@superatomai/sdk-node 0.0.88-dsp → 0.0.89-dsp

package/dist/index.js

@@ -62,6 +62,7 @@ __export(index_exports, {
   bridgePreamble: () => bridgePreamble,
   captureContext: () => captureContext,
   clearContextTokens: () => clearContextTokens,
+  constraintPoliciesFromConfig: () => constraintPoliciesFromConfig,
   contextTokenCount: () => contextTokenCount,
   createCodexSession: () => createCodexSession,
   createCodingAgentSession: () => createCodingAgentSession,
@@ -1952,7 +1953,17 @@ function runWithContext(ctx, fn) {
   return getStorage().run(ctx, fn);
 }
 function runAsUser(user, fn) {
-  const { userId, orgId, role, projectId, requestId, policies, allowedSources, graphVersion } = user;
+  const {
+    userId,
+    orgId,
+    role,
+    projectId,
+    requestId,
+    policies,
+    constraintPolicies,
+    allowedSources,
+    graphVersion
+  } = user;
   return runWithContext(
     // `allowedSources` is spread in only when given, so an absent restriction
     // stays absent rather than becoming an explicit `undefined` that a later
@@ -1962,6 +1973,7 @@ function runAsUser(user, fn) {
       projectId,
       requestId,
       policies,
+      ...constraintPolicies?.length ? { constraintPolicies } : {},
       ...allowedSources !== void 0 ? { allowedSources } : {},
       ...graphVersion !== void 0 ? { graphVersion } : {}
     },
@@ -2642,42 +2654,148 @@ function buildDirectToolCacheKey(toolId, parameters) {
   return `et-direct:${toolId}:${stableStringify(parameters || {})}`;
 }
 
-// src/handlers/request-identity.ts
-function graphVersionOf(v) {
-  if (v === "draft") return "draft";
-  return Number.isInteger(v) && v > 0 ? v : void 0;
+// src/handlers/data-access/v2/policies.ts
+var CONSTRAINT_OPS = [
+  "in",
+  "not_in",
+  "eq",
+  "ne",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "like",
+  "not_like",
+  "is_null",
+  "is_not_null"
+];
+var NO_VALUE_OPS = /* @__PURE__ */ new Set(["is_null", "is_not_null"]);
+function constraintPoliciesFromConfig(raw) {
+  const entries = Array.isArray(raw) ? raw : [raw];
+  const out = [];
+  for (const entry of entries) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const e = entry;
+    const sourceId = typeof e.sourceId === "string" && e.sourceId ? e.sourceId : null;
+    const label = typeof e.label === "string" && e.label.trim() ? e.label.trim() : void 0;
+    const bad = (why) => ({ sourceId, label, invalid: why });
+    let schema2;
+    if (e.schema !== void 0 && e.schema !== null) {
+      if (typeof e.schema !== "string" || !e.schema.trim()) {
+        out.push(bad("schema must be a schema name"));
+        continue;
+      }
+      schema2 = e.schema.trim();
+    }
+    let readableTables;
+    let tablesBad;
+    if (e.readableTables !== void 0 && e.readableTables !== null) {
+      if (typeof e.readableTables !== "object" || Array.isArray(e.readableTables)) {
+        out.push(bad("readableTables must be an object of table to columns"));
+        continue;
+      }
+      readableTables = {};
+      for (const [table, cols] of Object.entries(e.readableTables)) {
+        if (cols === null) {
+          readableTables[table] = null;
+          continue;
+        }
+        if (!Array.isArray(cols) || cols.length === 0) {
+          tablesBad = `readableTables["${table}"] must be a non-empty list or null`;
+          break;
+        }
+        const columns = cols.filter((c) => typeof c === "string" && !!c.trim()).map((c) => c.trim());
+        if (columns.length !== cols.length) {
+          tablesBad = `readableTables["${table}"] has an entry that is not a column name`;
+          break;
+        }
+        readableTables[table] = columns;
+      }
+      if (!tablesBad && Object.keys(readableTables).length === 0) {
+        tablesBad = "readableTables names no tables \u2014 omit it to allow every table";
+      }
+      if (tablesBad) {
+        out.push(bad(tablesBad));
+        continue;
+      }
+    }
+    const rowFilters = {};
+    let filtersBad;
+    const rawFilters = e.rowFilters;
+    if (rawFilters !== void 0 && rawFilters !== null) {
+      if (typeof rawFilters !== "object" || Array.isArray(rawFilters)) {
+        filtersBad = "rowFilters must be an object keyed by table";
+      } else {
+        for (const [table, items] of Object.entries(rawFilters)) {
+          if (readableTables && !(table in readableTables)) {
+            filtersBad = `rowFilters names "${table}", which readableTables does not allow`;
+            break;
+          }
+          if (!Array.isArray(items) || items.length === 0) {
+            filtersBad = `rowFilters["${table}"] must be a non-empty list`;
+            break;
+          }
+          const parsed = [];
+          for (const item of items) {
+            if (!item || typeof item !== "object") {
+              filtersBad = `rowFilters["${table}"] has an entry that is not an object`;
+              break;
+            }
+            const f = item;
+            if (typeof f.column !== "string" || !f.column.trim()) {
+              filtersBad = `a filter on "${table}" has no column`;
+              break;
+            }
+            const op = typeof f.op === "string" ? f.op.toLowerCase() : "in";
+            if (!CONSTRAINT_OPS.includes(op)) {
+              filtersBad = `unsupported operator "${f.op}" on "${table}.${f.column}"`;
+              break;
+            }
+            const values = Array.isArray(f.values) ? f.values : [];
+            if (!NO_VALUE_OPS.has(op) && values.length === 0) {
+              filtersBad = `the filter on "${table}.${f.column}" has no values`;
+              break;
+            }
+            parsed.push({
+              column: f.column.trim(),
+              op,
+              ...NO_VALUE_OPS.has(op) ? {} : { values },
+              label: typeof f.label === "string" && f.label.trim() ? f.label.trim() : void 0
+            });
+          }
+          if (filtersBad) break;
+          rowFilters[table] = parsed;
+        }
+      }
+    }
+    if (filtersBad) {
+      out.push(bad(filtersBad));
+      continue;
+    }
+    const rawLimits = e.limits;
+    const num = (v) => typeof v === "number" && Number.isInteger(v) && v > 0 ? v : void 0;
+    const limits = rawLimits ? { maxRows: num(rawLimits.maxRows), maxExecutionSeconds: num(rawLimits.maxExecutionSeconds) } : void 0;
+    out.push({
+      sourceId,
+      label,
+      ...schema2 ? { schema: schema2 } : {},
+      ...readableTables ? { readableTables } : {},
+      ...Object.keys(rowFilters).length ? { rowFilters } : {},
+      ...limits ? { limits } : {}
+    });
+  }
+  return out;
 }
+
+// src/handlers/data-access/shape.ts
 function scopedForm(config2) {
   if (!config2 || typeof config2 !== "object" || Array.isArray(config2)) return void 0;
   const c = config2;
   return "allowedSources" in c || "policies" in c ? c : void 0;
 }
-function allowedSourcesFrom(value) {
-  if (value === void 0 || value === null) return null;
-  if (!Array.isArray(value)) {
-    if (!warnedBadSources) {
-      warnedBadSources = true;
-      logger.warn(
-        `[RequestIdentity] "allowedSources" is ${typeof value}, not a list of source ids \u2014 treating it as NO sources rather than all of them. Fix the config: "allowedSources": ["mssql-1a2b"].`
-      );
-    }
-    return [];
-  }
-  const out = [];
-  for (const item of value) {
-    if (typeof item !== "string" || !item.trim()) continue;
-    const id = item.trim();
-    if (!out.includes(id)) out.push(id);
-  }
-  return out;
-}
-function accessFromConfig(config2) {
-  const scoped = scopedForm(config2);
-  return {
-    policies: policiesFromConfig(config2),
-    allowedSources: scoped ? allowedSourcesFrom(scoped.allowedSources) : null
-  };
-}
+
+// src/handlers/data-access/v1/policies.ts
+var warnedUnlabelled = false;
 function exceptionsFromConfig(raw) {
   if (!Array.isArray(raw)) return [];
   const str = (v) => typeof v === "string" && v.trim() ? v.trim() : void 0;
@@ -2756,16 +2874,55 @@ function policiesFromConfig(config2) {
   }
   return out;
 }
+
+// src/handlers/request-identity.ts
+function graphVersionOf(v) {
+  if (v === "draft") return "draft";
+  return Number.isInteger(v) && v > 0 ? v : void 0;
+}
+function allowedSourcesFrom(value) {
+  if (value === void 0 || value === null) return null;
+  if (!Array.isArray(value)) {
+    if (!warnedBadSources) {
+      warnedBadSources = true;
+      logger.warn(
+        `[RequestIdentity] "allowedSources" is ${typeof value}, not a list of source ids \u2014 treating it as NO sources rather than all of them. Fix the config: "allowedSources": ["mssql-1a2b"].`
+      );
+    }
+    return [];
+  }
+  const out = [];
+  for (const item of value) {
+    if (typeof item !== "string" || !item.trim()) continue;
+    const id = item.trim();
+    if (!out.includes(id)) out.push(id);
+  }
+  return out;
+}
+function accessFromConfig(config2) {
+  const scoped = scopedForm(config2);
+  const allowedSources = scoped ? allowedSourcesFrom(scoped.allowedSources) : null;
+  if (scoped?.version === 2) {
+    return {
+      policies: [],
+      constraintPolicies: constraintPoliciesFromConfig(scoped.policies),
+      allowedSources
+    };
+  }
+  return { policies: policiesFromConfig(config2), constraintPolicies: [], allowedSources };
+}
 var warnedUntrusted = false;
 var warnedAnonymous = false;
-var warnedUnlabelled = false;
 var warnedBadSources = false;
 var announcedVerified = false;
 var reportedIdMismatches = /* @__PURE__ */ new Set();
 function runWithMessageIdentity(message, fn) {
   const verified = message?.authContext;
   const requestId = message?.id;
-  const { policies, allowedSources } = verified ? accessFromConfig(verified.config) : accessFromConfig(message?.payload?.config);
+  const { policies, constraintPolicies, allowedSources } = verified ? accessFromConfig(verified.config) : accessFromConfig(message?.payload?.config);
+  logger.info(
+    `[RequestIdentity] ${message?.type ?? "?"}: access from ${verified ? "authContext" : "payload"}${verified && verified.config == null ? " (none on it)" : ""}, allowedSources=${allowedSources === null ? "every source" : `[${allowedSources.join(", ") || "NONE"}]`}, ${constraintPolicies.length} constraint policy(ies), ${policies.length} row policy(ies)`
+  );
   if (verified?.userId) {
     const claimedId = message?.payload?.userId;
     if (!announcedVerified) {
@@ -2790,6 +2947,7 @@ function runWithMessageIdentity(message, fn) {
         role: verified.role,
         requestId,
         policies,
+        constraintPolicies,
         // `?? undefined` so "no restriction" leaves the key off the context
         // entirely; `[]` is passed through as the deny-everything it means.
         allowedSources: allowedSources ?? void 0,
@@ -2807,7 +2965,10 @@ function runWithMessageIdentity(message, fn) {
         "[RequestIdentity] Using the client-supplied payload.userId as the principal \u2014 the relay is not stamping a verified authContext yet, so this identity is NOT trustworthy. Fine for plumbing; do not enable policy enforcement until the relay change lands."
       );
     }
-    return runAsUser({ userId: claimed, requestId, policies, allowedSources: allowedSources ?? void 0 }, fn);
+    return runAsUser(
+      { userId: claimed, requestId, policies, constraintPolicies, allowedSources: allowedSources ?? void 0 },
+      fn
+    );
   }
   if (!warnedAnonymous) {
     warnedAnonymous = true;
@@ -30209,6 +30370,7 @@ var SuperatomSDK = class {
   bridgePreamble,
   captureContext,
   clearContextTokens,
+  constraintPoliciesFromConfig,
   contextTokenCount,
   createCodexSession,
   createCodingAgentSession,

package/dist/index.mjs

@@ -1840,7 +1840,17 @@ function runWithContext(ctx, fn) {
   return getStorage().run(ctx, fn);
 }
 function runAsUser(user, fn) {
-  const { userId, orgId, role, projectId, requestId, policies, allowedSources, graphVersion } = user;
+  const {
+    userId,
+    orgId,
+    role,
+    projectId,
+    requestId,
+    policies,
+    constraintPolicies,
+    allowedSources,
+    graphVersion
+  } = user;
   return runWithContext(
     // `allowedSources` is spread in only when given, so an absent restriction
     // stays absent rather than becoming an explicit `undefined` that a later
@@ -1850,6 +1860,7 @@ function runAsUser(user, fn) {
       projectId,
       requestId,
       policies,
+      ...constraintPolicies?.length ? { constraintPolicies } : {},
       ...allowedSources !== void 0 ? { allowedSources } : {},
       ...graphVersion !== void 0 ? { graphVersion } : {}
     },
@@ -2530,42 +2541,148 @@ function buildDirectToolCacheKey(toolId, parameters) {
   return `et-direct:${toolId}:${stableStringify(parameters || {})}`;
 }
 
-// src/handlers/request-identity.ts
-function graphVersionOf(v) {
-  if (v === "draft") return "draft";
-  return Number.isInteger(v) && v > 0 ? v : void 0;
+// src/handlers/data-access/v2/policies.ts
+var CONSTRAINT_OPS = [
+  "in",
+  "not_in",
+  "eq",
+  "ne",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "like",
+  "not_like",
+  "is_null",
+  "is_not_null"
+];
+var NO_VALUE_OPS = /* @__PURE__ */ new Set(["is_null", "is_not_null"]);
+function constraintPoliciesFromConfig(raw) {
+  const entries = Array.isArray(raw) ? raw : [raw];
+  const out = [];
+  for (const entry of entries) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const e = entry;
+    const sourceId = typeof e.sourceId === "string" && e.sourceId ? e.sourceId : null;
+    const label = typeof e.label === "string" && e.label.trim() ? e.label.trim() : void 0;
+    const bad = (why) => ({ sourceId, label, invalid: why });
+    let schema2;
+    if (e.schema !== void 0 && e.schema !== null) {
+      if (typeof e.schema !== "string" || !e.schema.trim()) {
+        out.push(bad("schema must be a schema name"));
+        continue;
+      }
+      schema2 = e.schema.trim();
+    }
+    let readableTables;
+    let tablesBad;
+    if (e.readableTables !== void 0 && e.readableTables !== null) {
+      if (typeof e.readableTables !== "object" || Array.isArray(e.readableTables)) {
+        out.push(bad("readableTables must be an object of table to columns"));
+        continue;
+      }
+      readableTables = {};
+      for (const [table, cols] of Object.entries(e.readableTables)) {
+        if (cols === null) {
+          readableTables[table] = null;
+          continue;
+        }
+        if (!Array.isArray(cols) || cols.length === 0) {
+          tablesBad = `readableTables["${table}"] must be a non-empty list or null`;
+          break;
+        }
+        const columns = cols.filter((c) => typeof c === "string" && !!c.trim()).map((c) => c.trim());
+        if (columns.length !== cols.length) {
+          tablesBad = `readableTables["${table}"] has an entry that is not a column name`;
+          break;
+        }
+        readableTables[table] = columns;
+      }
+      if (!tablesBad && Object.keys(readableTables).length === 0) {
+        tablesBad = "readableTables names no tables \u2014 omit it to allow every table";
+      }
+      if (tablesBad) {
+        out.push(bad(tablesBad));
+        continue;
+      }
+    }
+    const rowFilters = {};
+    let filtersBad;
+    const rawFilters = e.rowFilters;
+    if (rawFilters !== void 0 && rawFilters !== null) {
+      if (typeof rawFilters !== "object" || Array.isArray(rawFilters)) {
+        filtersBad = "rowFilters must be an object keyed by table";
+      } else {
+        for (const [table, items] of Object.entries(rawFilters)) {
+          if (readableTables && !(table in readableTables)) {
+            filtersBad = `rowFilters names "${table}", which readableTables does not allow`;
+            break;
+          }
+          if (!Array.isArray(items) || items.length === 0) {
+            filtersBad = `rowFilters["${table}"] must be a non-empty list`;
+            break;
+          }
+          const parsed = [];
+          for (const item of items) {
+            if (!item || typeof item !== "object") {
+              filtersBad = `rowFilters["${table}"] has an entry that is not an object`;
+              break;
+            }
+            const f = item;
+            if (typeof f.column !== "string" || !f.column.trim()) {
+              filtersBad = `a filter on "${table}" has no column`;
+              break;
+            }
+            const op = typeof f.op === "string" ? f.op.toLowerCase() : "in";
+            if (!CONSTRAINT_OPS.includes(op)) {
+              filtersBad = `unsupported operator "${f.op}" on "${table}.${f.column}"`;
+              break;
+            }
+            const values = Array.isArray(f.values) ? f.values : [];
+            if (!NO_VALUE_OPS.has(op) && values.length === 0) {
+              filtersBad = `the filter on "${table}.${f.column}" has no values`;
+              break;
+            }
+            parsed.push({
+              column: f.column.trim(),
+              op,
+              ...NO_VALUE_OPS.has(op) ? {} : { values },
+              label: typeof f.label === "string" && f.label.trim() ? f.label.trim() : void 0
+            });
+          }
+          if (filtersBad) break;
+          rowFilters[table] = parsed;
+        }
+      }
+    }
+    if (filtersBad) {
+      out.push(bad(filtersBad));
+      continue;
+    }
+    const rawLimits = e.limits;
+    const num = (v) => typeof v === "number" && Number.isInteger(v) && v > 0 ? v : void 0;
+    const limits = rawLimits ? { maxRows: num(rawLimits.maxRows), maxExecutionSeconds: num(rawLimits.maxExecutionSeconds) } : void 0;
+    out.push({
+      sourceId,
+      label,
+      ...schema2 ? { schema: schema2 } : {},
+      ...readableTables ? { readableTables } : {},
+      ...Object.keys(rowFilters).length ? { rowFilters } : {},
+      ...limits ? { limits } : {}
+    });
+  }
+  return out;
 }
+
+// src/handlers/data-access/shape.ts
 function scopedForm(config2) {
   if (!config2 || typeof config2 !== "object" || Array.isArray(config2)) return void 0;
   const c = config2;
   return "allowedSources" in c || "policies" in c ? c : void 0;
 }
-function allowedSourcesFrom(value) {
-  if (value === void 0 || value === null) return null;
-  if (!Array.isArray(value)) {
-    if (!warnedBadSources) {
-      warnedBadSources = true;
-      logger.warn(
-        `[RequestIdentity] "allowedSources" is ${typeof value}, not a list of source ids \u2014 treating it as NO sources rather than all of them. Fix the config: "allowedSources": ["mssql-1a2b"].`
-      );
-    }
-    return [];
-  }
-  const out = [];
-  for (const item of value) {
-    if (typeof item !== "string" || !item.trim()) continue;
-    const id = item.trim();
-    if (!out.includes(id)) out.push(id);
-  }
-  return out;
-}
-function accessFromConfig(config2) {
-  const scoped = scopedForm(config2);
-  return {
-    policies: policiesFromConfig(config2),
-    allowedSources: scoped ? allowedSourcesFrom(scoped.allowedSources) : null
-  };
-}
+
+// src/handlers/data-access/v1/policies.ts
+var warnedUnlabelled = false;
 function exceptionsFromConfig(raw) {
   if (!Array.isArray(raw)) return [];
   const str = (v) => typeof v === "string" && v.trim() ? v.trim() : void 0;
@@ -2644,16 +2761,55 @@ function policiesFromConfig(config2) {
   }
   return out;
 }
+
+// src/handlers/request-identity.ts
+function graphVersionOf(v) {
+  if (v === "draft") return "draft";
+  return Number.isInteger(v) && v > 0 ? v : void 0;
+}
+function allowedSourcesFrom(value) {
+  if (value === void 0 || value === null) return null;
+  if (!Array.isArray(value)) {
+    if (!warnedBadSources) {
+      warnedBadSources = true;
+      logger.warn(
+        `[RequestIdentity] "allowedSources" is ${typeof value}, not a list of source ids \u2014 treating it as NO sources rather than all of them. Fix the config: "allowedSources": ["mssql-1a2b"].`
+      );
+    }
+    return [];
+  }
+  const out = [];
+  for (const item of value) {
+    if (typeof item !== "string" || !item.trim()) continue;
+    const id = item.trim();
+    if (!out.includes(id)) out.push(id);
+  }
+  return out;
+}
+function accessFromConfig(config2) {
+  const scoped = scopedForm(config2);
+  const allowedSources = scoped ? allowedSourcesFrom(scoped.allowedSources) : null;
+  if (scoped?.version === 2) {
+    return {
+      policies: [],
+      constraintPolicies: constraintPoliciesFromConfig(scoped.policies),
+      allowedSources
+    };
+  }
+  return { policies: policiesFromConfig(config2), constraintPolicies: [], allowedSources };
+}
 var warnedUntrusted = false;
 var warnedAnonymous = false;
-var warnedUnlabelled = false;
 var warnedBadSources = false;
 var announcedVerified = false;
 var reportedIdMismatches = /* @__PURE__ */ new Set();
 function runWithMessageIdentity(message, fn) {
   const verified = message?.authContext;
   const requestId = message?.id;
-  const { policies, allowedSources } = verified ? accessFromConfig(verified.config) : accessFromConfig(message?.payload?.config);
+  const { policies, constraintPolicies, allowedSources } = verified ? accessFromConfig(verified.config) : accessFromConfig(message?.payload?.config);
+  logger.info(
+    `[RequestIdentity] ${message?.type ?? "?"}: access from ${verified ? "authContext" : "payload"}${verified && verified.config == null ? " (none on it)" : ""}, allowedSources=${allowedSources === null ? "every source" : `[${allowedSources.join(", ") || "NONE"}]`}, ${constraintPolicies.length} constraint policy(ies), ${policies.length} row policy(ies)`
+  );
   if (verified?.userId) {
     const claimedId = message?.payload?.userId;
     if (!announcedVerified) {
@@ -2678,6 +2834,7 @@ function runWithMessageIdentity(message, fn) {
         role: verified.role,
         requestId,
         policies,
+        constraintPolicies,
         // `?? undefined` so "no restriction" leaves the key off the context
         // entirely; `[]` is passed through as the deny-everything it means.
         allowedSources: allowedSources ?? void 0,
@@ -2695,7 +2852,10 @@ function runWithMessageIdentity(message, fn) {
         "[RequestIdentity] Using the client-supplied payload.userId as the principal \u2014 the relay is not stamping a verified authContext yet, so this identity is NOT trustworthy. Fine for plumbing; do not enable policy enforcement until the relay change lands."
       );
     }
-    return runAsUser({ userId: claimed, requestId, policies, allowedSources: allowedSources ?? void 0 }, fn);
+    return runAsUser(
+      { userId: claimed, requestId, policies, constraintPolicies, allowedSources: allowedSources ?? void 0 },
+      fn
+    );
   }
   if (!warnedAnonymous) {
     warnedAnonymous = true;
@@ -30096,6 +30256,7 @@ export {
   bridgePreamble,
   captureContext,
   clearContextTokens,
+  constraintPoliciesFromConfig,
   contextTokenCount,
   createCodexSession,
   createCodingAgentSession,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superatomai/sdk-node",
-  "version": "0.0.88-dsp",
+  "version": "0.0.89-dsp",
   "description": "Node.js TypeScript SDK for Superatom",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",