@intentius/chant-lexicon-sql 0.124.24 → 0.124.26

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "4e51745dab5620b066bb56c64dd42e13aca79ad24b0da5d2995f123498024783",
+    "manifest.json": "4b71c644a9deaf6fe1399be5b88121e0311dcf9e4208f7abcceaf45e95f2fd69",
     "meta.json": "59ca03876cce0d293e15a7f0a90ef7f250d133e46773c73fedede4a2ec792119",
     "types/index.d.ts": "0286ebb367773e84c76818b0f69cb14cff8328fd2f8c65ed87563c8d5815458c",
     "rules/postgres-templates.ts": "082da542239ab9f9627026972281102a61ca269cb79e2514f402dfc400ccdcde",
@@ -79,5 +79,5 @@
     "rules/sqlpg125.ts": "cc7411c57c525613dc720ba00e986bbc4e5a84b8b0bcfa7a6ce0d058f039f025",
     "rules/sqlpg126.ts": "d57b82a5842273876510131d67bf4418cbd61eff821e245edebc644dafd502bb"
   },
-  "composite": "196ca842183748f111a4a69d0236c249177a3c036f7538a7514a51091e31aba3"
+  "composite": "ba7ce0b2d454e12132bc5f1c87ae1ba71a978a13dae9f861a13d2eea98de8cd8"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "sql",
-  "version": "0.124.24",
+  "version": "0.124.26",
   "chantVersion": ">=0.1.0",
   "namespace": "SQL",
   "intrinsics": [],

package/dist/postgres/live/client.d.ts

@@ -28,6 +28,15 @@ export declare class PostgresQueryError extends Error {
     readonly position?: number | undefined;
     constructor(message: string, code?: string | undefined, position?: number | undefined);
 }
+/**
+ * The URL with libpq's meaning of `sslmode`. pg-connection-string reads
+ * `sslmode=require` as verify-full unless `uselibpqcompat=true` is set, so an
+ * RDS host without its CA bundle, or a tunnel whose host name doesn't match
+ * the certificate, fails to connect. In psql, `require` encrypts without
+ * verifying, and a profile url means what it means there. A url that sets
+ * `uselibpqcompat` itself is left alone.
+ */
+export declare function withLibpqSslMode(url: URL): URL;
 /** Connect to `endpoint` and set the catalog-reading session up. */
 export declare function connectPostgres(endpoint: PostgresEndpoint, options?: {
     applicationName?: string;

package/dist/postgres/live/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/postgres/live/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3F,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAED,uEAAuE;AACvE,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM;gBAF1B,OAAO,EAAE,MAAM,EACN,IAAI,CAAC,EAAE,MAAM,YAAA,EACb,QAAQ,CAAC,EAAE,MAAM,YAAA;CAK7B;AAgBD,oEAAoE;AACpE,wBAAsB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAoCrI;AAED,8FAA8F;AAC9F,eAAO,MAAM,2BAA2B,UAAU,CAAC;AAEnD,0JAA0J;AAC1J,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,0FAA0F;AAC1F,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAsB1F;AAED,uDAAuD;AACvD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAQ1E;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,cAAc,EAAE,aAAa,GAAE,MAAgC,GAAG,OAAO,CAAC,cAAc,CAAC,CAkB7I"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/postgres/live/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3F,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAED,uEAAuE;AACvE,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM;gBAF1B,OAAO,EAAE,MAAM,EACN,IAAI,CAAC,EAAE,MAAM,YAAA,EACb,QAAQ,CAAC,EAAE,MAAM,YAAA;CAK7B;AAgBD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAG9C;AAED,oEAAoE;AACpE,wBAAsB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAoCrI;AAED,8FAA8F;AAC9F,eAAO,MAAM,2BAA2B,UAAU,CAAC;AAEnD,0JAA0J;AAC1J,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,0FAA0F;AAC1F,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAsB1F;AAED,uDAAuD;AACvD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAQ1E;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,cAAc,EAAE,aAAa,GAAE,MAAgC,GAAG,OAAO,CAAC,cAAc,CAAC,CAkB7I"}

package/dist/postgres/testing/migration.d.ts

@@ -18,6 +18,7 @@ export declare class ApprovingLedger {
         appended: import("@intentius/chant/point-decision").PendingGateRecord[];
         resolved: import("@intentius/chant/point-decision").GateResolutionRecord[];
         applied: import("@intentius/chant/gate-decision").AppliedGateRecord[];
+        checkpoints: Map<string, string>;
     };
     approveLast(): void;
 }

package/dist/postgres/testing/migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../src/postgres/testing/migration.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAoD,KAAK,UAAU,EAAE,KAAK,cAAc,EAAiB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE9J,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAEpF,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,qBAAqB,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAO/F;AAED,gFAAgF;AAChF,wBAAsB,cAAc,CAAC,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAItJ;AAED,uIAAuI;AACvI,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,WAAW,CAAiB;IACpC,IAAI;;;;MAA0B;IAE9B,WAAW,IAAI,IAAI;CAcpB;AAED,2CAA2C;AAC3C,eAAO,MAAM,UAAU,GAAI,GAAG,WAAW,EAAE,MAAM,MAAM,KAAG,OAAyF,CAAC"}
+{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../src/postgres/testing/migration.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAoD,KAAK,UAAU,EAAE,KAAK,cAAc,EAAiB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE9J,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAEpF,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,qBAAqB,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAO/F;AAED,gFAAgF;AAChF,wBAAsB,cAAc,CAAC,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAItJ;AAED,uIAAuI;AACvI,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,WAAW,CAAiB;IACpC,IAAI;;;;;MAA0B;IAE9B,WAAW,IAAI,IAAI;CAcpB;AAED,2CAA2C;AAC3C,eAAO,MAAM,UAAU,GAAI,GAAG,WAAW,EAAE,MAAM,MAAM,KAAG,OAAyF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-sql",
-  "version": "0.124.24",
+  "version": "0.124.26",
   "description": "SQL lexicon for chant — database schema as typed declarations, one dialect at a time; ClickHouse first, with types read from a pinned server's catalog",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -72,6 +72,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.24"
+    "@intentius/chant": "^0.124.26"
   }
 }

package/src/postgres/live/client.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, test } from "vitest";
+import { parse } from "pg-connection-string";
+import { withLibpqSslMode } from "./client";
+
+const ssl = (url: string) => parse(withLibpqSslMode(new URL(url)).toString()).ssl;
+
+describe("withLibpqSslMode", () => {
+  test("sslmode=require encrypts without verifying the certificate, as in psql", () => {
+    expect(ssl("postgres://shop.abc123.eu-west-1.rds.amazonaws.com:5432/shop?sslmode=require")).toEqual({ rejectUnauthorized: false });
+  });
+
+  test("sslmode=verify-full still verifies", () => {
+    expect(ssl("postgres://localhost:5432/shop?sslmode=verify-full")).toEqual({});
+  });
+
+  test("a url that sets uselibpqcompat itself is left alone", () => {
+    const url = "postgres://localhost:5432/shop?sslmode=require&uselibpqcompat=false";
+    expect(withLibpqSslMode(new URL(url)).toString()).toBe(url);
+  });
+
+  test("a url without sslmode is left alone", () => {
+    const url = "postgres://localhost:5432/shop";
+    expect(withLibpqSslMode(new URL(url)).toString()).toBe(url);
+  });
+});

package/src/postgres/live/client.ts

@@ -52,11 +52,24 @@ const wrap = (err: unknown): PostgresQueryError => {
   return new PostgresQueryError(e.message ?? String(err), e.code, e.position !== undefined ? Number(e.position) : undefined);
 };
 
+/**
+ * The URL with libpq's meaning of `sslmode`. pg-connection-string reads
+ * `sslmode=require` as verify-full unless `uselibpqcompat=true` is set, so an
+ * RDS host without its CA bundle, or a tunnel whose host name doesn't match
+ * the certificate, fails to connect. In psql, `require` encrypts without
+ * verifying, and a profile url means what it means there. A url that sets
+ * `uselibpqcompat` itself is left alone.
+ */
+export function withLibpqSslMode(url: URL): URL {
+  if (url.searchParams.has("sslmode") && !url.searchParams.has("uselibpqcompat")) url.searchParams.set("uselibpqcompat", "true");
+  return url;
+}
+
 /** Connect to `endpoint` and set the catalog-reading session up. */
 export async function connectPostgres(endpoint: PostgresEndpoint, options: { applicationName?: string } = {}): Promise<PostgresClient> {
   const pg = await pgModule();
   // node-postgres lets the connection string's fields win over the config's, so the credentials go into the URL.
-  const url = new URL(endpoint.url);
+  const url = withLibpqSslMode(new URL(endpoint.url));
   if (endpoint.user !== undefined) url.username = encodeURIComponent(endpoint.user);
   const password = endpoint.token ? await endpoint.token.get() : endpoint.password;
   if (password !== undefined) url.password = encodeURIComponent(password);