@intentius/sql-yodeler 0.3.0 → 0.4.0

package/dist/config/settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/config/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAiB,MAAM,kDAAkD,CAAC;AAC5G,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAgB,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAmBnD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAE/C,MAAM,KAAK,GAA2B,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;AAElF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY;IACtD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,iEAAiE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,KAAK,CAAC,KAAwB,EAAE,KAAa;IACpD,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,GAAG,KAAK,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,CAAW;IAC3C,OAAO,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,OAA0C,EAAE,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IAClI,4FAA4F;IAC5F,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAiD,CAAC;IAErG,IAAI,QAAkB,CAAC;IACvB,IAAI,cAAsB,CAAC;IAC3B,IAAI,GAAG,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,WAAW,kBAAkB,IAAI,WAAW,CAAC,CAAC;QAChF,cAAc,GAAG,WAAW,CAAC;IAC/B,CAAC;SAAM,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3C,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,IAAI,WAAW,CAAC,CAAC;QACpE,cAAc,GAAG,gBAAgB,IAAI,WAAW,CAAC;IACnD,CAAC;SAAM,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QAC9B,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACvD,cAAc,GAAG,gBAAgB,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC9B,cAAc,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,IAAI,SAAS,GAAG,mBAAmB,CAAC;IACpC,IAAI,GAAG,EAAE,OAAO,KAAK,SAAS;QAAE,SAAS,GAAG,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;SAC1D,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,mDAAmD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACtJ,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,GAAG,EAAE,QAAQ,KAAK,SAAS;QAAE,UAAU,GAAG,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC7D,IAAI,GAAG,CAAC,aAAa,CAAC;QAAE,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;IAE3F,OAAO;QACL,QAAQ;QACR,cAAc;QACd,eAAe,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QAC5C,eAAe,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,wBAAwB,CAAC,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QACnJ,SAAS;QACT,UAAU;KACX,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAA2D,EAAU,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC;AAEtK;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAA0C,EAAE,IAAY;IACjG,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACjE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAI,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAkD,EAAE,QAAQ,CAAC;IACjH,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,WAAW,kBAAkB,IAAI,WAAW,CAAC,CAAC;IACzE,4GAA4G;IAC5G,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,IAAI,QAAQ,EAAE,gBAAgB,IAAI,WAAW,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACtF,OAAO,IAAI,UAAU,CACnB,GAAG,WAAW,sBAAsB,IAAI,gBAAgB,aAAa,CAAC,IAAI,CAAC,wFAAwF,IAAI,YAAY;QACjL,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,uBAAuB,IAAI,qFAAqF,CAChM,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAW,EAAuB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/config/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAiB,MAAM,kDAAkD,CAAC;AAC5G,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAgB,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAmBnD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAE/C,MAAM,KAAK,GAA2B,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;AAElF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY;IACtD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,iEAAiE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,KAAK,CAAC,KAAwB,EAAE,KAAa;IACpD,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,GAAG,KAAK,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,CAAW;IAC3C,OAAO,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,OAA0C,EAAE,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IAClI,4FAA4F;IAC5F,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAiD,CAAC;IAErG,IAAI,QAAkB,CAAC;IACvB,IAAI,cAAsB,CAAC;IAC3B,IAAI,GAAG,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,WAAW,kBAAkB,IAAI,WAAW,CAAC,CAAC;QAChF,cAAc,GAAG,WAAW,CAAC;IAC/B,CAAC;SAAM,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3C,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,IAAI,WAAW,CAAC,CAAC;QACpE,cAAc,GAAG,gBAAgB,IAAI,WAAW,CAAC;IACnD,CAAC;SAAM,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QAC9B,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACvD,cAAc,GAAG,gBAAgB,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC9B,cAAc,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,IAAI,SAAS,GAAG,mBAAmB,CAAC;IACpC,IAAI,GAAG,EAAE,OAAO,KAAK,SAAS;QAAE,SAAS,GAAG,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;SAC1D,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,mDAAmD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACtJ,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,GAAG,EAAE,QAAQ,KAAK,SAAS;QAAE,UAAU,GAAG,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC7D,IAAI,GAAG,CAAC,aAAa,CAAC;QAAE,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;IAE3F,OAAO;QACL,QAAQ;QACR,cAAc;QACd,eAAe,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QAC5C,eAAe,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,wBAAwB,CAAC,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QACnJ,SAAS;QACT,UAAU;KACX,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAA2D,EAAU,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC;AAEtK;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAA0C,EAAE,IAAY;IACjG,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACjE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAI,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAkD,EAAE,QAAQ,CAAC;IACjH,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,WAAW,kBAAkB,IAAI,WAAW,CAAC,CAAC;IACzE,4GAA4G;IAC5G,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,IAAI,QAAQ,EAAE,gBAAgB,IAAI,WAAW,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACtF,OAAO,IAAI,UAAU,CACnB,GAAG,WAAW,sBAAsB,IAAI,gBAAgB,aAAa,CAAC,IAAI,CAAC,wFAAwF,IAAI,YAAY;QACjL,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,uBAAuB,IAAI,qFAAqF,CAChM,CAAC;AACJ,CAAC;AAED,0JAA0J;AAC1J,MAAM,UAAU,iBAAiB,CAAC,GAAqC,EAAE,OAAyC,EAAE,IAAY;IAC9H,IAAI,GAAG,EAAE,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClF,IAAI,OAAO,OAAO,EAAE,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,IAAI,SAAS,EAAE,CAAC;IACnH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAgE,EAAE,IAAY;IACrH,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAC/D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IACtD,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACrC,OAAO,IAAI,UAAU,CACnB,GAAG,WAAW,sBAAsB,IAAI,cAAc,MAAM,CAAC,GAAG,CAAC,8EAA8E,IAAI,cAAc,OAAO,CAAC,UAAU,GAAG;QACpL,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,IAAI,cAAc,MAAM,CAAC,GAAG,CAAC,+CAA+C,CACxL,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAW,EAAuB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/credentials.d.ts

@@ -0,0 +1,119 @@
+/**
+ * The reader and the writer of an environment (#50), for a project's
+ * `chant.config.ts`:
+ *
+ * ```ts
+ * import { credentials } from "@intentius/sql-yodeler";
+ *
+ * profiles: {
+ *   dev: { url: "postgres://127.0.0.1:5432/app", ...credentials("dev", "postgres"), schemas: ["app"] },
+ *   prod: {
+ *     url: "postgres://db.abc.us-east-1.rds.amazonaws.com:5432/app",
+ *     ...credentials("prod", "postgres", { writer: { password: { token: "rds-iam" } } }),
+ *     schemas: ["app"],
+ *   },
+ * }
+ * ```
+ *
+ * `YODEL_CREDENTIALS` picks the role a process connects as: the reader
+ * unless it is `writer` (every environment) or `writer:<env>` (that one).
+ * Only an environment's apply job sets it. Each role reads its user and its
+ * password from a variable, by default `<ENV>_<DIALECT>_READER_USER`,
+ * `..._READER_PASSWORD`, `..._WRITER_USER` and `..._WRITER_PASSWORD`
+ * (`DEV_POSTGRES_READER_USER`), the names `yodel ci` maps the forge's
+ * secrets to. A role's password can instead be a short-lived token, minted
+ * by chant's sql lexicon when a connection needs it: `{ token: "rds-iam" }`,
+ * `{ token: "cloud-sql-iam" }` or `{ token: "entra" }` (Postgres), or
+ * `{ token: "command", command: ["./mint.sh"] }` (either dialect).
+ *
+ * The profile carries both roles under a symbol chant does not read, so
+ * yodel sees the reader and the writer from one evaluation of the config:
+ * it refuses (exit 4) an environment whose two roles are the same user or
+ * read the same variable, and `yodel ci` gives each job the variables, and
+ * the cloud identity, of the role it runs as.
+ */
+/** A value read from an environment variable, as chant's profiles name one. */
+export interface EnvRef {
+    env: string;
+}
+/** A short-lived password, minted by chant's sql lexicon when a connection needs one. */
+export type TokenSource = {
+    token: "rds-iam";
+    region?: string;
+    ttlSeconds?: number;
+} | {
+    token: "cloud-sql-iam";
+    ttlSeconds?: number;
+} | {
+    token: "entra";
+    ttlSeconds?: number;
+} | {
+    token: "command";
+    command: string[];
+    ttlSeconds?: number;
+};
+/** The token sources that mint from a cloud identity, which a CI job gets over OIDC. */
+export type CloudToken = Exclude<TokenSource["token"], "command">;
+export declare const CLOUD_TOKENS: readonly CloudToken[];
+export type Role = "reader" | "writer";
+export declare const ROLES: readonly Role[];
+/** One role's user and password. Either left out is read from its default variable. */
+export interface RoleCredentials {
+    user?: EnvRef;
+    password?: EnvRef | TokenSource;
+}
+export type CredentialsDialect = "clickhouse" | "postgres";
+/** Both roles of one environment, as {@link credentials} recorded them. */
+export interface Credentials {
+    env: string;
+    dialect: CredentialsDialect;
+    /** The role this process connects as. */
+    role: Role;
+    reader: {
+        user: EnvRef;
+        password: EnvRef | TokenSource;
+    };
+    writer: {
+        user: EnvRef;
+        password: EnvRef | TokenSource;
+    };
+}
+/** Where a profile made by {@link credentials} keeps both roles. A symbol, so chant's strict profile schema does not see it. */
+export declare const CREDENTIALS: unique symbol;
+/** What {@link credentials} returns: the chosen role's `user` and `password`, to spread into the profile. */
+export interface ProfileCredentials {
+    user: EnvRef;
+    password: EnvRef | TokenSource;
+    [CREDENTIALS]: Credentials;
+}
+/** DEV_POSTGRES for dev on Postgres: what an environment's variables start with. */
+export declare const credentialsPrefix: (env: string, dialect: CredentialsDialect) => string;
+/** The role `YODEL_CREDENTIALS` picks for `env`: the writer under `writer` or `writer:<env>`, else the reader. */
+export declare function roleOf(env: string, value?: string | undefined): Role;
+/**
+ * The profile's `user` and `password` for the role `YODEL_CREDENTIALS`
+ * picks, with both roles recorded for yodel. `roles` replaces a role's
+ * user or password; what it leaves out is read from the default variable.
+ */
+export declare function credentials(env: string, dialect: CredentialsDialect, roles?: {
+    reader?: RoleCredentials;
+    writer?: RoleCredentials;
+}): ProfileCredentials;
+/** The roles a profile made by {@link credentials} carries; undefined for any other profile. */
+export declare function credentialsOf(profile: unknown): Credentials | undefined;
+/** The variables a role reads its user and password from (a token source reads none). */
+export declare function roleVariables(c: Credentials, role: Role): string[];
+/** The cloud token source a role's password is minted by, if it is one. */
+export declare function cloudToken(c: Credentials, role: Role): CloudToken | undefined;
+/** How a role's password is got, for a message: `DEV_POSTGRES_READER_PASSWORD` or `a rds-iam token`. */
+export declare function describePassword(p: EnvRef | TokenSource): string;
+/**
+ * Why environment `c.env`'s reader and writer are not two identities, or
+ * undefined when they are: both name the same user variable, both users
+ * resolve to the same name in `processEnv`, or both read the same password
+ * variable (a job holding the reader's would hold the writer's). The
+ * message names the variables and the user.
+ */
+export declare function sharedCredentials(c: Credentials, processEnv?: NodeJS.ProcessEnv): string | undefined;
+/** The first refusal among a config's profiles, checked in order; see {@link sharedCredentials}. */
+export declare function sharedCredentialsIn(profiles: Record<string, unknown>, processEnv?: NodeJS.ProcessEnv): string | undefined;

package/dist/credentials.js

@@ -0,0 +1,119 @@
+/**
+ * The reader and the writer of an environment (#50), for a project's
+ * `chant.config.ts`:
+ *
+ * ```ts
+ * import { credentials } from "@intentius/sql-yodeler";
+ *
+ * profiles: {
+ *   dev: { url: "postgres://127.0.0.1:5432/app", ...credentials("dev", "postgres"), schemas: ["app"] },
+ *   prod: {
+ *     url: "postgres://db.abc.us-east-1.rds.amazonaws.com:5432/app",
+ *     ...credentials("prod", "postgres", { writer: { password: { token: "rds-iam" } } }),
+ *     schemas: ["app"],
+ *   },
+ * }
+ * ```
+ *
+ * `YODEL_CREDENTIALS` picks the role a process connects as: the reader
+ * unless it is `writer` (every environment) or `writer:<env>` (that one).
+ * Only an environment's apply job sets it. Each role reads its user and its
+ * password from a variable, by default `<ENV>_<DIALECT>_READER_USER`,
+ * `..._READER_PASSWORD`, `..._WRITER_USER` and `..._WRITER_PASSWORD`
+ * (`DEV_POSTGRES_READER_USER`), the names `yodel ci` maps the forge's
+ * secrets to. A role's password can instead be a short-lived token, minted
+ * by chant's sql lexicon when a connection needs it: `{ token: "rds-iam" }`,
+ * `{ token: "cloud-sql-iam" }` or `{ token: "entra" }` (Postgres), or
+ * `{ token: "command", command: ["./mint.sh"] }` (either dialect).
+ *
+ * The profile carries both roles under a symbol chant does not read, so
+ * yodel sees the reader and the writer from one evaluation of the config:
+ * it refuses (exit 4) an environment whose two roles are the same user or
+ * read the same variable, and `yodel ci` gives each job the variables, and
+ * the cloud identity, of the role it runs as.
+ */
+export const CLOUD_TOKENS = ["rds-iam", "cloud-sql-iam", "entra"];
+export const ROLES = ["reader", "writer"];
+/** Where a profile made by {@link credentials} keeps both roles. A symbol, so chant's strict profile schema does not see it. */
+export const CREDENTIALS = Symbol.for("@intentius/sql-yodeler/credentials");
+/** DEV_POSTGRES for dev on Postgres: what an environment's variables start with. */
+export const credentialsPrefix = (env, dialect) => `${env.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_${dialect.toUpperCase()}`;
+/** The role `YODEL_CREDENTIALS` picks for `env`: the writer under `writer` or `writer:<env>`, else the reader. */
+export function roleOf(env, value = process.env.YODEL_CREDENTIALS) {
+    return value === "writer" || value === `writer:${env}` ? "writer" : "reader";
+}
+/**
+ * The profile's `user` and `password` for the role `YODEL_CREDENTIALS`
+ * picks, with both roles recorded for yodel. `roles` replaces a role's
+ * user or password; what it leaves out is read from the default variable.
+ */
+export function credentials(env, dialect, roles = {}) {
+    const prefix = credentialsPrefix(env, dialect);
+    const of = (role) => {
+        const r = roles[role] ?? {};
+        const upper = role.toUpperCase();
+        return { user: r.user ?? { env: `${prefix}_${upper}_USER` }, password: r.password ?? { env: `${prefix}_${upper}_PASSWORD` } };
+    };
+    const role = roleOf(env);
+    const recorded = { env, dialect, role, reader: of("reader"), writer: of("writer") };
+    const chosen = recorded[role];
+    return { user: chosen.user, password: chosen.password, [CREDENTIALS]: recorded };
+}
+/** The roles a profile made by {@link credentials} carries; undefined for any other profile. */
+export function credentialsOf(profile) {
+    if (typeof profile !== "object" || profile === null)
+        return undefined;
+    const c = profile[CREDENTIALS];
+    return typeof c === "object" && c !== null ? c : undefined;
+}
+const isEnvRef = (v) => typeof v === "object" && v !== null && typeof v.env === "string";
+/** The variables a role reads its user and password from (a token source reads none). */
+export function roleVariables(c, role) {
+    const r = c[role];
+    return [r.user, r.password].filter(isEnvRef).map((v) => v.env);
+}
+/** The cloud token source a role's password is minted by, if it is one. */
+export function cloudToken(c, role) {
+    const p = c[role].password;
+    return !isEnvRef(p) && CLOUD_TOKENS.includes(p.token) ? p.token : undefined;
+}
+/** How a role's password is got, for a message: `DEV_POSTGRES_READER_PASSWORD` or `a rds-iam token`. */
+export function describePassword(p) {
+    if (isEnvRef(p))
+        return p.env;
+    return p.token === "command" ? `a command token (${p.command[0] ?? ""})` : `a ${p.token} token`;
+}
+/**
+ * Why environment `c.env`'s reader and writer are not two identities, or
+ * undefined when they are: both name the same user variable, both users
+ * resolve to the same name in `processEnv`, or both read the same password
+ * variable (a job holding the reader's would hold the writer's). The
+ * message names the variables and the user.
+ */
+export function sharedCredentials(c, processEnv = process.env) {
+    const where = `sql.profiles.${c.env}`;
+    const { reader, writer } = c;
+    if (reader.user.env === writer.user.env) {
+        return `${where}: the reader and the writer read their user from the same variable, ${reader.user.env}, so a job that holds the reader holds the writer. Give the writer a user of its own (${credentialsPrefix(c.env, c.dialect)}_WRITER_USER).`;
+    }
+    const r = processEnv[reader.user.env];
+    const w = processEnv[writer.user.env];
+    if (r !== undefined && r !== "" && r === w) {
+        return `${where}: the reader (${reader.user.env}) and the writer (${writer.user.env}) are the same user, ${r}, so a job that holds the reader can write. Give each role its own database user.`;
+    }
+    if (isEnvRef(reader.password) && isEnvRef(writer.password) && reader.password.env === writer.password.env) {
+        return `${where}: the reader and the writer read their password from the same variable, ${reader.password.env}, so a job that holds the reader holds the writer's password. Give the writer a password variable of its own.`;
+    }
+    return undefined;
+}
+/** The first refusal among a config's profiles, checked in order; see {@link sharedCredentials}. */
+export function sharedCredentialsIn(profiles, processEnv = process.env) {
+    for (const profile of Object.values(profiles)) {
+        const c = credentialsOf(profile);
+        const why = c ? sharedCredentials(c, processEnv) : undefined;
+        if (why)
+            return why;
+    }
+    return undefined;
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAiBH,MAAM,CAAC,MAAM,YAAY,GAA0B,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;AAIzF,MAAM,CAAC,MAAM,KAAK,GAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAoB3D,gIAAgI;AAChI,MAAM,CAAC,MAAM,WAAW,GAAkB,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAU,CAAC;AASpG,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,OAA2B,EAAU,EAAE,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;AAElK,kHAAkH;AAClH,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,QAA4B,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAC3F,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,OAA2B,EAAE,QAAgE,EAAE;IACtI,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,CAAC,IAAU,EAAE,EAAE;QACxB,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,WAAW,EAAE,EAAE,CAAC;IAChI,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAgB,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjG,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC;AACnF,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,CAAC,GAAI,OAAmC,CAAC,WAAW,CAAC,CAAC;IAC5D,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAE,CAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAQ,CAAuB,CAAC,GAAG,KAAK,QAAQ,CAAC;AAEtI,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,CAAc,EAAE,IAAU;IACtD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,CAAc,EAAE,IAAU;IACnD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAK,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,KAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;AACrH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,gBAAgB,CAAC,CAAuB;IACtD,IAAI,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC;IAC9B,OAAO,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,QAAQ,CAAC;AAClG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAc,EAAE,aAAgC,OAAO,CAAC,GAAG;IAC3F,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,OAAO,GAAG,KAAK,uEAAuE,MAAM,CAAC,IAAI,CAAC,GAAG,yFAAyF,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACpP,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,GAAG,KAAK,iBAAiB,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,mFAAmF,CAAC;IAClM,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC1G,OAAO,GAAG,KAAK,2EAA2E,MAAM,CAAC,QAAQ,CAAC,GAAG,+GAA+G,CAAC;IAC/N,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,mBAAmB,CAAC,QAAiC,EAAE,aAAgC,OAAO,CAAC,GAAG;IAChH,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/exit.js

@@ -20,7 +20,7 @@ export const EXIT_CODES = [
     [EXIT_ERROR, "an error"],
     [EXIT_NEEDS_OP, "something yodel will not do itself (a change that needs an Op it does not run, a manual step); for yodel drift, drift found"],
     [EXIT_OUTSTANDING, "something outstanding: apply stopped at its approval gate, status found pending migrations, lint found errors"],
-    [EXIT_REFUSED, "refused, nothing done: a checksum mismatch, an applied migration gone from the directory, an out-of-order migration, a fork or another problem in the migrations directory, a migration the environment it must run on first has not applied"],
+    [EXIT_REFUSED, "refused, nothing done: a checksum mismatch, an applied migration gone from the directory, an out-of-order migration, a fork or another problem in the migrations directory, a migration the environment it must run on first has not applied, an environment whose reader and writer are one identity"],
     [EXIT_LOCKED, "another apply holds the lock"],
 ];
 /** Why `yodel plan` exits 0 with pending migrations, where `yodel status` exits 3. */

package/dist/exit.js.map

@@ -1 +1 @@
-{"version":3,"file":"exit.js","sourceRoot":"","sources":["../src/exit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AACzB,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAC5B,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,6BAA6B;AAC7B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,oCAAoC;AACpC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAE7B,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAA6C;IAClE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IACnC,CAAC,UAAU,EAAE,UAAU,CAAC;IACxB,CAAC,aAAa,EAAE,6HAA6H,CAAC;IAC9I,CAAC,gBAAgB,EAAE,+GAA+G,CAAC;IACnI,CAAC,YAAY,EAAE,8OAA8O,CAAC;IAC9P,CAAC,WAAW,EAAE,8BAA8B,CAAC;CAC9C,CAAC;AAEF,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAC5B,4NAA4N,CAAC"}
+{"version":3,"file":"exit.js","sourceRoot":"","sources":["../src/exit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AACzB,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAC5B,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,6BAA6B;AAC7B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,oCAAoC;AACpC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAE7B,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAA6C;IAClE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IACnC,CAAC,UAAU,EAAE,UAAU,CAAC;IACxB,CAAC,aAAa,EAAE,6HAA6H,CAAC;IAC9I,CAAC,gBAAgB,EAAE,+GAA+G,CAAC;IACnI,CAAC,YAAY,EAAE,uSAAuS,CAAC;IACvT,CAAC,WAAW,EAAE,8BAA8B,CAAC;CAC9C,CAAC;AAEF,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAC5B,4NAA4N,CAAC"}

package/dist/index.d.ts

@@ -7,7 +7,11 @@
  * ```
  */
 export { defineConfig } from "./config/define.js";
-export type { EnvironmentConfig, PolicyConfig, PolicyMigration, PolicyPlan, PolicyRule, PolicyStep, NotifyConfig, Topology, TopologySetting, YodelConfig } from "./config/define.js";
+export { credentials, roleOf } from "./credentials.js";
+export type { CloudToken, Credentials, EnvRef, ProfileCredentials, Role, RoleCredentials, TokenSource } from "./credentials.js";
+export type { ApprovalMode, EnvironmentApprovalMode, EnvironmentConfig, PolicyConfig, PolicyMigration, PolicyPlan, PolicyRule, PolicyStep, NotifyConfig, Topology, TopologySetting, YodelConfig } from "./config/define.js";
 export { verifyWebhook, signWebhook } from "./notify/verify.js";
 export type { NotifyEvent, NotifyEventKind } from "./notify/index.js";
 export type { DdlSource } from "./sources/index.js";
+export { defineTests, expectError, expectRows, expectValue } from "./testing/define.js";
+export type { ErrorExpectation, Expectation, RowsExpectation, TestCase, ValueExpectation } from "./testing/define.js";

package/dist/index.js

@@ -7,5 +7,7 @@
  * ```
  */
 export { defineConfig } from "./config/define.js";
+export { credentials, roleOf } from "./credentials.js";
 export { verifyWebhook, signWebhook } from "./notify/verify.js";
+export { defineTests, expectError, expectRows, expectValue } from "./testing/define.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGhE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/init/adopt.js

@@ -82,7 +82,7 @@ async function adoptWith(project, env, venv, options, processEnv, log) {
     if (live.ir.resources.length === 0) {
         throw new YodelError(`refused: ${env.name} holds no objects in its scope (sql.profiles.${env.name}); there is nothing to adopt. Declare a schema and run yodel new instead. Nothing was written.`, REFUSED);
     }
-    const objects = describeImported(live.ir);
+    const objects = [...describeImported(live.ir), ...(live.access ?? [])];
     log(`read ${String(objects.length)} object(s) from ${env.name}`);
     const journal = new Journal();
     try {

package/dist/init/adopt.js.map

@@ -1 +1 @@
-{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../../src/init/adopt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAkC,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAa,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAkB,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAqB,MAAM,uBAAuB,CAAC;AAEjH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AA2BzD,oFAAoF;AACpF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;AAE5G,gJAAgJ;AAChJ,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,GAAgB,EAAE,UAA+D,EAAE;IAC7H,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAClB,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,gJAAgJ,EAC7L,OAAO,CACR,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1C,MAAM,IAAI,UAAU,CAClB,YAAY,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,GAAG,+BAA+B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK;YACnJ,8KAA8K,EAChL,OAAO,CACR,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,eAAe,EAAE,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACvF,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAE,CAAC,SAAS,EAAE,QAAQ,CAAW,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,UAAU,CAAW,CAAC;IAC7H,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3F,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,UAAU,CAClB,yBAAyB,GAAG,CAAC,IAAI,aAAa,GAAG,oCAAoC,IAAI,kCAAkC,eAAe,cAAc;YACtJ,YAAY,GAAG,sCAAsC,GAAG,CAAC,IAAI,IAAI,GAAG,wBAAwB,EAC9F,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,UAAU,CAClB,yBAAyB,GAAG,CAAC,IAAI,IAAI,GAAG,aAAa,eAAe,mBAAmB,IAAI,kCAAkC,GAAG,CAAC,IAAI,kIAAkI,EACvQ,OAAO,CACR,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG,CAAC,IAAU,EAAE,UAA6B,EAAE,EAAW,EAAE,CAC3E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;AAE1F,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAgB,EAAE,GAAgB,EAAE,UAAwB,EAAE;IACxF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7C,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAE1G,MAAM,IAAI,GAAiB,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAgB,EAAE,GAAgB,EAAE,IAAkB,EAAE,OAAqB,EAAE,UAA6B,EAAE,GAA2B;IAChK,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,UAAU,CAAC,YAAY,GAAG,CAAC,IAAI,gDAAgD,GAAG,CAAC,IAAI,gGAAgG,EAAE,OAAO,CAAC,CAAC;IAC9M,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,QAAQ,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/B,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,GAAG,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEvC,sGAAsG;QACtG,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7E,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,UAAU,CAClB,mEAAmE,GAAG,CAAC,IAAI,wDAAwD;oBACjI,+EAA+E,MAAM,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,IAAI,eAAe,CAAC,EAAE,CAC/I,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,mBAAmB,GAAG,CAAC,IAAI,aAAa,CAAC,CAAC;YAC9C,IAAI,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACrI,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,8DAA8D,CAAC,CAAC;QAEhH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,SAAS,GAAc,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACpJ,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;QAChD,GAAG,CAAC,SAAS,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,aAAa,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAE5G,MAAM,IAAI,GAAG;YACX,WAAW,EAAE,GAAG,CAAC,IAAI;YACrB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO;YACP,WAAW;YACX,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC;YAC1C,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE;YACvE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QACF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,MAAM;YAAE,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7C,GAAG,CAAC,YAAY,IAAI,CAAC,EAAE,eAAe,IAAI,CAAC,QAAQ,CAAC,QAAQ,wDAAwD,CAAC,CAAC;QACtH,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;IAChF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC"}
+{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../../src/init/adopt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAkC,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAa,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAkB,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAqB,MAAM,uBAAuB,CAAC;AAEjH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AA2BzD,oFAAoF;AACpF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;AAE5G,gJAAgJ;AAChJ,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,GAAgB,EAAE,UAA+D,EAAE;IAC7H,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAClB,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,gJAAgJ,EAC7L,OAAO,CACR,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1C,MAAM,IAAI,UAAU,CAClB,YAAY,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,GAAG,+BAA+B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK;YACnJ,8KAA8K,EAChL,OAAO,CACR,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,eAAe,EAAE,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACvF,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAE,CAAC,SAAS,EAAE,QAAQ,CAAW,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,UAAU,CAAW,CAAC;IAC7H,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3F,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,UAAU,CAClB,yBAAyB,GAAG,CAAC,IAAI,aAAa,GAAG,oCAAoC,IAAI,kCAAkC,eAAe,cAAc;YACtJ,YAAY,GAAG,sCAAsC,GAAG,CAAC,IAAI,IAAI,GAAG,wBAAwB,EAC9F,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,UAAU,CAClB,yBAAyB,GAAG,CAAC,IAAI,IAAI,GAAG,aAAa,eAAe,mBAAmB,IAAI,kCAAkC,GAAG,CAAC,IAAI,kIAAkI,EACvQ,OAAO,CACR,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG,CAAC,IAAU,EAAE,UAA6B,EAAE,EAAW,EAAE,CAC3E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;AAE1F,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAgB,EAAE,GAAgB,EAAE,UAAwB,EAAE;IACxF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7C,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAE1G,MAAM,IAAI,GAAiB,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAgB,EAAE,GAAgB,EAAE,IAAkB,EAAE,OAAqB,EAAE,UAA6B,EAAE,GAA2B;IAChK,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,UAAU,CAAC,YAAY,GAAG,CAAC,IAAI,gDAAgD,GAAG,CAAC,IAAI,gGAAgG,EAAE,OAAO,CAAC,CAAC;IAC9M,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,QAAQ,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/B,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,GAAG,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEvC,sGAAsG;QACtG,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7E,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,UAAU,CAClB,mEAAmE,GAAG,CAAC,IAAI,wDAAwD;oBACjI,+EAA+E,MAAM,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,IAAI,eAAe,CAAC,EAAE,CAC/I,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,mBAAmB,GAAG,CAAC,IAAI,aAAa,CAAC,CAAC;YAC9C,IAAI,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACrI,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,8DAA8D,CAAC,CAAC;QAEhH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,SAAS,GAAc,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACpJ,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;QAChD,GAAG,CAAC,SAAS,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,aAAa,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAE5G,MAAM,IAAI,GAAG;YACX,WAAW,EAAE,GAAG,CAAC,IAAI;YACrB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO;YACP,WAAW;YACX,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC;YAC1C,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE;YACvE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QACF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,MAAM;YAAE,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7C,GAAG,CAAC,YAAY,IAAI,CAAC,EAAE,eAAe,IAAI,CAAC,QAAQ,CAAC,QAAQ,wDAAwD,CAAC,CAAC;QACtH,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;IAChF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC"}

package/dist/init/clickhouse-access.d.ts

@@ -0,0 +1,64 @@
+/**
+ * ClickHouse access control adopted by `yodel init --from` (#46), where the
+ * environment manages access: chant's ClickHouse import writes databases,
+ * tables, views, dictionaries and functions, and no user, role, row policy
+ * or grant, so yodel reads those itself and writes them as `user`, `role`,
+ * `policy` and `grant` declarations in `access.ts`, beside the import's
+ * `schema.ts`.
+ *
+ * What is adopted, read from the server's catalog:
+ *
+ * - every row policy on a table in the profile's databases;
+ * - the grantees: each user or role holding a privilege in those databases,
+ *   each role a policy applies to, and each user or role those roles are
+ *   granted to. The `default` user is the server's own and is left out;
+ * - for each grantee, its `CREATE USER` or `CREATE ROLE` and all of its
+ *   grants (`SHOW GRANTS FOR`), not only those in the databases: chant
+ *   compares a grantee's grants as a whole and revokes what is not
+ *   declared, so a partial list would plan revokes.
+ *
+ * A user's authentication is the environment's: its `IDENTIFIED` clause is
+ * left out, and chant then compares the user without it and never creates
+ * or changes its password. A grantee with a partial revoke (`REVOKE` in
+ * `SHOW GRANTS`) cannot be declared, since a declaration holds no `REVOKE`:
+ * it is left out with a warning, and its grants with it.
+ *
+ * A table the import declared, or a user or role adopted here, is
+ * interpolated where a statement names it (`ON ${events}`, `TO ${reader}`),
+ * so the declarations carry their dependencies and a baseline creates them
+ * in order.
+ */
+import type { GeneratedFile } from "@intentius/chant/import/generator";
+import type { TemplateIR } from "@intentius/chant/import/parser";
+import type { Environment, Project } from "../project.js";
+/** What {@link clickhouseAccessDeclarations} adopts. */
+export interface AdoptedAccess {
+    /** `access.ts`, or none when there is nothing to adopt. */
+    file?: GeneratedFile;
+    /** The objects adopted, as `<kind> <name>` lines for people. */
+    objects: string[];
+    warnings: string[];
+}
+interface Statement {
+    kind: "user" | "role" | "policy" | "grant";
+    exportName: string;
+    /** The object's own name, never interpolated in its own statement. */
+    own?: string;
+    sql: string;
+}
+/** `CREATE USER u IDENTIFIED WITH sha256_password HOST ...` without its authentication, which is the environment's. */
+export declare function withoutAuthentication(sql: string): string;
+/**
+ * The statement as a template body: `db.table` of a declared table as its
+ * export, and a principal as its export where the statement names it as a
+ * grantee, a granted role or a default role (anywhere in a `GRANT`, after
+ * `TO` in a row policy, after `DEFAULT ROLE` in a user). Strings and the
+ * object's own name stay as they are.
+ */
+export declare function templateOf(s: Pick<Statement, "kind" | "own" | "sql">, tables: ReadonlyMap<string, string>, principals: ReadonlyMap<string, string>): {
+    body: string;
+    refs: Set<string>;
+};
+/** The users, roles, row policies and grants to adopt from `env`, as `access.ts`; see the module comment. */
+export declare function clickhouseAccessDeclarations(project: Project, env: Environment, ir: TemplateIR, processEnv: NodeJS.ProcessEnv): Promise<AdoptedAccess>;
+export {};

package/dist/init/clickhouse-access.js

@@ -0,0 +1,211 @@
+/**
+ * ClickHouse access control adopted by `yodel init --from` (#46), where the
+ * environment manages access: chant's ClickHouse import writes databases,
+ * tables, views, dictionaries and functions, and no user, role, row policy
+ * or grant, so yodel reads those itself and writes them as `user`, `role`,
+ * `policy` and `grant` declarations in `access.ts`, beside the import's
+ * `schema.ts`.
+ *
+ * What is adopted, read from the server's catalog:
+ *
+ * - every row policy on a table in the profile's databases;
+ * - the grantees: each user or role holding a privilege in those databases,
+ *   each role a policy applies to, and each user or role those roles are
+ *   granted to. The `default` user is the server's own and is left out;
+ * - for each grantee, its `CREATE USER` or `CREATE ROLE` and all of its
+ *   grants (`SHOW GRANTS FOR`), not only those in the databases: chant
+ *   compares a grantee's grants as a whole and revokes what is not
+ *   declared, so a partial list would plan revokes.
+ *
+ * A user's authentication is the environment's: its `IDENTIFIED` clause is
+ * left out, and chant then compares the user without it and never creates
+ * or changes its password. A grantee with a partial revoke (`REVOKE` in
+ * `SHOW GRANTS`) cannot be declared, since a declaration holds no `REVOKE`:
+ * it is left out with a warning, and its grants with it.
+ *
+ * A table the import declared, or a user or role adopted here, is
+ * interpolated where a statement names it (`ON ${events}`, `TO ${reader}`),
+ * so the declarations carry their dependencies and a baseline creates them
+ * in order.
+ */
+const quote = (s) => `'${s.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+const ident = (s) => `\`${s.replace(/`/g, "``")}\``;
+const list = (xs) => xs.map(quote).join(", ");
+const JS_RESERVED = new Set("break case catch class const continue debugger default delete do else enum export extends false finally for function if import in instanceof new null return super switch this throw true try typeof var void while with yield let static implements interface package private protected public await".split(" "));
+function camel(name) {
+    const words = name.split(/[^A-Za-z0-9]+/).filter(Boolean);
+    const s = words.map((w, i) => (i === 0 ? w.charAt(0).toLowerCase() : w.charAt(0).toUpperCase()) + w.slice(1)).join("") || "object";
+    return /^[0-9]/.test(s) ? `a${s}` : s;
+}
+/** `CREATE USER u IDENTIFIED WITH sha256_password HOST ...` without its authentication, which is the environment's. */
+export function withoutAuthentication(sql) {
+    return sql
+        .replace(/\s+NOT\s+IDENTIFIED\b/i, "")
+        .replace(/\s+IDENTIFIED\s+(?:WITH\s+\w+)?(?:\s+BY\s+'(?:[^'\\]|\\.)*')?(?:\s+SALT\s+'(?:[^'\\]|\\.)*')?/i, "");
+}
+/** The statement's tokens: quoted strings, identifiers (bare or backquoted, with `name` unquoted), and the rest. */
+function tokens(sql) {
+    const out = [];
+    const re = /('(?:[^'\\]|\\.)*')|(`(?:[^`]|``)*`)|([A-Za-z_][A-Za-z0-9_]*)|(\s+|.)/gs;
+    for (let m = re.exec(sql); m; m = re.exec(sql)) {
+        if (m[1] !== undefined)
+            out.push({ kind: "string", text: m[1] });
+        else if (m[2] !== undefined)
+            out.push({ kind: "ident", text: m[2], name: m[2].slice(1, -1).replace(/``/g, "`") });
+        else if (m[3] !== undefined)
+            out.push({ kind: "ident", text: m[3], name: m[3] });
+        else
+            out.push({ kind: "other", text: m[4] ?? "" });
+    }
+    return out;
+}
+/** `text` escaped for a template literal. */
+const literal = (text) => text.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${");
+/**
+ * The statement as a template body: `db.table` of a declared table as its
+ * export, and a principal as its export where the statement names it as a
+ * grantee, a granted role or a default role (anywhere in a `GRANT`, after
+ * `TO` in a row policy, after `DEFAULT ROLE` in a user). Strings and the
+ * object's own name stay as they are.
+ */
+export function templateOf(s, tables, principals) {
+    const t = tokens(s.sql);
+    const refs = new Set();
+    let body = "";
+    let ownSeen = false;
+    let zone = s.kind === "grant";
+    for (let i = 0; i < t.length; i++) {
+        const tok = t[i];
+        if (tok === undefined)
+            break;
+        if (tok.kind === "ident") {
+            const word = tok.text.toUpperCase();
+            if (s.kind === "policy" && word === "TO")
+                zone = true;
+            if (s.kind === "user" && word === "DEFAULT" && t[i + 2]?.text.toUpperCase() === "ROLE")
+                zone = true;
+            if (s.kind === "user" && zone && ["SETTINGS", "GRANTEES", "HOST", "VALID", "IN"].includes(word))
+                zone = false;
+            // db.table
+            const next = t[i + 2];
+            if (t[i + 1]?.text === "." && next?.kind === "ident") {
+                const exp = tables.get(`${tok.name ?? ""}.${next.name ?? ""}`);
+                if (exp) {
+                    body += `\${${exp}}`;
+                    refs.add(exp);
+                    i += 2;
+                    continue;
+                }
+            }
+            if (!ownSeen && s.own !== undefined && tok.name === s.own) {
+                ownSeen = true;
+                body += literal(tok.text);
+                continue;
+            }
+            const exp = zone && tok.name !== undefined ? principals.get(tok.name) : undefined;
+            if (exp && t[i - 1]?.text !== ".") {
+                body += `\${${exp}}`;
+                refs.add(exp);
+                continue;
+            }
+        }
+        body += literal(tok.text);
+    }
+    return { body, refs };
+}
+/** The users, roles, row policies and grants to adopt from `env`, as `access.ts`; see the module comment. */
+export async function clickhouseAccessDeclarations(project, env, ir, processEnv) {
+    const { bindClickHouse } = await import("@intentius/chant-lexicon-sql/clickhouse/live/bind");
+    const { clickhouseQuery } = await import("@intentius/chant-lexicon-sql/clickhouse/http");
+    const target = await bindClickHouse({ environment: env.name, config: project.config, cwd: project.dir, env: processEnv });
+    const q = (sql) => clickhouseQuery(target.endpoint, sql);
+    const first = async (sql) => Object.values((await q(sql))[0] ?? {})[0] ?? "";
+    const databases = target.databases ?? [];
+    const warnings = [];
+    if (databases.length === 0)
+        return { objects: [], warnings };
+    const policies = await q(`SELECT short_name AS name, database, table, apply_to_list FROM system.row_policies WHERE database IN (${list(databases)}) ORDER BY database, table, name`);
+    const holders = await q(`SELECT DISTINCT user_name, role_name FROM system.grants WHERE database IN (${list(databases)})`);
+    const named = new Set([...holders.flatMap((h) => [h.user_name, h.role_name]).filter((n) => !!n), ...policies.flatMap((p) => p.apply_to_list)]);
+    const allRoles = new Set((await q("SELECT name FROM system.roles")).map((r) => r.name));
+    const allUsers = new Set((await q("SELECT name FROM system.users")).map((r) => r.name));
+    const roles = new Set([...named].filter((n) => allRoles.has(n)));
+    const users = new Set([...named].filter((n) => allUsers.has(n) && n !== "default"));
+    if (roles.size > 0) {
+        for (const g of await q(`SELECT user_name, role_name FROM system.role_grants WHERE granted_role_name IN (${list([...roles])})`)) {
+            if (g.user_name && g.user_name !== "default")
+                users.add(g.user_name);
+            if (g.role_name)
+                roles.add(g.role_name);
+        }
+    }
+    // Each grantee's grants whole; one with a partial revoke cannot be declared.
+    const grants = new Map();
+    for (const name of [...[...roles].sort(), ...[...users].sort()]) {
+        const lines = (await q(`SHOW GRANTS FOR ${ident(name)}`)).map((r) => Object.values(r)[0] ?? "");
+        if (lines.some((l) => /^\s*REVOKE\b/i.test(l))) {
+            warnings.push(`${roles.has(name) ? "role" : "user"} ${name} has a partial revoke (${lines.find((l) => /^\s*REVOKE\b/i.test(l)) ?? ""}), which a grant declaration cannot hold; left out, with its grants`);
+            roles.delete(name);
+            users.delete(name);
+            continue;
+        }
+        grants.set(name, lines.filter((l) => /^\s*GRANT\b/i.test(l)));
+    }
+    const used = new Set(ir.resources.map((r) => r.logicalId));
+    const exportFor = (base) => {
+        let b = camel(base);
+        if (JS_RESERVED.has(b))
+            b = `${b}Access`;
+        let name = b;
+        for (let i = 2; used.has(name); i++)
+            name = `${b}${String(i)}`;
+        used.add(name);
+        return name;
+    };
+    const tables = new Map();
+    for (const r of ir.resources) {
+        const p = r.properties;
+        if (p.database !== undefined && p.name !== undefined && r.type !== "ClickHouse::Function")
+            tables.set(`${p.database}.${p.name}`, r.logicalId);
+    }
+    const statements = [];
+    const principals = new Map();
+    for (const name of [...roles].sort()) {
+        const exportName = exportFor(name);
+        principals.set(name, exportName);
+        statements.push({ kind: "role", exportName, own: name, sql: await first(`SHOW CREATE ROLE ${ident(name)}`) });
+    }
+    for (const name of [...users].sort()) {
+        const exportName = exportFor(name);
+        principals.set(name, exportName);
+        statements.push({ kind: "user", exportName, own: name, sql: withoutAuthentication(await first(`SHOW CREATE USER ${ident(name)}`)) });
+    }
+    for (const p of policies) {
+        const sql = await first(`SHOW CREATE ROW POLICY ${ident(p.name)} ON ${ident(p.database)}.${ident(p.table)}`);
+        statements.push({ kind: "policy", exportName: exportFor(`${p.table}_${p.name}`), own: p.name, sql });
+    }
+    for (const [grantee, lines] of grants) {
+        lines.forEach((sql, i) => {
+            statements.push({ kind: "grant", exportName: exportFor(`${grantee}_grant${lines.length > 1 ? `_${String(i + 1)}` : ""}`), sql });
+        });
+    }
+    if (statements.length === 0)
+        return { objects: [], warnings };
+    const bodies = statements.map((s) => ({ s, ...templateOf(s, tables, principals) }));
+    const declared = new Set(statements.map((s) => s.exportName));
+    const fromSchema = [...new Set(bodies.flatMap((b) => [...b.refs].filter((r) => !declared.has(r))))].sort();
+    const tags = [...new Set(statements.map((s) => s.kind))].sort();
+    const lines = [`import { ${tags.join(", ")} } from "@intentius/chant-lexicon-sql/clickhouse";`];
+    if (fromSchema.length > 0)
+        lines.push(`import { ${fromSchema.join(", ")} } from "./schema.js";`);
+    lines.push("");
+    // Roles, then users (whose default role names a role), then policies and grants, so each comes after what it interpolates.
+    for (const b of bodies)
+        lines.push(`export const ${b.s.exportName} = ${b.s.kind}\`${b.body}\`;`, "");
+    return {
+        file: { path: "access.ts", content: `${lines.join("\n").trimEnd()}\n` },
+        objects: statements.map((s) => (s.kind === "grant" ? `Grant ${s.sql}` : `${s.kind === "policy" ? "RowPolicy" : s.kind === "user" ? "User" : "Role"} ${s.own ?? ""}`)),
+        warnings,
+    };
+}
+//# sourceMappingURL=clickhouse-access.js.map