRNAME}/${entry.name}.sql does not match its journal checksum \u2014 committed migrations must not be edited`);
-      return 1;
-    }
-    const snapshotText = await readSnapshotText(dir, entry.ordinal);
-    if (checksumOf(snapshotText) !== entry.snapshot_checksum) {
-      log(`the snapshot for ${entry.name} does not match its journal checksum \u2014 committed snapshots must not be edited (the next diff builds on it)`);
-      return 1;
-    }
-    const snapshot = JSON.parse(snapshotText);
-    if (entry.ordinal > 1 && snapshot.prevId !== previousId3) {
-      log(`snapshot chain broken at ${entry.name} \u2014 regenerate the workspace with \`seq-studio orm diff\``);
-      return 1;
-    }
-    if (entry.previous_content_hash !== previousHash) {
-      log(`content-hash chain broken at ${entry.name} \u2014 migrations must be appended in order by \`seq-studio orm diff\``);
-      return 1;
-    }
-    previousId3 = snapshot.id;
-    previousHash = entry.content_hash;
+  const broken = await verifyCommittedLedger(dir, workspace.journal.entries);
+  if (broken) {
+    log(broken);
+    return 1;
   }
   if (tip.content_hash !== loaded.hash) {
     log(`definitions changed since ${tip.name} \u2014 run \`seq-studio orm diff\` and commit the new migration`);
@@ -12162,8 +12206,9 @@ async function applyV2Command(rest, dir) {
   const applied = await apiRequestStrict("POST", `/api/orm/namespaces/${namespace}/apply`, {
     version_id: registered.version_id,
     ...allowDestructive ? { allow_destructive: true } : {},
-    ...schemaAlreadyActive && registered.operation_set_id ? { operation_set_id: registered.operation_set_id } : {}
-  });
+    ...schemaAlreadyActive && registered.operation_set_id ? { operation_set_id: registered.operation_set_id } : {},
+    ...applySourceFromEnv()
+  }, applySourceHeaders());
   const live = { namespace, contentHash: registered.content_hash };
   if ("ops_only" in applied) {
     console.log(
@@ -12619,8 +12664,9 @@ async function applyCommand(rest) {
   if (dryRun) return dryRunRehearsal({ namespace, versionId: registered.version_id, contentHash: registered.content_hash });
   const applied = await apiRequestStrict("POST", `/api/orm/namespaces/${namespace}/apply`, {
     version_id: registered.version_id,
-    ...allowDestructive ? { allow_destructive: true } : {}
-  });
+    ...allowDestructive ? { allow_destructive: true } : {},
+    ...applySourceFromEnv()
+  }, applySourceHeaders());
   if ("status" in applied) {
     const verdict = await awaitQueuedApply({ dir, namespace, contentHash: registered.content_hash, runId: applied.run_id, applyWait });
     return verdict === "live" ? writeGeneratedTypes(dir, loaded) : verdict;
@@ -12765,7 +12811,7 @@ async function apiRequest(method, path, body, options) {
   if (!token) throw new Error("not authenticated \u2014 run: seq-studio login");
   const response = await fetch(`${baseUrl}${path}`, {
     method,
-    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    headers: { ...options?.headers, Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
     body: body === void 0 ? void 0 : JSON.stringify(body)
   });
   if (response.status === 404 && options?.allow404) return null;
@@ -12792,18 +12838,20 @@ function errorDetail(payload) {
   const fields = details && typeof details === "object" ? Object.entries(details).filter(([, value]) => typeof value === "string").map(([key, value]) => `${key}: ${String(value)}`) : [];
   return `${String(first.message)}${code ? ` (${code})` : ""}${fields.length ? ` [${fields.join(", ")}]` : ""}`;
 }
-async function apiRequestStrict(method, path, body) {
-  const result = await apiRequest(method, path, body);
+async function apiRequestStrict(method, path, body, headers) {
+  const result = await apiRequest(method, path, body, { headers });
   if (result === null) throw new Error(`${method} ${path} returned no payload`);
   return result;
 }
 async function fetchRegistryState(namespace, contentHash) {
   if (!process.env[BASE_URL_ENV]?.trim() || !await resolveToken()) return { kind: "offline" };
-  const body = await apiRequest("GET", `/api/orm/namespaces/${namespace}?hash=${encodeURIComponent(contentHash)}`, void 0, { allow404: true });
+  const body = await apiRequest("GET", `/api/orm/namespaces/${namespace}?hash=${encodeURIComponent(contentHash)}&activations_limit=1`, void 0, { allow404: true });
   if (!body) return { kind: "missing" };
+  const latest = body.activations?.[0];
   return {
     kind: "found",
     activeVersionId: body.namespace.active_version_id,
+    activeActivation: latest && latest.id === body.namespace.active_activation_id ? latest : null,
     versions: body.versions,
     hashVersion: body.hash_version ?? null
   };
@@ -12818,6 +12866,6 @@ function positional(rest) {
 }
 var firstLine2 = (sql4) => sql4.split("\n")[0] ?? sql4;
 
-export { BASE_URL_ENV, ORM_MODULE_PATH_ENV, TOKEN_ENV, errorDetail, parseApplyWait, runCli, setTokenProvider };
+export { BASE_URL_ENV, ORM_MODULE_PATH_ENV, SOURCE_AUTHORIZATION_ENV, SOURCE_ENV, TOKEN_ENV, UNVERIFIED_SOURCE_REASON_ENV, applySourceFromEnv, applySourceHeaders, describeActivation, errorDetail, parseApplyWait, runCli, setTokenProvider };
 //# sourceMappingURL=cli.js.map
 //# sourceMappingURL=cli.js.map