@sequenceholdings/orm 2.8.5 → 2.10.0

package/dist/compiler.cjs

@@ -1665,19 +1665,20 @@ var variableIrSchema = zod.z.object({
   defaultValue: variableDefaultIrSchema.optional()
 });
 var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz", "jsonb"]), nullable: zod.z.boolean() });
+var sqlObjectIrSchema = zod.z.object({
+  ref: zod.z.string(),
+  table: zod.z.string(),
+  columns: zod.z.array(sqlColumnSchema.extend({ type: zod.z.string() })).min(1),
+  scan: zod.z.string().min(1),
+  read: zod.z.array(zod.z.string()).min(1)
+}).strict();
 var compiledOperationSchema = zod.z.object({
   language: zod.z.literal("sql").optional(),
   /** Server-compiled object catalog and permission ceiling, never caller SQL. */
   sqlQuery: zod.z.object({
     catalog: zod.z.object({
       identity: zod.z.string(),
-      objects: zod.z.array(zod.z.object({
-        ref: zod.z.string(),
-        table: zod.z.string(),
-        columns: zod.z.array(sqlColumnSchema.extend({ type: zod.z.string() })).min(1),
-        scan: zod.z.string().min(1),
-        read: zod.z.array(zod.z.string()).min(1)
-      }).strict()).min(1).max(256)
+      objects: zod.z.array(sqlObjectIrSchema).min(1).max(256)
     }).strict(),
     read: zod.z.array(zod.z.string()).min(1).max(256),
     maxRows: zod.z.number().int().min(1).max(1e4)
@@ -2337,6 +2338,7 @@ var FLIPPED = {
   ">=": "<="
 };
 function resolveTable(resolver, table) {
+  resolver.onTable?.(table);
   const info = resolver.tables[table];
   if (!info) {
     throw new PolicyCompileError(`unknown table '${table}'`, "unknown-table", Object.keys(resolver.tables));
@@ -3560,12 +3562,12 @@ function computeOpHash({
   definition,
   schemaHash
 }) {
-  const digest = crypto.createHash("sha256").update(OP_HASH_DOMAIN).update(`${COMPILER_MAJOR}\0${schemaHash}\0`).update(canonicalOperationText(definition)).digest("hex");
-  return `sha256:${digest}`;
+  const digest2 = crypto.createHash("sha256").update(OP_HASH_DOMAIN).update(`${COMPILER_MAJOR}\0${schemaHash}\0`).update(canonicalOperationText(definition)).digest("hex");
+  return `sha256:${digest2}`;
 }
 function computeOpsHash(opHashes) {
-  const digest = crypto.createHash("sha256").update(OPS_HASH_DOMAIN).update([...opHashes].sort().join("\n")).digest("hex");
-  return `sha256:${digest}`;
+  const digest2 = crypto.createHash("sha256").update(OPS_HASH_DOMAIN).update([...opHashes].sort().join("\n")).digest("hex");
+  return `sha256:${digest2}`;
 }
 var SOURCE_DIRECTIVES = /* @__PURE__ */ new Set(["prefetch", "writeback", "localOnly"]);
 var fail = (message, code) => {
@@ -5020,8 +5022,8 @@ function restrictOperation({
 // src/compiler-gql/artifact.ts
 var SCHEMA_HASH_DOMAIN = "sequence-orm-canonical-v2\0";
 function computeSchemaHash(canonical) {
-  const digest = crypto.createHash("sha256").update(SCHEMA_HASH_DOMAIN).update(stableJson(canonical)).digest("hex");
-  return `sha256:${digest}`;
+  const digest2 = crypto.createHash("sha256").update(SCHEMA_HASH_DOMAIN).update(stableJson(canonical)).digest("hex");
+  return `sha256:${digest2}`;
 }
 function compileNamespace({ canonical, sdl, documents }) {
   const { ctx, diagnostics } = buildCompileContext(canonical);
@@ -6475,10 +6477,13 @@ function sqlHash(value) {
   return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`;
 }
 function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
-  if (!publishedObjects.length || new Set(publishedObjects).size !== publishedObjects.length) throw new Error("SQL objects must be explicitly declared and unique");
   const { ctx, diagnostics } = buildCompileContext(canonical);
   if (diagnostics.some((d) => d.severity === "error")) throw new Error(diagnostics.map((d) => d.message).join("; "));
-  const identity = sqlHash(`ontology-sql-v1\0${computeSchemaHash(canonical)}\0${executionTarget}`);
+  return createSqlCatalogFromContext({ canonical, publishedObjects, executionTarget, ctx });
+}
+function createSqlCatalogFromContext({ canonical, publishedObjects, executionTarget, ctx, identity: suppliedIdentity }) {
+  if (!publishedObjects.length || new Set(publishedObjects).size !== publishedObjects.length) throw new Error("SQL objects must be explicitly declared and unique");
+  const identity = suppliedIdentity ?? sqlHash(`ontology-sql-v1\0${computeSchemaHash(canonical)}\0${executionTarget}`);
   const logicalNames = new Map(Object.entries(ctx.tables).map(([key, meta]) => [meta, key]));
   const refOf = (meta) => `${meta.namespace ?? canonical.namespace}/${logicalNames.get(meta)}`;
   const definitions = [canonical, ...canonical.imports ?? []];
@@ -6615,9 +6620,10 @@ var SqlEmitter = class {
         only(cte, ["ctename", "ctequery", "ctematerialized", "location"]);
         const name2 = str(cte.ctename);
         if (scope.ctes.has(name2)) fail3("duplicate CTE");
+        const materialization = cte.ctematerialized === "CTEMaterializeAlways" ? "MATERIALIZED " : cte.ctematerialized === "CTEMaterializeNever" ? "NOT MATERIALIZED " : cte.ctematerialized === "CTEMaterializeDefault" ? "" : fail3("unsupported CTE materialization");
         const result2 = this.select(obj(cte.ctequery), { ...parent, ctes: scope.ctes });
         scope.ctes.set(name2, result2);
-        ctes.push(`${quoteIdentifier(name2)} AS (${result2.text})`);
+        ctes.push(`${quoteIdentifier(name2)} AS ${materialization}(${result2.text})`);
       }
     }
     const result = node.op === "SETOP_UNION" ? this.union(node, scope) : this.projection(node, scope);
@@ -7223,7 +7229,7 @@ function compileBuiltinSqlArtifact({ namespace, definitions, read, unbackedObjec
     if (owner !== namespace && selected.some((identity) => !definition.exports?.[identity.slice(owner.length + 1)]?.read)) {
       throw new Error("SQL object is not exported");
     }
-    objects.push(...createSqlCatalog({ canonical: definition, publishedObjects: selected, executionTarget }).objects);
+    objects.push(...createSqlCatalogFromContext({ canonical: definition, publishedObjects: selected, executionTarget, ctx }).objects);
   }
   if (objects.length !== read.length) throw new Error("SQL object is unavailable");
   const actualRead = [...new Set(objects.flatMap((object) => object.read))].sort();
@@ -7235,7 +7241,7 @@ function compileBuiltinSqlArtifact({ namespace, definitions, read, unbackedObjec
     definitions.map((definition) => [definition.namespace, computeSchemaHash(definition)]).sort()
   ])) };
   return normalizeIr({
-    irVersion: RUNTIME_SQL_IR_VERSION,
+    irVersion: usesServicePrincipal(policies) ? SERVICE_PRINCIPAL_IR_VERSION : RUNTIME_SQL_IR_VERSION,
     namespace,
     schemaHash: catalog.identity,
     ownSchemaHash: localHash(anchor),
@@ -7261,6 +7267,177 @@ function compileBuiltinSqlArtifact({ namespace, definitions, read, unbackedObjec
     } }
   });
 }
+var OBJECT_METADATA_FORMAT = 1;
+var digest = zod.z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+var objectSqlBundleSchema = zod.z.object({
+  format: zod.z.literal(OBJECT_METADATA_FORMAT),
+  dependencies: zod.z.record(zod.z.string(), digest),
+  object: sqlObjectIrSchema,
+  tables: zod.z.record(zod.z.string(), tableMetaIrSchema),
+  readPolicies: zod.z.record(zod.z.string(), predIrSchema)
+}).strict();
+function contractHashes(canonical) {
+  const hashes = /* @__PURE__ */ new Map();
+  for (const owner of [canonical, ...canonical.imports ?? []]) {
+    for (const relation of [...owner.tables, ...owner.views ?? []]) {
+      const name2 = "table" in relation ? relation.table : relation.view;
+      hashes.set(`${owner.namespace}/${name2}`, sqlHash(stableJson([
+        "orm-object-contract-v1",
+        owner.namespace,
+        relation,
+        owner.enums,
+        owner.exports?.[name2]
+      ])));
+    }
+  }
+  return hashes;
+}
+function objectClosure({ roots, tables, policies, sourceDependencies }) {
+  const required = /* @__PURE__ */ new Set(), links = /* @__PURE__ */ new Map();
+  const walk = (pred, table) => {
+    if (!pred) return;
+    if (pred.kind === "and" || pred.kind === "or") for (const operand of pred.operands) walk(operand, table);
+    else if (pred.kind === "not") walk(pred.operand, table);
+    else if (pred.kind === "exists" || pred.kind === "aggPredicate") {
+      const link = tables[table]?.links.find((candidate) => candidate.name === pred.link);
+      if (!link) throw new Error("object policy dependency is unavailable");
+      const used = links.get(table) ?? /* @__PURE__ */ new Set();
+      used.add(link.name);
+      links.set(table, used);
+      visit2(link.target);
+      walk(pred.where, link.target);
+    }
+  };
+  const visit2 = (ref) => {
+    if (required.has(ref)) return;
+    const meta = tables[ref];
+    if (!meta) throw new Error("object dependency is unavailable");
+    required.add(ref);
+    if (required.size > 1024) throw new Error("object dependency budget exceeded");
+    walk(policies[ref], ref);
+    for (const dependency of sourceDependencies.get(ref) ?? []) visit2(dependency);
+    for (const backing of meta.dependencies ?? []) visit2(backing);
+  };
+  for (const root of roots) visit2(root);
+  return { required: [...required].sort(), links };
+}
+async function compileObjectMetadata({ canonical: raw }) {
+  const canonical = normalizeCanonical(canonicalDefinitionSchema.parse(raw));
+  await validateManagedViewQueries({ canonical });
+  const context = buildCompileContext(canonical);
+  if (context.diagnostics.some((item) => item.severity === "error")) throw new Error("invalid object metadata definition");
+  const { ctx } = context;
+  const hashes = contractHashes(canonical);
+  const ref = (key) => {
+    const meta = ctx.tables[key];
+    if (!meta) throw new Error("object dependency is unavailable");
+    return `${meta.namespace ?? canonical.namespace}/${key}`;
+  };
+  const tables = {}, policies = {};
+  const sourceDependencies = /* @__PURE__ */ new Map();
+  const relations = [canonical, ...canonical.imports ?? []].flatMap(canonicalRelations);
+  const expressions = new Map(relations.map((relation) => [relation.table, relation.policies.read]));
+  for (const [key, meta] of Object.entries(ctx.tables)) {
+    tables[ref(key)] = {
+      ...meta,
+      namespace: meta.namespace ?? canonical.namespace,
+      links: meta.links.map((link) => ({ ...link, target: ref(link.target) })),
+      ...meta.dependencies ? { dependencies: meta.dependencies.map(ref) } : {},
+      ...meta.foreignReferences ? { foreignReferences: meta.foreignReferences.map((link) => ({ ...link, target: ref(link.target) })) } : {}
+    };
+    const policy = ctx.readPolicies.get(key);
+    if (policy) policies[ref(key)] = policy;
+    const expression = expressions.get(key);
+    if (expression !== void 0) {
+      const consulted = /* @__PURE__ */ new Set();
+      compilePolicy({ expression, table: key, access: "read", resolver: {
+        tables: ctx.tables,
+        onTable: (table) => {
+          consulted.add(ref(table));
+        },
+        readPolicy: (table) => expressions.get(table),
+        policyNamespace: (table) => ctx.tables[table]?.namespace
+      } });
+      sourceDependencies.set(ref(key), [...consulted]);
+    }
+  }
+  const objects = [];
+  for (const relation of [...canonical.tables, ...canonical.views ?? []]) {
+    const name2 = "table" in relation ? relation.table : relation.view;
+    const identity = `${canonical.namespace}/${name2}`, contractHash = hashes.get(identity);
+    let bundle = null;
+    if (!relation.internal) {
+      const object = createSqlCatalogFromContext({
+        canonical,
+        ctx,
+        identity: contractHash,
+        publishedObjects: [identity],
+        executionTarget: "default"
+      }).objects[0];
+      const closure = objectClosure({ roots: object.read, tables, policies, sourceDependencies });
+      bundle = objectSqlBundleSchema.parse({
+        format: OBJECT_METADATA_FORMAT,
+        object,
+        // platformUsers is compiler-owned metadata, pinned by the format above.
+        dependencies: Object.fromEntries(closure.required.filter((key) => hashes.has(key)).map((key) => [key, hashes.get(key)])),
+        tables: Object.fromEntries(closure.required.map((key) => {
+          const { foreignReferences: _writeReferences, ...meta } = tables[key];
+          return [key, { ...meta, links: meta.links.filter((link) => closure.links.get(key)?.has(link.name)) }];
+        })),
+        readPolicies: Object.fromEntries(closure.required.filter((key) => policies[key]).map((key) => [key, policies[key]]))
+      });
+    }
+    objects.push({ name: name2, contractHash, bundle });
+  }
+  return {
+    format: OBJECT_METADATA_FORMAT,
+    objects,
+    relations: Object.values(ctx.tables).map(({ schema, table }) => ({ schema, table }))
+  };
+}
+function composeObjectSqlArtifact({ namespace, bundles }) {
+  const tables = {}, readPolicies = {};
+  const pins = /* @__PURE__ */ new Map();
+  const objects = bundles.map((bundle) => {
+    if (!bundle.object.ref.startsWith(`${namespace}/`) && !bundle.tables[bundle.object.ref]?.exportRead) throw new Error("SQL object is not exported");
+    for (const [ref, hash] of Object.entries(bundle.dependencies)) {
+      if (pins.has(ref) && pins.get(ref) !== hash) throw new Error("inconsistent object contracts");
+      pins.set(ref, hash);
+    }
+    for (const [ref, meta] of Object.entries(bundle.tables)) {
+      const previous = tables[ref];
+      const links = new Map([...previous?.links ?? [], ...meta.links].map((link) => [link.name, link]));
+      tables[ref] = { ...meta, links: [...links.values()] };
+    }
+    Object.assign(readPolicies, bundle.readPolicies);
+    return bundle.object;
+  });
+  const read = [...new Set(objects.flatMap((object) => object.read))].sort();
+  const identity = sqlHash(stableJson(["orm-object-sql-v1", namespace, bundles]));
+  return normalizeIr({
+    irVersion: usesServicePrincipal(readPolicies) ? SERVICE_PRINCIPAL_IR_VERSION : RUNTIME_SQL_IR_VERSION,
+    namespace,
+    schemaHash: identity,
+    opsHash: BUILTIN_SQL_READ_HASH,
+    tables,
+    readPolicies,
+    operations: { BuiltinSqlRead: {
+      irVersion: RUNTIME_SQL_IR_VERSION,
+      name: "BuiltinSqlRead",
+      opHash: BUILTIN_SQL_READ_HASH,
+      language: "sql",
+      kind: "query",
+      requires: null,
+      roots: [],
+      tableSet: read,
+      variables: [
+        { name: "sql", type: { kind: "scalar", scalar: "text" }, nullable: false, list: false },
+        { name: "parameters", type: { kind: "scalar", scalar: "jsonb" }, nullable: true, list: false }
+      ],
+      sqlQuery: { catalog: { identity, objects }, read, maxRows: 1e3 }
+    } }
+  });
+}
 var DATASET_PREVIEW_LIMIT = 100;
 function compileDatasetPreviews(input) {
   const canonical = normalizeCanonical(input);
@@ -7306,6 +7483,64 @@ function compileDatasetPreviews(input) {
   return operations;
 }
 
+// src/compiler-gql/operation-metadata.ts
+var OPERATION_METADATA_FORMAT = 1;
+function projectOperationMetadata({ artifact, operation }) {
+  const required = /* @__PURE__ */ new Set(), dynamic = /* @__PURE__ */ new Set();
+  const visit2 = (table) => {
+    if (required.has(table)) return;
+    const meta = artifact.tables[table];
+    if (!meta) throw new Error(`operation metadata references missing table '${table}'`);
+    required.add(table);
+    walk(artifact.readPolicies?.[table], table);
+    for (const dependency of meta.dependencies ?? []) visit2(dependency);
+  };
+  const walk = (value, table) => {
+    if (Array.isArray(value)) {
+      for (const child of value) walk(child, table);
+      return;
+    }
+    if (!value || typeof value !== "object") return;
+    const node = value;
+    let scope = typeof node.table === "string" && artifact.tables[node.table] ? node.table : table;
+    if (scope !== table) visit2(scope);
+    if (typeof node.link === "string") {
+      const link = artifact.tables[scope]?.links.find((candidate) => candidate.name === node.link);
+      if (!link) throw new Error("operation metadata has an unresolved relationship");
+      scope = link.target;
+      visit2(scope);
+    }
+    for (const [key, child] of Object.entries(node)) {
+      if (["value", "objects", "set", "inc", "append", "pk", "onConflict"].includes(key)) continue;
+      walk(child, scope);
+    }
+  };
+  const visitDynamic = (table) => {
+    if (dynamic.has(table)) return;
+    dynamic.add(table);
+    visit2(table);
+    for (const link of artifact.tables[table].links) visitDynamic(link.target);
+  };
+  for (const table of operation.tableSet) visit2(table);
+  for (const root of operation.roots) {
+    visit2(root.table);
+    walk(root, root.table);
+    if (root.kind === "mutation" && !["delete", "deleteByPk", "cowRevert"].includes(root.op)) {
+      for (const reference of artifact.tables[root.table].foreignReferences ?? []) visit2(reference.target);
+    }
+  }
+  for (const variable of operation.variables) if (variable.type.kind === "inputRef") {
+    visit2(variable.type.table);
+    if (["boolExp", "orderBy"].includes(variable.type.input)) visitDynamic(variable.type.table);
+  }
+  return normalizeIr({
+    ...artifact,
+    tables: Object.fromEntries([...required].sort().map((table) => [table, artifact.tables[table]])),
+    readPolicies: Object.fromEntries([...required].filter((table) => artifact.readPolicies?.[table]).map((table) => [table, artifact.readPolicies[table]])),
+    operations: { [operation.name]: operation }
+  });
+}
+
 exports.COMPILER_MAJOR = COMPILER_MAJOR;
 exports.CONST_TRUE = CONST_TRUE;
 exports.DATASET_PREVIEW_LIMIT = DATASET_PREVIEW_LIMIT;
@@ -7313,6 +7548,8 @@ exports.DEFAULT_LIMIT = DEFAULT_LIMIT;
 exports.DocumentCompileError = DocumentCompileError;
 exports.MAX_LIMIT = MAX_LIMIT;
 exports.NamespaceCompileError = NamespaceCompileError;
+exports.OBJECT_METADATA_FORMAT = OBJECT_METADATA_FORMAT;
+exports.OPERATION_METADATA_FORMAT = OPERATION_METADATA_FORMAT;
 exports.ORDER_BY_DIRECTIONS = ORDER_BY_DIRECTIONS;
 exports.OperationLowerer = OperationLowerer;
 exports.PLATFORM_USER_TABLE = PLATFORM_USER_TABLE;
@@ -7336,10 +7573,12 @@ exports.compileDatasetPreviews = compileDatasetPreviews;
 exports.compileDefaultOperations = compileDefaultOperations;
 exports.compileNamespace = compileNamespace;
 exports.compileNamespaceOrThrow = compileNamespaceOrThrow;
+exports.compileObjectMetadata = compileObjectMetadata;
 exports.compileOperationDocuments = compileOperationDocuments;
 exports.compilePolicy = compilePolicy;
 exports.compilePredicateV2 = compilePredicateV2;
 exports.compileRuntimeSql = compileRuntimeSql;
+exports.composeObjectSqlArtifact = composeObjectSqlArtifact;
 exports.computeOpHash = computeOpHash;
 exports.computeOpsHash = computeOpsHash;
 exports.computePinnedColumnsByTable = computePinnedColumnsByTable;
@@ -7353,6 +7592,7 @@ exports.inputTypeName = inputTypeName;
 exports.isSqlOperationDocument = isSqlOperationDocument;
 exports.lowerOperation = lowerOperation;
 exports.mutationRootNames = mutationRootNames;
+exports.objectSqlBundleSchema = objectSqlBundleSchema;
 exports.parseDocuments = parseDocuments;
 exports.parsePolicy = parsePolicy;
 exports.parseSdl = parseSdl;
@@ -7360,6 +7600,7 @@ exports.pascalCase = pascalCase;
 exports.platformUserMeta = platformUserMeta;
 exports.predContains = predContains;
 exports.predContainsExists = predContainsExists;
+exports.projectOperationMetadata = projectOperationMetadata;
 exports.queryRootNames = queryRootNames;
 exports.referencedSqlObjects = referencedSqlObjects;
 exports.restrictOperation = restrictOperation;