@intentius/chant-lexicon-sql 0.124.30 → 0.124.32

package/dist/postgres/providers/index.js

@@ -0,0 +1,73 @@
+/**
+ * Managed-provider knowledge for the Postgres dialect (#3282): which roles
+ * and schemas a provider owns, which extensions it lets a customer create,
+ * and which statements it refuses. See ./types.ts for what a list means and
+ * how stale one can be.
+ */
+import { aurora } from "./aurora.js";
+import { azure } from "./azure.js";
+import { cloudSql } from "./cloud-sql.js";
+import { neon } from "./neon.js";
+import { rds } from "./rds.js";
+import { supabase } from "./supabase.js";
+import { POSTGRES_PROVIDERS } from "./types.js";
+export { POSTGRES_PROVIDERS, COMMON_REFUSED } from "./types.js";
+const DATA = {
+    rds,
+    aurora,
+    "cloud-sql": cloudSql,
+    azure,
+    neon,
+    supabase,
+};
+/** The data for one provider. */
+export function providerData(provider) {
+    return DATA[provider];
+}
+export const isPostgresProvider = (v) => typeof v === "string" && POSTGRES_PROVIDERS.includes(v);
+/** Role and schema names fold to lower case unless quoted; the lists are lower case. */
+const fold = (name) => name.toLowerCase();
+/**
+ * Whether the provider lets a customer create the extension. `undefined` when
+ * the provider's list is partial and does not name it: the answer is unknown,
+ * not no.
+ */
+export function providerAllowsExtension(provider, name) {
+    const data = DATA[provider];
+    if (data.allowedExtensions.includes(fold(name)))
+        return true;
+    return data.extensionListComplete ? false : undefined;
+}
+/**
+ * Whether the provider owns a live object, so import and describe can read it
+ * as foreign (not the project's to declare or change). A role or schema the
+ * provider created, an extension the provider installs, or a `pg_` built-in
+ * role. Names are compared case-folded.
+ */
+export function isProviderOwned(provider, object) {
+    const data = DATA[provider];
+    const name = fold(object.name);
+    switch (object.kind) {
+        case "role":
+            return data.reservedRoles.includes(name) || name.startsWith("pg_");
+        case "schema":
+            return data.reservedSchemas.includes(name);
+        case "extension":
+            return data.providerExtensions.includes(name);
+    }
+}
+/** Reduce a statement to what the refused-statement patterns match: comments and strings removed, upper case, whitespace collapsed. */
+export function normalizeStatement(sql) {
+    return sql
+        .replace(/\/\*[\s\S]*?\*\//g, " ")
+        .replace(/--[^\n]*/g, " ")
+        .replace(/'(?:[^']|'')*'/g, "''")
+        .replace(/\s+/g, " ")
+        .trim()
+        .toUpperCase();
+}
+/** The refused-statement entry a statement matches on the provider, if any. */
+export function refusedStatement(provider, sql) {
+    const text = normalizeStatement(sql);
+    return DATA[provider].refusedStatements.find((r) => r.pattern.test(text));
+}

package/dist/postgres/providers/neon.js

@@ -0,0 +1,44 @@
+import { words, COMMON_REFUSED } from "./types.js";
+/**
+ * Neon. The extension list is the "Postgres extensions" table, the entries
+ * with a PG18 version (entries marked `-` for PG18, such as plv8, rum and
+ * pg_search, are left out), read 2026-10-03. Table names were mapped to
+ * `CREATE EXTENSION` names where the page says so: pgvector is `vector`,
+ * pg_roaringbitmap is `roaringbitmap`. wal2json is a decoder plugin the page
+ * says needs no CREATE EXTENSION, so it is not listed. Reserved roles are
+ * the "Reserved role names" list plus neon_service, which the roles page
+ * describes as internal.
+ */
+export const neon = {
+    provider: "neon",
+    label: "Neon",
+    sources: [
+        { url: "https://neon.com/docs/extensions/pg-extensions", readOn: "2026-10-03", covers: "allowedExtensions (PG18 column)" },
+        { url: "https://neon.com/docs/manage/roles", readOn: "2026-10-03", covers: "reservedRoles, neon_superuser, internal roles" },
+        { url: "https://neon.com/docs/reference/compatibility", readOn: "2026-10-03", covers: "no superuser, no tablespaces" },
+    ],
+    reservedRoles: ["neon_superuser", "cloud_admin", "zenith_admin", "neon_service"],
+    reservedSchemas: [],
+    allowedExtensions: words(`
+    address_standardizer address_standardizer_data_us anon autoinc bloom btree_gin btree_gist citext cube dblink
+    dict_int earthdistance fuzzystrmatch h3 h3_postgis hll hstore hypopg insert_username intagg intarray ip4r isn
+    lakebase_text lakebase_tokenizer lakebase_vector lo ltree moddatetime neon neon_utils pg_cron pg_graphql
+    pg_hashids pg_hint_plan pg_ivm pg_jsonschema pg_partman pg_prewarm pg_repack pg_session_jwt pg_stat_statements
+    pg_tiktoken pg_trgm pg_uuidv7 pgcrypto pgjwt pgrag pgrouting pgrowlocks pgstattuple pgtap pgx_ulid plpgsql
+    plpgsql_check postgis postgis_raster postgis_sfcgal postgis_tiger_geocoder postgis_topology postgres_fdw prefix
+    rdkit refint roaringbitmap seg semver tablefunc tcn timescaledb tsm_system_rows tsm_system_time unaccent
+    uuid-ossp vector xml2
+  `),
+    extensionListComplete: true,
+    providerExtensions: ["neon", "neon_utils", "pg_session_jwt", "lakebase_text", "lakebase_tokenizer", "lakebase_vector"],
+    refusedStatements: [
+        ...COMMON_REFUSED,
+        { id: "create-tablespace", pattern: /^CREATE TABLESPACE\b/, reason: "Neon does not support tablespaces" },
+        { id: "alter-neon-superuser", pattern: /^(ALTER|DROP) (ROLE|USER) "?NEON_SUPERUSER"?\b/, reason: "neon_superuser is not intended to be modified" },
+    ],
+    toCheck: [
+        "reservedSchemas: none read from a page: https://neon.com/docs/manage/roles",
+        "pg_repack needs a paid plan and Neon Support to enable, pg_ivm is not available for new installs: https://neon.com/docs/extensions/pg-extensions",
+        "older majors' columns",
+    ],
+};

package/dist/postgres/providers/rds.js

@@ -0,0 +1,47 @@
+import { words, COMMON_REFUSED } from "./types.js";
+/**
+ * Amazon RDS for PostgreSQL. The extension list is the table for major 18 on
+ * the "Extensions supported for RDS for PostgreSQL" page, read 2026-10-03;
+ * the other majors differ at the edges and are not modelled (the list is the
+ * newest GA major's). Package names on that page were mapped to extension
+ * names: pgvector is `vector`, h3-pg is `h3` and `h3_postgis`.
+ */
+export const rds = {
+    provider: "rds",
+    label: "Amazon RDS for PostgreSQL",
+    sources: [
+        {
+            url: "https://docs.aws.amazon.com/AmazonRDS/latest/PostgreSQLReleaseNotes/postgresql-extensions.html",
+            readOn: "2026-10-03",
+            covers: "allowedExtensions (major 18 table)",
+        },
+        {
+            url: "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.PostgreSQL.CommonDBATasks.Roles.html",
+            readOn: "2026-10-03",
+            covers: "the master user is a member of rds_superuser, not a superuser",
+        },
+    ],
+    reservedRoles: ["rdsadmin", "rds_superuser", "rds_replication", "rds_password", "rds_iam", "rds_ad", "rdsrepladmin"],
+    reservedSchemas: [],
+    allowedExtensions: words(`
+    address_standardizer address_standardizer_data_us amcheck auto_explain aws_commons aws_lambda aws_s3 bloom
+    btree_gin btree_gist citext cube dblink dict_int dict_xsyn earthdistance fuzzystrmatch h3 h3_postgis hll hstore
+    hstore_plperl hypopg intagg intarray ip4r isn lo log_fdw ltree mysql_fdw oracle_fdw orafce pageinspect pg_bigm
+    pg_buffercache pg_cron pg_freespacemap pg_hint_plan pg_logicalinspect pg_partman pg_prewarm pg_proctab pg_repack
+    pg_similarity pg_stat_monitor pg_stat_statements pg_tle pg_transport pg_trgm pg_visibility pg_walinspect pgaudit
+    pgcrypto pglogical pgrouting pgrowlocks pgstattuple pgtap plperl plpgsql plprofiler pltcl plv8 postgis
+    postgis_raster postgis_tiger_geocoder postgis_topology postgres_fdw prefix rdkit roaringbitmap seg sslinfo
+    tablefunc tcn tds_fdw tsm_system_rows tsm_system_time unaccent uuid-ossp vector wal2json
+  `),
+    extensionListComplete: true,
+    providerExtensions: ["aws_commons", "aws_lambda", "aws_s3", "rds_tools", "log_fdw", "pg_transport"],
+    refusedStatements: [
+        ...COMMON_REFUSED,
+        { id: "create-tablespace-location", pattern: /^CREATE TABLESPACE\b/, reason: "RDS refuses tablespaces on a customer-chosen LOCATION" },
+    ],
+    toCheck: [
+        "reservedRoles beyond rds_superuser were not read from a page: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.PostgreSQL.CommonDBATasks.Roles.html",
+        "refusedStatements beyond the common three are from the documented master-user model, not a statement list",
+        "per-major differences in the extension list",
+    ],
+};

package/dist/postgres/providers/supabase.js

@@ -0,0 +1,45 @@
+import { words } from "./types.js";
+/**
+ * Supabase. The extension names are the ones the extensions overview's
+ * sidebar documents (plv8, pgjwt, timescaledb and pgsodium are marked
+ * deprecated there and left out), read 2026-10-03. The overview's full list
+ * is rendered by script and could not be read, so the list is partial:
+ * `extensionListComplete` is false and SQLPG004 does not report a name
+ * outside it. Roles are the "Supabase roles" section of the roles page. The
+ * unsupported operations are the two the roles-and-superuser page names.
+ */
+export const supabase = {
+    provider: "supabase",
+    label: "Supabase",
+    sources: [
+        { url: "https://supabase.com/docs/guides/database/extensions", readOn: "2026-10-03", covers: "allowedExtensions (partial: the documented extension pages)" },
+        { url: "https://supabase.com/docs/guides/database/postgres/roles", readOn: "2026-10-03", covers: "reservedRoles; auth, storage and etl schemas" },
+        {
+            url: "https://raw.githubusercontent.com/supabase/supabase/master/apps/docs/content/guides/database/postgres/roles-superuser.mdx",
+            readOn: "2026-10-03",
+            covers: "superuser-only statements (the source of https://supabase.com/docs/guides/database/postgres/roles-superuser)",
+        },
+    ],
+    reservedRoles: [
+        "postgres", "anon", "authenticator", "authenticated", "service_role", "supabase_auth_admin",
+        "supabase_storage_admin", "supabase_etl_admin", "dashboard_user", "supabase_admin",
+    ],
+    reservedSchemas: ["auth", "storage", "etl"],
+    allowedExtensions: words(`
+    hypopg http index_advisor pgaudit pgroonga pgrouting pg_cron pg_graphql pg_hashids pg_jsonschema pg_net
+    pg_partman pg_plan_filter postgres_fdw vector pg_stat_statements pg_repack postgis pgmq pgtap plpgsql_check
+    uuid-ossp rum
+  `),
+    extensionListComplete: false,
+    providerExtensions: ["pg_graphql", "pg_net", "pgmq", "index_advisor"],
+    refusedStatements: [
+        { id: "copy-program", pattern: /^COPY\b.*\b(FROM|TO) PROGRAM\b/, reason: "COPY ... FROM PROGRAM needs a superuser, which Supabase does not give out" },
+        { id: "superuser-role", pattern: /^(CREATE|ALTER) (ROLE|USER)\b.*\bSUPERUSER\b/, reason: "the SUPERUSER attribute cannot be granted on Supabase" },
+    ],
+    toCheck: [
+        "the full extension list (page body is script-rendered): https://supabase.com/docs/guides/database/extensions",
+        "reservedSchemas beyond auth, storage and etl (extensions, realtime, graphql, graphql_public, vault, net, supabase_functions, pgbouncer were not read from a page): https://supabase.com/docs/guides/database/postgres/roles",
+        "refused statements beyond the two the roles-and-superuser page lists (ALTER SYSTEM was not stated): https://supabase.com/docs/guides/database/postgres/roles-superuser",
+        "providerExtensions are inferred from the extension pages' names, not from a statement of ownership",
+    ],
+};

package/dist/postgres/providers/types.js

@@ -0,0 +1,21 @@
+/**
+ * What the Postgres dialect knows about a managed provider (#3282): the
+ * roles and schemas the provider owns, the extensions it lets a customer
+ * create, and the statements it refuses because they need a superuser.
+ *
+ * The lists are data, one file per provider, each citing the page it was read
+ * from and the date it was read. A provider changes its lists without
+ * announcing it, so a list is a snapshot, not a contract: an extension a
+ * provider added since is reported by SQLPG004 as not allowed until the list
+ * is refreshed, and `toCheck` names what a file did not verify.
+ */
+/** The providers the dialect has data for. */
+export const POSTGRES_PROVIDERS = ["rds", "aurora", "cloud-sql", "azure", "neon", "supabase"];
+/** Split a whitespace-separated list, so a long extension list stays readable in source. */
+export const words = (s) => s.split(/\s+/).filter(Boolean);
+/** Statements that need the superuser every managed provider withholds. */
+export const COMMON_REFUSED = [
+    { id: "alter-system", pattern: /^ALTER SYSTEM\b/, reason: "ALTER SYSTEM writes postgresql.auto.conf, which a managed service owns; use the provider's parameter settings" },
+    { id: "copy-program", pattern: /^COPY\b.*\b(FROM|TO) PROGRAM\b/, reason: "COPY ... PROGRAM runs a command on the host, which the provider does not give out" },
+    { id: "superuser-role", pattern: /^(CREATE|ALTER) (ROLE|USER)\b.*\bSUPERUSER\b/, reason: "the SUPERUSER attribute cannot be granted on a managed service" },
+];

package/dist/postgres/row-types.js

@@ -0,0 +1,107 @@
+/**
+ * What a Postgres column's value is in TypeScript, for `RowOf` (#3751): the
+ * value node-postgres (`pg`, the driver the lexicon itself uses) hands back
+ * with its default type parsers. `bigint` and `numeric` are strings, since a
+ * JavaScript number cannot hold every value; `integer`, `smallint`, `real`
+ * and `double precision` are numbers; dates and timestamps are `Date`s;
+ * `json` and `jsonb` are parsed, so their shape is the application's
+ * (`unknown`); everything the driver does not parse is its text form.
+ *
+ * The table names every built-in type of every supported major's catalog
+ * (`COLUMN_TYPES`), and a test fails on one it does not, so a type a new
+ * catalog adds is a decision rather than a silent `unknown`.
+ */
+const NUMBER = "number";
+const STRING = "string";
+const DATE = "Date";
+/** The TypeScript type of each built-in type's value, by its `format_type()` name. */
+export const POSTGRES_ROW_TYPES = {
+    // Numbers the driver parses; the 64-bit and arbitrary-precision ones stay text.
+    smallint: NUMBER,
+    integer: NUMBER,
+    real: NUMBER,
+    "double precision": NUMBER,
+    oid: NUMBER,
+    bigint: STRING,
+    numeric: STRING,
+    money: STRING,
+    regclass: STRING,
+    regcollation: STRING,
+    regconfig: STRING,
+    regdictionary: STRING,
+    regnamespace: STRING,
+    regoper: STRING,
+    regoperator: STRING,
+    regproc: STRING,
+    regprocedure: STRING,
+    regrole: STRING,
+    regtype: STRING,
+    boolean: "boolean",
+    // Strings.
+    text: STRING,
+    "character varying": STRING,
+    character: STRING,
+    name: STRING,
+    '"char"': STRING,
+    uuid: STRING,
+    xml: STRING,
+    bit: STRING,
+    "bit varying": STRING,
+    cidr: STRING,
+    inet: STRING,
+    macaddr: STRING,
+    macaddr8: STRING,
+    tsvector: STRING,
+    tsquery: STRING,
+    jsonpath: STRING,
+    pg_lsn: STRING,
+    pg_snapshot: STRING,
+    txid_snapshot: STRING,
+    refcursor: STRING,
+    aclitem: STRING,
+    cid: STRING,
+    tid: STRING,
+    xid: STRING,
+    xid8: STRING,
+    int2vector: STRING,
+    oidvector: STRING,
+    gtsvector: STRING,
+    pg_brin_bloom_summary: STRING,
+    pg_brin_minmax_multi_summary: STRING,
+    pg_dependencies: STRING,
+    pg_mcv_list: STRING,
+    pg_ndistinct: STRING,
+    pg_node_tree: STRING,
+    // Dates and times: the driver parses dates and timestamps, not times of day.
+    date: DATE,
+    "timestamp without time zone": DATE,
+    "timestamp with time zone": DATE,
+    "time without time zone": STRING,
+    "time with time zone": STRING,
+    interval: "{ years?: number; months?: number; days?: number; hours?: number; minutes?: number; seconds?: number; milliseconds?: number }",
+    // Ranges and multiranges arrive as their text form.
+    int4range: STRING,
+    int8range: STRING,
+    numrange: STRING,
+    tsrange: STRING,
+    tstzrange: STRING,
+    daterange: STRING,
+    int4multirange: STRING,
+    int8multirange: STRING,
+    nummultirange: STRING,
+    tsmultirange: STRING,
+    tstzmultirange: STRING,
+    datemultirange: STRING,
+    // Geometry: the driver parses a point and a circle.
+    point: "{ x: number; y: number }",
+    circle: "{ x: number; y: number; radius: number }",
+    line: STRING,
+    lseg: STRING,
+    box: STRING,
+    path: STRING,
+    polygon: STRING,
+    // Parsed, so the application's own shape.
+    json: "unknown",
+    jsonb: "unknown",
+    bytea: "Uint8Array",
+};

package/dist/postgres/testing/fake-client.js

@@ -0,0 +1,34 @@
+/**
+ * A fake Postgres client for unit tests: answers the catalog reader's queries
+ * (`../live/catalog.ts`) from rows the test gives, by which catalog each query
+ * reads. Anything else answers no rows.
+ */
+export function fakeClient(catalog, log = []) {
+    let oid = 16384;
+    const tables = (catalog.tables ?? []).map((t) => ({ ...t, oid: String(oid++) }));
+    return {
+        async query(sql) {
+            log.push(sql);
+            const rows = (r) => r;
+            // A probe for one undeclarable kind (`../live/undeclarable.ts`), which its comment names.
+            const probe = /^\/\* chant undeclarable: (.+?) \*\//.exec(sql);
+            if (probe)
+                return rows((catalog.undeclarable ?? []).filter((u) => u.kind === probe[1]).map((u) => ({ schema: u.schema ?? null, name: u.name, owner: null })));
+            if (sql.includes("FROM pg_catalog.pg_namespace n WHERE"))
+                return rows((catalog.schemas ?? []).map((s, i) => ({ oid: String(100 + i), name: s.name, comment: s.comment ?? null })));
+            if (sql.includes("c.relkind IN ('r', 'p')")) {
+                return rows(tables.map((t) => ({ oid: t.oid, schema: t.schema, name: t.name, kind: "r", persistence: "p", ispartition: false, typed: false, partkey: null, bound: null, parents: [], reloptions: null, am: "heap", tablespace: null, comment: t.comment ?? null })));
+            }
+            if (sql.includes("FROM pg_catalog.pg_attribute a JOIN")) {
+                return rows(tables.flatMap((t) => (t.columns ?? []).map((c, i) => ({ rel: t.oid, num: i + 1, name: c.name, type: c.type, notnull: c.notnull ?? false, identity: "", generated: "", islocal: true, dflt: c.dflt ?? null, collation: null, comment: null, compression: "", storage: "x", typstorage: "x" }))));
+            }
+            if (sql.includes("c.relkind IN ('v', 'm')")) {
+                return rows((catalog.views ?? []).map((v) => ({ oid: String(oid++), schema: v.schema, name: v.name, kind: v.materialized ? "m" : "v", def: v.def, reloptions: null, populated: true, am: null, tablespace: null, comment: v.comment ?? null, column_comments: [] })));
+            }
+            if (sql.includes("FROM pg_catalog.pg_index i"))
+                return rows((catalog.indexes ?? []).map((x) => ({ oid: String(oid++), schema: x.schema, name: x.name, table_name: x.table, def: x.def, comment: null })));
+            return [];
+        },
+        async end() { },
+    };
+}

package/dist/postgres/testing/migration.js

@@ -0,0 +1,48 @@
+/**
+ * Running `PostgresMigrationOp` in a live test (#3281, #3322): the Op's
+ * activities with the test's config and server, core's local executor, and
+ * an in-memory gate ledger a test approves on.
+ */
+import { memoryGateLedgerPort, runOpLocally, loadProfiles } from "@intentius/chant/op";
+import * as migrationActivities from "../../op/activities/postgres-migration.js";
+import { PostgresMigrationOp } from "../migrate/op.js";
+/** The migration activities, each called with `deps()`, as the local executor resolves them. */
+export function migrationActivityMap(deps) {
+    const map = new Map();
+    for (const [name, fn] of Object.entries(migrationActivities)) {
+        if (typeof fn !== "function" || !name.startsWith("postgresMigration"))
+            continue;
+        map.set(name, ((args, signal) => fn(args, signal, deps())));
+    }
+    return map;
+}
+/** One run of the Op through core's local executor, as far as its next gate. */
+export async function runMigrationOp(config, gates, deps) {
+    const { op } = PostgresMigrationOp(config);
+    const props = op.props;
+    return runOpLocally(props, migrationActivityMap(deps), await loadProfiles(), undefined, { gates, now: new Date().toISOString() });
+}
+/** An in-memory gate ledger a person approves on: each approval answers the gate the last run stopped at, for the plan it recorded. */
+export class ApprovingLedger {
+    constructor() {
+        this.pending = [];
+        this.resolutions = [];
+        this.port = memoryGateLedgerPort();
+    }
+    approveLast() {
+        const last = this.port.appended.at(-1);
+        this.pending.push(...this.port.appended);
+        this.resolutions.push({
+            version: 1,
+            kind: "resolution",
+            op: last.op,
+            gate: last.gate,
+            resolvedBy: "e2e",
+            timestamp: new Date(Date.parse(last.timestamp) + 1000).toISOString(),
+            ...(last.planDigest ? { planDigest: last.planDigest } : {}),
+        });
+        this.port = memoryGateLedgerPort({ pending: this.pending, resolutions: this.resolutions });
+    }
+}
+/** An outcome attribute a run recorded. */
+export const runOutcome = (r, name) => r.records.flatMap((x) => x.outcomes ?? []).find((o) => o.name === name)?.value;

package/dist/postgres/testing/roundtrip-schema.js

@@ -0,0 +1,64 @@
+/**
+ * The schema the live round trip creates on its source server: every object
+ * kind the dialect declares, with what the catalog's printers rewrite most
+ * (type aliases, literal casts, `IN` lists, unnamed constraints, identity and
+ * sequence options, storage parameters, comments), an extension and the
+ * domain over its type, a collation, composite and range types (and a
+ * multirange column), plain and ordered-set aggregates, a cast and an event
+ * trigger (#3911), a partitioned table and a partition, an ORM's
+ * revision table that import leaves out, and an object carrying chant's
+ * ownership trailer.
+ */
+export const ROUNDTRIP_SCHEMA = `
+CREATE SCHEMA app;
+COMMENT ON SCHEMA app IS 'The shop';
+CREATE EXTENSION citext WITH SCHEMA app;
+CREATE TYPE app.order_status AS ENUM ('placed', 'paid', 'shipped');
+CREATE DOMAIN app.email AS app.citext CONSTRAINT email_shape CHECK (VALUE LIKE '%@%');
+COMMENT ON CONSTRAINT email_shape ON DOMAIN app.email IS 'needs an @';
+CREATE SEQUENCE app.invoice_seq AS integer START WITH 1000 CACHE 10;
+CREATE TABLE app.users (
+  id bigint GENERATED ALWAYS AS IDENTITY (START WITH 10) PRIMARY KEY,
+  email app.email NOT NULL UNIQUE,
+  plan text NOT NULL DEFAULT 'free' CHECK (plan IN ('free', 'pro')),
+  created_at timestamptz NOT NULL DEFAULT now()
+) WITH (fillfactor = 90);
+COMMENT ON TABLE app.users IS 'Accounts [chant managed-by=chant stack=shop env=e2e]';
+COMMENT ON COLUMN app.users.email IS 'Login name';
+CREATE TABLE app.orders (
+  id serial PRIMARY KEY,
+  user_id bigint NOT NULL REFERENCES app.users (id) ON DELETE CASCADE,
+  invoice_no integer NOT NULL DEFAULT nextval('app.invoice_seq'),
+  status app.order_status NOT NULL DEFAULT 'placed',
+  amount numeric(12, 2) NOT NULL CONSTRAINT amount_positive CHECK (amount >= 0),
+  discount int DEFAULT -1,
+  total numeric GENERATED ALWAYS AS (amount * 2) STORED,
+  placed_at timestamp(3) without time zone
+);
+CREATE INDEX orders_user_idx ON app.orders (user_id, placed_at DESC) WHERE status <> 'shipped';
+CREATE UNIQUE INDEX orders_invoice_idx ON app.orders USING btree (invoice_no) INCLUDE (amount);
+CREATE TABLE app.measures (ts date NOT NULL, v double precision) PARTITION BY RANGE (ts);
+CREATE TABLE app.measures_2026 PARTITION OF app.measures FOR VALUES FROM ('2026-01-01') TO ('2027-01-01');
+CREATE VIEW app.order_totals AS
+  SELECT u.id AS user_id, u.email, count(o.id) AS n, coalesce(sum(o.amount), 0) AS total
+  FROM app.users u LEFT JOIN app.orders o ON o.user_id = u.id
+  GROUP BY u.id, u.email;
+CREATE MATERIALIZED VIEW app.daily AS SELECT placed_at::date AS day, count(*) AS n FROM app.orders GROUP BY 1 WITH NO DATA;
+CREATE COLLATION app.ci (provider = icu, locale = 'und-u-ks-level2', deterministic = false);
+COMMENT ON COLLATION app.ci IS 'Case-insensitive';
+CREATE TYPE app.pair AS (a integer, b text COLLATE "C");
+COMMENT ON TYPE app.pair IS 'Two values';
+CREATE TYPE app.floatrange AS RANGE (SUBTYPE = float8, SUBTYPE_DIFF = float8mi);
+CREATE TABLE app.people (id integer PRIMARY KEY, nick text COLLATE app.ci, span app.floatrange, tags app.floatmultirange);
+CREATE FUNCTION app.add2(a integer, b integer) RETURNS integer LANGUAGE sql IMMUTABLE AS $$ SELECT a + b $$;
+CREATE AGGREGATE app.total(integer) (SFUNC = app.add2, STYPE = integer, INITCOND = '0', PARALLEL = SAFE);
+COMMENT ON AGGREGATE app.total(integer) IS 'A sum';
+CREATE FUNCTION app.middle(v double precision[]) RETURNS double precision LANGUAGE sql IMMUTABLE AS $$ SELECT v[(array_length(v, 1) + 1) / 2] $$;
+CREATE AGGREGATE app.median_of(ORDER BY double precision) (SFUNC = pg_catalog.array_append, STYPE = double precision[], FINALFUNC = app.middle);
+CREATE FUNCTION app.pair_text(p app.pair) RETURNS text LANGUAGE sql IMMUTABLE AS $$ SELECT p.a || ':' || p.b $$;
+CREATE CAST (app.pair AS text) WITH FUNCTION app.pair_text(app.pair) AS ASSIGNMENT;
+COMMENT ON CAST (app.pair AS text) IS 'a:b';
+CREATE FUNCTION app.audit() RETURNS event_trigger LANGUAGE plpgsql AS $$ BEGIN END $$;
+CREATE EVENT TRIGGER app_audit ON ddl_command_end WHEN TAG IN ('CREATE TABLE') EXECUTE FUNCTION app.audit();
+CREATE TABLE public._prisma_migrations (id varchar(36) PRIMARY KEY, checksum varchar(64) NOT NULL);
+`;

package/dist/postgres/testing/server.js

@@ -0,0 +1,47 @@
+/**
+ * A throwaway Postgres server for the live tests: the pinned image on a random
+ * loopback port, a client for it, and a URL for a second database on it.
+ * Always removed with its volume.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { startScratchContainer } from "../../core/container.js";
+import { postgresImage, POSTGRES_LATEST_MAJOR } from "../../spec/postgres-pin.js";
+import { connectPostgres } from "../live/client.js";
+export { dockerAvailable } from "../../core/container.js";
+const PASSWORD = "chant";
+const exec = promisify(execFile);
+export async function startTestPostgres(major = POSTGRES_LATEST_MAJOR) {
+    let port = "";
+    let name = "";
+    const endpoint = (db = "postgres") => ({ url: `postgres://postgres@127.0.0.1:${port}/${db}`, password: PASSWORD });
+    const container = await startScratchContainer({
+        image: postgresImage(major),
+        namePrefix: "chant-sql-pg-test",
+        containerPort: 5432,
+        env: { POSTGRES_PASSWORD: PASSWORD },
+        removeVolumes: true,
+        readyTimeoutMs: 120000,
+        notReady: "did not accept a connection",
+        onStarted: (n) => {
+            name = n;
+        },
+        ready: async (p) => {
+            port = p;
+            // The image runs a temporary server for initdb and then restarts it: ready is the second "ready" line.
+            const logs = await exec("docker", ["logs", name]).then((r) => `${r.stdout}${r.stderr}`, () => "");
+            if ((logs.match(/database system is ready to accept connections/g) ?? []).length < 2)
+                return false;
+            try {
+                const c = await connectPostgres(endpoint());
+                await c.query("SELECT 1");
+                await c.end();
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    });
+    return { name: container.name, endpoint, connect: (db) => connectPostgres(endpoint(db)), stop: () => container.stop() };
+}