@intentius/chant-lexicon-sql 0.116.0 → 0.118.0

package/dist/postgres/plan/commands.d.ts

@@ -43,6 +43,8 @@ export interface PgServerPlan {
     diff: PgSchemaDiff;
     /** The major the changes were classified for: the server's, else the one asked for. */
     major?: number;
+    /** The schemas the read was limited to; undefined is every schema. */
+    scope?: string[];
 }
 /**
  * The declared objects (a build's, keyed by export name) against what a
@@ -56,6 +58,16 @@ export declare function planAgainstClient(client: PostgresClient, target: Postgr
     readLive?: typeof readLiveSchema;
     serverNormalize?: typeof serverNormalized;
 }): Promise<PgServerPlan>;
+/**
+ * The declarations a plan compares: all of them where the profile manages
+ * access; otherwise none of the policies, roles, grants and default
+ * privileges, and no table's row-level security, so a project that manages
+ * access elsewhere is not affected. `unmanaged` counts what was left out.
+ */
+export declare function accessScoped(objects: readonly PgSchemaObject[], managed: boolean): {
+    kept: PgSchemaObject[];
+    unmanaged: number;
+};
 /** The declared objects against the server, keys by qualified name and labels with the export name. */
 export declare function planPgAgainstServer(environment: string, buildFile: string, options?: Omit<BindOptions, "environment">): Promise<PgSchemaDiff>;
 //# sourceMappingURL=commands.d.ts.map

package/dist/postgres/plan/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAA+B,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAqB,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEvF,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE1D,OAAO,EAAmF,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAChI,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAItD,wBAAgB,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/E;AAED,gGAAgG;AAChG,wBAAsB,YAAY,CAAC,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE;YAAE,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAG7I;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAIlG;AAED,qHAAqH;AACrH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,cAAc,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,SAAW,GAAG,YAAY,CAG7I;AAYD,sIAAsI;AACtI,MAAM,WAAW,YAAY;IAC3B,uHAAuH;IACvH,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,+DAA+D;IAC/D,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB,gFAAgF;IAChF,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B,IAAI,EAAE,YAAY,CAAC;IACnB,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,SAAS,cAAc,EAAE,EAChC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,cAAc,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,gBAAgB,CAAA;CAAO,GAClI,OAAO,CAAC,YAAY,CAAC,CAwBvB;AAED,uGAAuG;AACvG,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,IAAI,CAAC,WAAW,EAAE,aAAa,CAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAYvJ"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAA+B,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAqB,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEvF,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE1D,OAAO,EAAmF,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAChI,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAQtD,wBAAgB,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/E;AAED,gGAAgG;AAChG,wBAAsB,YAAY,CAAC,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE;YAAE,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAG7I;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAIlG;AAED,qHAAqH;AACrH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,cAAc,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,SAAW,GAAG,YAAY,CAG7I;AAYD,sIAAsI;AACtI,MAAM,WAAW,YAAY;IAC3B,uHAAuH;IACvH,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,+DAA+D;IAC/D,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB,gFAAgF;IAChF,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B,IAAI,EAAE,YAAY,CAAC;IACnB,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,SAAS,cAAc,EAAE,EAChC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,cAAc,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,gBAAgB,CAAA;CAAO,GAClI,OAAO,CAAC,YAAY,CAAC,CAyCvB;AAQD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAgBhI;AAED,uGAAuG;AACvG,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,IAAI,CAAC,WAAW,EAAE,aAAa,CAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAYvJ"}

package/dist/postgres/plan/deep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/deep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAmB,KAAK,qBAAqB,EAAgC,MAAM,mCAAmC,CAAC;AAE9H,OAAO,EAAyC,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AACvF,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAI7E,OAAO,EAAkD,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIrG,KAAK,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAiBrC,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,CAAC,EAAE,YAAY,GAAG,KAAK,CAGhD;AAuED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAmDpH;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAiDhC"}
+{"version":3,"file":"deep.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/deep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAmB,KAAK,qBAAqB,EAAgC,MAAM,mCAAmC,CAAC;AAE9H,OAAO,EAAyC,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AACvF,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAI7E,OAAO,EAAkD,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIrG,KAAK,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAqBrC,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,CAAC,EAAE,YAAY,GAAG,KAAK,CAGhD;AA+ED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAmDpH;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GACnC,OAAO,CAAC,qBAAqB,CAAC,CA0DhC"}

package/dist/postgres/plan/diff.d.ts

@@ -16,11 +16,18 @@ import { type ChangeSet, type ClassifiedChange } from "../../core/classifier.js"
 import { matchByIdentity } from "../../core/diff.js";
 import { type PgChangeClass, type PgClassifierRuleId } from "./rules.js";
 import { type CanonicalConstraint } from "./normalize.js";
+import { type AccessChange } from "../access/acl.js";
 import { type PgDiffObject, type PgSchemaObject } from "./schema.js";
 import type { PostgresMigrationOpSuggestion } from "../migrate/handoff.js";
 /** What the diff needs to know beyond the two schemas: the server's major (`sql.postgresMajor`, else the newest pinned). */
 export interface PgDiffOptions {
     major?: number;
+    /**
+     * Whether to compare the access the two sides declare (grants, revokes,
+     * default privileges). On by default, for a diff between two builds; a plan
+     * against a server compares the server's access itself (`./commands.ts`).
+     */
+    access?: boolean;
 }
 export type PgChange = ClassifiedChange<PgClassifierRuleId, PgChangeClass>;
 export interface PgSchemaDiff extends ChangeSet<PgChange> {
@@ -28,6 +35,8 @@ export interface PgSchemaDiff extends ChangeSet<PgChange> {
     refused: PgChange[];
     /** The `PostgresMigrationOp` to run for each refused column rename or type change (#3281). */
     migrationOps?: PostgresMigrationOpSuggestion[];
+    /** The access changes among `changes`, each with its GRANT, REVOKE or ALTER DEFAULT PRIVILEGES statements (#3681). */
+    access?: AccessChange[];
 }
 /** The rule adding a constraint falls under. */
 export declare function addConstraintRule(c: CanonicalConstraint): PgClassifierRuleId;
@@ -41,5 +50,5 @@ export declare function addConstraintRule(c: CanonicalConstraint): PgClassifierR
  * (`../apply/`) match the same way.
  */
 export declare function matchPgObjects(before: readonly PgSchemaObject[], after: readonly PgSchemaObject[]): ReturnType<typeof matchByIdentity<PgDiffObject>>;
-export declare function diffPgSchemas(before: readonly PgSchemaObject[], after: readonly PgSchemaObject[], options?: PgDiffOptions): PgSchemaDiff;
+export declare function diffPgSchemas(beforeAll: readonly PgSchemaObject[], afterAll: readonly PgSchemaObject[], options?: PgDiffOptions): PgSchemaDiff;
 //# sourceMappingURL=diff.d.ts.map

package/dist/postgres/plan/diff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAoB,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAuB,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC3F,OAAO,EAAoD,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACzG,OAAO,EAAe,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAExE,4HAA4H;AAC5H,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,QAAQ,GAAG,gBAAgB,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;AAE3E,MAAM,WAAW,YAAa,SAAQ,SAAS,CAAC,QAAQ,CAAC;IACvD,6EAA6E;IAC7E,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,6BAA6B,EAAE,CAAC;CAChD;AAqHD,gDAAgD;AAChD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,mBAAmB,GAAG,kBAAkB,CAa5E;AAqJD;;;GAGG;AACH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,YAAY,CAAC,CAAC,CAUpJ;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,GAAE,aAAkB,GAAG,YAAY,CA0B5I"}
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAoB,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAuB,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC3F,OAAO,EAAkE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvH,OAAO,EAAmE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AACnH,OAAO,EAAe,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAExE,4HAA4H;AAC5H,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,QAAQ,GAAG,gBAAgB,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;AAE3E,MAAM,WAAW,YAAa,SAAQ,SAAS,CAAC,QAAQ,CAAC;IACvD,6EAA6E;IAC7E,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,6BAA6B,EAAE,CAAC;IAC/C,sHAAsH;IACtH,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;CACzB;AAqHD,gDAAgD;AAChD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,mBAAmB,GAAG,kBAAkB,CAa5E;AA6KD;;;GAGG;AACH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,YAAY,CAAC,CAAC,CAUpJ;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,EAAE,QAAQ,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,GAAE,aAAkB,GAAG,YAAY,CAqClJ"}

package/dist/postgres/plan/normalize.d.ts

@@ -85,7 +85,11 @@ export interface CanonicalConstraint {
     notValid?: boolean;
     comment?: string;
 }
-export type CanonicalKind = "schema" | "table" | "index" | "view" | "materializedView" | "sequence" | "enum" | "domain" | "extension" | "function" | "procedure" | "trigger";
+export type CanonicalKind = "schema" | "table" | "index" | "view" | "materializedView" | "sequence" | "enum" | "domain" | "extension" | "function" | "procedure" | "trigger" | "policy" | "role" | "grant" | "defaultPrivileges";
+/** The kinds whose declarations are privileges, compared as the access they add up to (`../access/`), not one by one. */
+export declare const ACCESS_KINDS: ReadonlySet<CanonicalKind>;
+/** The kinds a profile manages only when it says so (`sql.profiles.<env>.access`). */
+export declare const ACCESS_MANAGED_KINDS: ReadonlySet<CanonicalKind>;
 export interface CanonicalPgObject {
     kind: CanonicalKind;
     schema?: string;
@@ -115,6 +119,9 @@ export declare function canonicalSequenceOptions(o: {
 export declare function canonicalArgType(text: string, defaultSchema: string): string;
 /** A routine's identity among its overloads: its input parameter types, `(integer,text)`. */
 export declare function routineSignature(p: Pick<RoutineProps, "args">, defaultSchema: string): string;
+/** A routine named with its parameters as a GRANT writes it (`app.f(int, text)`), as the target the catalog names: `app.f(integer,text)`. */
+export declare function canonicalRoutineTarget(text: string, defaultSchema: string): string;
+export declare function canonicalRoleAttributes(options: readonly string[]): string[];
 /**
  * A definition in canonical form. `props` is an entity's props, declared or
  * parsed from what the server printed; `defaultSchema` qualifies a bare name.

package/dist/postgres/plan/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAQH,OAAO,KAAK,EAWV,YAAY,EAKb,MAAM,aAAa,CAAC;AAoCrB,sFAAsF;AACtF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAAiE,CAAC;AAEjI,uHAAuH;AACvH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ1E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,aAAa,SAAW,GAAG,MAAM,GAAG,SAAS,CAgCpG;AA8CD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAyB1E;AAmDD,2HAA2H;AAC3H,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAS7F;AAID,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IACrE,wGAAwG;IACxG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAE7K,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,WAAW,EAAE,mBAAmB,EAAE,CAAC;CACpC;AAyBD,8FAA8F;AAC9F,wBAAgB,wBAAwB,CACtC,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7I,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAiBR;AAoCD,uIAAuI;AACvI,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAI5E;AAKD,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7F;AAqGD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,SAAW,GAAG,iBAAiB,CAsJjI;AAED,kHAAkH;AAClH,wBAAgB,cAAc,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAEtF;AAED,gEAAgE;AAChE,eAAO,MAAM,WAAW,GAAI,2BAA2B,eAAe,KAAG,MAA8B,CAAC"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAQH,OAAO,KAAK,EAeV,YAAY,EAKb,MAAM,aAAa,CAAC;AAsCrB,sFAAsF;AACtF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAAiE,CAAC;AAEjI,uHAAuH;AACvH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ1E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,aAAa,SAAW,GAAG,MAAM,GAAG,SAAS,CAgCpG;AA8CD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAyB1E;AAmDD,2HAA2H;AAC3H,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAS7F;AAID,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IACrE,wGAAwG;IACxG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,OAAO,GACP,OAAO,GACP,MAAM,GACN,kBAAkB,GAClB,UAAU,GACV,MAAM,GACN,QAAQ,GACR,WAAW,GACX,UAAU,GACV,WAAW,GACX,SAAS,GACT,QAAQ,GACR,MAAM,GACN,OAAO,GACP,mBAAmB,CAAC;AAExB,yHAAyH;AACzH,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,aAAa,CAA2C,CAAC;AAEhG,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,aAAa,CAA6D,CAAC;AAE1H,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,WAAW,EAAE,mBAAmB,EAAE,CAAC;CACpC;AA6BD,8FAA8F;AAC9F,wBAAgB,wBAAwB,CACtC,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7I,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAiBR;AAoCD,uIAAuI;AACvI,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAI5E;AAKD,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7F;AAsED,6IAA6I;AAC7I,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAalF;AAKD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAW5E;AAiCD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,SAAW,GAAG,iBAAiB,CAuMjI;AAED,kHAAkH;AAClH,wBAAgB,cAAc,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAEtF;AAED,gEAAgE;AAChE,eAAO,MAAM,WAAW,GAAI,2BAA2B,eAAe,KAAG,MAA8B,CAAC"}

package/dist/postgres/plan/rules.d.ts

@@ -84,6 +84,14 @@ export declare const PG_CLASSIFIER_RULES: {
     readonly SQLPG283: PgClassifierRule;
     readonly SQLPG284: PgClassifierRule;
     readonly SQLPG285: PgClassifierRule;
+    readonly SQLPG290: PgClassifierRule;
+    readonly SQLPG291: PgClassifierRule;
+    readonly SQLPG292: PgClassifierRule;
+    readonly SQLPG293: PgClassifierRule;
+    readonly SQLPG294: PgClassifierRule;
+    readonly SQLPG296: PgClassifierRule;
+    readonly SQLPG297: PgClassifierRule;
+    readonly SQLPG298: PgClassifierRule;
     readonly SQLPG270: PgClassifierRule;
 };
 export type PgClassifierRuleId = keyof typeof PG_CLASSIFIER_RULES;

package/dist/postgres/plan/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAkB,KAAK,aAAa,EAAE,KAAK,cAAc,IAAI,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAErH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEhH,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,aAAa,CAY1D,CAAC;AASF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6PqB,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,mBAAmB,CAAC"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAkB,KAAK,aAAa,EAAE,KAAK,cAAc,IAAI,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAErH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEhH,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,aAAa,CAY1D,CAAC;AASF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAySqB,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,mBAAmB,CAAC"}

package/dist/postgres/plan/schema.d.ts

@@ -43,7 +43,8 @@ export declare function pgSchemaFromBuildFile(path: string, defaultSchema?: stri
  * The namespace an object's name is unique in: relations (tables, views,
  * sequences, indexes) share one per schema, types and domains another,
  * functions and procedures a third (told apart by their parameter types),
- * and a trigger's name is unique on its table.
+ * a trigger's or a policy's name is unique on its table, and a role's in the
+ * cluster.
  */
 export declare function pgNamespace(kind: string): string;
 /** The identity an object has on a server: its kind's namespace, its qualified name, and its signature where it has one. */

package/dist/postgres/plan/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGxE,oHAAoH;AACpH,MAAM,WAAW,YAAa,SAAQ,iBAAiB;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,0CAA0C;IAC1C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sGAAsG;IACtG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kHAAkH;IAClH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;AAEjD,6HAA6H;AAC7H,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAajG;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,YAAY,CAgBzF;AAQD,+EAA+E;AAC/E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,SAAW,GAAG,cAAc,EAAE,CAIhG;AAED,8GAA8G;AAC9G,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7D;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,SAAW,GAAG,cAAc,EAAE,CAE9F;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,4HAA4H;AAC5H,wBAAgB,YAAY,CAAC,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE3G;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,cAAc,EAAE,CAEzF;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,EAAE,CAUvG"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGxE,oHAAoH;AACpH,MAAM,WAAW,YAAa,SAAQ,iBAAiB;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,0CAA0C;IAC1C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sGAAsG;IACtG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kHAAkH;IAClH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;AAEjD,6HAA6H;AAC7H,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAajG;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,YAAY,CAgBzF;AAQD,+EAA+E;AAC/E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,SAAW,GAAG,cAAc,EAAE,CAIhG;AAED,8GAA8G;AAC9G,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7D;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,SAAW,GAAG,cAAc,EAAE,CAE9F;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMhD;AAED,4HAA4H;AAC5H,wBAAgB,YAAY,CAAC,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE3G;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,cAAc,EAAE,CAEzF;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,EAAE,CAUvG"}

package/dist/postgres/plan/server-normalize.d.ts

@@ -8,7 +8,10 @@
  * (`CREATE TEMP VIEW`, or a `CREATE TEMP TABLE` holding the columns' types,
  * defaults and generated expressions and the checks) inside a transaction
  * that is always rolled back, with a short `lock_timeout`, and read back with
- * the same printers the catalog read uses. Nothing is left behind: Postgres
+ * the same printers the catalog read uses. A trigger's `WHEN` and a policy's
+ * `USING` and `WITH CHECK`, which the server prints with the casts it
+ * resolved, are read back from a trigger or policy on a temporary copy of the
+ * table (`CREATE TEMP TABLE ... (LIKE table)`). Nothing is left behind: Postgres
  * DDL is transactional and a temporary object lives in the session's own
  * schema. A server that refuses (no TEMP privilege, a lock not granted in
  * time, an expression it rejects) leaves the rules' answer standing.

package/dist/postgres/plan/server-normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-normalize.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/server-normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AA4FpE;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,SAAS,iBAAiB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CA+B5J"}
+{"version":3,"file":"server-normalize.d.ts","sourceRoot":"","sources":["../../../src/postgres/plan/server-normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAiHpE;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,SAAS,iBAAiB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAmC5J"}

package/dist/postgres.d.ts

@@ -5,7 +5,7 @@
  * the statements are Postgres's own DDL, parsed at build time into entities,
  * and the names fold and quote as Postgres folds and quotes them.
  */
-export { schema, table, index, view, sequence, type, domain, extension, func, procedure, trigger, literal, SqlLiteral, SqlTemplateError, PostgresObject, POSTGRES_ENTITY_TYPES, isPostgresObject, isColumnRef, quoteIdent, type PostgresEntityType, type PostgresSchema, type PostgresRelation, type PostgresTable, type PostgresView, type PostgresIndex, type PostgresSequence, type PostgresEnum, type PostgresDomain, type PostgresExtension, type PostgresFunction, type PostgresProcedure, type PostgresTrigger, type ColumnDef, type KeyDef, type CheckDef, type ForeignKeyDef, type ExclusionDef, type SchemaProps, type TableProps, type IndexProps, type ViewProps, type SequenceProps, type EnumProps, type DomainProps, type ExtensionProps, type RoutineProps, type RoutineArgDef, type FunctionProps, type ProcedureProps, type TriggerProps, type LineageEdge, } from "./postgres/entities.js";
+export { schema, table, index, view, sequence, type, domain, extension, func, procedure, trigger, policy, role, grant, literal, SqlLiteral, SqlTemplateError, PostgresObject, POSTGRES_ENTITY_TYPES, isPostgresObject, isColumnRef, quoteIdent, type PostgresEntityType, type PostgresSchema, type PostgresRelation, type PostgresTable, type PostgresView, type PostgresIndex, type PostgresSequence, type PostgresEnum, type PostgresDomain, type PostgresExtension, type PostgresFunction, type PostgresProcedure, type PostgresTrigger, type PostgresPolicy, type PostgresRole, type PostgresGrant, type ColumnDef, type KeyDef, type CheckDef, type ForeignKeyDef, type ExclusionDef, type SchemaProps, type TableProps, type IndexProps, type ViewProps, type SequenceProps, type EnumProps, type DomainProps, type ExtensionProps, type RoutineProps, type RoutineArgDef, type FunctionProps, type ProcedureProps, type TriggerProps, type PolicyProps, type RoleProps, type GrantProps, type DefaultPrivilegesProps, type PrivilegeDef, type LineageEdge, } from "./postgres/entities.js";
 export { POSTGRES_PROVIDERS, COMMON_REFUSED, providerData, isPostgresProvider, providerAllowsExtension, isProviderOwned, refusedStatement, normalizeStatement, type PostgresProvider, type ProviderData, type ProviderSource, type RefusedStatement, type LiveObjectRef, } from "./postgres/providers/index.js";
 export { PostgresMigrationOp, type PostgresMigrationOpConfig, type PostgresMigrationOpResources, type PostgresMigrationArgs, } from "./postgres/migrate/op.js";
 export { POSTGRES_RECEIPTS_TABLE } from "./postgres/migrate/receipts.js";

package/dist/postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../src/postgres.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,IAAI,EACJ,MAAM,EACN,SAAS,EACT,IAAI,EACJ,SAAS,EACT,OAAO,EACP,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../src/postgres.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,IAAI,EACJ,MAAM,EACN,SAAS,EACT,IAAI,EACJ,SAAS,EACT,OAAO,EACP,MAAM,EACN,IAAI,EACJ,KAAK,EACL,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,cAAc,uBAAuB,CAAC"}

package/dist/rules/postgres-templates.ts

@@ -17,12 +17,12 @@ export const POSTGRES_TEMPLATE_SOURCES: readonly TemplateSource<PostgresTag>[] =
   {
     dialect: "postgres",
     modules: ["@intentius/chant-lexicon-sql/postgres"],
-    tags: ["schema", "table", "index", "view", "sequence", "type", "domain", "extension", "func", "procedure", "trigger"],
+    tags: ["schema", "table", "index", "view", "sequence", "type", "domain", "extension", "func", "procedure", "trigger", "policy", "role", "grant"],
   },
   {
     dialect: "postgres",
     modules: ["@intentius/chant-lexicon-sql"],
-    tags: ["schema", "index", "sequence", "type", "domain", "extension", "func", "procedure", "trigger"],
+    tags: ["schema", "index", "sequence", "type", "domain", "extension", "func", "procedure", "trigger", "policy", "role", "grant"],
   },
 ];
 

package/dist/rules/sqlch001.ts

@@ -1,12 +1,18 @@
 import type { LintContext, LintDiagnostic, LintRule } from "@intentius/chant/lint/rule";
 import { parseCreate } from "../../clickhouse/parser";
+import { parseAccess } from "../../clickhouse/access";
 import { SqlSyntaxError } from "../../clickhouse/tokens";
 import { findTemplates, templatePosition, tokensOf } from "./templates";
 
-const STATEMENT: Record<string, string> = { database: "CREATE DATABASE", table: "CREATE TABLE", view: "CREATE VIEW" };
+const ACCESS_TAGS = new Set(["user", "role", "policy", "grant"]);
+const ACCESS_STATEMENT: Record<string, string> = { user: "CREATE USER", role: "CREATE ROLE", rowPolicy: "CREATE ROW POLICY", grant: "GRANT" };
+
+const STATEMENT: Record<string, string> = { database: "CREATE DATABASE", table: "CREATE TABLE", view: "CREATE VIEW", dictionary: "CREATE DICTIONARY", function: "CREATE FUNCTION" };
+/** The tag a statement belongs in: `func` for a function, the statement's own name otherwise. */
+const tagOf = (statement: string): string => (statement === "function" ? "func" : statement);
 
 /**
- * SQLCH001: the DDL in a `database`, `table` or `view` template does not parse, or holds another statement than its tag.
+ * SQLCH001: the DDL in a ClickHouse template (`database`, `table`, `view`, `dictionary`, `func`, `user`, `role`, `policy`, `grant`) does not parse, or holds another statement than its tag.
  *
  * The same parse runs when the build calls the tag, and fails the build there.
  * This rule reports it in the editor and in `chant lint`, at the token, before
@@ -27,12 +33,28 @@ export const sqlch001: LintRule = {
       let tokens;
       try {
         tokens = tokensOf(found);
+        if (ACCESS_TAGS.has(found.tag)) {
+          const node = parseAccess(tokens);
+          const tag = node.statement === "rowPolicy" ? "policy" : node.statement;
+          if (tag !== found.tag || node.revoke) {
+            out.push({
+              ruleId: "SQLCH001",
+              severity: "error",
+              message: node.revoke
+                ? `${found.tag}\`...\` holds a REVOKE; declare the grants a grantee keeps, and a plan revokes the rest`
+                : `${found.tag}\`...\` holds a ${ACCESS_STATEMENT[node.statement]}; use the ${tag} tag`,
+              file: context.filePath,
+              ...templatePosition(source, found, 0, 0),
+            });
+          }
+          continue;
+        }
         const node = parseCreate(tokens);
-        if (node.statement !== found.tag) {
+        if (tagOf(node.statement) !== found.tag) {
           out.push({
             ruleId: "SQLCH001",
             severity: "error",
-            message: `${found.tag}\`...\` holds a ${STATEMENT[node.statement]}; use the ${node.statement} tag`,
+            message: `${found.tag}\`...\` holds a ${STATEMENT[node.statement]}; use the ${tagOf(node.statement)} tag`,
             file: context.filePath,
             ...templatePosition(source, found, 0, 0),
           });

package/dist/rules/sqlch002.ts

@@ -41,7 +41,8 @@ function keyColumns(tokens: Token[], span: Span): Array<{ name: string; token: T
 }
 
 function allowsNullableKey(tokens: Token[], node: CreateNode): boolean {
-  if (node.statement === "database" || !node.settings) return false;
+  if (node.statement !== "table" && node.statement !== "view") return false;
+  if (!node.settings) return false;
   const s = node.settings.find((x) => x.key === "allow_nullable_key");
   if (!s) return false;
   const v = tokens.slice(s.value.from, s.value.to).map((t) => t.text).join("").trim().toLowerCase().replace(/'/g, "");
@@ -74,7 +75,7 @@ export const sqlch002: LintRule = {
         if (err instanceof SqlSyntaxError) continue; // SQLCH001 reports it
         throw err;
       }
-      if (node.statement === "database" || allowsNullableKey(tokens, node)) continue;
+      if ((node.statement !== "table" && node.statement !== "view") || allowsNullableKey(tokens, node)) continue;
       const nullable = new Set(node.columns.filter((c) => c.name && isNullable(tokens, c)).map((c) => c.name));
       if (nullable.size === 0) continue;
       const reported = new Set<string>();

package/dist/rules/sqlpg001.ts

@@ -1,6 +1,6 @@
 import type { LintContext, LintDiagnostic, LintRule } from "@intentius/chant/lint/rule";
 import { parseStatements, SqlSyntaxError } from "../../postgres/parser";
-import { STATEMENT_NAMES, type PostgresTag } from "../../postgres/entities";
+import { followOnStray, STATEMENT_NAMES, type PostgresTag } from "../../postgres/entities";
 import { findPostgresTemplates, postgresTokensOf, templatePosition, tokenPosition } from "./postgres-templates";
 
 /** The statement each tag holds. */
@@ -16,6 +16,9 @@ const STATEMENT: Record<PostgresTag, string> = {
   func: "function",
   procedure: "procedure",
   trigger: "trigger",
+  policy: "policy",
+  role: "role",
+  grant: "grant",
 };
 
 const TAG_OF: Record<string, PostgresTag> = Object.fromEntries(Object.entries(STATEMENT).map(([tag, statement]) => [statement, tag as PostgresTag]));
@@ -62,15 +65,15 @@ export const sqlpg001: LintRule = {
           report(
             use
               ? `${found.tag}\`...\` holds a ${STATEMENT_NAMES[node!.statement]}; use the ${use} tag`
-              : `${found.tag}\`...\` starts with a COMMENT ON; it goes after the CREATE it comments on`,
+              : `${found.tag}\`...\` starts with a ${STATEMENT_NAMES[node!.statement]}; it goes after the CREATE it belongs to`,
             templatePosition(source, found, 0, 0),
           );
           continue;
         }
-        const stray = rest.find((n) => n.statement !== "comment");
+        const stray = followOnStray(found.tag, rest);
         if (stray) {
           report(
-            `${found.tag}\`...\` holds a second statement (${STATEMENT_NAMES[stray.statement]}); a template declares one object, followed only by COMMENT ON statements for it`,
+            `${found.tag}\`...\` holds a second statement (${STATEMENT_NAMES[stray.statement]}); a template declares one object, followed only by COMMENT ON statements for it${found.tag === "table" ? " and ALTER TABLE ... ROW LEVEL SECURITY" : ""}`,
             templatePosition(source, found, 0, 0),
           );
         }

package/dist/rules/templates.ts

@@ -13,7 +13,7 @@ import { findSqlTemplates, type FoundTemplate as SqlFoundTemplate, type Template
 
 export { templatePosition, tokenPosition } from "../../core/find-templates";
 
-export type SqlTag = "database" | "table" | "view";
+export type SqlTag = "database" | "table" | "view" | "dictionary" | "func" | "user" | "role" | "policy" | "grant";
 
 /**
  * The ClickHouse tags, by the modules they are imported from. The package
@@ -22,7 +22,7 @@ export type SqlTag = "database" | "table" | "view";
 export const CLICKHOUSE_TEMPLATE_SOURCE: TemplateSource<SqlTag> = {
   dialect: "clickhouse",
   modules: ["@intentius/chant-lexicon-sql", "@intentius/chant-lexicon-sql/clickhouse"],
-  tags: ["database", "table", "view"],
+  tags: ["database", "table", "view", "dictionary", "func", "user", "role", "policy", "grant"],
 };
 
 export type FoundTemplate = SqlFoundTemplate<SqlTag>;

package/dist/serializer.d.ts

@@ -12,7 +12,8 @@
  *
  * The order is the dependency order of the references: a view after the
  * tables it reads, a materialized view after its target, a table after its
- * database. Ties break by export name, so the output is the same however the
+ * database. An object read from a `.sql` file (`./sql-files.ts`) that a
+ * template names in its text counts as referenced too. Ties break by export name, so the output is the same however the
  * files were discovered. A reference cycle is an error naming the cycle.
  *
  * One build holds one dialect: the dialect is the document's, and a project

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAc,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAQjF,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAiEhD,eAAO,MAAM,aAAa,EAAE,UAsC3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAc,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AASjF,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAmEhD,eAAO,MAAM,aAAa,EAAE,UAuC3B,CAAC"}

package/dist/sql-files.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Plain `.sql` files as a schema source (#3646): DDL read into the same
+ * declarations the tagged templates make. Also at the package root.
+ *
+ * - {@link readSqlFile}: the objects a file of DDL declares, each with its
+ *   export name, type, qualified name and DDL.
+ * - {@link sqlFileDeclarations}: the same file as TypeScript, one `schema.ts`
+ *   of `table`, `view`, ... templates, as `chant import <file>.sql` writes it.
+ * - {@link sqlFileEntities}: the declarations themselves, with the references
+ *   between the files' objects, and to objects declared elsewhere, as
+ *   interpolations, so dependency order comes from the graph. The build uses
+ *   it for every `.sql` file in the source directory.
+ *
+ * Postgres reads each `CREATE`, `GRANT`, `REVOKE` and `ALTER DEFAULT
+ * PRIVILEGES` as an object, with `COMMENT ON`, `ALTER TABLE ... ROW LEVEL
+ * SECURITY` and `ALTER TABLE ... ADD <table constraint>` folded into the
+ * object they finish; ClickHouse reads `CREATE DATABASE`, `TABLE`, `VIEW`,
+ * `MATERIALIZED VIEW`, `DICTIONARY` and `FUNCTION`. Any other statement, and any
+ * statement that does not parse, throws a {@link SqlFileError} naming every
+ * such statement: none is left out.
+ *
+ * A name is a reference where it is qualified (`app.users`), or bare where an
+ * object is named (`REFERENCES users`, `FROM users`, an index's table, a
+ * column of an enum type) and an object declared without a schema has it.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+import type { SqlDialect } from "./dialects.js";
+import { SqlFileError, type ReadOptions } from "./files/common.js";
+export { SqlFileError };
+export type { ReadOptions as SqlFileOptions };
+/** One object a file of DDL declares. */
+export interface SqlFileObject {
+    /** The export it is declared as. */
+    export: string;
+    /** Its entity type, `Postgres::Table`. */
+    type: string;
+    /** `schema.name` (Postgres), `database.name` (ClickHouse); the name alone when the DDL does not qualify it. */
+    name: string;
+    /** Its statements: the CREATE, then what was folded into it. */
+    ddl: string;
+    /** The file it came from, the `origin` it was read under. */
+    origin: string;
+}
+/** A file to read: its DDL and the name errors give it. */
+export interface SqlFileSource extends ReadOptions {
+    ddl: string;
+}
+/** The objects a file of DDL declares. Throws a {@link SqlFileError} naming each statement it cannot read. */
+export declare function readSqlFile(dialect: SqlDialect, ddl: string, options: ReadOptions): SqlFileObject[];
+/**
+ * A file of DDL as TypeScript declarations: the `schema.ts` `chant import`
+ * writes, with `header` as comment lines at its top, and the objects in it.
+ */
+export declare function sqlFileDeclarations(dialect: SqlDialect, ddl: string, options: ReadOptions & {
+    header?: string;
+}): {
+    content: string;
+    objects: SqlFileObject[];
+};
+/** Where an entity read from a `.sql` file came from: its `origin`. Undefined for any other entity. */
+export declare function sqlFileOf(entity: unknown): string | undefined;
+/**
+ * The declarations the files make, by export name. `known` holds the
+ * entities declared elsewhere (the project's tagged templates): a file's
+ * reference to one of them is an interpolation of it, as an import would
+ * write it, and an export name or an object one of them already declares is
+ * an error naming both.
+ */
+export declare function sqlFileEntities(dialect: SqlDialect, sources: readonly SqlFileSource[], options?: {
+    known?: ReadonlyMap<string, Declarable>;
+}): Map<string, Declarable>;
+/**
+ * The objects read from `.sql` files that each other object names in its
+ * DDL as text, by export name: a tagged template cannot import a file's
+ * object, so it names it, and this is the edge the dependency order needs.
+ * Empty when no object came from a file.
+ */
+export declare function sqlFileReferences(dialect: SqlDialect, objects: ReadonlyMap<string, Declarable>): Map<string, string[]>;
+//# sourceMappingURL=sql-files.d.ts.map

package/dist/sql-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-files.d.ts","sourceRoot":"","sources":["../src/sql-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAUhE,OAAO,EAAE,YAAY,EAAE,CAAC;AACxB,YAAY,EAAE,WAAW,IAAI,cAAc,EAAE,CAAC;AAE9C,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,+GAA+G;IAC/G,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2DAA2D;AAC3D,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD,GAAG,EAAE,MAAM,CAAC;CACb;AAuBD,8GAA8G;AAC9G,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,aAAa,EAAE,CAInG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,CAW/J;AAED,uGAAuG;AACvG,wBAAgB,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE7D;AA4BD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,aAAa,EAAE,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;CAAO,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAqD1K;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAatH"}

package/dist/token-source.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Short-lived database credentials (#3685): a profile's `password` can name a
+ * token source instead of an environment variable, and the token is minted
+ * when a connection needs it.
+ *
+ * ```ts
+ * profiles: {
+ *   prod: { url: "postgres://db.abc.us-east-1.rds.amazonaws.com:5432/shop", user: { env: "PG_USER" }, password: { token: "rds-iam" } },
+ *   ci: { url: "postgres://db.internal:5432/shop", password: { token: "command", command: ["./mint-token.sh"], ttlSeconds: 600 } },
+ * }
+ * ```
+ *
+ * Each cloud source runs that cloud's own command line, which reads the job's
+ * ambient identity (an OIDC-federated role in CI, a workload identity, a
+ * logged-in developer), so chant holds no cloud SDK and no long-lived secret:
+ *
+ * - `rds-iam`: `aws rds generate-db-auth-token`, for RDS and Aurora. The host
+ *   and port come from the profile's URL, the user from its `user`, the region
+ *   from `region`, else `AWS_REGION`, else the RDS host name.
+ * - `cloud-sql-iam`: `gcloud sql generate-login-token`.
+ * - `entra`: `az account get-access-token` for Azure Database for PostgreSQL.
+ * - `command`: any command that prints a password on its standard output.
+ *
+ * A token is reused until most of its lifetime has passed and minted again
+ * after, so a long apply, whose ClickHouse requests each carry the password
+ * and whose Postgres connections each authenticate when opened, never sends
+ * an expired one. A token is never written to a message, an outcome or a log.
+ */
+import { z } from "zod";
+/** The token sources a profile's `password` can name. */
+export declare const tokenSourceSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    token: z.ZodLiteral<"rds-iam">;
+    /** The AWS region. `AWS_REGION`, `AWS_DEFAULT_REGION`, else the RDS host name's, when omitted. */
+    region: z.ZodOptional<z.ZodString>;
+    /** How long a token is valid, in seconds. 900, the RDS lifetime, when omitted. */
+    ttlSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    token: z.ZodLiteral<"cloud-sql-iam">;
+    /** How long a token is valid, in seconds. 3600 when omitted. */
+    ttlSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    token: z.ZodLiteral<"entra">;
+    /** How long a token is valid, in seconds. 3600 when omitted. */
+    ttlSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    token: z.ZodLiteral<"command">;
+    /** The program and its arguments, run without a shell; its standard output, trimmed, is the password. */
+    command: z.ZodArray<z.ZodString>;
+    /** How long a token is valid, in seconds. 300 when omitted. */
+    ttlSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>], "token">;
+export type TokenSourceConfig = z.infer<typeof tokenSourceSchema>;
+/** The cloud sources, which mint for a Postgres server only. */
+export declare const POSTGRES_ONLY_TOKEN_SOURCES: ReadonlySet<string>;
+/** A token source that could not mint. The message names the source and the command, never what it printed. */
+export declare class TokenSourceError extends Error {
+    constructor(message: string);
+}
+/** Runs a program without a shell and returns its standard output. */
+export type RunCommand = (argv: readonly string[], env: Record<string, string | undefined>) => Promise<string>;
+/** Where a token is minted, and the cached token. */
+export interface CredentialSource {
+    /** What the token is minted by, for a message: `sql.profiles.prod.password (rds-iam)`. */
+    readonly source: string;
+    /** A valid token: the cached one, or a new one when it has expired. */
+    get(): Promise<string>;
+    /** Forget the cached token, so the next `get()` mints again. */
+    invalidate(): void;
+}
+/** The program a source runs. Pure, for tests. */
+export declare function tokenCommand(config: TokenSourceConfig, input: {
+    url: string;
+    user?: string;
+    env: Record<string, string | undefined>;
+}): readonly string[];
+/**
+ * A source that mints with `config` when asked. Nothing runs until `get()`.
+ * `now` and `run` are for tests.
+ */
+export declare function credentialSource(config: TokenSourceConfig, input: {
+    url: string;
+    user?: string;
+    env: Record<string, string | undefined>;
+    source: string;
+    run?: RunCommand;
+    now?: () => number;
+}): CredentialSource;
+//# sourceMappingURL=token-source.d.ts.map

package/dist/token-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-source.d.ts","sourceRoot":"","sources":["../src/token-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,yDAAyD;AACzD,eAAO,MAAM,iBAAiB;;IAG1B,kGAAkG;;IAElG,kFAAkF;;;;IAKlF,gEAAgE;;;;IAKhE,gEAAgE;;;;IAKhE,yGAAyG;;IAEzG,+DAA+D;;6BAGjE,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,gEAAgE;AAChE,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAAkD,CAAC;AAY/G,+GAA+G;AAC/G,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED,sEAAsE;AACtE,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAU/G,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,gEAAgE;IAChE,UAAU,IAAI,IAAI,CAAC;CACpB;AAED,kDAAkD;AAClD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,GAC7E,SAAS,MAAM,EAAE,CA0BnB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE;IACL,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GACA,gBAAgB,CAoClB"}

package/dist/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EAAgD,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAMtH,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAgEvF,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAoEpF"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EAAgD,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAMtH,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AA0EvF,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAoEpF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-sql",
-  "version": "0.116.0",
+  "version": "0.118.0",
   "description": "SQL lexicon for chant — database schema as typed declarations, one dialect at a time; ClickHouse first, with types read from a pinned server's catalog",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -70,7 +70,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.116.0",
+    "@intentius/chant": "^0.118.0",
     "typescript": "^5.9.3"
   }
 }