@superatomai/sdk-node 0.0.88-dsp → 0.0.90-dsp

package/dist/index.d.mts

@@ -5160,6 +5160,56 @@ interface SourcePolicy {
     /** Grants outside the scope above. Empty or absent means none. */
     exceptions?: PolicyException[];
 }
+/**
+ * Operators the constraint engine builds predicates from. A superset of
+ * {@link RowFilter.op}, which the original rewriter is limited to.
+ */
+type ConstraintOp = 'in' | 'not_in' | 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'like' | 'not_like' | 'is_null' | 'is_not_null';
+/**
+ * One filter in a {@link ConstraintPolicy}.
+ *
+ * No `table`, unlike {@link RowFilter}: these are keyed by table, so a filter
+ * cannot fail to match the table it was written for and leave it unfiltered.
+ */
+interface ConstraintFilter {
+    column: string;
+    op?: ConstraintOp;
+    /** Omitted only for `is_null` / `is_not_null`. */
+    values?: unknown[];
+    label?: string;
+}
+/**
+ * What one user may see in one source, in the shape the constraint engine reads
+ * (`sqlrewrite/v2/engine.py`).
+ *
+ * Not a superset of {@link SourcePolicy} but a different shape: it adds
+ * schemas, columns and limits. A claim carries one shape or the other, never
+ * both.
+ */
+interface ConstraintPolicy {
+    sourceId?: string | null;
+    label?: string;
+    /**
+     * Every table is read from this schema, whatever schema the query wrote —
+     * which is what makes it a restriction: there is no other schema to reach.
+     * Absent means schemas are left exactly as written.
+     */
+    schema?: string;
+    /** table → readable columns, or `null` for every column. Absent: every table. */
+    readableTables?: Record<string, string[] | null>;
+    /** table → filters, ANDed together. */
+    rowFilters?: Record<string, ConstraintFilter[]>;
+    limits?: {
+        maxRows?: number;
+        maxExecutionSeconds?: number;
+    };
+    /**
+     * Why this policy could not be read. Set rather than dropping the policy:
+     * a dropped policy leaves its source UNRESTRICTED, which is the opposite of
+     * what a malformed restriction should mean. The gate refuses the source.
+     */
+    invalid?: string;
+}
 interface RequestContext {
     principal: Principal;
     projectId?: string;
@@ -5169,6 +5219,11 @@ interface RequestContext {
      * — see the backend's policy-gate.
      */
     policies?: SourcePolicy[];
+    /**
+     * The same restrictions in the constraint shape. Present only when the claim
+     * said `version: 2`, and then `policies` is empty: one claim, one engine.
+     */
+    constraintPolicies?: ConstraintPolicy[];
     /**
      * The data sources this user may reach AT ALL, by source id.
      *
@@ -5221,6 +5276,7 @@ declare function runAsUser<T>(user: {
     projectId?: string;
     requestId?: string;
     policies?: SourcePolicy[];
+    constraintPolicies?: ConstraintPolicy[];
     allowedSources?: string[] | null;
     graphVersion?: GraphVersion;
 }, fn: () => T): T;
@@ -5269,6 +5325,35 @@ declare function describeContext(ctx?: RequestContext | undefined): string;
 /** True when the context represents a signed-in user rather than a trusted job. */
 declare function isUserContext(ctx?: RequestContext | undefined): boolean;
 
+/**
+ * The constraint policy shape (`version: 2`), read onto the request context.
+ *
+ * Strict, and failing CLOSED, which is the opposite of the legacy parser beside
+ * it. There, dropping something malformed grants LESS. Here it grants MORE: a
+ * dropped policy leaves its source with no restriction at all. So a policy that
+ * cannot be read is kept, marked `invalid`, and the gate refuses the source.
+ */
+
+declare function constraintPoliciesFromConfig(raw: unknown): ConstraintPolicy[];
+
+/**
+ * The original policy shape, read out of the admin-authored per-user config.
+ *
+ * Every step here is defensive and DROPS what it cannot read, because the
+ * config is free-form JSON typed by a human into an admin field. That is a
+ * deliberate trade with a sharp edge — a typo'd policy silently becomes no
+ * policy, i.e. unrestricted. The constraint shape next door takes the opposite
+ * approach for exactly that reason.
+ */
+
+/**
+ * Read access policies out of the admin-authored per-user config.
+ *
+ * Accepts either a single object or an array, so one user can be scoped across
+ * several sources — and the object form, whose policies sit under `policies`.
+ */
+declare function policiesFromConfig(config: unknown): SourcePolicy[];
+
 /**
  * Deriving "who is asking" from an incoming WebSocket message.
  *
@@ -5283,6 +5368,8 @@ declare function isUserContext(ctx?: RequestContext | undefined): boolean;
 /** Everything one request's config says about what the caller may see. */
 interface ResolvedAccess {
     policies: SourcePolicy[];
+    /** Set instead of `policies` when the claim said `version: 2`. */
+    constraintPolicies: ConstraintPolicy[];
     /** `null` means every source; `[]` means none — see `RequestContext.allowedSources`. */
     allowedSources: string[] | null;
 }
@@ -5296,19 +5383,6 @@ interface ResolvedAccess {
  * drop EVERY row filter the customer wrote.
  */
 declare function accessFromConfig(config: unknown): ResolvedAccess;
-/**
- * Read access policies out of the admin-authored per-user config.
- *
- * The config is free-form JSON typed by a human into an admin field, so every
- * step here is defensive: a malformed entry is DROPPED, never guessed at. That
- * is a deliberate trade-off with a sharp edge — a typo'd policy silently
- * becomes no policy, i.e. unrestricted. Validating shapes against the source
- * schema (and refusing, rather than dropping) is the fix, and is not built yet.
- *
- * Accepts either a single object or an array, so one user can be scoped across
- * several sources — and the object form, whose policies sit under `policies`.
- */
-declare function policiesFromConfig(config: unknown): SourcePolicy[];
 /**
  * Run `fn` with the caller's identity established.
  *
@@ -5655,6 +5729,13 @@ interface CodexSessionOptions extends CodingAgentSessionOptions {
     extraConfig?: Record<string, unknown>;
     approvalPolicy?: 'never' | 'on-request' | 'on-failure' | 'untrusted';
 }
+/**
+ * codex reads only the first `project_doc_max_bytes` of the instructions file (default 32 KiB) and
+ * drops the rest without a word; composed instructions run past that, losing their closing rules.
+ */
+declare const CODEX_DOC_MAX_BYTES: number;
+/** The `--config` overrides for one run: per run, so no host's config.toml decides them. */
+declare function codexRunConfig(opts: Pick<CodexSessionOptions, 'mcpServers' | 'instructionsFile' | 'extraConfig'>): Record<string, unknown>;
 declare function createCodexSession(opts: CodexSessionOptions): CodingAgentSession;
 
 /**
@@ -6759,4 +6840,4 @@ declare class SuperatomSDK {
     getConversationSimilarityThreshold(): number;
 }
 
-export { ALL_COLUMN_KEYS, ANSWER_COMPONENT_NAMES, type AgentConfig, type AgentEvent, type AgentResponse, type AgentRunContext, type AgentRunHandlers, type AgentRunRecord, type AgentRunResult, type AgentTrigger, type AgentUsage, type AnalyticsEventType, type AnalyticsStatus, type AnswerProvider, type AnswerProviderContext, type ApplySummary, BM25L, type BM25LOptions, type BaseLLMConfig, type BuildTriggerInput, CATEGORY_KEYS, CONTEXT_CONFIG, type CapturedLog, CleanupService, type CodexSessionOptions, type CodingAgentCollectionConfig, type CodingAgentDefinition, type CodingAgentSession, type CodingAgentSessionOptions, type CodingAgentsConfig, type ColInfo, type ColType, type CollectionHandler, type CollectionOperation, type Component, type DBUIBlock, DEFAULT_AGENT_CONFIG, DEFAULT_FMT_CONFIG, type DashboardAgentCollectionConfig, type DatabaseType, type FindingCode, type Fmt, type FmtConfig, type GeneratedFile, type GraphVersion, type Harness, type HybridSearchOptions, INSTRUCTIONS_FILE, type IncomingMessage, type KbNodesQueryFilters, type KbNodesRequestPayload, LLM, type LLMUsageEntry, type LogLevel, MainAgent, type McpServerSpec, type Message, MissingRequestContextError, type ModelStrategy, NUMERIC_KEYS, type NarrationUpdate, type OutputContract, type OutputField, type OutputValidator, type PiSessionListener, type PiSessionState, type PiTranscriptEntry, type PolicyException, type PolicyExceptionTable, type Principal, type PromptAttachment, type PromptContext, type RequestContext, type RerankedResult, type ResolvedAccess, type RowFilter, type RunAgentOptions, STORAGE_CONFIG, type ScriptComponentSpec, ScriptMatcher, type ScriptParameter, type ScriptRecipe, type ScriptRecipeMetaRow, type ScriptRecipeStore, type ScriptResult, ScriptStore, type ScriptStoreOptions, type SelectedWorkflow, type ShimDef, type ShimSummary, type ShimTarget, type SourcePolicy, type SpecToValidate, SuperatomSDK, type SuperatomSDKConfig, type T_RESPONSE, type TaskType, Thread, ThreadManager, type Tool$1 as Tool, type ToolOutputSchema, type TriggerEvent, type TriggerFireInfo, UIBlock, UILogCollector, type User, UserManager, type UsersData, type ValidationContext, type ValidationFinding, type WorkflowDescriptor, type Workspace, accessFromConfig, analyticsClient, answerCatalogForBinding, answerComponents, anthropicLLM, assertReadOnlySql, bindContext, bridgePreamble, captureContext, clearContextTokens, contextTokenCount, createCodexSession, createCodingAgentSession, dashboardConversationHistory, dataFingerprint, describeContext, describeTriggers, emitAgentEvent, extractNamedExport, formatFindingsForAgent, geminiLLM, getCodingAgent, getCodingAgentsConfig, getPiSessionState, getRequestContext, groqLLM, hybridRerank, inferColumns, isUserContext, listCodingAgents, llmUsageLogger, logger, makeFmt, mintContextToken, normalizeScriptBody, onAgentRun, onPiSessionUpdate, openaiLLM, policiesFromConfig, projectForDatasetBinding, promptLoader, queryCache, registerCodingAgentCollection, registerCodingAgents, registerDashboardAgentCollection, requireRequestContext, rerankChromaResults, rerankConversationResults, resolveContextToken, resolveScriptRecipeStore, revokeContextToken, runAsSystem, runAsUser, runCodingAgent, runScript, runWithContext, runWithMessageIdentity, startAgentTriggers, stopAgentTriggers, userPromptErrorLogger, validateComponentSpec, withCapturedContext, writeBridgeShims, writeShims };
+export { ALL_COLUMN_KEYS, ANSWER_COMPONENT_NAMES, type AgentConfig, type AgentEvent, type AgentResponse, type AgentRunContext, type AgentRunHandlers, type AgentRunRecord, type AgentRunResult, type AgentTrigger, type AgentUsage, type AnalyticsEventType, type AnalyticsStatus, type AnswerProvider, type AnswerProviderContext, type ApplySummary, BM25L, type BM25LOptions, type BaseLLMConfig, type BuildTriggerInput, CATEGORY_KEYS, CODEX_DOC_MAX_BYTES, CONTEXT_CONFIG, type CapturedLog, CleanupService, type CodexSessionOptions, type CodingAgentCollectionConfig, type CodingAgentDefinition, type CodingAgentSession, type CodingAgentSessionOptions, type CodingAgentsConfig, type ColInfo, type ColType, type CollectionHandler, type CollectionOperation, type Component, type ConstraintFilter, type ConstraintOp, type ConstraintPolicy, type DBUIBlock, DEFAULT_AGENT_CONFIG, DEFAULT_FMT_CONFIG, type DashboardAgentCollectionConfig, type DatabaseType, type FindingCode, type Fmt, type FmtConfig, type GeneratedFile, type GraphVersion, type Harness, type HybridSearchOptions, INSTRUCTIONS_FILE, type IncomingMessage, type KbNodesQueryFilters, type KbNodesRequestPayload, LLM, type LLMUsageEntry, type LogLevel, MainAgent, type McpServerSpec, type Message, MissingRequestContextError, type ModelStrategy, NUMERIC_KEYS, type NarrationUpdate, type OutputContract, type OutputField, type OutputValidator, type PiSessionListener, type PiSessionState, type PiTranscriptEntry, type PolicyException, type PolicyExceptionTable, type Principal, type PromptAttachment, type PromptContext, type RequestContext, type RerankedResult, type ResolvedAccess, type RowFilter, type RunAgentOptions, STORAGE_CONFIG, type ScriptComponentSpec, ScriptMatcher, type ScriptParameter, type ScriptRecipe, type ScriptRecipeMetaRow, type ScriptRecipeStore, type ScriptResult, ScriptStore, type ScriptStoreOptions, type SelectedWorkflow, type ShimDef, type ShimSummary, type ShimTarget, type SourcePolicy, type SpecToValidate, SuperatomSDK, type SuperatomSDKConfig, type T_RESPONSE, type TaskType, Thread, ThreadManager, type Tool$1 as Tool, type ToolOutputSchema, type TriggerEvent, type TriggerFireInfo, UIBlock, UILogCollector, type User, UserManager, type UsersData, type ValidationContext, type ValidationFinding, type WorkflowDescriptor, type Workspace, accessFromConfig, analyticsClient, answerCatalogForBinding, answerComponents, anthropicLLM, assertReadOnlySql, bindContext, bridgePreamble, captureContext, clearContextTokens, codexRunConfig, constraintPoliciesFromConfig, contextTokenCount, createCodexSession, createCodingAgentSession, dashboardConversationHistory, dataFingerprint, describeContext, describeTriggers, emitAgentEvent, extractNamedExport, formatFindingsForAgent, geminiLLM, getCodingAgent, getCodingAgentsConfig, getPiSessionState, getRequestContext, groqLLM, hybridRerank, inferColumns, isUserContext, listCodingAgents, llmUsageLogger, logger, makeFmt, mintContextToken, normalizeScriptBody, onAgentRun, onPiSessionUpdate, openaiLLM, policiesFromConfig, projectForDatasetBinding, promptLoader, queryCache, registerCodingAgentCollection, registerCodingAgents, registerDashboardAgentCollection, requireRequestContext, rerankChromaResults, rerankConversationResults, resolveContextToken, resolveScriptRecipeStore, revokeContextToken, runAsSystem, runAsUser, runCodingAgent, runScript, runWithContext, runWithMessageIdentity, startAgentTriggers, stopAgentTriggers, userPromptErrorLogger, validateComponentSpec, withCapturedContext, writeBridgeShims, writeShims };

package/dist/index.d.ts

@@ -5160,6 +5160,56 @@ interface SourcePolicy {
     /** Grants outside the scope above. Empty or absent means none. */
     exceptions?: PolicyException[];
 }
+/**
+ * Operators the constraint engine builds predicates from. A superset of
+ * {@link RowFilter.op}, which the original rewriter is limited to.
+ */
+type ConstraintOp = 'in' | 'not_in' | 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'like' | 'not_like' | 'is_null' | 'is_not_null';
+/**
+ * One filter in a {@link ConstraintPolicy}.
+ *
+ * No `table`, unlike {@link RowFilter}: these are keyed by table, so a filter
+ * cannot fail to match the table it was written for and leave it unfiltered.
+ */
+interface ConstraintFilter {
+    column: string;
+    op?: ConstraintOp;
+    /** Omitted only for `is_null` / `is_not_null`. */
+    values?: unknown[];
+    label?: string;
+}
+/**
+ * What one user may see in one source, in the shape the constraint engine reads
+ * (`sqlrewrite/v2/engine.py`).
+ *
+ * Not a superset of {@link SourcePolicy} but a different shape: it adds
+ * schemas, columns and limits. A claim carries one shape or the other, never
+ * both.
+ */
+interface ConstraintPolicy {
+    sourceId?: string | null;
+    label?: string;
+    /**
+     * Every table is read from this schema, whatever schema the query wrote —
+     * which is what makes it a restriction: there is no other schema to reach.
+     * Absent means schemas are left exactly as written.
+     */
+    schema?: string;
+    /** table → readable columns, or `null` for every column. Absent: every table. */
+    readableTables?: Record<string, string[] | null>;
+    /** table → filters, ANDed together. */
+    rowFilters?: Record<string, ConstraintFilter[]>;
+    limits?: {
+        maxRows?: number;
+        maxExecutionSeconds?: number;
+    };
+    /**
+     * Why this policy could not be read. Set rather than dropping the policy:
+     * a dropped policy leaves its source UNRESTRICTED, which is the opposite of
+     * what a malformed restriction should mean. The gate refuses the source.
+     */
+    invalid?: string;
+}
 interface RequestContext {
     principal: Principal;
     projectId?: string;
@@ -5169,6 +5219,11 @@ interface RequestContext {
      * — see the backend's policy-gate.
      */
     policies?: SourcePolicy[];
+    /**
+     * The same restrictions in the constraint shape. Present only when the claim
+     * said `version: 2`, and then `policies` is empty: one claim, one engine.
+     */
+    constraintPolicies?: ConstraintPolicy[];
     /**
      * The data sources this user may reach AT ALL, by source id.
      *
@@ -5221,6 +5276,7 @@ declare function runAsUser<T>(user: {
     projectId?: string;
     requestId?: string;
     policies?: SourcePolicy[];
+    constraintPolicies?: ConstraintPolicy[];
     allowedSources?: string[] | null;
     graphVersion?: GraphVersion;
 }, fn: () => T): T;
@@ -5269,6 +5325,35 @@ declare function describeContext(ctx?: RequestContext | undefined): string;
 /** True when the context represents a signed-in user rather than a trusted job. */
 declare function isUserContext(ctx?: RequestContext | undefined): boolean;
 
+/**
+ * The constraint policy shape (`version: 2`), read onto the request context.
+ *
+ * Strict, and failing CLOSED, which is the opposite of the legacy parser beside
+ * it. There, dropping something malformed grants LESS. Here it grants MORE: a
+ * dropped policy leaves its source with no restriction at all. So a policy that
+ * cannot be read is kept, marked `invalid`, and the gate refuses the source.
+ */
+
+declare function constraintPoliciesFromConfig(raw: unknown): ConstraintPolicy[];
+
+/**
+ * The original policy shape, read out of the admin-authored per-user config.
+ *
+ * Every step here is defensive and DROPS what it cannot read, because the
+ * config is free-form JSON typed by a human into an admin field. That is a
+ * deliberate trade with a sharp edge — a typo'd policy silently becomes no
+ * policy, i.e. unrestricted. The constraint shape next door takes the opposite
+ * approach for exactly that reason.
+ */
+
+/**
+ * Read access policies out of the admin-authored per-user config.
+ *
+ * Accepts either a single object or an array, so one user can be scoped across
+ * several sources — and the object form, whose policies sit under `policies`.
+ */
+declare function policiesFromConfig(config: unknown): SourcePolicy[];
+
 /**
  * Deriving "who is asking" from an incoming WebSocket message.
  *
@@ -5283,6 +5368,8 @@ declare function isUserContext(ctx?: RequestContext | undefined): boolean;
 /** Everything one request's config says about what the caller may see. */
 interface ResolvedAccess {
     policies: SourcePolicy[];
+    /** Set instead of `policies` when the claim said `version: 2`. */
+    constraintPolicies: ConstraintPolicy[];
     /** `null` means every source; `[]` means none — see `RequestContext.allowedSources`. */
     allowedSources: string[] | null;
 }
@@ -5296,19 +5383,6 @@ interface ResolvedAccess {
  * drop EVERY row filter the customer wrote.
  */
 declare function accessFromConfig(config: unknown): ResolvedAccess;
-/**
- * Read access policies out of the admin-authored per-user config.
- *
- * The config is free-form JSON typed by a human into an admin field, so every
- * step here is defensive: a malformed entry is DROPPED, never guessed at. That
- * is a deliberate trade-off with a sharp edge — a typo'd policy silently
- * becomes no policy, i.e. unrestricted. Validating shapes against the source
- * schema (and refusing, rather than dropping) is the fix, and is not built yet.
- *
- * Accepts either a single object or an array, so one user can be scoped across
- * several sources — and the object form, whose policies sit under `policies`.
- */
-declare function policiesFromConfig(config: unknown): SourcePolicy[];
 /**
  * Run `fn` with the caller's identity established.
  *
@@ -5655,6 +5729,13 @@ interface CodexSessionOptions extends CodingAgentSessionOptions {
     extraConfig?: Record<string, unknown>;
     approvalPolicy?: 'never' | 'on-request' | 'on-failure' | 'untrusted';
 }
+/**
+ * codex reads only the first `project_doc_max_bytes` of the instructions file (default 32 KiB) and
+ * drops the rest without a word; composed instructions run past that, losing their closing rules.
+ */
+declare const CODEX_DOC_MAX_BYTES: number;
+/** The `--config` overrides for one run: per run, so no host's config.toml decides them. */
+declare function codexRunConfig(opts: Pick<CodexSessionOptions, 'mcpServers' | 'instructionsFile' | 'extraConfig'>): Record<string, unknown>;
 declare function createCodexSession(opts: CodexSessionOptions): CodingAgentSession;
 
 /**
@@ -6759,4 +6840,4 @@ declare class SuperatomSDK {
     getConversationSimilarityThreshold(): number;
 }
 
-export { ALL_COLUMN_KEYS, ANSWER_COMPONENT_NAMES, type AgentConfig, type AgentEvent, type AgentResponse, type AgentRunContext, type AgentRunHandlers, type AgentRunRecord, type AgentRunResult, type AgentTrigger, type AgentUsage, type AnalyticsEventType, type AnalyticsStatus, type AnswerProvider, type AnswerProviderContext, type ApplySummary, BM25L, type BM25LOptions, type BaseLLMConfig, type BuildTriggerInput, CATEGORY_KEYS, CONTEXT_CONFIG, type CapturedLog, CleanupService, type CodexSessionOptions, type CodingAgentCollectionConfig, type CodingAgentDefinition, type CodingAgentSession, type CodingAgentSessionOptions, type CodingAgentsConfig, type ColInfo, type ColType, type CollectionHandler, type CollectionOperation, type Component, type DBUIBlock, DEFAULT_AGENT_CONFIG, DEFAULT_FMT_CONFIG, type DashboardAgentCollectionConfig, type DatabaseType, type FindingCode, type Fmt, type FmtConfig, type GeneratedFile, type GraphVersion, type Harness, type HybridSearchOptions, INSTRUCTIONS_FILE, type IncomingMessage, type KbNodesQueryFilters, type KbNodesRequestPayload, LLM, type LLMUsageEntry, type LogLevel, MainAgent, type McpServerSpec, type Message, MissingRequestContextError, type ModelStrategy, NUMERIC_KEYS, type NarrationUpdate, type OutputContract, type OutputField, type OutputValidator, type PiSessionListener, type PiSessionState, type PiTranscriptEntry, type PolicyException, type PolicyExceptionTable, type Principal, type PromptAttachment, type PromptContext, type RequestContext, type RerankedResult, type ResolvedAccess, type RowFilter, type RunAgentOptions, STORAGE_CONFIG, type ScriptComponentSpec, ScriptMatcher, type ScriptParameter, type ScriptRecipe, type ScriptRecipeMetaRow, type ScriptRecipeStore, type ScriptResult, ScriptStore, type ScriptStoreOptions, type SelectedWorkflow, type ShimDef, type ShimSummary, type ShimTarget, type SourcePolicy, type SpecToValidate, SuperatomSDK, type SuperatomSDKConfig, type T_RESPONSE, type TaskType, Thread, ThreadManager, type Tool$1 as Tool, type ToolOutputSchema, type TriggerEvent, type TriggerFireInfo, UIBlock, UILogCollector, type User, UserManager, type UsersData, type ValidationContext, type ValidationFinding, type WorkflowDescriptor, type Workspace, accessFromConfig, analyticsClient, answerCatalogForBinding, answerComponents, anthropicLLM, assertReadOnlySql, bindContext, bridgePreamble, captureContext, clearContextTokens, contextTokenCount, createCodexSession, createCodingAgentSession, dashboardConversationHistory, dataFingerprint, describeContext, describeTriggers, emitAgentEvent, extractNamedExport, formatFindingsForAgent, geminiLLM, getCodingAgent, getCodingAgentsConfig, getPiSessionState, getRequestContext, groqLLM, hybridRerank, inferColumns, isUserContext, listCodingAgents, llmUsageLogger, logger, makeFmt, mintContextToken, normalizeScriptBody, onAgentRun, onPiSessionUpdate, openaiLLM, policiesFromConfig, projectForDatasetBinding, promptLoader, queryCache, registerCodingAgentCollection, registerCodingAgents, registerDashboardAgentCollection, requireRequestContext, rerankChromaResults, rerankConversationResults, resolveContextToken, resolveScriptRecipeStore, revokeContextToken, runAsSystem, runAsUser, runCodingAgent, runScript, runWithContext, runWithMessageIdentity, startAgentTriggers, stopAgentTriggers, userPromptErrorLogger, validateComponentSpec, withCapturedContext, writeBridgeShims, writeShims };
+export { ALL_COLUMN_KEYS, ANSWER_COMPONENT_NAMES, type AgentConfig, type AgentEvent, type AgentResponse, type AgentRunContext, type AgentRunHandlers, type AgentRunRecord, type AgentRunResult, type AgentTrigger, type AgentUsage, type AnalyticsEventType, type AnalyticsStatus, type AnswerProvider, type AnswerProviderContext, type ApplySummary, BM25L, type BM25LOptions, type BaseLLMConfig, type BuildTriggerInput, CATEGORY_KEYS, CODEX_DOC_MAX_BYTES, CONTEXT_CONFIG, type CapturedLog, CleanupService, type CodexSessionOptions, type CodingAgentCollectionConfig, type CodingAgentDefinition, type CodingAgentSession, type CodingAgentSessionOptions, type CodingAgentsConfig, type ColInfo, type ColType, type CollectionHandler, type CollectionOperation, type Component, type ConstraintFilter, type ConstraintOp, type ConstraintPolicy, type DBUIBlock, DEFAULT_AGENT_CONFIG, DEFAULT_FMT_CONFIG, type DashboardAgentCollectionConfig, type DatabaseType, type FindingCode, type Fmt, type FmtConfig, type GeneratedFile, type GraphVersion, type Harness, type HybridSearchOptions, INSTRUCTIONS_FILE, type IncomingMessage, type KbNodesQueryFilters, type KbNodesRequestPayload, LLM, type LLMUsageEntry, type LogLevel, MainAgent, type McpServerSpec, type Message, MissingRequestContextError, type ModelStrategy, NUMERIC_KEYS, type NarrationUpdate, type OutputContract, type OutputField, type OutputValidator, type PiSessionListener, type PiSessionState, type PiTranscriptEntry, type PolicyException, type PolicyExceptionTable, type Principal, type PromptAttachment, type PromptContext, type RequestContext, type RerankedResult, type ResolvedAccess, type RowFilter, type RunAgentOptions, STORAGE_CONFIG, type ScriptComponentSpec, ScriptMatcher, type ScriptParameter, type ScriptRecipe, type ScriptRecipeMetaRow, type ScriptRecipeStore, type ScriptResult, ScriptStore, type ScriptStoreOptions, type SelectedWorkflow, type ShimDef, type ShimSummary, type ShimTarget, type SourcePolicy, type SpecToValidate, SuperatomSDK, type SuperatomSDKConfig, type T_RESPONSE, type TaskType, Thread, ThreadManager, type Tool$1 as Tool, type ToolOutputSchema, type TriggerEvent, type TriggerFireInfo, UIBlock, UILogCollector, type User, UserManager, type UsersData, type ValidationContext, type ValidationFinding, type WorkflowDescriptor, type Workspace, accessFromConfig, analyticsClient, answerCatalogForBinding, answerComponents, anthropicLLM, assertReadOnlySql, bindContext, bridgePreamble, captureContext, clearContextTokens, codexRunConfig, constraintPoliciesFromConfig, contextTokenCount, createCodexSession, createCodingAgentSession, dashboardConversationHistory, dataFingerprint, describeContext, describeTriggers, emitAgentEvent, extractNamedExport, formatFindingsForAgent, geminiLLM, getCodingAgent, getCodingAgentsConfig, getPiSessionState, getRequestContext, groqLLM, hybridRerank, inferColumns, isUserContext, listCodingAgents, llmUsageLogger, logger, makeFmt, mintContextToken, normalizeScriptBody, onAgentRun, onPiSessionUpdate, openaiLLM, policiesFromConfig, projectForDatasetBinding, promptLoader, queryCache, registerCodingAgentCollection, registerCodingAgents, registerDashboardAgentCollection, requireRequestContext, rerankChromaResults, rerankConversationResults, resolveContextToken, resolveScriptRecipeStore, revokeContextToken, runAsSystem, runAsUser, runCodingAgent, runScript, runWithContext, runWithMessageIdentity, startAgentTriggers, stopAgentTriggers, userPromptErrorLogger, validateComponentSpec, withCapturedContext, writeBridgeShims, writeShims };

package/dist/index.js

@@ -34,6 +34,7 @@ __export(index_exports, {
   ANSWER_COMPONENT_NAMES: () => ANSWER_COMPONENT_NAMES,
   BM25L: () => BM25L,
   CATEGORY_KEYS: () => CATEGORY_KEYS,
+  CODEX_DOC_MAX_BYTES: () => CODEX_DOC_MAX_BYTES,
   CONTEXT_CONFIG: () => CONTEXT_CONFIG,
   CleanupService: () => CleanupService,
   DEFAULT_AGENT_CONFIG: () => DEFAULT_AGENT_CONFIG,
@@ -62,6 +63,8 @@ __export(index_exports, {
   bridgePreamble: () => bridgePreamble,
   captureContext: () => captureContext,
   clearContextTokens: () => clearContextTokens,
+  codexRunConfig: () => codexRunConfig,
+  constraintPoliciesFromConfig: () => constraintPoliciesFromConfig,
   contextTokenCount: () => contextTokenCount,
   createCodexSession: () => createCodexSession,
   createCodingAgentSession: () => createCodingAgentSession,
@@ -1952,7 +1955,17 @@ function runWithContext(ctx, fn) {
   return getStorage().run(ctx, fn);
 }
 function runAsUser(user, fn) {
-  const { userId, orgId, role, projectId, requestId, policies, allowedSources, graphVersion } = user;
+  const {
+    userId,
+    orgId,
+    role,
+    projectId,
+    requestId,
+    policies,
+    constraintPolicies,
+    allowedSources,
+    graphVersion
+  } = user;
   return runWithContext(
     // `allowedSources` is spread in only when given, so an absent restriction
     // stays absent rather than becoming an explicit `undefined` that a later
@@ -1962,6 +1975,7 @@ function runAsUser(user, fn) {
       projectId,
       requestId,
       policies,
+      ...constraintPolicies?.length ? { constraintPolicies } : {},
       ...allowedSources !== void 0 ? { allowedSources } : {},
       ...graphVersion !== void 0 ? { graphVersion } : {}
     },
@@ -2642,42 +2656,148 @@ function buildDirectToolCacheKey(toolId, parameters) {
   return `et-direct:${toolId}:${stableStringify(parameters || {})}`;
 }
 
-// src/handlers/request-identity.ts
-function graphVersionOf(v) {
-  if (v === "draft") return "draft";
-  return Number.isInteger(v) && v > 0 ? v : void 0;
+// src/handlers/data-access/v2/policies.ts
+var CONSTRAINT_OPS = [
+  "in",
+  "not_in",
+  "eq",
+  "ne",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "like",
+  "not_like",
+  "is_null",
+  "is_not_null"
+];
+var NO_VALUE_OPS = /* @__PURE__ */ new Set(["is_null", "is_not_null"]);
+function constraintPoliciesFromConfig(raw) {
+  const entries = Array.isArray(raw) ? raw : [raw];
+  const out = [];
+  for (const entry of entries) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const e = entry;
+    const sourceId = typeof e.sourceId === "string" && e.sourceId ? e.sourceId : null;
+    const label = typeof e.label === "string" && e.label.trim() ? e.label.trim() : void 0;
+    const bad = (why) => ({ sourceId, label, invalid: why });
+    let schema2;
+    if (e.schema !== void 0 && e.schema !== null) {
+      if (typeof e.schema !== "string" || !e.schema.trim()) {
+        out.push(bad("schema must be a schema name"));
+        continue;
+      }
+      schema2 = e.schema.trim();
+    }
+    let readableTables;
+    let tablesBad;
+    if (e.readableTables !== void 0 && e.readableTables !== null) {
+      if (typeof e.readableTables !== "object" || Array.isArray(e.readableTables)) {
+        out.push(bad("readableTables must be an object of table to columns"));
+        continue;
+      }
+      readableTables = {};
+      for (const [table, cols] of Object.entries(e.readableTables)) {
+        if (cols === null) {
+          readableTables[table] = null;
+          continue;
+        }
+        if (!Array.isArray(cols) || cols.length === 0) {
+          tablesBad = `readableTables["${table}"] must be a non-empty list or null`;
+          break;
+        }
+        const columns = cols.filter((c) => typeof c === "string" && !!c.trim()).map((c) => c.trim());
+        if (columns.length !== cols.length) {
+          tablesBad = `readableTables["${table}"] has an entry that is not a column name`;
+          break;
+        }
+        readableTables[table] = columns;
+      }
+      if (!tablesBad && Object.keys(readableTables).length === 0) {
+        tablesBad = "readableTables names no tables \u2014 omit it to allow every table";
+      }
+      if (tablesBad) {
+        out.push(bad(tablesBad));
+        continue;
+      }
+    }
+    const rowFilters = {};
+    let filtersBad;
+    const rawFilters = e.rowFilters;
+    if (rawFilters !== void 0 && rawFilters !== null) {
+      if (typeof rawFilters !== "object" || Array.isArray(rawFilters)) {
+        filtersBad = "rowFilters must be an object keyed by table";
+      } else {
+        for (const [table, items] of Object.entries(rawFilters)) {
+          if (readableTables && !(table in readableTables)) {
+            filtersBad = `rowFilters names "${table}", which readableTables does not allow`;
+            break;
+          }
+          if (!Array.isArray(items) || items.length === 0) {
+            filtersBad = `rowFilters["${table}"] must be a non-empty list`;
+            break;
+          }
+          const parsed = [];
+          for (const item of items) {
+            if (!item || typeof item !== "object") {
+              filtersBad = `rowFilters["${table}"] has an entry that is not an object`;
+              break;
+            }
+            const f = item;
+            if (typeof f.column !== "string" || !f.column.trim()) {
+              filtersBad = `a filter on "${table}" has no column`;
+              break;
+            }
+            const op = typeof f.op === "string" ? f.op.toLowerCase() : "in";
+            if (!CONSTRAINT_OPS.includes(op)) {
+              filtersBad = `unsupported operator "${f.op}" on "${table}.${f.column}"`;
+              break;
+            }
+            const values = Array.isArray(f.values) ? f.values : [];
+            if (!NO_VALUE_OPS.has(op) && values.length === 0) {
+              filtersBad = `the filter on "${table}.${f.column}" has no values`;
+              break;
+            }
+            parsed.push({
+              column: f.column.trim(),
+              op,
+              ...NO_VALUE_OPS.has(op) ? {} : { values },
+              label: typeof f.label === "string" && f.label.trim() ? f.label.trim() : void 0
+            });
+          }
+          if (filtersBad) break;
+          rowFilters[table] = parsed;
+        }
+      }
+    }
+    if (filtersBad) {
+      out.push(bad(filtersBad));
+      continue;
+    }
+    const rawLimits = e.limits;
+    const num = (v) => typeof v === "number" && Number.isInteger(v) && v > 0 ? v : void 0;
+    const limits = rawLimits ? { maxRows: num(rawLimits.maxRows), maxExecutionSeconds: num(rawLimits.maxExecutionSeconds) } : void 0;
+    out.push({
+      sourceId,
+      label,
+      ...schema2 ? { schema: schema2 } : {},
+      ...readableTables ? { readableTables } : {},
+      ...Object.keys(rowFilters).length ? { rowFilters } : {},
+      ...limits ? { limits } : {}
+    });
+  }
+  return out;
 }
+
+// src/handlers/data-access/shape.ts
 function scopedForm(config2) {
   if (!config2 || typeof config2 !== "object" || Array.isArray(config2)) return void 0;
   const c = config2;
   return "allowedSources" in c || "policies" in c ? c : void 0;
 }
-function allowedSourcesFrom(value) {
-  if (value === void 0 || value === null) return null;
-  if (!Array.isArray(value)) {
-    if (!warnedBadSources) {
-      warnedBadSources = true;
-      logger.warn(
-        `[RequestIdentity] "allowedSources" is ${typeof value}, not a list of source ids \u2014 treating it as NO sources rather than all of them. Fix the config: "allowedSources": ["mssql-1a2b"].`
-      );
-    }
-    return [];
-  }
-  const out = [];
-  for (const item of value) {
-    if (typeof item !== "string" || !item.trim()) continue;
-    const id = item.trim();
-    if (!out.includes(id)) out.push(id);
-  }
-  return out;
-}
-function accessFromConfig(config2) {
-  const scoped = scopedForm(config2);
-  return {
-    policies: policiesFromConfig(config2),
-    allowedSources: scoped ? allowedSourcesFrom(scoped.allowedSources) : null
-  };
-}
+
+// src/handlers/data-access/v1/policies.ts
+var warnedUnlabelled = false;
 function exceptionsFromConfig(raw) {
   if (!Array.isArray(raw)) return [];
   const str = (v) => typeof v === "string" && v.trim() ? v.trim() : void 0;
@@ -2756,16 +2876,55 @@ function policiesFromConfig(config2) {
   }
   return out;
 }
+
+// src/handlers/request-identity.ts
+function graphVersionOf(v) {
+  if (v === "draft") return "draft";
+  return Number.isInteger(v) && v > 0 ? v : void 0;
+}
+function allowedSourcesFrom(value) {
+  if (value === void 0 || value === null) return null;
+  if (!Array.isArray(value)) {
+    if (!warnedBadSources) {
+      warnedBadSources = true;
+      logger.warn(
+        `[RequestIdentity] "allowedSources" is ${typeof value}, not a list of source ids \u2014 treating it as NO sources rather than all of them. Fix the config: "allowedSources": ["mssql-1a2b"].`
+      );
+    }
+    return [];
+  }
+  const out = [];
+  for (const item of value) {
+    if (typeof item !== "string" || !item.trim()) continue;
+    const id = item.trim();
+    if (!out.includes(id)) out.push(id);
+  }
+  return out;
+}
+function accessFromConfig(config2) {
+  const scoped = scopedForm(config2);
+  const allowedSources = scoped ? allowedSourcesFrom(scoped.allowedSources) : null;
+  if (scoped?.version === 2) {
+    return {
+      policies: [],
+      constraintPolicies: constraintPoliciesFromConfig(scoped.policies),
+      allowedSources
+    };
+  }
+  return { policies: policiesFromConfig(config2), constraintPolicies: [], allowedSources };
+}
 var warnedUntrusted = false;
 var warnedAnonymous = false;
-var warnedUnlabelled = false;
 var warnedBadSources = false;
 var announcedVerified = false;
 var reportedIdMismatches = /* @__PURE__ */ new Set();
 function runWithMessageIdentity(message, fn) {
   const verified = message?.authContext;
   const requestId = message?.id;
-  const { policies, allowedSources } = verified ? accessFromConfig(verified.config) : accessFromConfig(message?.payload?.config);
+  const { policies, constraintPolicies, allowedSources } = verified ? accessFromConfig(verified.config) : accessFromConfig(message?.payload?.config);
+  logger.info(
+    `[RequestIdentity] ${message?.type ?? "?"}: access from ${verified ? "authContext" : "payload"}${verified && verified.config == null ? " (none on it)" : ""}, allowedSources=${allowedSources === null ? "every source" : `[${allowedSources.join(", ") || "NONE"}]`}, ${constraintPolicies.length} constraint policy(ies), ${policies.length} row policy(ies)`
+  );
   if (verified?.userId) {
     const claimedId = message?.payload?.userId;
     if (!announcedVerified) {
@@ -2790,6 +2949,7 @@ function runWithMessageIdentity(message, fn) {
         role: verified.role,
         requestId,
         policies,
+        constraintPolicies,
         // `?? undefined` so "no restriction" leaves the key off the context
         // entirely; `[]` is passed through as the deny-everything it means.
         allowedSources: allowedSources ?? void 0,
@@ -2807,7 +2967,10 @@ function runWithMessageIdentity(message, fn) {
         "[RequestIdentity] Using the client-supplied payload.userId as the principal \u2014 the relay is not stamping a verified authContext yet, so this identity is NOT trustworthy. Fine for plumbing; do not enable policy enforcement until the relay change lands."
       );
     }
-    return runAsUser({ userId: claimed, requestId, policies, allowedSources: allowedSources ?? void 0 }, fn);
+    return runAsUser(
+      { userId: claimed, requestId, policies, constraintPolicies, allowedSources: allowedSources ?? void 0 },
+      fn
+    );
   }
   if (!warnedAnonymous) {
     warnedAnonymous = true;
@@ -24649,6 +24812,20 @@ function buildEnv(opts) {
   }
   return { ...env, ...opts.env ?? {} };
 }
+var CODEX_DOC_MAX_BYTES = 256 * 1024;
+function codexRunConfig(opts) {
+  return {
+    // Tools reach codex as MCP servers; each server's name shows up on
+    // every tool event, so the runner can tell ours from codex's own.
+    ...opts.mcpServers && Object.keys(opts.mcpServers).length ? { mcp_servers: opts.mcpServers } : {},
+    // Per run, not ~/.codex/config.toml: a host without that line would run
+    // the agent with no instructions at all. AGENTS.md still wins if present.
+    ...opts.instructionsFile && opts.instructionsFile !== "AGENTS.md" ? { project_doc_fallback_filenames: [opts.instructionsFile] } : {},
+    project_doc_max_bytes: CODEX_DOC_MAX_BYTES,
+    // Last: a deployment's own value wins.
+    ...opts.extraConfig ?? {}
+  };
+}
 function createCodexSession(opts) {
   const model = opts.model ?? process.env.CODEX_AGENT_MODEL;
   let thread = null;
@@ -24671,21 +24848,12 @@ function createCodexSession(opts) {
   async function ensureThread() {
     if (thread) return thread;
     const { Codex } = await loadCodex();
-    const config2 = {
-      // Tools reach codex as MCP servers; each server's name shows up on
-      // every tool event, so the runner can tell ours from codex's own.
-      ...opts.mcpServers && Object.keys(opts.mcpServers).length ? { mcp_servers: opts.mcpServers } : {},
-      // Per run, not ~/.codex/config.toml: a host without that line would run
-      // the agent with no instructions at all. AGENTS.md still wins if present.
-      ...opts.instructionsFile && opts.instructionsFile !== "AGENTS.md" ? { project_doc_fallback_filenames: [opts.instructionsFile] } : {},
-      ...opts.extraConfig ?? {}
-    };
+    const config2 = codexRunConfig(opts);
     const codex = new Codex({
       ...opts.apiKey ? { apiKey: opts.apiKey } : {},
       ...opts.baseUrl ? { baseUrl: opts.baseUrl } : {},
       env: buildEnv(opts),
-      // Only when non-empty: an empty override is pointless CLI noise.
-      ...Object.keys(config2).length ? { config: config2 } : {}
+      config: config2
     });
     thread = resumeId ? codex.resumeThread(resumeId, threadOptions()) : codex.startThread(threadOptions());
     return thread;
@@ -30181,6 +30349,7 @@ var SuperatomSDK = class {
   ANSWER_COMPONENT_NAMES,
   BM25L,
   CATEGORY_KEYS,
+  CODEX_DOC_MAX_BYTES,
   CONTEXT_CONFIG,
   CleanupService,
   DEFAULT_AGENT_CONFIG,
@@ -30209,6 +30378,8 @@ var SuperatomSDK = class {
   bridgePreamble,
   captureContext,
   clearContextTokens,
+  codexRunConfig,
+  constraintPoliciesFromConfig,
   contextTokenCount,
   createCodexSession,
   createCodingAgentSession,

package/dist/index.mjs

@@ -1840,7 +1840,17 @@ function runWithContext(ctx, fn) {
   return getStorage().run(ctx, fn);
 }
 function runAsUser(user, fn) {
-  const { userId, orgId, role, projectId, requestId, policies, allowedSources, graphVersion } = user;
+  const {
+    userId,
+    orgId,
+    role,
+    projectId,
+    requestId,
+    policies,
+    constraintPolicies,
+    allowedSources,
+    graphVersion
+  } = user;
   return runWithContext(
     // `allowedSources` is spread in only when given, so an absent restriction
     // stays absent rather than becoming an explicit `undefined` that a later
@@ -1850,6 +1860,7 @@ function runAsUser(user, fn) {
       projectId,
       requestId,
       policies,
+      ...constraintPolicies?.length ? { constraintPolicies } : {},
       ...allowedSources !== void 0 ? { allowedSources } : {},
       ...graphVersion !== void 0 ? { graphVersion } : {}
     },
@@ -2530,42 +2541,148 @@ function buildDirectToolCacheKey(toolId, parameters) {
   return `et-direct:${toolId}:${stableStringify(parameters || {})}`;
 }
 
-// src/handlers/request-identity.ts
-function graphVersionOf(v) {
-  if (v === "draft") return "draft";
-  return Number.isInteger(v) && v > 0 ? v : void 0;
+// src/handlers/data-access/v2/policies.ts
+var CONSTRAINT_OPS = [
+  "in",
+  "not_in",
+  "eq",
+  "ne",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "like",
+  "not_like",
+  "is_null",
+  "is_not_null"
+];
+var NO_VALUE_OPS = /* @__PURE__ */ new Set(["is_null", "is_not_null"]);
+function constraintPoliciesFromConfig(raw) {
+  const entries = Array.isArray(raw) ? raw : [raw];
+  const out = [];
+  for (const entry of entries) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const e = entry;
+    const sourceId = typeof e.sourceId === "string" && e.sourceId ? e.sourceId : null;
+    const label = typeof e.label === "string" && e.label.trim() ? e.label.trim() : void 0;
+    const bad = (why) => ({ sourceId, label, invalid: why });
+    let schema2;
+    if (e.schema !== void 0 && e.schema !== null) {
+      if (typeof e.schema !== "string" || !e.schema.trim()) {
+        out.push(bad("schema must be a schema name"));
+        continue;
+      }
+      schema2 = e.schema.trim();
+    }
+    let readableTables;
+    let tablesBad;
+    if (e.readableTables !== void 0 && e.readableTables !== null) {
+      if (typeof e.readableTables !== "object" || Array.isArray(e.readableTables)) {
+        out.push(bad("readableTables must be an object of table to columns"));
+        continue;
+      }
+      readableTables = {};
+      for (const [table, cols] of Object.entries(e.readableTables)) {
+        if (cols === null) {
+          readableTables[table] = null;
+          continue;
+        }
+        if (!Array.isArray(cols) || cols.length === 0) {
+          tablesBad = `readableTables["${table}"] must be a non-empty list or null`;
+          break;
+        }
+        const columns = cols.filter((c) => typeof c === "string" && !!c.trim()).map((c) => c.trim());
+        if (columns.length !== cols.length) {
+          tablesBad = `readableTables["${table}"] has an entry that is not a column name`;
+          break;
+        }
+        readableTables[table] = columns;
+      }
+      if (!tablesBad && Object.keys(readableTables).length === 0) {
+        tablesBad = "readableTables names no tables \u2014 omit it to allow every table";
+      }
+      if (tablesBad) {
+        out.push(bad(tablesBad));
+        continue;
+      }
+    }
+    const rowFilters = {};
+    let filtersBad;
+    const rawFilters = e.rowFilters;
+    if (rawFilters !== void 0 && rawFilters !== null) {
+      if (typeof rawFilters !== "object" || Array.isArray(rawFilters)) {
+        filtersBad = "rowFilters must be an object keyed by table";
+      } else {
+        for (const [table, items] of Object.entries(rawFilters)) {
+          if (readableTables && !(table in readableTables)) {
+            filtersBad = `rowFilters names "${table}", which readableTables does not allow`;
+            break;
+          }
+          if (!Array.isArray(items) || items.length === 0) {
+            filtersBad = `rowFilters["${table}"] must be a non-empty list`;
+            break;
+          }
+          const parsed = [];
+          for (const item of items) {
+            if (!item || typeof item !== "object") {
+              filtersBad = `rowFilters["${table}"] has an entry that is not an object`;
+              break;
+            }
+            const f = item;
+            if (typeof f.column !== "string" || !f.column.trim()) {
+              filtersBad = `a filter on "${table}" has no column`;
+              break;
+            }
+            const op = typeof f.op === "string" ? f.op.toLowerCase() : "in";
+            if (!CONSTRAINT_OPS.includes(op)) {
+              filtersBad = `unsupported operator "${f.op}" on "${table}.${f.column}"`;
+              break;
+            }
+            const values = Array.isArray(f.values) ? f.values : [];
+            if (!NO_VALUE_OPS.has(op) && values.length === 0) {
+              filtersBad = `the filter on "${table}.${f.column}" has no values`;
+              break;
+            }
+            parsed.push({
+              column: f.column.trim(),
+              op,
+              ...NO_VALUE_OPS.has(op) ? {} : { values },
+              label: typeof f.label === "string" && f.label.trim() ? f.label.trim() : void 0
+            });
+          }
+          if (filtersBad) break;
+          rowFilters[table] = parsed;
+        }
+      }
+    }
+    if (filtersBad) {
+      out.push(bad(filtersBad));
+      continue;
+    }
+    const rawLimits = e.limits;
+    const num = (v) => typeof v === "number" && Number.isInteger(v) && v > 0 ? v : void 0;
+    const limits = rawLimits ? { maxRows: num(rawLimits.maxRows), maxExecutionSeconds: num(rawLimits.maxExecutionSeconds) } : void 0;
+    out.push({
+      sourceId,
+      label,
+      ...schema2 ? { schema: schema2 } : {},
+      ...readableTables ? { readableTables } : {},
+      ...Object.keys(rowFilters).length ? { rowFilters } : {},
+      ...limits ? { limits } : {}
+    });
+  }
+  return out;
 }
+
+// src/handlers/data-access/shape.ts
 function scopedForm(config2) {
   if (!config2 || typeof config2 !== "object" || Array.isArray(config2)) return void 0;
   const c = config2;
   return "allowedSources" in c || "policies" in c ? c : void 0;
 }
-function allowedSourcesFrom(value) {
-  if (value === void 0 || value === null) return null;
-  if (!Array.isArray(value)) {
-    if (!warnedBadSources) {
-      warnedBadSources = true;
-      logger.warn(
-        `[RequestIdentity] "allowedSources" is ${typeof value}, not a list of source ids \u2014 treating it as NO sources rather than all of them. Fix the config: "allowedSources": ["mssql-1a2b"].`
-      );
-    }
-    return [];
-  }
-  const out = [];
-  for (const item of value) {
-    if (typeof item !== "string" || !item.trim()) continue;
-    const id = item.trim();
-    if (!out.includes(id)) out.push(id);
-  }
-  return out;
-}
-function accessFromConfig(config2) {
-  const scoped = scopedForm(config2);
-  return {
-    policies: policiesFromConfig(config2),
-    allowedSources: scoped ? allowedSourcesFrom(scoped.allowedSources) : null
-  };
-}
+
+// src/handlers/data-access/v1/policies.ts
+var warnedUnlabelled = false;
 function exceptionsFromConfig(raw) {
   if (!Array.isArray(raw)) return [];
   const str = (v) => typeof v === "string" && v.trim() ? v.trim() : void 0;
@@ -2644,16 +2761,55 @@ function policiesFromConfig(config2) {
   }
   return out;
 }
+
+// src/handlers/request-identity.ts
+function graphVersionOf(v) {
+  if (v === "draft") return "draft";
+  return Number.isInteger(v) && v > 0 ? v : void 0;
+}
+function allowedSourcesFrom(value) {
+  if (value === void 0 || value === null) return null;
+  if (!Array.isArray(value)) {
+    if (!warnedBadSources) {
+      warnedBadSources = true;
+      logger.warn(
+        `[RequestIdentity] "allowedSources" is ${typeof value}, not a list of source ids \u2014 treating it as NO sources rather than all of them. Fix the config: "allowedSources": ["mssql-1a2b"].`
+      );
+    }
+    return [];
+  }
+  const out = [];
+  for (const item of value) {
+    if (typeof item !== "string" || !item.trim()) continue;
+    const id = item.trim();
+    if (!out.includes(id)) out.push(id);
+  }
+  return out;
+}
+function accessFromConfig(config2) {
+  const scoped = scopedForm(config2);
+  const allowedSources = scoped ? allowedSourcesFrom(scoped.allowedSources) : null;
+  if (scoped?.version === 2) {
+    return {
+      policies: [],
+      constraintPolicies: constraintPoliciesFromConfig(scoped.policies),
+      allowedSources
+    };
+  }
+  return { policies: policiesFromConfig(config2), constraintPolicies: [], allowedSources };
+}
 var warnedUntrusted = false;
 var warnedAnonymous = false;
-var warnedUnlabelled = false;
 var warnedBadSources = false;
 var announcedVerified = false;
 var reportedIdMismatches = /* @__PURE__ */ new Set();
 function runWithMessageIdentity(message, fn) {
   const verified = message?.authContext;
   const requestId = message?.id;
-  const { policies, allowedSources } = verified ? accessFromConfig(verified.config) : accessFromConfig(message?.payload?.config);
+  const { policies, constraintPolicies, allowedSources } = verified ? accessFromConfig(verified.config) : accessFromConfig(message?.payload?.config);
+  logger.info(
+    `[RequestIdentity] ${message?.type ?? "?"}: access from ${verified ? "authContext" : "payload"}${verified && verified.config == null ? " (none on it)" : ""}, allowedSources=${allowedSources === null ? "every source" : `[${allowedSources.join(", ") || "NONE"}]`}, ${constraintPolicies.length} constraint policy(ies), ${policies.length} row policy(ies)`
+  );
   if (verified?.userId) {
     const claimedId = message?.payload?.userId;
     if (!announcedVerified) {
@@ -2678,6 +2834,7 @@ function runWithMessageIdentity(message, fn) {
         role: verified.role,
         requestId,
         policies,
+        constraintPolicies,
         // `?? undefined` so "no restriction" leaves the key off the context
         // entirely; `[]` is passed through as the deny-everything it means.
         allowedSources: allowedSources ?? void 0,
@@ -2695,7 +2852,10 @@ function runWithMessageIdentity(message, fn) {
         "[RequestIdentity] Using the client-supplied payload.userId as the principal \u2014 the relay is not stamping a verified authContext yet, so this identity is NOT trustworthy. Fine for plumbing; do not enable policy enforcement until the relay change lands."
       );
     }
-    return runAsUser({ userId: claimed, requestId, policies, allowedSources: allowedSources ?? void 0 }, fn);
+    return runAsUser(
+      { userId: claimed, requestId, policies, constraintPolicies, allowedSources: allowedSources ?? void 0 },
+      fn
+    );
   }
   if (!warnedAnonymous) {
     warnedAnonymous = true;
@@ -24537,6 +24697,20 @@ function buildEnv(opts) {
   }
   return { ...env, ...opts.env ?? {} };
 }
+var CODEX_DOC_MAX_BYTES = 256 * 1024;
+function codexRunConfig(opts) {
+  return {
+    // Tools reach codex as MCP servers; each server's name shows up on
+    // every tool event, so the runner can tell ours from codex's own.
+    ...opts.mcpServers && Object.keys(opts.mcpServers).length ? { mcp_servers: opts.mcpServers } : {},
+    // Per run, not ~/.codex/config.toml: a host without that line would run
+    // the agent with no instructions at all. AGENTS.md still wins if present.
+    ...opts.instructionsFile && opts.instructionsFile !== "AGENTS.md" ? { project_doc_fallback_filenames: [opts.instructionsFile] } : {},
+    project_doc_max_bytes: CODEX_DOC_MAX_BYTES,
+    // Last: a deployment's own value wins.
+    ...opts.extraConfig ?? {}
+  };
+}
 function createCodexSession(opts) {
   const model = opts.model ?? process.env.CODEX_AGENT_MODEL;
   let thread = null;
@@ -24559,21 +24733,12 @@ function createCodexSession(opts) {
   async function ensureThread() {
     if (thread) return thread;
     const { Codex } = await loadCodex();
-    const config2 = {
-      // Tools reach codex as MCP servers; each server's name shows up on
-      // every tool event, so the runner can tell ours from codex's own.
-      ...opts.mcpServers && Object.keys(opts.mcpServers).length ? { mcp_servers: opts.mcpServers } : {},
-      // Per run, not ~/.codex/config.toml: a host without that line would run
-      // the agent with no instructions at all. AGENTS.md still wins if present.
-      ...opts.instructionsFile && opts.instructionsFile !== "AGENTS.md" ? { project_doc_fallback_filenames: [opts.instructionsFile] } : {},
-      ...opts.extraConfig ?? {}
-    };
+    const config2 = codexRunConfig(opts);
     const codex = new Codex({
       ...opts.apiKey ? { apiKey: opts.apiKey } : {},
       ...opts.baseUrl ? { baseUrl: opts.baseUrl } : {},
       env: buildEnv(opts),
-      // Only when non-empty: an empty override is pointless CLI noise.
-      ...Object.keys(config2).length ? { config: config2 } : {}
+      config: config2
     });
     thread = resumeId ? codex.resumeThread(resumeId, threadOptions()) : codex.startThread(threadOptions());
     return thread;
@@ -30068,6 +30233,7 @@ export {
   ANSWER_COMPONENT_NAMES,
   BM25L,
   CATEGORY_KEYS,
+  CODEX_DOC_MAX_BYTES,
   CONTEXT_CONFIG,
   CleanupService,
   DEFAULT_AGENT_CONFIG,
@@ -30096,6 +30262,8 @@ export {
   bridgePreamble,
   captureContext,
   clearContextTokens,
+  codexRunConfig,
+  constraintPoliciesFromConfig,
   contextTokenCount,
   createCodexSession,
   createCodingAgentSession,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superatomai/sdk-node",
-  "version": "0.0.88-dsp",
+  "version": "0.0.90-dsp",
   "description": "Node.js TypeScript SDK for Superatom",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",