@intentius/chant-lexicon-sql 0.116.0 → 0.117.0

package/dist/postgres/plan/diff.d.ts

@@ -16,11 +16,18 @@ import { type ChangeSet, type ClassifiedChange } from "../../core/classifier.js"
 import { matchByIdentity } from "../../core/diff.js";
 import { type PgChangeClass, type PgClassifierRuleId } from "./rules.js";
 import { type CanonicalConstraint } from "./normalize.js";
+import { type AccessChange } from "../access/acl.js";
 import { type PgDiffObject, type PgSchemaObject } from "./schema.js";
 import type { PostgresMigrationOpSuggestion } from "../migrate/handoff.js";
 /** What the diff needs to know beyond the two schemas: the server's major (`sql.postgresMajor`, else the newest pinned). */
 export interface PgDiffOptions {
     major?: number;
+    /**
+     * Whether to compare the access the two sides declare (grants, revokes,
+     * default privileges). On by default, for a diff between two builds; a plan
+     * against a server compares the server's access itself (`./commands.ts`).
+     */
+    access?: boolean;
 }
 export type PgChange = ClassifiedChange<PgClassifierRuleId, PgChangeClass>;
 export interface PgSchemaDiff extends ChangeSet<PgChange> {
@@ -28,6 +35,8 @@ export interface PgSchemaDiff extends ChangeSet<PgChange> {
     refused: PgChange[];
     /** The `PostgresMigrationOp` to run for each refused column rename or type change (#3281). */
     migrationOps?: PostgresMigrationOpSuggestion[];
+    /** The access changes among `changes`, each with its GRANT, REVOKE or ALTER DEFAULT PRIVILEGES statements (#3681). */
+    access?: AccessChange[];
 }
 /** The rule adding a constraint falls under. */
 export declare function addConstraintRule(c: CanonicalConstraint): PgClassifierRuleId;
@@ -41,5 +50,5 @@ export declare function addConstraintRule(c: CanonicalConstraint): PgClassifierR
  * (`../apply/`) match the same way.
  */
 export declare function matchPgObjects(before: readonly PgSchemaObject[], after: readonly PgSchemaObject[]): ReturnType<typeof matchByIdentity<PgDiffObject>>;
-export declare function diffPgSchemas(before: readonly PgSchemaObject[], after: readonly PgSchemaObject[], options?: PgDiffOptions): PgSchemaDiff;
+export declare function diffPgSchemas(beforeAll: readonly PgSchemaObject[], afterAll: readonly PgSchemaObject[], options?: PgDiffOptions): PgSchemaDiff;
 //# sourceMappingURL=diff.d.ts.map

package/dist/postgres/plan/diff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAoB,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAuB,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC3F,OAAO,EAAoD,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACzG,OAAO,EAAe,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAExE,4HAA4H;AAC5H,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,QAAQ,GAAG,gBAAgB,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;AAE3E,MAAM,WAAW,YAAa,SAAQ,SAAS,CAAC,QAAQ,CAAC;IACvD,6EAA6E;IAC7E,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,6BAA6B,EAAE,CAAC;CAChD;AAqHD,gDAAgD;AAChD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,mBAAmB,GAAG,kBAAkB,CAa5E;AAqJD;;;GAGG;AACH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,YAAY,CAAC,CAAC,CAUpJ;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,GAAE,aAAkB,GAAG,YAAY,CA0B5I"}
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAoB,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAuB,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC3F,OAAO,EAAkE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvH,OAAO,EAAmE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AACnH,OAAO,EAAe,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAExE,4HAA4H;AAC5H,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,QAAQ,GAAG,gBAAgB,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;AAE3E,MAAM,WAAW,YAAa,SAAQ,SAAS,CAAC,QAAQ,CAAC;IACvD,6EAA6E;IAC7E,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,6BAA6B,EAAE,CAAC;IAC/C,sHAAsH;IACtH,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;CACzB;AAqHD,gDAAgD;AAChD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,mBAAmB,GAAG,kBAAkB,CAa5E;AA6KD;;;GAGG;AACH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,YAAY,CAAC,CAAC,CAUpJ;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,EAAE,QAAQ,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,GAAE,aAAkB,GAAG,YAAY,CAqClJ"}

package/dist/postgres/plan/normalize.d.ts

@@ -85,7 +85,11 @@ export interface CanonicalConstraint {
     notValid?: boolean;
     comment?: string;
 }
-export type CanonicalKind = "schema" | "table" | "index" | "view" | "materializedView" | "sequence" | "enum" | "domain" | "extension" | "function" | "procedure" | "trigger";
+export type CanonicalKind = "schema" | "table" | "index" | "view" | "materializedView" | "sequence" | "enum" | "domain" | "extension" | "function" | "procedure" | "trigger" | "policy" | "role" | "grant" | "defaultPrivileges";
+/** The kinds whose declarations are privileges, compared as the access they add up to (`../access/`), not one by one. */
+export declare const ACCESS_KINDS: ReadonlySet<CanonicalKind>;
+/** The kinds a profile manages only when it says so (`sql.profiles.<env>.access`). */
+export declare const ACCESS_MANAGED_KINDS: ReadonlySet<CanonicalKind>;
 export interface CanonicalPgObject {
     kind: CanonicalKind;
     schema?: string;
@@ -115,6 +119,9 @@ export declare function canonicalSequenceOptions(o: {
 export declare function canonicalArgType(text: string, defaultSchema: string): string;
 /** A routine's identity among its overloads: its input parameter types, `(integer,text)`. */
 export declare function routineSignature(p: Pick<RoutineProps, "args">, defaultSchema: string): string;
+/** A routine named with its parameters as a GRANT writes it (`app.f(int, text)`), as the target the catalog names: `app.f(integer,text)`. */
+export declare function canonicalRoutineTarget(text: string, defaultSchema: string): string;
+export declare function canonicalRoleAttributes(options: readonly string[]): string[];
 /**
  * A definition in canonical form. `props` is an entity's props, declared or
  * parsed from what the server printed; `defaultSchema` qualifies a bare name.

package/dist/postgres/plan/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAQH,OAAO,KAAK,EAWV,YAAY,EAKb,MAAM,aAAa,CAAC;AAoCrB,sFAAsF;AACtF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAAiE,CAAC;AAEjI,uHAAuH;AACvH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ1E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,aAAa,SAAW,GAAG,MAAM,GAAG,SAAS,CAgCpG;AA8CD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAyB1E;AAmDD,2HAA2H;AAC3H,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAS7F;AAID,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IACrE,wGAAwG;IACxG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAE7K,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,WAAW,EAAE,mBAAmB,EAAE,CAAC;CACpC;AAyBD,8FAA8F;AAC9F,wBAAgB,wBAAwB,CACtC,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7I,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAiBR;AAoCD,uIAAuI;AACvI,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAI5E;AAKD,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7F;AAqGD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,SAAW,GAAG,iBAAiB,CAsJjI;AAED,kHAAkH;AAClH,wBAAgB,cAAc,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAEtF;AAED,gEAAgE;AAChE,eAAO,MAAM,WAAW,GAAI,2BAA2B,eAAe,KAAG,MAA8B,CAAC"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAQH,OAAO,KAAK,EAeV,YAAY,EAKb,MAAM,aAAa,CAAC;AAsCrB,sFAAsF;AACtF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAAiE,CAAC;AAEjI,uHAAuH;AACvH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ1E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,aAAa,SAAW,GAAG,MAAM,GAAG,SAAS,CAgCpG;AA8CD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAyB1E;AAmDD,2HAA2H;AAC3H,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAS7F;AAID,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IACrE,wGAAwG;IACxG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,OAAO,GACP,OAAO,GACP,MAAM,GACN,kBAAkB,GAClB,UAAU,GACV,MAAM,GACN,QAAQ,GACR,WAAW,GACX,UAAU,GACV,WAAW,GACX,SAAS,GACT,QAAQ,GACR,MAAM,GACN,OAAO,GACP,mBAAmB,CAAC;AAExB,yHAAyH;AACzH,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,aAAa,CAA2C,CAAC;AAEhG,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,aAAa,CAA6D,CAAC;AAE1H,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,WAAW,EAAE,mBAAmB,EAAE,CAAC;CACpC;AA6BD,8FAA8F;AAC9F,wBAAgB,wBAAwB,CACtC,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7I,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAiBR;AAoCD,uIAAuI;AACvI,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAI5E;AAKD,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7F;AAsED,6IAA6I;AAC7I,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAalF;AAKD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAW5E;AAiCD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,SAAW,GAAG,iBAAiB,CAuMjI;AAED,kHAAkH;AAClH,wBAAgB,cAAc,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAEtF;AAED,gEAAgE;AAChE,eAAO,MAAM,WAAW,GAAI,2BAA2B,eAAe,KAAG,MAA8B,CAAC"}

package/dist/postgres/plan/rules.d.ts

@@ -84,6 +84,14 @@ export declare const PG_CLASSIFIER_RULES: {
     readonly SQLPG283: PgClassifierRule;
     readonly SQLPG284: PgClassifierRule;
     readonly SQLPG285: PgClassifierRule;
+    readonly SQLPG290: PgClassifierRule;
+    readonly SQLPG291: PgClassifierRule;
+    readonly SQLPG292: PgClassifierRule;
+    readonly SQLPG293: PgClassifierRule;
+    readonly SQLPG294: PgClassifierRule;
+    readonly SQLPG296: PgClassifierRule;
+    readonly SQLPG297: PgClassifierRule;
+    readonly SQLPG298: PgClassifierRule;
     readonly SQLPG270: PgClassifierRule;
 };
 export type PgClassifierRuleId = keyof typeof PG_CLASSIFIER_RULES;

package/dist/postgres/plan/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAkB,KAAK,aAAa,EAAE,KAAK,cAAc,IAAI,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAErH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEhH,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,aAAa,CAY1D,CAAC;AASF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6PqB,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,mBAAmB,CAAC"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAkB,KAAK,aAAa,EAAE,KAAK,cAAc,IAAI,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAErH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEhH,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,aAAa,CAY1D,CAAC;AASF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAySqB,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,mBAAmB,CAAC"}

package/dist/postgres/plan/schema.d.ts

@@ -43,7 +43,8 @@ export declare function pgSchemaFromBuildFile(path: string, defaultSchema?: stri
  * The namespace an object's name is unique in: relations (tables, views,
  * sequences, indexes) share one per schema, types and domains another,
  * functions and procedures a third (told apart by their parameter types),
- * and a trigger's name is unique on its table.
+ * a trigger's or a policy's name is unique on its table, and a role's in the
+ * cluster.
  */
 export declare function pgNamespace(kind: string): string;
 /** The identity an object has on a server: its kind's namespace, its qualified name, and its signature where it has one. */

package/dist/postgres/plan/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGxE,oHAAoH;AACpH,MAAM,WAAW,YAAa,SAAQ,iBAAiB;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,0CAA0C;IAC1C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sGAAsG;IACtG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kHAAkH;IAClH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;AAEjD,6HAA6H;AAC7H,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAajG;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,YAAY,CAgBzF;AAQD,+EAA+E;AAC/E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,SAAW,GAAG,cAAc,EAAE,CAIhG;AAED,8GAA8G;AAC9G,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7D;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,SAAW,GAAG,cAAc,EAAE,CAE9F;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,4HAA4H;AAC5H,wBAAgB,YAAY,CAAC,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE3G;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,cAAc,EAAE,CAEzF;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,EAAE,CAUvG"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGxE,oHAAoH;AACpH,MAAM,WAAW,YAAa,SAAQ,iBAAiB;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,0CAA0C;IAC1C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sGAAsG;IACtG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kHAAkH;IAClH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;AAEjD,6HAA6H;AAC7H,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAajG;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,YAAY,CAgBzF;AAQD,+EAA+E;AAC/E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,SAAW,GAAG,cAAc,EAAE,CAIhG;AAED,8GAA8G;AAC9G,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7D;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,SAAW,GAAG,cAAc,EAAE,CAE9F;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMhD;AAED,4HAA4H;AAC5H,wBAAgB,YAAY,CAAC,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE3G;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,cAAc,EAAE,CAEzF;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,EAAE,CAUvG"}

package/dist/postgres/plan/server-normalize.d.ts

@@ -8,7 +8,10 @@
  * (`CREATE TEMP VIEW`, or a `CREATE TEMP TABLE` holding the columns' types,
  * defaults and generated expressions and the checks) inside a transaction
  * that is always rolled back, with a short `lock_timeout`, and read back with
- * the same printers the catalog read uses. Nothing is left behind: Postgres
+ * the same printers the catalog read uses. A trigger's `WHEN` and a policy's
+ * `USING` and `WITH CHECK`, which the server prints with the casts it
+ * resolved, are read back from a trigger or policy on a temporary copy of the
+ * table (`CREATE TEMP TABLE ... (LIKE table)`). Nothing is left behind: Postgres
  * DDL is transactional and a temporary object lives in the session's own
  * schema. A server that refuses (no TEMP privilege, a lock not granted in
  * time, an expression it rejects) leaves the rules' answer standing.

package/dist/postgres/plan/server-normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-normalize.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/server-normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AA4FpE;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,SAAS,iBAAiB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CA+B5J"}
+{"version":3,"file":"server-normalize.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/server-normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAiHpE;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,SAAS,iBAAiB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAmC5J"}

package/dist/postgres.d.ts

@@ -5,7 +5,7 @@
  * the statements are Postgres's own DDL, parsed at build time into entities,
  * and the names fold and quote as Postgres folds and quotes them.
  */
-export { schema, table, index, view, sequence, type, domain, extension, func, procedure, trigger, literal, SqlLiteral, SqlTemplateError, PostgresObject, POSTGRES_ENTITY_TYPES, isPostgresObject, isColumnRef, quoteIdent, type PostgresEntityType, type PostgresSchema, type PostgresRelation, type PostgresTable, type PostgresView, type PostgresIndex, type PostgresSequence, type PostgresEnum, type PostgresDomain, type PostgresExtension, type PostgresFunction, type PostgresProcedure, type PostgresTrigger, type ColumnDef, type KeyDef, type CheckDef, type ForeignKeyDef, type ExclusionDef, type SchemaProps, type TableProps, type IndexProps, type ViewProps, type SequenceProps, type EnumProps, type DomainProps, type ExtensionProps, type RoutineProps, type RoutineArgDef, type FunctionProps, type ProcedureProps, type TriggerProps, type LineageEdge, } from "./postgres/entities.js";
+export { schema, table, index, view, sequence, type, domain, extension, func, procedure, trigger, policy, role, grant, literal, SqlLiteral, SqlTemplateError, PostgresObject, POSTGRES_ENTITY_TYPES, isPostgresObject, isColumnRef, quoteIdent, type PostgresEntityType, type PostgresSchema, type PostgresRelation, type PostgresTable, type PostgresView, type PostgresIndex, type PostgresSequence, type PostgresEnum, type PostgresDomain, type PostgresExtension, type PostgresFunction, type PostgresProcedure, type PostgresTrigger, type PostgresPolicy, type PostgresRole, type PostgresGrant, type ColumnDef, type KeyDef, type CheckDef, type ForeignKeyDef, type ExclusionDef, type SchemaProps, type TableProps, type IndexProps, type ViewProps, type SequenceProps, type EnumProps, type DomainProps, type ExtensionProps, type RoutineProps, type RoutineArgDef, type FunctionProps, type ProcedureProps, type TriggerProps, type PolicyProps, type RoleProps, type GrantProps, type DefaultPrivilegesProps, type PrivilegeDef, type LineageEdge, } from "./postgres/entities.js";
 export { POSTGRES_PROVIDERS, COMMON_REFUSED, providerData, isPostgresProvider, providerAllowsExtension, isProviderOwned, refusedStatement, normalizeStatement, type PostgresProvider, type ProviderData, type ProviderSource, type RefusedStatement, type LiveObjectRef, } from "./postgres/providers/index.js";
 export { PostgresMigrationOp, type PostgresMigrationOpConfig, type PostgresMigrationOpResources, type PostgresMigrationArgs, } from "./postgres/migrate/op.js";
 export { POSTGRES_RECEIPTS_TABLE } from "./postgres/migrate/receipts.js";

package/dist/postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../src/postgres.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,IAAI,EACJ,MAAM,EACN,SAAS,EACT,IAAI,EACJ,SAAS,EACT,OAAO,EACP,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../src/postgres.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,IAAI,EACJ,MAAM,EACN,SAAS,EACT,IAAI,EACJ,SAAS,EACT,OAAO,EACP,MAAM,EACN,IAAI,EACJ,KAAK,EACL,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,cAAc,uBAAuB,CAAC"}

package/dist/rules/postgres-templates.ts

@@ -17,12 +17,12 @@ export const POSTGRES_TEMPLATE_SOURCES: readonly TemplateSource<PostgresTag>[] =
   {
     dialect: "postgres",
     modules: ["@intentius/chant-lexicon-sql/postgres"],
-    tags: ["schema", "table", "index", "view", "sequence", "type", "domain", "extension", "func", "procedure", "trigger"],
+    tags: ["schema", "table", "index", "view", "sequence", "type", "domain", "extension", "func", "procedure", "trigger", "policy", "role", "grant"],
   },
   {
     dialect: "postgres",
     modules: ["@intentius/chant-lexicon-sql"],
-    tags: ["schema", "index", "sequence", "type", "domain", "extension", "func", "procedure", "trigger"],
+    tags: ["schema", "index", "sequence", "type", "domain", "extension", "func", "procedure", "trigger", "policy", "role", "grant"],
   },
 ];
 

package/dist/rules/sqlpg001.ts

@@ -1,6 +1,6 @@
 import type { LintContext, LintDiagnostic, LintRule } from "@intentius/chant/lint/rule";
 import { parseStatements, SqlSyntaxError } from "../../postgres/parser";
-import { STATEMENT_NAMES, type PostgresTag } from "../../postgres/entities";
+import { followOnStray, STATEMENT_NAMES, type PostgresTag } from "../../postgres/entities";
 import { findPostgresTemplates, postgresTokensOf, templatePosition, tokenPosition } from "./postgres-templates";
 
 /** The statement each tag holds. */
@@ -16,6 +16,9 @@ const STATEMENT: Record<PostgresTag, string> = {
   func: "function",
   procedure: "procedure",
   trigger: "trigger",
+  policy: "policy",
+  role: "role",
+  grant: "grant",
 };
 
 const TAG_OF: Record<string, PostgresTag> = Object.fromEntries(Object.entries(STATEMENT).map(([tag, statement]) => [statement, tag as PostgresTag]));
@@ -62,15 +65,15 @@ export const sqlpg001: LintRule = {
           report(
             use
               ? `${found.tag}\`...\` holds a ${STATEMENT_NAMES[node!.statement]}; use the ${use} tag`
-              : `${found.tag}\`...\` starts with a COMMENT ON; it goes after the CREATE it comments on`,
+              : `${found.tag}\`...\` starts with a ${STATEMENT_NAMES[node!.statement]}; it goes after the CREATE it belongs to`,
             templatePosition(source, found, 0, 0),
           );
           continue;
         }
-        const stray = rest.find((n) => n.statement !== "comment");
+        const stray = followOnStray(found.tag, rest);
         if (stray) {
           report(
-            `${found.tag}\`...\` holds a second statement (${STATEMENT_NAMES[stray.statement]}); a template declares one object, followed only by COMMENT ON statements for it`,
+            `${found.tag}\`...\` holds a second statement (${STATEMENT_NAMES[stray.statement]}); a template declares one object, followed only by COMMENT ON statements for it${found.tag === "table" ? " and ALTER TABLE ... ROW LEVEL SECURITY" : ""}`,
             templatePosition(source, found, 0, 0),
           );
         }

package/dist/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EAAgD,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAMtH,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAgEvF,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAoEpF"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EAAgD,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAMtH,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAoEvF,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAoEpF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-sql",
-  "version": "0.116.0",
+  "version": "0.117.0",
   "description": "SQL lexicon for chant — database schema as typed declarations, one dialect at a time; ClickHouse first, with types read from a pinned server's catalog",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -70,7 +70,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.116.0",
+    "@intentius/chant": "^0.117.0",
     "typescript": "^5.9.3"
   }
 }

package/src/codegen/registry.ts

@@ -29,6 +29,10 @@ const KINDS: Record<string, string> = {
   PostgresFunction: POSTGRES_ENTITY_TYPES.function,
   PostgresProcedure: POSTGRES_ENTITY_TYPES.procedure,
   PostgresTrigger: POSTGRES_ENTITY_TYPES.trigger,
+  PostgresPolicy: POSTGRES_ENTITY_TYPES.policy,
+  PostgresRole: POSTGRES_ENTITY_TYPES.role,
+  PostgresGrant: POSTGRES_ENTITY_TYPES.grant,
+  PostgresDefaultPrivileges: POSTGRES_ENTITY_TYPES.defaultPrivileges,
 };
 
 export function buildRegistry(): string {

package/src/config.ts

@@ -146,6 +146,16 @@ export const sqlProfileSchema = z.strictObject({
    * `CONCURRENTLY` index build), in milliseconds. 0, no limit, when omitted.
    */
   scanTimeoutMs: z.number().int().nonnegative().optional(),
+  /**
+   * Postgres: whether chant manages access in this environment (#3681): the
+   * declared row-level security policies and each table's row-level security,
+   * the declared roles (created when missing, never dropped), and the
+   * privileges on the declared objects and the default privileges, which a
+   * plan compares and an apply grants and revokes. Off when omitted: the
+   * access declarations are not planned or applied, and the server's access
+   * is not read, so a project that manages access elsewhere is not affected.
+   */
+  access: z.boolean().optional(),
 });
 
 const dialectName = z.enum(SQL_DIALECTS);

package/src/generated/lexicon-sql.json

@@ -78,5 +78,25 @@
     "resourceType": "Postgres::Trigger",
     "kind": "resource",
     "lexicon": "sql"
+  },
+  "PostgresPolicy": {
+    "resourceType": "Postgres::Policy",
+    "kind": "resource",
+    "lexicon": "sql"
+  },
+  "PostgresRole": {
+    "resourceType": "Postgres::Role",
+    "kind": "resource",
+    "lexicon": "sql"
+  },
+  "PostgresGrant": {
+    "resourceType": "Postgres::Grant",
+    "kind": "resource",
+    "lexicon": "sql"
+  },
+  "PostgresDefaultPrivileges": {
+    "resourceType": "Postgres::DefaultPrivileges",
+    "kind": "resource",
+    "lexicon": "sql"
   }
 }

package/src/index.ts

@@ -18,7 +18,7 @@ export { database, table, view, literal } from "./clickhouse/entities";
 // A tag folds as the function its file imports, so `table` imported from
 // `@intentius/chant-lexicon-sql/postgres` is Postgres's. Declarations import
 // them from the dialect subpath.
-export { schema, index, sequence, type, domain, extension, func, procedure, trigger } from "./postgres/entities";
+export { schema, index, sequence, type, domain, extension, func, procedure, trigger, policy, role, grant } from "./postgres/entities";
 
 // A schema change's statements between two builds, rendered offline for a
 // migration file (#3644); also at `@intentius/chant-lexicon-sql/migration-statements`.

package/src/lint/rules/postgres-templates.ts

@@ -17,12 +17,12 @@ export const POSTGRES_TEMPLATE_SOURCES: readonly TemplateSource<PostgresTag>[] =
   {
     dialect: "postgres",
     modules: ["@intentius/chant-lexicon-sql/postgres"],
-    tags: ["schema", "table", "index", "view", "sequence", "type", "domain", "extension", "func", "procedure", "trigger"],
+    tags: ["schema", "table", "index", "view", "sequence", "type", "domain", "extension", "func", "procedure", "trigger", "policy", "role", "grant"],
   },
   {
     dialect: "postgres",
     modules: ["@intentius/chant-lexicon-sql"],
-    tags: ["schema", "index", "sequence", "type", "domain", "extension", "func", "procedure", "trigger"],
+    tags: ["schema", "index", "sequence", "type", "domain", "extension", "func", "procedure", "trigger", "policy", "role", "grant"],
   },
 ];
 

package/src/lint/rules/sqlpg001.ts

@@ -1,6 +1,6 @@
 import type { LintContext, LintDiagnostic, LintRule } from "@intentius/chant/lint/rule";
 import { parseStatements, SqlSyntaxError } from "../../postgres/parser";
-import { STATEMENT_NAMES, type PostgresTag } from "../../postgres/entities";
+import { followOnStray, STATEMENT_NAMES, type PostgresTag } from "../../postgres/entities";
 import { findPostgresTemplates, postgresTokensOf, templatePosition, tokenPosition } from "./postgres-templates";
 
 /** The statement each tag holds. */
@@ -16,6 +16,9 @@ const STATEMENT: Record<PostgresTag, string> = {
   func: "function",
   procedure: "procedure",
   trigger: "trigger",
+  policy: "policy",
+  role: "role",
+  grant: "grant",
 };
 
 const TAG_OF: Record<string, PostgresTag> = Object.fromEntries(Object.entries(STATEMENT).map(([tag, statement]) => [statement, tag as PostgresTag]));
@@ -62,15 +65,15 @@ export const sqlpg001: LintRule = {
           report(
             use
               ? `${found.tag}\`...\` holds a ${STATEMENT_NAMES[node!.statement]}; use the ${use} tag`
-              : `${found.tag}\`...\` starts with a COMMENT ON; it goes after the CREATE it comments on`,
+              : `${found.tag}\`...\` starts with a ${STATEMENT_NAMES[node!.statement]}; it goes after the CREATE it belongs to`,
             templatePosition(source, found, 0, 0),
           );
           continue;
         }
-        const stray = rest.find((n) => n.statement !== "comment");
+        const stray = followOnStray(found.tag, rest);
         if (stray) {
           report(
-            `${found.tag}\`...\` holds a second statement (${STATEMENT_NAMES[stray.statement]}); a template declares one object, followed only by COMMENT ON statements for it`,
+            `${found.tag}\`...\` holds a second statement (${STATEMENT_NAMES[stray.statement]}); a template declares one object, followed only by COMMENT ON statements for it${found.tag === "table" ? " and ALTER TABLE ... ROW LEVEL SECURITY" : ""}`,
             templatePosition(source, found, 0, 0),
           );
         }

package/src/lsp/postgres-template.ts

@@ -152,6 +152,8 @@ export function postgresDeclarations(content: string, fileName = "file.ts"): Pos
         case "function":
         case "procedure":
         case "trigger":
+        case "policy":
+        case "role":
           sqlName = text(node.name.span);
           kind = node.statement;
           break;

package/src/mcp/postgres.ts

@@ -81,7 +81,7 @@ export function postgresSearch(params: Record<string, unknown>): unknown {
   };
 }
 
-const TAGS = { schema: pg.schema, table: pg.table, index: pg.index, view: pg.view, sequence: pg.sequence, type: pg.type, domain: pg.domain, extension: pg.extension, func: pg.func, procedure: pg.procedure, trigger: pg.trigger } as const;
+const TAGS = { schema: pg.schema, table: pg.table, index: pg.index, view: pg.view, sequence: pg.sequence, type: pg.type, domain: pg.domain, extension: pg.extension, func: pg.func, procedure: pg.procedure, trigger: pg.trigger, policy: pg.policy, role: pg.role, grant: pg.grant } as const;
 export const POSTGRES_TAGS = Object.keys(TAGS);
 
 /** Parse one statement with the Postgres tag; an error comes back as SQLPG001 with its line and column. */

package/src/migration-statements.ts

@@ -237,6 +237,13 @@ function postgresStatements(beforeJson: string, afterJson: string, options: Diff
       });
     }
   }
+  // Privileges (#3681), after the objects they are on: one statement each, under the declaration behind it.
+  const afterByExport = new Map(after.map((o) => [o.exportName, o]));
+  for (const c of diff.access ?? []) {
+    const decl = c.exports.map((e) => afterByExport.get(e)).find((o) => o !== undefined);
+    const where = decl ? at(decl.exportName, decl.type, decl.name) : at(c.change.object, c.target.kind === "default" ? POSTGRES_ENTITY_TYPES.defaultPrivileges : POSTGRES_ENTITY_TYPES.grant, c.change.object.slice(4));
+    for (const sql of c.sql) steps.push({ kind: "statement", ...where, sql, rule: c.change.rule, class: c.change.class, transactional: true });
+  }
   const beforeByExport = new Map(before.map((o) => [o.exportName, o]));
   for (const d of plan.drops) {
     const o = beforeByExport.get(d.key);

package/src/op/activities/postgres-migration.ts

@@ -17,8 +17,8 @@ import { resolveBoundTarget } from "../../postgres/live/bind";
 import { connectPostgres, type PostgresClient, type PostgresEndpoint } from "../../postgres/live/client";
 import { DEFAULT_POSTGRES_APPLY_TIMEOUTS, declaredObjects } from "../../postgres/apply/apply";
 import { PG_CLASSIFIER_RULES } from "../../postgres/plan/rules";
-import { declaredTable, migrationPlanDigest, observeMigration } from "../../postgres/migrate/observe";
-import { backfill, verifyMigration, type BackfillDeps, type BackfillResult, type VerifyResult } from "../../postgres/migrate/backfill";
+import { declaredTable, migrationPlanDigest, MigrationRefusal, observeMigration } from "../../postgres/migrate/observe";
+import { backfill, MigrationVerificationError, verifyMigration, type BackfillDeps, type BackfillResult, type VerifyResult } from "../../postgres/migrate/backfill";
 import {
   carryOver,
   compensate,
@@ -60,8 +60,33 @@ async function loadConfig(cwd: string): Promise<Pick<ChantConfig, "sql" | "owner
   }
 }
 
+/**
+ * With `onFailure: "keep"` (#3687) no onFailure drops what the expand added,
+ * so a step that fails says what a person does instead: a refusal or a
+ * failed verification would otherwise fail every run after it the same way.
+ */
+const ON_FAILURE_DROPS = "onFailure drops what the expand added, and the next run starts again.";
+
+function noting(args: PostgresMigrationArgs, err: unknown): unknown {
+  if (args.keepOnFailure && (err instanceof MigrationRefusal || err instanceof MigrationVerificationError)) {
+    const kept =
+      `This migration keeps what the expand added on failure (onFailure: "keep"), so nothing drops it: ` +
+      `to start again from a new column, run the Op once with onFailure: "drop" (the default), whose onFailure drops it when this step fails again.`;
+    err.message = err.message.includes(ON_FAILURE_DROPS) ? err.message.replace(ON_FAILURE_DROPS, kept) : `${err.message.replace(/\.?$/, ".")} ${kept}`;
+  }
+  return err;
+}
+
 /** Bind the server, connect and read the declaration, run `body` with it, then close the connection. */
 async function withRun<T>(args: PostgresMigrationArgs, signal: AbortSignal | undefined, deps: PostgresMigrationDeps, body: (run: MigrationRun) => Promise<T>): Promise<T> {
+  try {
+    return await bound(args, signal, deps, body);
+  } catch (err) {
+    throw noting(args, err);
+  }
+}
+
+async function bound<T>(args: PostgresMigrationArgs, signal: AbortSignal | undefined, deps: PostgresMigrationDeps, body: (run: MigrationRun) => Promise<T>): Promise<T> {
   const cwd = args.cwd ?? process.cwd();
   const config = deps.config ?? (await loadConfig(cwd));
   const marker = resolveOwnershipMarker(args, config, "PostgresMigrationOp");

package/src/op/activity-contracts.ts

@@ -127,6 +127,7 @@ const migrationArgs = z.strictObject({
   stack: z.string().optional(),
   ownershipEnv: z.string().optional(),
   cwd: z.string().optional(),
+  keepOnFailure: z.boolean().optional(),
 });
 
 const migrationState = z.enum(["migrate", "switched", "done"]);

package/src/plugin.ts

@@ -106,6 +106,9 @@ export const sqlPlugin: LexiconPlugin = {
       { name: "func", isTag: true, description: "A Postgres CREATE FUNCTION, parsed into a function entity with its body kept verbatim" },
       { name: "procedure", isTag: true, description: "A Postgres CREATE PROCEDURE, parsed into a procedure entity with its body kept verbatim" },
       { name: "trigger", isTag: true, description: "A Postgres CREATE TRIGGER, parsed into a trigger entity on its table" },
+      { name: "policy", isTag: true, description: "A Postgres CREATE POLICY, parsed into a row-level security policy on its table" },
+      { name: "role", isTag: true, description: "A Postgres CREATE ROLE without a password or memberships, parsed into a role entity" },
+      { name: "grant", isTag: true, description: "A Postgres GRANT, REVOKE or ALTER DEFAULT PRIVILEGES, parsed into the privileges it declares" },
       {
         name: "literal",
         isTag: false,