@sequenceholdings/orm 2.9.0 → 2.10.0

package/dist/cli.cjs

@@ -1816,19 +1816,20 @@ var variableIrSchema = zod.z.object({
   defaultValue: variableDefaultIrSchema.optional()
 });
 var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz", "jsonb"]), nullable: zod.z.boolean() });
+var sqlObjectIrSchema = zod.z.object({
+  ref: zod.z.string(),
+  table: zod.z.string(),
+  columns: zod.z.array(sqlColumnSchema.extend({ type: zod.z.string() })).min(1),
+  scan: zod.z.string().min(1),
+  read: zod.z.array(zod.z.string()).min(1)
+}).strict();
 var compiledOperationSchema = zod.z.object({
   language: zod.z.literal("sql").optional(),
   /** Server-compiled object catalog and permission ceiling, never caller SQL. */
   sqlQuery: zod.z.object({
     catalog: zod.z.object({
       identity: zod.z.string(),
-      objects: zod.z.array(zod.z.object({
-        ref: zod.z.string(),
-        table: zod.z.string(),
-        columns: zod.z.array(sqlColumnSchema.extend({ type: zod.z.string() })).min(1),
-        scan: zod.z.string().min(1),
-        read: zod.z.array(zod.z.string()).min(1)
-      }).strict()).min(1).max(256)
+      objects: zod.z.array(sqlObjectIrSchema).min(1).max(256)
     }).strict(),
     read: zod.z.array(zod.z.string()).min(1).max(256),
     maxRows: zod.z.number().int().min(1).max(1e4)
@@ -2488,6 +2489,7 @@ var FLIPPED = {
   ">=": "<="
 };
 function resolveTable(resolver, table) {
+  resolver.onTable?.(table);
   const info = resolver.tables[table];
   if (!info) {
     throw new PolicyCompileError(`unknown table '${table}'`, "unknown-table", Object.keys(resolver.tables));
@@ -5403,10 +5405,13 @@ function sqlHash(value) {
   return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`;
 }
 function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
-  if (!publishedObjects.length || new Set(publishedObjects).size !== publishedObjects.length) throw new Error("SQL objects must be explicitly declared and unique");
   const { ctx, diagnostics } = buildCompileContext(canonical);
   if (diagnostics.some((d) => d.severity === "error")) throw new Error(diagnostics.map((d) => d.message).join("; "));
-  const identity = sqlHash(`ontology-sql-v1\0${computeSchemaHash(canonical)}\0${executionTarget}`);
+  return createSqlCatalogFromContext({ canonical, publishedObjects, executionTarget, ctx });
+}
+function createSqlCatalogFromContext({ canonical, publishedObjects, executionTarget, ctx, identity: suppliedIdentity }) {
+  if (!publishedObjects.length || new Set(publishedObjects).size !== publishedObjects.length) throw new Error("SQL objects must be explicitly declared and unique");
+  const identity = suppliedIdentity ?? sqlHash(`ontology-sql-v1\0${computeSchemaHash(canonical)}\0${executionTarget}`);
   const logicalNames = new Map(Object.entries(ctx.tables).map(([key, meta]) => [meta, key]));
   const refOf = (meta) => `${meta.namespace ?? canonical.namespace}/${logicalNames.get(meta)}`;
   const definitions = [canonical, ...canonical.imports ?? []];
@@ -5517,9 +5522,10 @@ var SqlEmitter = class {
         only(cte, ["ctename", "ctequery", "ctematerialized", "location"]);
         const name2 = str(cte.ctename);
         if (scope.ctes.has(name2)) fail3("duplicate CTE");
+        const materialization = cte.ctematerialized === "CTEMaterializeAlways" ? "MATERIALIZED " : cte.ctematerialized === "CTEMaterializeNever" ? "NOT MATERIALIZED " : cte.ctematerialized === "CTEMaterializeDefault" ? "" : fail3("unsupported CTE materialization");
         const result2 = this.select(obj(cte.ctequery), { ...parent, ctes: scope.ctes });
         scope.ctes.set(name2, result2);
-        ctes.push(`${quoteIdentifier(name2)} AS (${result2.text})`);
+        ctes.push(`${quoteIdentifier(name2)} AS ${materialization}(${result2.text})`);
       }
     }
     const result = node.op === "SETOP_UNION" ? this.union(node, scope) : this.projection(node, scope);
@@ -11428,6 +11434,11 @@ var BASE_URL_ENV = "SEQUENCE_ORM_BASE_URL";
 var TOKEN_ENV = "SEQUENCE_ORM_TOKEN";
 var SOURCE_ENV = "SEQUENCE_ORM_SOURCE";
 var UNVERIFIED_SOURCE_REASON_ENV = "SEQUENCE_ORM_UNVERIFIED_SOURCE_REASON";
+var SOURCE_AUTHORIZATION_ENV = "SEQUENCE_ORM_SOURCE_AUTHORIZATION";
+function applySourceHeaders(env = process.env) {
+  const token = env[SOURCE_AUTHORIZATION_ENV]?.trim();
+  return token ? { "x-sequence-source-authorization": `Bearer ${token}` } : {};
+}
 function applySourceFromEnv(env = process.env) {
   const reason = env[UNVERIFIED_SOURCE_REASON_ENV]?.trim();
   const override = reason ? { unverified_source_reason: reason } : {};
@@ -11987,7 +11998,8 @@ function describeActivation(activation) {
   const by = `by ${activation.actor_sub.replace(/^google-apps\|/, "")}`;
   if (activation.source_commit && activation.source_branch) {
     const at = activation.source_path ? ` at ${activation.source_path}` : "";
-    return `${since} from ${activation.source_commit.slice(0, 12)} on ${activation.source_branch}${at} (${activation.provenance_class}) ${by}`;
+    const branch = activation.source_environment ? `${activation.source_environment}:${activation.source_branch}` : activation.source_branch;
+    return `${since} from ${activation.source_commit.slice(0, 12)} on ${branch}${at} (${activation.provenance_class}) ${by}`;
   }
   const failure = activation.reported_source?.verification_failure;
   const why = typeof failure === "string" ? `: ${failure}` : "";
@@ -12199,7 +12211,7 @@ async function applyV2Command(rest, dir) {
     ...allowDestructive ? { allow_destructive: true } : {},
     ...schemaAlreadyActive && registered.operation_set_id ? { operation_set_id: registered.operation_set_id } : {},
     ...applySourceFromEnv()
-  });
+  }, applySourceHeaders());
   const live = { namespace, contentHash: registered.content_hash };
   if ("ops_only" in applied) {
     console.log(
@@ -12657,7 +12669,7 @@ async function applyCommand(rest) {
     version_id: registered.version_id,
     ...allowDestructive ? { allow_destructive: true } : {},
     ...applySourceFromEnv()
-  });
+  }, applySourceHeaders());
   if ("status" in applied) {
     const verdict = await awaitQueuedApply({ dir, namespace, contentHash: registered.content_hash, runId: applied.run_id, applyWait });
     return verdict === "live" ? writeGeneratedTypes(dir, loaded) : verdict;
@@ -12802,7 +12814,7 @@ async function apiRequest(method, path, body, options) {
   if (!token) throw new Error("not authenticated \u2014 run: seq-studio login");
   const response = await fetch(`${baseUrl}${path}`, {
     method,
-    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    headers: { ...options?.headers, Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
     body: body === void 0 ? void 0 : JSON.stringify(body)
   });
   if (response.status === 404 && options?.allow404) return null;
@@ -12829,8 +12841,8 @@ function errorDetail(payload) {
   const fields = details && typeof details === "object" ? Object.entries(details).filter(([, value]) => typeof value === "string").map(([key, value]) => `${key}: ${String(value)}`) : [];
   return `${String(first.message)}${code ? ` (${code})` : ""}${fields.length ? ` [${fields.join(", ")}]` : ""}`;
 }
-async function apiRequestStrict(method, path, body) {
-  const result = await apiRequest(method, path, body);
+async function apiRequestStrict(method, path, body, headers) {
+  const result = await apiRequest(method, path, body, { headers });
   if (result === null) throw new Error(`${method} ${path} returned no payload`);
   return result;
 }
@@ -12859,10 +12871,12 @@ var firstLine2 = (sql4) => sql4.split("\n")[0] ?? sql4;
 
 exports.BASE_URL_ENV = BASE_URL_ENV;
 exports.ORM_MODULE_PATH_ENV = ORM_MODULE_PATH_ENV;
+exports.SOURCE_AUTHORIZATION_ENV = SOURCE_AUTHORIZATION_ENV;
 exports.SOURCE_ENV = SOURCE_ENV;
 exports.TOKEN_ENV = TOKEN_ENV;
 exports.UNVERIFIED_SOURCE_REASON_ENV = UNVERIFIED_SOURCE_REASON_ENV;
 exports.applySourceFromEnv = applySourceFromEnv;
+exports.applySourceHeaders = applySourceHeaders;
 exports.describeActivation = describeActivation;
 exports.errorDetail = errorDetail;
 exports.parseApplyWait = parseApplyWait;