@vibeorm/runtime 2.0.0-alpha.8 → 2.0.0-alpha.9

package/dist/scoped.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Tenant scoping — `$scoped` (framework handoff: one scoped handle per request).
+ *
+ * A CALLER-CONFIGURED row-scoping layer: the base client plus a total
+ * per-model tenancy map plus a scope value produce a NEW handle whose every
+ * query is structurally confined to that tenant. Complements `@@policy`
+ * (schema-declared, fail-closed) — the two do NOT combine: `$scoped` refuses
+ * on a client whose schema declares any `@@policy`.
+ *
+ * Implemented as PURE args rewriting over the built delegates (the views.ts /
+ * policy.ts pattern — ZERO query-builder edits; every emitted statement is a
+ * shape the catalogs already pin). The rewrite relies on three verified
+ * builder properties:
+ *   1. findUnique/connect wheres compile their FULL where object — extra
+ *      fields and `AND` groups become filters (query-builder findUnique,
+ *      nested-writes resolveTargetKey), so injecting the tenant predicate
+ *      into a unique where IS the verified lookup, inside whatever
+ *      transaction the write already runs.
+ *   2. A guard field beyond the conflict target forces upsert onto the
+ *      transactional find-then-write fallback (PG-2), whose probe honors the
+ *      full where — so an injected upsert can never fire ON CONFLICT against
+ *      another tenant's row.
+ *   3. Cursors compile from caller-supplied values only (no row lookup), so
+ *      cursor pagination needs no rewrite to stay leak-free.
+ *
+ * Deny-by-default: every argument node that touches a scoped model either
+ * gets the predicate injected where semantics allow, or the call REFUSES with
+ * a typed `ScopedQueryError { model, path, reason }` before any SQL runs.
+ * Raw SQL is absent from the scoped surface; the deliberate escape is the
+ * BASE client, which this layer never mutates.
+ */
+import type { RelationIR } from "@vibeorm/schema";
+import type { FieldMeta, RuntimeMeta } from "./model-meta.ts";
+import type { ClientRow, DynamicClient } from "./client.ts";
+/** Scope values a tenant column can carry (matches String / Int / BigInt columns). */
+export type ScopeValue = string | number | bigint;
+/**
+ * What happens when a scoped model appears as a CHILD inside another model's
+ * nested write: `"verify"` (default) rewrites reference verbs into
+ * tenant-verified lookups; `"refuse"` rejects every reference verb (nested
+ * `create` stays allowed under both — it is forced into the tenant).
+ */
+export type ScopedNestedMode = "verify" | "refuse";
+/** One model's classification in the tenancy map. */
+export type ScopedModelEntry = "none" | {
+    readonly column: string;
+    readonly nested?: ScopedNestedMode;
+} | {
+    readonly through: string;
+    readonly nested?: ScopedNestedMode;
+};
+/** The per-model tenancy map — must classify EVERY model (totality). */
+export type ScopedModelsMap = Readonly<Record<string, ScopedModelEntry>>;
+/** The `$scoped` argument. */
+export type ScopedClientConfig = {
+    readonly scope: ScopeValue | null;
+    readonly models: ScopedModelsMap;
+};
+type ResolvedEntry = {
+    readonly kind: "none";
+} | {
+    readonly kind: "column";
+    readonly field: FieldMeta;
+    readonly nested: ScopedNestedMode;
+} | {
+    readonly kind: "through";
+    readonly relation: RelationIR;
+    readonly targetModel: string;
+    readonly nested: ScopedNestedMode;
+};
+type ResolvedScopedModels = ReadonlyMap<string, ResolvedEntry>;
+/**
+ * Validate the models map against the runtime meta: totality, known
+ * columns/relations, scopeable column types, acyclic through-chains ending on
+ * a { column } model. Cached by (map, meta) object identity — the framework
+ * holds one map constant and calls `$scoped` per request.
+ */
+export declare function resolveScopedModels(params: {
+    meta: RuntimeMeta;
+    models: ScopedModelsMap;
+}): ResolvedScopedModels;
+/** A rewritten call: which base-delegate method to run, with which args. */
+export type RewrittenScopedCall = {
+    readonly model: string;
+    readonly method: string;
+    readonly args: ClientRow | undefined;
+};
+/** A validated, scope-bound rewriter — the pure core a binding's tests drive. */
+export type ScopeRewriter = {
+    readonly rewrite: (call: {
+        model: string;
+        method: string;
+        args?: ClientRow;
+    }) => RewrittenScopedCall;
+};
+/**
+ * Validate a models map + scope against the runtime meta and return the pure
+ * per-call rewriter (`ScopedQueryError` on refusals). This is `$scoped`'s
+ * engine without the client plumbing — conformance rewrite-vectors run here.
+ */
+export declare function createScopeRewriter(params: {
+    meta: RuntimeMeta;
+    models: ScopedModelsMap;
+    scope: ScopeValue | null;
+}): ScopeRewriter;
+/**
+ * Rewrite ONE delegate call for a scoped handle — pure: same inputs, same
+ * output; refusals throw `ScopedQueryError` before any SQL could run. This is
+ * the function the conformance rewrite-vectors pin.
+ */
+export declare function rewriteScopedCall(params: {
+    meta: RuntimeMeta;
+    resolved: ResolvedScopedModels;
+    scope: ScopeValue | null;
+    preds: ReadonlyMap<string, ClientRow | null>;
+    model: string;
+    method: string;
+    args: ClientRow | undefined;
+}): RewrittenScopedCall;
+/**
+ * Attach `$scoped` to a built client. Validation happens per call:
+ * `@@policy` schemas refuse (the two scoping layers do not combine), the
+ * models map is resolved against the schema (cached by object identity), and
+ * the scope value is type-checked against every scoped column.
+ */
+export declare function attachScoped(params: {
+    client: DynamicClient;
+    meta: RuntimeMeta;
+}): void;
+export {};
+//# sourceMappingURL=scoped.d.ts.map

package/dist/scoped.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped.d.ts","sourceRoot":"","sources":["../src/scoped.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAuB,MAAM,iBAAiB,CAAC;AAEvE,OAAO,KAAK,EAAE,SAAS,EAAa,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,KAAK,EAAe,SAAS,EAAE,aAAa,EAAiB,MAAM,aAAa,CAAC;AAKxF,sFAAsF;AACtF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAElD;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEnD,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GACxB,MAAM,GACN;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAErE,wEAAwE;AACxE,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEzE,8BAA8B;AAC9B,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;CAClC,CAAC;AAIF,KAAK,aAAa,GACd;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GACzF;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,CAAC;AAEN,KAAK,oBAAoB,GAAG,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAsC/D;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,eAAe,CAAC;CACzB,GAAG,oBAAoB,CAmIvB;AA2sBD,4EAA4E;AAC5E,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;CACtC,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,CAAA;KAAE,KAAK,mBAAmB,CAAC;CACtG,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAC1B,GAAG,aAAa,CAkBhB;AAID;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;CAC7B,GAAG,mBAAmB,CA0GtB;AAiKD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAAG,IAAI,CAuCvF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibeorm/runtime",
-  "version": "2.0.0-alpha.8",
+  "version": "2.0.0-alpha.9",
   "description": "Driver-agnostic query engine and client runtime for VibeORM v2",
   "keywords": [
     "orm",
@@ -41,11 +41,12 @@
     "bun": ">=1.2.0"
   },
   "dependencies": {
-    "@vibeorm/schema": "2.0.0-alpha.6",
-    "@vibeorm/sql": "2.0.0-alpha.6"
+    "@vibeorm/schema": "2.0.0-alpha.7",
+    "@vibeorm/sql": "2.0.0-alpha.7"
   },
   "devDependencies": {
-    "@electric-sql/pglite": "^0.5.4"
+    "@electric-sql/pglite": "^0.5.4",
+    "@vibeorm/scoped-conformance": "0.1.0-alpha.0"
   },
   "publishConfig": {
     "access": "public"