@sequenceholdings/orm 2.8.5 → 2.10.0

package/dist/compiler.js

@@ -1663,19 +1663,20 @@ var variableIrSchema = z.object({
   defaultValue: variableDefaultIrSchema.optional()
 });
 var sqlColumnSchema = z.object({ name: z.string(), type: z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz", "jsonb"]), nullable: z.boolean() });
+var sqlObjectIrSchema = z.object({
+  ref: z.string(),
+  table: z.string(),
+  columns: z.array(sqlColumnSchema.extend({ type: z.string() })).min(1),
+  scan: z.string().min(1),
+  read: z.array(z.string()).min(1)
+}).strict();
 var compiledOperationSchema = z.object({
   language: z.literal("sql").optional(),
   /** Server-compiled object catalog and permission ceiling, never caller SQL. */
   sqlQuery: z.object({
     catalog: z.object({
       identity: z.string(),
-      objects: z.array(z.object({
-        ref: z.string(),
-        table: z.string(),
-        columns: z.array(sqlColumnSchema.extend({ type: z.string() })).min(1),
-        scan: z.string().min(1),
-        read: z.array(z.string()).min(1)
-      }).strict()).min(1).max(256)
+      objects: z.array(sqlObjectIrSchema).min(1).max(256)
     }).strict(),
     read: z.array(z.string()).min(1).max(256),
     maxRows: z.number().int().min(1).max(1e4)
@@ -2335,6 +2336,7 @@ var FLIPPED = {
   ">=": "<="
 };
 function resolveTable(resolver, table) {
+  resolver.onTable?.(table);
   const info = resolver.tables[table];
   if (!info) {
     throw new PolicyCompileError(`unknown table '${table}'`, "unknown-table", Object.keys(resolver.tables));
@@ -3558,12 +3560,12 @@ function computeOpHash({
   definition,
   schemaHash
 }) {
-  const digest = createHash("sha256").update(OP_HASH_DOMAIN).update(`${COMPILER_MAJOR}\0${schemaHash}\0`).update(canonicalOperationText(definition)).digest("hex");
-  return `sha256:${digest}`;
+  const digest2 = createHash("sha256").update(OP_HASH_DOMAIN).update(`${COMPILER_MAJOR}\0${schemaHash}\0`).update(canonicalOperationText(definition)).digest("hex");
+  return `sha256:${digest2}`;
 }
 function computeOpsHash(opHashes) {
-  const digest = createHash("sha256").update(OPS_HASH_DOMAIN).update([...opHashes].sort().join("\n")).digest("hex");
-  return `sha256:${digest}`;
+  const digest2 = createHash("sha256").update(OPS_HASH_DOMAIN).update([...opHashes].sort().join("\n")).digest("hex");
+  return `sha256:${digest2}`;
 }
 var SOURCE_DIRECTIVES = /* @__PURE__ */ new Set(["prefetch", "writeback", "localOnly"]);
 var fail = (message, code) => {
@@ -5018,8 +5020,8 @@ function restrictOperation({
 // src/compiler-gql/artifact.ts
 var SCHEMA_HASH_DOMAIN = "sequence-orm-canonical-v2\0";
 function computeSchemaHash(canonical) {
-  const digest = createHash("sha256").update(SCHEMA_HASH_DOMAIN).update(stableJson(canonical)).digest("hex");
-  return `sha256:${digest}`;
+  const digest2 = createHash("sha256").update(SCHEMA_HASH_DOMAIN).update(stableJson(canonical)).digest("hex");
+  return `sha256:${digest2}`;
 }
 function compileNamespace({ canonical, sdl, documents }) {
   const { ctx, diagnostics } = buildCompileContext(canonical);
@@ -6473,10 +6475,13 @@ function sqlHash(value) {
   return `sha256:${createHash("sha256").update(value).digest("hex")}`;
 }
 function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
-  if (!publishedObjects.length || new Set(publishedObjects).size !== publishedObjects.length) throw new Error("SQL objects must be explicitly declared and unique");
   const { ctx, diagnostics } = buildCompileContext(canonical);
   if (diagnostics.some((d) => d.severity === "error")) throw new Error(diagnostics.map((d) => d.message).join("; "));
-  const identity = sqlHash(`ontology-sql-v1\0${computeSchemaHash(canonical)}\0${executionTarget}`);
+  return createSqlCatalogFromContext({ canonical, publishedObjects, executionTarget, ctx });
+}
+function createSqlCatalogFromContext({ canonical, publishedObjects, executionTarget, ctx, identity: suppliedIdentity }) {
+  if (!publishedObjects.length || new Set(publishedObjects).size !== publishedObjects.length) throw new Error("SQL objects must be explicitly declared and unique");
+  const identity = suppliedIdentity ?? sqlHash(`ontology-sql-v1\0${computeSchemaHash(canonical)}\0${executionTarget}`);
   const logicalNames = new Map(Object.entries(ctx.tables).map(([key, meta]) => [meta, key]));
   const refOf = (meta) => `${meta.namespace ?? canonical.namespace}/${logicalNames.get(meta)}`;
   const definitions = [canonical, ...canonical.imports ?? []];
@@ -6613,9 +6618,10 @@ var SqlEmitter = class {
         only(cte, ["ctename", "ctequery", "ctematerialized", "location"]);
         const name2 = str(cte.ctename);
         if (scope.ctes.has(name2)) fail3("duplicate CTE");
+        const materialization = cte.ctematerialized === "CTEMaterializeAlways" ? "MATERIALIZED " : cte.ctematerialized === "CTEMaterializeNever" ? "NOT MATERIALIZED " : cte.ctematerialized === "CTEMaterializeDefault" ? "" : fail3("unsupported CTE materialization");
         const result2 = this.select(obj(cte.ctequery), { ...parent, ctes: scope.ctes });
         scope.ctes.set(name2, result2);
-        ctes.push(`${quoteIdentifier(name2)} AS (${result2.text})`);
+        ctes.push(`${quoteIdentifier(name2)} AS ${materialization}(${result2.text})`);
       }
     }
     const result = node.op === "SETOP_UNION" ? this.union(node, scope) : this.projection(node, scope);
@@ -7221,7 +7227,7 @@ function compileBuiltinSqlArtifact({ namespace, definitions, read, unbackedObjec
     if (owner !== namespace && selected.some((identity) => !definition.exports?.[identity.slice(owner.length + 1)]?.read)) {
       throw new Error("SQL object is not exported");
     }
-    objects.push(...createSqlCatalog({ canonical: definition, publishedObjects: selected, executionTarget }).objects);
+    objects.push(...createSqlCatalogFromContext({ canonical: definition, publishedObjects: selected, executionTarget, ctx }).objects);
   }
   if (objects.length !== read.length) throw new Error("SQL object is unavailable");
   const actualRead = [...new Set(objects.flatMap((object) => object.read))].sort();
@@ -7233,7 +7239,7 @@ function compileBuiltinSqlArtifact({ namespace, definitions, read, unbackedObjec
     definitions.map((definition) => [definition.namespace, computeSchemaHash(definition)]).sort()
   ])) };
   return normalizeIr({
-    irVersion: RUNTIME_SQL_IR_VERSION,
+    irVersion: usesServicePrincipal(policies) ? SERVICE_PRINCIPAL_IR_VERSION : RUNTIME_SQL_IR_VERSION,
     namespace,
     schemaHash: catalog.identity,
     ownSchemaHash: localHash(anchor),
@@ -7259,6 +7265,177 @@ function compileBuiltinSqlArtifact({ namespace, definitions, read, unbackedObjec
     } }
   });
 }
+var OBJECT_METADATA_FORMAT = 1;
+var digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+var objectSqlBundleSchema = z.object({
+  format: z.literal(OBJECT_METADATA_FORMAT),
+  dependencies: z.record(z.string(), digest),
+  object: sqlObjectIrSchema,
+  tables: z.record(z.string(), tableMetaIrSchema),
+  readPolicies: z.record(z.string(), predIrSchema)
+}).strict();
+function contractHashes(canonical) {
+  const hashes = /* @__PURE__ */ new Map();
+  for (const owner of [canonical, ...canonical.imports ?? []]) {
+    for (const relation of [...owner.tables, ...owner.views ?? []]) {
+      const name2 = "table" in relation ? relation.table : relation.view;
+      hashes.set(`${owner.namespace}/${name2}`, sqlHash(stableJson([
+        "orm-object-contract-v1",
+        owner.namespace,
+        relation,
+        owner.enums,
+        owner.exports?.[name2]
+      ])));
+    }
+  }
+  return hashes;
+}
+function objectClosure({ roots, tables, policies, sourceDependencies }) {
+  const required = /* @__PURE__ */ new Set(), links = /* @__PURE__ */ new Map();
+  const walk = (pred, table) => {
+    if (!pred) return;
+    if (pred.kind === "and" || pred.kind === "or") for (const operand of pred.operands) walk(operand, table);
+    else if (pred.kind === "not") walk(pred.operand, table);
+    else if (pred.kind === "exists" || pred.kind === "aggPredicate") {
+      const link = tables[table]?.links.find((candidate) => candidate.name === pred.link);
+      if (!link) throw new Error("object policy dependency is unavailable");
+      const used = links.get(table) ?? /* @__PURE__ */ new Set();
+      used.add(link.name);
+      links.set(table, used);
+      visit2(link.target);
+      walk(pred.where, link.target);
+    }
+  };
+  const visit2 = (ref) => {
+    if (required.has(ref)) return;
+    const meta = tables[ref];
+    if (!meta) throw new Error("object dependency is unavailable");
+    required.add(ref);
+    if (required.size > 1024) throw new Error("object dependency budget exceeded");
+    walk(policies[ref], ref);
+    for (const dependency of sourceDependencies.get(ref) ?? []) visit2(dependency);
+    for (const backing of meta.dependencies ?? []) visit2(backing);
+  };
+  for (const root of roots) visit2(root);
+  return { required: [...required].sort(), links };
+}
+async function compileObjectMetadata({ canonical: raw }) {
+  const canonical = normalizeCanonical(canonicalDefinitionSchema.parse(raw));
+  await validateManagedViewQueries({ canonical });
+  const context = buildCompileContext(canonical);
+  if (context.diagnostics.some((item) => item.severity === "error")) throw new Error("invalid object metadata definition");
+  const { ctx } = context;
+  const hashes = contractHashes(canonical);
+  const ref = (key) => {
+    const meta = ctx.tables[key];
+    if (!meta) throw new Error("object dependency is unavailable");
+    return `${meta.namespace ?? canonical.namespace}/${key}`;
+  };
+  const tables = {}, policies = {};
+  const sourceDependencies = /* @__PURE__ */ new Map();
+  const relations = [canonical, ...canonical.imports ?? []].flatMap(canonicalRelations);
+  const expressions = new Map(relations.map((relation) => [relation.table, relation.policies.read]));
+  for (const [key, meta] of Object.entries(ctx.tables)) {
+    tables[ref(key)] = {
+      ...meta,
+      namespace: meta.namespace ?? canonical.namespace,
+      links: meta.links.map((link) => ({ ...link, target: ref(link.target) })),
+      ...meta.dependencies ? { dependencies: meta.dependencies.map(ref) } : {},
+      ...meta.foreignReferences ? { foreignReferences: meta.foreignReferences.map((link) => ({ ...link, target: ref(link.target) })) } : {}
+    };
+    const policy = ctx.readPolicies.get(key);
+    if (policy) policies[ref(key)] = policy;
+    const expression = expressions.get(key);
+    if (expression !== void 0) {
+      const consulted = /* @__PURE__ */ new Set();
+      compilePolicy({ expression, table: key, access: "read", resolver: {
+        tables: ctx.tables,
+        onTable: (table) => {
+          consulted.add(ref(table));
+        },
+        readPolicy: (table) => expressions.get(table),
+        policyNamespace: (table) => ctx.tables[table]?.namespace
+      } });
+      sourceDependencies.set(ref(key), [...consulted]);
+    }
+  }
+  const objects = [];
+  for (const relation of [...canonical.tables, ...canonical.views ?? []]) {
+    const name2 = "table" in relation ? relation.table : relation.view;
+    const identity = `${canonical.namespace}/${name2}`, contractHash = hashes.get(identity);
+    let bundle = null;
+    if (!relation.internal) {
+      const object = createSqlCatalogFromContext({
+        canonical,
+        ctx,
+        identity: contractHash,
+        publishedObjects: [identity],
+        executionTarget: "default"
+      }).objects[0];
+      const closure = objectClosure({ roots: object.read, tables, policies, sourceDependencies });
+      bundle = objectSqlBundleSchema.parse({
+        format: OBJECT_METADATA_FORMAT,
+        object,
+        // platformUsers is compiler-owned metadata, pinned by the format above.
+        dependencies: Object.fromEntries(closure.required.filter((key) => hashes.has(key)).map((key) => [key, hashes.get(key)])),
+        tables: Object.fromEntries(closure.required.map((key) => {
+          const { foreignReferences: _writeReferences, ...meta } = tables[key];
+          return [key, { ...meta, links: meta.links.filter((link) => closure.links.get(key)?.has(link.name)) }];
+        })),
+        readPolicies: Object.fromEntries(closure.required.filter((key) => policies[key]).map((key) => [key, policies[key]]))
+      });
+    }
+    objects.push({ name: name2, contractHash, bundle });
+  }
+  return {
+    format: OBJECT_METADATA_FORMAT,
+    objects,
+    relations: Object.values(ctx.tables).map(({ schema, table }) => ({ schema, table }))
+  };
+}
+function composeObjectSqlArtifact({ namespace, bundles }) {
+  const tables = {}, readPolicies = {};
+  const pins = /* @__PURE__ */ new Map();
+  const objects = bundles.map((bundle) => {
+    if (!bundle.object.ref.startsWith(`${namespace}/`) && !bundle.tables[bundle.object.ref]?.exportRead) throw new Error("SQL object is not exported");
+    for (const [ref, hash] of Object.entries(bundle.dependencies)) {
+      if (pins.has(ref) && pins.get(ref) !== hash) throw new Error("inconsistent object contracts");
+      pins.set(ref, hash);
+    }
+    for (const [ref, meta] of Object.entries(bundle.tables)) {
+      const previous = tables[ref];
+      const links = new Map([...previous?.links ?? [], ...meta.links].map((link) => [link.name, link]));
+      tables[ref] = { ...meta, links: [...links.values()] };
+    }
+    Object.assign(readPolicies, bundle.readPolicies);
+    return bundle.object;
+  });
+  const read = [...new Set(objects.flatMap((object) => object.read))].sort();
+  const identity = sqlHash(stableJson(["orm-object-sql-v1", namespace, bundles]));
+  return normalizeIr({
+    irVersion: usesServicePrincipal(readPolicies) ? SERVICE_PRINCIPAL_IR_VERSION : RUNTIME_SQL_IR_VERSION,
+    namespace,
+    schemaHash: identity,
+    opsHash: BUILTIN_SQL_READ_HASH,
+    tables,
+    readPolicies,
+    operations: { BuiltinSqlRead: {
+      irVersion: RUNTIME_SQL_IR_VERSION,
+      name: "BuiltinSqlRead",
+      opHash: BUILTIN_SQL_READ_HASH,
+      language: "sql",
+      kind: "query",
+      requires: null,
+      roots: [],
+      tableSet: read,
+      variables: [
+        { name: "sql", type: { kind: "scalar", scalar: "text" }, nullable: false, list: false },
+        { name: "parameters", type: { kind: "scalar", scalar: "jsonb" }, nullable: true, list: false }
+      ],
+      sqlQuery: { catalog: { identity, objects }, read, maxRows: 1e3 }
+    } }
+  });
+}
 var DATASET_PREVIEW_LIMIT = 100;
 function compileDatasetPreviews(input) {
   const canonical = normalizeCanonical(input);
@@ -7304,6 +7481,64 @@ function compileDatasetPreviews(input) {
   return operations;
 }
 
-export { COMPILER_MAJOR, CONST_TRUE, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, DocumentCompileError, MAX_LIMIT, NamespaceCompileError, ORDER_BY_DIRECTIONS, OperationLowerer, PLATFORM_USER_TABLE, PLATFORM_USER_TYPENAME, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, PolicyCompileError, PolicyParseError, allowedBoolExpOperators, allowedOps, andPred, assertClaimsOnlyWhen, bindNamedParameters, buildCompileContext, camelCase, canonicalOperationText, classifyInputType, collectPinnedColumns, compileBuiltinSqlArtifact, compileDatasetPreviews, compileDefaultOperations, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compilePolicy, compilePredicateV2, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, defineOperation, enumTypeName, flattenOperation, generateDefaultOperations, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parsePolicy, parseSdl, pascalCase, platformUserMeta, predContains, predContainsExists, queryRootNames, referencedSqlObjects, restrictOperation, sqlOperationDefinitionSchema, sqlQueryInputSchema, typeNameForTable, validateAppendInput, validateBoolExpInput, validateInsertInput, validateManagedViewQueries, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput, walkPolicy, walkPred };
+// src/compiler-gql/operation-metadata.ts
+var OPERATION_METADATA_FORMAT = 1;
+function projectOperationMetadata({ artifact, operation }) {
+  const required = /* @__PURE__ */ new Set(), dynamic = /* @__PURE__ */ new Set();
+  const visit2 = (table) => {
+    if (required.has(table)) return;
+    const meta = artifact.tables[table];
+    if (!meta) throw new Error(`operation metadata references missing table '${table}'`);
+    required.add(table);
+    walk(artifact.readPolicies?.[table], table);
+    for (const dependency of meta.dependencies ?? []) visit2(dependency);
+  };
+  const walk = (value, table) => {
+    if (Array.isArray(value)) {
+      for (const child of value) walk(child, table);
+      return;
+    }
+    if (!value || typeof value !== "object") return;
+    const node = value;
+    let scope = typeof node.table === "string" && artifact.tables[node.table] ? node.table : table;
+    if (scope !== table) visit2(scope);
+    if (typeof node.link === "string") {
+      const link = artifact.tables[scope]?.links.find((candidate) => candidate.name === node.link);
+      if (!link) throw new Error("operation metadata has an unresolved relationship");
+      scope = link.target;
+      visit2(scope);
+    }
+    for (const [key, child] of Object.entries(node)) {
+      if (["value", "objects", "set", "inc", "append", "pk", "onConflict"].includes(key)) continue;
+      walk(child, scope);
+    }
+  };
+  const visitDynamic = (table) => {
+    if (dynamic.has(table)) return;
+    dynamic.add(table);
+    visit2(table);
+    for (const link of artifact.tables[table].links) visitDynamic(link.target);
+  };
+  for (const table of operation.tableSet) visit2(table);
+  for (const root of operation.roots) {
+    visit2(root.table);
+    walk(root, root.table);
+    if (root.kind === "mutation" && !["delete", "deleteByPk", "cowRevert"].includes(root.op)) {
+      for (const reference of artifact.tables[root.table].foreignReferences ?? []) visit2(reference.target);
+    }
+  }
+  for (const variable of operation.variables) if (variable.type.kind === "inputRef") {
+    visit2(variable.type.table);
+    if (["boolExp", "orderBy"].includes(variable.type.input)) visitDynamic(variable.type.table);
+  }
+  return normalizeIr({
+    ...artifact,
+    tables: Object.fromEntries([...required].sort().map((table) => [table, artifact.tables[table]])),
+    readPolicies: Object.fromEntries([...required].filter((table) => artifact.readPolicies?.[table]).map((table) => [table, artifact.readPolicies[table]])),
+    operations: { [operation.name]: operation }
+  });
+}
+
+export { COMPILER_MAJOR, CONST_TRUE, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, DocumentCompileError, MAX_LIMIT, NamespaceCompileError, OBJECT_METADATA_FORMAT, OPERATION_METADATA_FORMAT, ORDER_BY_DIRECTIONS, OperationLowerer, PLATFORM_USER_TABLE, PLATFORM_USER_TYPENAME, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, PolicyCompileError, PolicyParseError, allowedBoolExpOperators, allowedOps, andPred, assertClaimsOnlyWhen, bindNamedParameters, buildCompileContext, camelCase, canonicalOperationText, classifyInputType, collectPinnedColumns, compileBuiltinSqlArtifact, compileDatasetPreviews, compileDefaultOperations, compileNamespace, compileNamespaceOrThrow, compileObjectMetadata, compileOperationDocuments, compilePolicy, compilePredicateV2, compileRuntimeSql, composeObjectSqlArtifact, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, defineOperation, enumTypeName, flattenOperation, generateDefaultOperations, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, objectSqlBundleSchema, parseDocuments, parsePolicy, parseSdl, pascalCase, platformUserMeta, predContains, predContainsExists, projectOperationMetadata, queryRootNames, referencedSqlObjects, restrictOperation, sqlOperationDefinitionSchema, sqlQueryInputSchema, typeNameForTable, validateAppendInput, validateBoolExpInput, validateInsertInput, validateManagedViewQueries, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput, walkPolicy, walkPred };
 //# sourceMappingURL=compiler.js.map
 //# sourceMappingURL=compiler.js.map