@memberjunction/codegen-lib 6.1.0-edge.5 → 6.1.0-edge.7

package/dist/Database/providers/postgresql/PostgreSQLCodeGenProvider.d.ts

@@ -400,7 +400,7 @@ export declare class PostgreSQLCodeGenProvider extends CodeGenDatabaseProvider {
         routineParams: string;
     };
     /** @inheritdoc */
-    callRoutineSQL(schema: string, routineName: string, params: string[], _paramNames?: string[], discardResult?: boolean): string;
+    callRoutineSQL(schema: string, routineName: string, params: string[], paramNames?: string[], discardResult?: boolean): string;
     /** @inheritdoc */
     conditionalInsertSQL(checkQuery: string, insertSQL: string): string;
     /** @inheritdoc */
@@ -487,7 +487,7 @@ export declare class PostgreSQLCodeGenProvider extends CodeGenDatabaseProvider {
      */
     parseColumnDefaultValue(sqlDefaultValue: string): string | null;
     /** @inheritdoc */
-    getPendingEntityFieldsSQL(mjCoreSchema: string, entityIDs?: string[]): string;
+    getPendingEntityFieldsSQL(mjCoreSchema: string, entityIDs?: string[], excludeSchemas?: string[]): string;
     /** @inheritdoc */
     getCheckConstraintsSchemaFilter(_excludeSchemas: string[]): string;
     /** @inheritdoc */
@@ -602,6 +602,14 @@ export declare class PostgreSQLCodeGenProvider extends CodeGenDatabaseProvider {
     private generateCascadeCursorDelete;
     /** Collects unique role SQL names from permissions that have a role name */
     private collectPermissionRoles;
+    /**
+     * B3: roles with a blank `SQLName` are app-tier-only BY DESIGN (decision D3a) — the grant
+     * emitters skip them, and this makes the skip visible: one INFO line per role per run.
+     * (PostgreSQL additionally emits NO field-security DENYs at all, per decision D2 — PG has
+     * no DENY primitive, so MJ's Deny-wins semantics cannot be expressed in its DB tier.)
+     */
+    private _appTierOnlyRolesLogged;
+    private logAppTierOnlyRoleSkip;
     /** @inheritdoc */
     getViewDefinitionSQL(schema: string, viewName: string): string;
     /**

package/dist/Database/providers/postgresql/PostgreSQLCodeGenProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostgreSQLCodeGenProvider.d.ts","sourceRoot":"","sources":["../../../../src/Database/providers/postgresql/PostgreSQLCodeGenProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAyE,MAAM,sBAAsB,CAAC;AAE1I,OAAO,EACH,uBAAuB,EACvB,QAAQ,EACR,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EACnB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAAqB,gBAAgB,EAAE,UAAU,EAA4H,MAAM,6BAA6B,CAAC;AAoBxN;;;;;;;;GAQG;AACH,qBACa,yBAA0B,SAAQ,uBAAuB;IAClE,kBAAkB;IAClB,IAAI,OAAO,IAAI,UAAU,CAExB;IAED,kBAAkB;IAClB,IAAI,WAAW,IAAI,gBAAgB,CAElC;IAED;;;;;;;;;;;;OAYG;IACG,eAAe,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA0ClD;;;;;;;;;;;;;;;;;OAiBG;IACM,kCAAkC,IAAI,OAAO;IAMtD;;;;OAIG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAoBlH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,gBAAgB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM;IAyN5D;;;;;;;;;OASG;IACM,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,MAAM;IAoBnH;;;;;;OAMG;IACM,kCAAkC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAMxG;;;;OAIG;IACM,kCAAkC,IAAI,MAAM;IAIrD;;;;;OAKG;IACM,sCAAsC,IAAI,MAAM;IAMzD;;;;;;;OAOG;IACH,OAAO,CAAC,6BAA6B;IAkBrC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;;;;;;OAOG;IACH,OAAO,CAAC,wBAAwB;IAqBhC;;;;OAIG;IACH,OAAO,CAAC,4BAA4B;IAapC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IA4DjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,yBAAyB;IA+GjC;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IA+D9C;;;;;;;OAOG;IACH,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAmE9C;;;;;;;OAOG;IACH,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAkClE;;;;;;OAMG;IACH,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAgCpD;;;;;OAKG;IACH,SAAS,CAAC,WAAW,IAAI,MAAM;IAI/B,8CAA8C;IAC9C,SAAS,CAAC,mBAAmB,IAAI,MAAM;IAIvC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAIhD,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM;IAIjD,SAAS,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAOjG,SAAS,CAAC,yBAAyB,IAAI,MAAM;IAI7C;;;;;OAKG;IACH,SAAS,CAAC,oBAAoB,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO;IAI3D,SAAS,CAAC,6BAA6B,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAajH;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,oBAAoB,EAAE,MAAM,GAAG,oBAAoB;IAuE/H;;;;;;OAMG;IAGH;;;OAGG;IACH,6BAA6B,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAiEjF;;OAEG;IACH,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IA6D/E;;OAEG;IACH,yBAAyB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAuDtE,4BAA4B,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAIhF,0BAA0B,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAI9E,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAInF,kBAAkB;IAClB,4BAA4B,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAahG;;;OAGG;IACH,0BAA0B,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAM7F;;;OAGG;IACH,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAqD1E;;;;;;;;;;;;OAYG;IACI,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAIhF,kBAAkB;IAClB,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAK3F;;;;OAIG;IACH,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAUxF,kBAAkB;IAClB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IASnD;;;;OAIG;IACH,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM;IAkBxF,kBAAkB;IAClB,iCAAiC,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAUnF,kBAAkB;IAClB,8BAA8B,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM;IAYrE;;;;OAIG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAmBnE;;;;;;OAMG;IACH;;;;;;OAMG;IACH,SAAS,CAAC,mBAAmB,CAAC,EAAE,EAAE,eAAe,GAAG,MAAM;IAI1D;;;;;;;;;;;OAWG;IACH,uBAAuB,CAAC,YAAY,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM;IAiCnF;;;;;;;;OAQG;IACH,SAAS,CAAC,wBAAwB,CAAC,EAAE,EAAE,eAAe,GAAG,MAAM;IAM/D,kBAAkB;IAClB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM;IAkB9D,kBAAkB;IAClB,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IASnE,kBAAkB;IAClB,gCAAgC,IAAI,MAAM;IAU1C;;;;;OAKG;IACH,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM;IA6DtE;;;;;OAKG;IACH,yBAAyB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG;QAC5D,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;KACzB;IA+BD,kBAAkB;IAClB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM;IAoB9H,kBAAkB;IAClB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAInE,kBAAkB;IAClB,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAM1F,kBAAkB;IAClB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM;IAQ5I,kBAAkB;IAClB,gCAAgC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM;IAOpI,kBAAkB;IAClB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM;IAcjH;;;;;OAKG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAgCvF,kBAAkB;IAClB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAUlG,kBAAkB;IAClB,gBAAgB,IAAI,MAAM;IAI1B,kBAAkB;IAClB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAgB3D,kBAAkB;IAClB,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;OAIG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAW7D,kBAAkB;IAClB,yBAAyB,IAAI,MAAM,EAAE;IAIrC;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,OAAO,CAE9B;IAED,kBAAkB;IAClB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAIlE;;;;OAIG;IACM,6BAA6B,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAgBlE;;;;OAIG;YACW,2BAA2B;IAqDzC,kBAAkB;IAClB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAcnF,kBAAkB;IAClB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAIlE;;;;OAIG;IACH,IAAI,+BAA+B,IAAI,OAAO,CAE7C;IAID;;;;;;;;;OASG;IACH,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAMzC;;;;;OAKG;IACH,uBAAuB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAuB/D,kBAAkB;IAClB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM;IAK7E,kBAAkB;IAClB,+BAA+B,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,MAAM;IAKlE,kBAAkB;IAClB,sCAAsC,IAAI,MAAM;IAKhD,kBAAkB;IAClB,gCAAgC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAK9D,kBAAkB;IAClB,4BAA4B,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAMjE;;;;;;OAMG;IACG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuChE,kBAAkB;IAClB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM;IAcrD;;;;;;;;;;;;OAYG;IACY,kBAAkB,CAC7B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC;IAqEhB;;;;;;;;;;;;OAYG;IACY,mBAAmB,CAAC,IAAI,EAAE;QACrC,MAAM,EAAE,UAAU,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAChC,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAkFlC;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,oBAAoB;IAKlC;;;OAGG;IACH,OAAO,CAAC,WAAW;IAUnB;;OAEG;IACH,OAAO,CAAC,UAAU;IAgBlB,4CAA4C;IAC5C,OAAO,CAAC,eAAe;IAIvB,wDAAwD;IACxD,OAAO,CAAC,0BAA0B;IAOlC,iDAAiD;IACjD,OAAO,CAAC,wBAAwB;IAUhC,oDAAoD;IACpD,OAAO,CAAC,sBAAsB;IAQ9B;;;;;OAKG;IACH,OAAO,CAAC,8BAA8B;IAWtC,6EAA6E;IAC7E,OAAO,CAAC,0BAA0B;IAUlC,sEAAsE;IACtE,OAAO,CAAC,yBAAyB;IAkEjC,yEAAyE;IACzE,OAAO,CAAC,mBAAmB;IAkD3B,2DAA2D;IAC3D,OAAO,CAAC,2BAA2B;IAsBnC,oEAAoE;IACpE,OAAO,CAAC,2BAA2B;IAmBnC,4EAA4E;IAC5E,OAAO,CAAC,sBAAsB;IAY9B,kBAAkB;IAClB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI9D;;;;OAIG;IACH,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAiBpE;;;;;OAKG;IACH,oCAAoC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAoBnG,kBAAkB;IAClB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAUzF;;;;OAIG;IACH,OAAO,CAAC,6BAA6B;IAyFrC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;;OAGG;IACH,OAAO,CAAC,wCAAwC;CA2BnD"}
+{"version":3,"file":"PostgreSQLCodeGenProvider.d.ts","sourceRoot":"","sources":["../../../../src/Database/providers/postgresql/PostgreSQLCodeGenProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAyE,MAAM,sBAAsB,CAAC;AAE1I,OAAO,EACH,uBAAuB,EACvB,QAAQ,EACR,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EACnB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAAqB,gBAAgB,EAAE,UAAU,EAA4H,MAAM,6BAA6B,CAAC;AAoBxN;;;;;;;;GAQG;AACH,qBACa,yBAA0B,SAAQ,uBAAuB;IAClE,kBAAkB;IAClB,IAAI,OAAO,IAAI,UAAU,CAExB;IAED,kBAAkB;IAClB,IAAI,WAAW,IAAI,gBAAgB,CAElC;IAED;;;;;;;;;;;;OAYG;IACG,eAAe,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA0ClD;;;;;;;;;;;;;;;;;OAiBG;IACM,kCAAkC,IAAI,OAAO;IAMtD;;;;OAIG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAoBlH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,gBAAgB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM;IAyN5D;;;;;;;;;OASG;IACM,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,MAAM;IAoBnH;;;;;;OAMG;IACM,kCAAkC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAMxG;;;;OAIG;IACM,kCAAkC,IAAI,MAAM;IAIrD;;;;;OAKG;IACM,sCAAsC,IAAI,MAAM;IAMzD;;;;;;;OAOG;IACH,OAAO,CAAC,6BAA6B;IAkBrC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;;;;;;OAOG;IACH,OAAO,CAAC,wBAAwB;IAqBhC;;;;OAIG;IACH,OAAO,CAAC,4BAA4B;IAapC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IA4DjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,yBAAyB;IA0HjC;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAkE9C;;;;;;;OAOG;IACH,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAmE9C;;;;;;;OAOG;IACH,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAkClE;;;;;;OAMG;IACH,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAgCpD;;;;;OAKG;IACH,SAAS,CAAC,WAAW,IAAI,MAAM;IAI/B,8CAA8C;IAC9C,SAAS,CAAC,mBAAmB,IAAI,MAAM;IAIvC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAIhD,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM;IAIjD,SAAS,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAOjG,SAAS,CAAC,yBAAyB,IAAI,MAAM;IAI7C;;;;;OAKG;IACH,SAAS,CAAC,oBAAoB,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO;IAI3D,SAAS,CAAC,6BAA6B,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAajH;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,oBAAoB,EAAE,MAAM,GAAG,oBAAoB;IAuE/H;;;;;;OAMG;IAGH;;;OAGG;IACH,6BAA6B,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAiEjF;;OAEG;IACH,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IA6D/E;;OAEG;IACH,yBAAyB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAuDtE,4BAA4B,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAIhF,0BAA0B,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAI9E,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAInF,kBAAkB;IAClB,4BAA4B,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAahG;;;OAGG;IACH,0BAA0B,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAM7F;;;OAGG;IACH,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAqD1E;;;;;;;;;;;;OAYG;IACI,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAIhF,kBAAkB;IAClB,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAK3F;;;;OAIG;IACH,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAWxF,kBAAkB;IAClB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IASnD;;;;OAIG;IACH,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM;IAqBxF,kBAAkB;IAClB,iCAAiC,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAUnF,kBAAkB;IAClB,8BAA8B,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM;IAYrE;;;;OAIG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAmBnE;;;;;;OAMG;IACH;;;;;;OAMG;IACH,SAAS,CAAC,mBAAmB,CAAC,EAAE,EAAE,eAAe,GAAG,MAAM;IAI1D;;;;;;;;;;;OAWG;IACH,uBAAuB,CAAC,YAAY,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM;IAiCnF;;;;;;;;OAQG;IACH,SAAS,CAAC,wBAAwB,CAAC,EAAE,EAAE,eAAe,GAAG,MAAM;IAM/D,kBAAkB;IAClB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM;IAkB9D,kBAAkB;IAClB,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IASnE,kBAAkB;IAClB,gCAAgC,IAAI,MAAM;IAU1C;;;;;OAKG;IACH,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM;IA6DtE;;;;;OAKG;IACH,yBAAyB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG;QAC5D,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;KACzB;IA+BD,kBAAkB;IAClB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM;IAyB7H,kBAAkB;IAClB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAInE,kBAAkB;IAClB,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAM1F,kBAAkB;IAClB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM;IAQ5I,kBAAkB;IAClB,gCAAgC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM;IAOpI,kBAAkB;IAClB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM;IAcjH;;;;;OAKG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAgCvF,kBAAkB;IAClB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAUlG,kBAAkB;IAClB,gBAAgB,IAAI,MAAM;IAI1B,kBAAkB;IAClB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAgB3D,kBAAkB;IAClB,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;OAIG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAW7D,kBAAkB;IAClB,yBAAyB,IAAI,MAAM,EAAE;IAIrC;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,OAAO,CAE9B;IAED,kBAAkB;IAClB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAIlE;;;;OAIG;IACM,6BAA6B,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAgBlE;;;;OAIG;YACW,2BAA2B;IAqDzC,kBAAkB;IAClB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAcnF,kBAAkB;IAClB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAIlE;;;;OAIG;IACH,IAAI,+BAA+B,IAAI,OAAO,CAE7C;IAID;;;;;;;;;OASG;IACH,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAMzC;;;;;OAKG;IACH,uBAAuB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAuB/D,kBAAkB;IAClB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM;IAKxG,kBAAkB;IAClB,+BAA+B,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,MAAM;IAKlE,kBAAkB;IAClB,sCAAsC,IAAI,MAAM;IAKhD,kBAAkB;IAClB,gCAAgC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAK9D,kBAAkB;IAClB,4BAA4B,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAMjE;;;;;;OAMG;IACG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuChE,kBAAkB;IAClB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM;IAcrD;;;;;;;;;;;;OAYG;IACY,kBAAkB,CAC7B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC;IAqEhB;;;;;;;;;;;;OAYG;IACY,mBAAmB,CAAC,IAAI,EAAE;QACrC,MAAM,EAAE,UAAU,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAChC,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAkFlC;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,oBAAoB;IAKlC;;;OAGG;IACH,OAAO,CAAC,WAAW;IAUnB;;OAEG;IACH,OAAO,CAAC,UAAU;IAgBlB,4CAA4C;IAC5C,OAAO,CAAC,eAAe;IAIvB,wDAAwD;IACxD,OAAO,CAAC,0BAA0B;IAOlC,iDAAiD;IACjD,OAAO,CAAC,wBAAwB;IAUhC,oDAAoD;IACpD,OAAO,CAAC,sBAAsB;IAQ9B;;;;;OAKG;IACH,OAAO,CAAC,8BAA8B;IAWtC,6EAA6E;IAC7E,OAAO,CAAC,0BAA0B;IAUlC,sEAAsE;IACtE,OAAO,CAAC,yBAAyB;IA8EjC,yEAAyE;IACzE,OAAO,CAAC,mBAAmB;IAkD3B,2DAA2D;IAC3D,OAAO,CAAC,2BAA2B;IA4BnC,oEAAoE;IACpE,OAAO,CAAC,2BAA2B;IAyBnC,4EAA4E;IAC5E,OAAO,CAAC,sBAAsB;IAY9B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB,CAAqB;IACpD,OAAO,CAAC,sBAAsB;IAS9B,kBAAkB;IAClB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI9D;;;;OAIG;IACH,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAiBpE;;;;;OAKG;IACH,oCAAoC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAoBnG,kBAAkB;IAClB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAUzF;;;;OAIG;IACH,OAAO,CAAC,6BAA6B;IA8FrC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;;OAGG;IACH,OAAO,CAAC,wCAAwC;CA2BnD"}

package/dist/Database/providers/postgresql/PostgreSQLCodeGenProvider.js

@@ -8,7 +8,7 @@ import { EntityInfo, ResolveStartupMode, SetProvider, StartupManager } from '@me
 import { RegisterClass, UUIDsEqual } from '@memberjunction/global';
 import { CodeGenDatabaseProvider, CRUDType, } from '../../codeGenDatabaseProvider.js';
 import { configInfo, mj_core_schema } from '../../../Config/config.js';
-import { logError, startSpinner, succeedSpinner } from '../../../Misc/status_logging.js';
+import { logError, logStatus, logWarning, startSpinner, succeedSpinner } from '../../../Misc/status_logging.js';
 import { buildMetadataSupportObjectsSQL } from './metadataSupportObjects.js';
 import { PostgreSQLDialect, AutoQuotePostgreSQLIdentifiers, restarLayeredOuterView, buildCreateOrReplaceLayeredOuterViewSQL, LayeredOuterRestarError } from '@memberjunction/sql-dialect';
 import { shouldIncludeFieldInParams, useJsonArgShape, UserCache, } from '@memberjunction/generic-database-provider';
@@ -29,6 +29,16 @@ const pgDialect = new PostgreSQLDialect();
  * `ClassFactory.CreateInstance(CodeGenDatabaseProvider, configInfo.dbPlatform)`.
  */
 let PostgreSQLCodeGenProvider = class PostgreSQLCodeGenProvider extends CodeGenDatabaseProvider {
+    constructor() {
+        super(...arguments);
+        /**
+         * B3: roles with a blank `SQLName` are app-tier-only BY DESIGN (decision D3a) — the grant
+         * emitters skip them, and this makes the skip visible: one INFO line per role per run.
+         * (PostgreSQL additionally emits NO field-security DENYs at all, per decision D2 — PG has
+         * no DENY primitive, so MJ's Deny-wins semantics cannot be expressed in its DB tier.)
+         */
+        this._appTierOnlyRolesLogged = new Set();
+    }
     /** @inheritdoc */
     get Dialect() {
         return pgDialect;
@@ -595,11 +605,22 @@ ${trigger}
         const fnName = this.getCRUDRoutineName(entity, CRUDType.Create);
         const viewName = this.getBaseViewName(entity);
         const permissions = this.generateCRUDPermissions(entity, fnName, CRUDType.Create);
-        const firstKey = entity.FirstPrimaryKey;
+        const isSingleKey = entity.PrimaryKeys.length === 1;
+        const firstKey = entity.FirstPrimaryKey; // first-pk-ok: read only for the UUID auto-generation strategy, which is gated on isSingleKey; every declaration, list and predicate below iterates entity.PrimaryKeys
         const pkType = firstKey.Type.toLowerCase().trim();
-        const pkIsUuidSingle = (pkType === 'uniqueidentifier' || pkType === 'uuid') && entity.PrimaryKeys.length === 1;
-        const pkPgType = this.mapSQLType(firstKey.SQLFullType);
-        const pkColQuoted = pgDialect.QuoteIdentifier(firstKey.Name);
+        const pkIsUuidSingle = (pkType === 'uniqueidentifier' || pkType === 'uuid') && isSingleKey;
+        // One plpgsql variable per key column. A single-column key keeps the historical `v_id`
+        // name; a composite key gets one variable per column so the INSERT lists every key
+        // column and the returning SELECT binds all of them (not just the first).
+        const pkVars = entity.PrimaryKeys.map((k) => ({
+            field: k,
+            varName: isSingleKey ? 'v_id' : `v_id_${k.CodeName}`,
+            pgType: this.mapSQLType(k.SQLFullType),
+        }));
+        const pkDeclarations = pkVars.map((v) => `    ${v.varName} ${v.pgType};`).join('\n');
+        const pkColListInit = pkVars.map((v) => `quote_ident('${v.field.Name.replace(/'/g, "''")}')`).join(" || ', ' || ");
+        const pkValListInit = pkVars.map((v) => `quote_literal(${v.varName}) || '::${v.pgType}'`).join(" || ', ' || ");
+        const pkWhere = pkVars.map((v) => `${pgDialect.QuoteIdentifier(v.field.Name)} = ${v.varName}`).join(' AND ');
         // Writable fields participating in the INSERT — exclude PK (handled
         // separately so we can supply a generated UUID when key is absent),
         // exclude virtual / special-date / non-API-writable.
@@ -629,17 +650,17 @@ ${trigger}
         const fieldNamesArrayLiteral = writableFields.map((f) => `'${f.Name}'`).join(', ');
         // ID resolution body: differs by PK strategy. Single-UUID PK is auto-
         // generated when the caller doesn't supply one; everything else (composite,
-        // non-UUID) requires the caller to provide the key explicitly.
+        // non-UUID) requires the caller to provide every key column explicitly.
         const idResolveBody = pkIsUuidSingle
             ? `    IF p_data ? '${firstKey.Name}' THEN
-        v_id := (p_data->>'${firstKey.Name}')::${pkPgType};
+        v_id := (p_data->>'${firstKey.Name}')::${this.mapSQLType(firstKey.SQLFullType)};
     ELSE
         v_id := gen_random_uuid();
     END IF;`
-            : `    IF NOT (p_data ? '${firstKey.Name}') THEN
-        RAISE EXCEPTION '${fnName}: p_data must include "${firstKey.Name}"';
+            : pkVars.map((v) => `    IF NOT (p_data ? '${v.field.Name}') THEN
+        RAISE EXCEPTION '${fnName}: p_data must include "${v.field.Name}"';
     END IF;
-    v_id := (p_data->>'${firstKey.Name}')::${pkPgType};`;
+    ${v.varName} := (p_data->>'${v.field.Name}')::${v.pgType};`).join('\n');
         return `
 ------------------------------------------------------------
 ----- CREATE FUNCTION FOR ${entity.BaseTable} (JSON-arg shape)
@@ -649,7 +670,7 @@ CREATE OR REPLACE FUNCTION ${pgDialect.QuoteSchema(entity.SchemaName, fnName)}(p
 RETURNS SETOF ${pgDialect.QuoteSchema(entity.SchemaName, viewName)}
 AS $$
 DECLARE
-    v_id ${pkPgType};
+${pkDeclarations}
     v_field_name TEXT;
     v_cast_expr  TEXT;
     v_col_list   TEXT;
@@ -658,8 +679,8 @@ DECLARE
 BEGIN
 ${idResolveBody}
 
-    v_col_list := quote_ident('${firstKey.Name.replace(/'/g, "''")}');
-    v_val_list := quote_literal(v_id) || '::${pkPgType}';
+    v_col_list := ${pkColListInit};
+    v_val_list := ${pkValListInit};
 
     -- Build column / value lists from keys present in p_data. Absent keys are
     -- omitted entirely so the column's DEFAULT applies (matching the typed-arg
@@ -686,7 +707,7 @@ ${fieldCastEntries}
 
     RETURN QUERY
     SELECT * FROM ${pgDialect.QuoteSchema(entity.SchemaName, viewName)}
-    WHERE ${pkColQuoted} = v_id;
+    WHERE ${pkWhere};
 END;
 $$ LANGUAGE plpgsql;
 ${permissions}
@@ -716,7 +737,10 @@ ${permissions}
         const viewName = this.getBaseViewName(entity);
         const paramString = this.generateCRUDParamString(entity.Fields, false);
         const permissions = this.generateCRUDPermissions(entity, fnName, CRUDType.Create);
-        const firstKey = entity.FirstPrimaryKey;
+        const firstKey = entity.FirstPrimaryKey; // first-pk-ok: drives the single-key UUID strategy (guarded by PrimaryKeys.length === 1 in buildCreateInsertStrategy); identity and composite strategies iterate entity.PrimaryKeys
+        // v_new_id receives the database-generated key: the identity/serial column when there is
+        // one (which on a composite key need not be the first column), else the single UUID key.
+        const generatedKey = entity.PrimaryKeys.find((k) => k.AutoIncrement) ?? firstKey;
         // For UUID PKs and AutoIncrement PKs, the strategy below adds the PK
         // column manually (with v_new_id or RETURNING). Excluding it from the
         // auto-generated insertColumns/insertValues avoids the column appearing
@@ -742,7 +766,7 @@ CREATE OR REPLACE FUNCTION ${pgDialect.QuoteSchema(entity.SchemaName, fnName)}(
     ${paramString}
 ) RETURNS SETOF ${pgDialect.QuoteSchema(entity.SchemaName, viewName)} AS $$
 DECLARE
-    v_new_id ${this.mapSQLType(firstKey.SQLFullType)};
+    v_new_id ${this.mapSQLType(generatedKey.SQLFullType)};
 BEGIN
     ${strategy.preInsert}INSERT INTO ${pgDialect.QuoteSchema(entity.SchemaName, entity.BaseTable)}
         (
@@ -1038,8 +1062,8 @@ WHERE ${ftsColName} IS NULL;
         if (entity.PrimaryKeys.length !== 1) {
             throw new Error(`[Hierarchy] Entity '${entity.Name}' has ${entity.PrimaryKeys.length} primary key fields. MemberJunction hierarchy TVF generation requires a single-column primary key.`);
         }
-        const primaryKey = entity.FirstPrimaryKey.Name;
-        const primaryKeyType = this.mapSQLType(entity.FirstPrimaryKey.SQLFullType);
+        const primaryKey = entity.FirstPrimaryKey.Name; // first-pk-ok: guarded by the PrimaryKeys.length !== 1 throw above; hierarchy TVFs are single-column by design
+        const primaryKeyType = this.mapSQLType(entity.FirstPrimaryKey.SQLFullType); // first-pk-ok: guarded by the PrimaryKeys.length !== 1 throw above; hierarchy TVFs are single-column by design
         const fieldName = field.Name;
         const fnName = this.getHierarchyMetaFunctionName(entity, field);
         return `
@@ -1104,8 +1128,8 @@ $$ LANGUAGE sql STABLE;
         if (entity.PrimaryKeys.length !== 1) {
             throw new Error(`[Hierarchy] Entity '${entity.Name}' has ${entity.PrimaryKeys.length} primary key fields. MemberJunction hierarchy TVF generation requires a single-column primary key.`);
         }
-        const primaryKey = entity.FirstPrimaryKey.Name;
-        const primaryKeyType = this.mapSQLType(entity.FirstPrimaryKey.SQLFullType);
+        const primaryKey = entity.FirstPrimaryKey.Name; // first-pk-ok: guarded by the PrimaryKeys.length !== 1 throw above; hierarchy TVFs are single-column by design
+        const primaryKeyType = this.mapSQLType(entity.FirstPrimaryKey.SQLFullType); // first-pk-ok: guarded by the PrimaryKeys.length !== 1 throw above; hierarchy TVFs are single-column by design
         const fieldName = field.Name;
         const fnName = this.getDescendantsFunctionName(entity, field);
         return `
@@ -1166,8 +1190,8 @@ $$ LANGUAGE sql STABLE;
         if (entity.PrimaryKeys.length !== 1) {
             throw new Error(`[Hierarchy] Entity '${entity.Name}' has ${entity.PrimaryKeys.length} primary key fields. MemberJunction hierarchy TVF generation requires a single-column primary key.`);
         }
-        const primaryKey = entity.FirstPrimaryKey.Name;
-        const primaryKeyType = this.mapSQLType(entity.FirstPrimaryKey.SQLFullType);
+        const primaryKey = entity.FirstPrimaryKey.Name; // first-pk-ok: guarded by the PrimaryKeys.length !== 1 throw above; hierarchy TVFs are single-column by design
+        const primaryKeyType = this.mapSQLType(entity.FirstPrimaryKey.SQLFullType); // first-pk-ok: guarded by the PrimaryKeys.length !== 1 throw above; hierarchy TVFs are single-column by design
         const fieldName = field.Name;
         const fnName = this.getAncestorsFunctionName(entity, field);
         return `
@@ -1244,7 +1268,7 @@ $$ LANGUAGE sql STABLE;
     generateHierarchyFieldJoin(entity, field, alias) {
         const fnName = this.getHierarchyMetaFunctionName(entity, field);
         const tableAlias = entity.BaseTableCodeName.charAt(0).toLowerCase();
-        return `LEFT JOIN LATERAL ${pgDialect.QuoteSchema(entity.SchemaName, fnName)}(${tableAlias}.${pgDialect.QuoteIdentifier(entity.FirstPrimaryKey.Name)}, ${tableAlias}.${pgDialect.QuoteIdentifier(field.Name)}) AS ${alias} ON true`;
+        return `LEFT JOIN LATERAL ${pgDialect.QuoteSchema(entity.SchemaName, fnName)}(${tableAlias}.${pgDialect.QuoteIdentifier(entity.FirstPrimaryKey.Name)}, ${tableAlias}.${pgDialect.QuoteIdentifier(field.Name)}) AS ${alias} ON true`; // first-pk-ok: hierarchy TVF argument; sql_codegen.getHierarchyFKs skips composite-key entities and the TVF generator throws for them
     }
     /**
      * Generates a PostgreSQL function that recursively calculates the root record ID for a
@@ -1254,8 +1278,8 @@ $$ LANGUAGE sql STABLE;
         if (entity.PrimaryKeys.length !== 1) {
             throw new Error(`[Hierarchy] Entity '${entity.Name}' has ${entity.PrimaryKeys.length} primary key fields. MemberJunction hierarchy TVF generation requires a single-column primary key.`);
         }
-        const primaryKey = entity.FirstPrimaryKey.Name;
-        const primaryKeyType = this.mapSQLType(entity.FirstPrimaryKey.SQLFullType);
+        const primaryKey = entity.FirstPrimaryKey.Name; // first-pk-ok: guarded by the PrimaryKeys.length !== 1 throw above; hierarchy TVFs are single-column by design
+        const primaryKeyType = this.mapSQLType(entity.FirstPrimaryKey.SQLFullType); // first-pk-ok: guarded by the PrimaryKeys.length !== 1 throw above; hierarchy TVFs are single-column by design
         const fieldName = field.Name;
         const fnName = this.getRootIDFunctionName(entity, field);
         return `
@@ -1330,8 +1354,9 @@ $$ LANGUAGE sql STABLE;
     generateRootFieldJoin(entity, field, alias) {
         const fnName = this.getRootIDFunctionName(entity, field);
         const tableAlias = entity.BaseTableCodeName.charAt(0).toLowerCase();
+        const primaryKey = entity.FirstPrimaryKey.Name; // first-pk-ok: hierarchy TVF argument; sql_codegen.getHierarchyFKs skips composite-key entities and the TVF generator throws for them
         return `LEFT JOIN LATERAL (
-    SELECT ${pgDialect.QuoteSchema(entity.SchemaName, fnName)}(${tableAlias}.${pgDialect.QuoteIdentifier(entity.FirstPrimaryKey.Name)}, ${tableAlias}.${pgDialect.QuoteIdentifier(field.Name)}) AS root_id
+    SELECT ${pgDialect.QuoteSchema(entity.SchemaName, fnName)}(${tableAlias}.${pgDialect.QuoteIdentifier(primaryKey)}, ${tableAlias}.${pgDialect.QuoteIdentifier(field.Name)}) AS root_id
 ) AS ${alias} ON true`;
     }
     // ─── PERMISSIONS ─────────────────────────────────────────────────────
@@ -1351,8 +1376,10 @@ $$ LANGUAGE sql STABLE;
     generateCRUDPermissions(entity, routineName, type) {
         const roles = [];
         for (const ep of entity.Permissions) {
-            if (!ep.RoleSQLName || ep.RoleSQLName.length === 0)
+            if (!ep.RoleSQLName || ep.RoleSQLName.length === 0) {
+                this.logAppTierOnlyRoleSkip(ep.Role);
                 continue;
+            }
             if ((type === CRUDType.Create && ep.CanCreate) ||
                 (type === CRUDType.Update && ep.CanUpdate) ||
                 (type === CRUDType.Delete && ep.CanDelete)) {
@@ -1604,9 +1631,15 @@ END $$;
     }
     // ─── METADATA MANAGEMENT: STORED PROCEDURE CALLS ─────────────────
     /** @inheritdoc */
-    callRoutineSQL(schema, routineName, params, _paramNames, discardResult) {
+    callRoutineSQL(schema, routineName, params, paramNames, discardResult) {
         const qualifiedName = pgDialect.QuoteSchema(schema, routineName);
-        const paramList = params.join(', ');
+        let paramList;
+        if (paramNames && paramNames.length === params.length) {
+            paramList = params.map((p, i) => `p_${paramNames[i]} => ${p}`).join(', ');
+        }
+        else {
+            paramList = params.join(', ');
+        }
         if (discardResult) {
             // `SELECT * FROM routine(...)` is not universally valid on PostgreSQL: a function
             // declared `RETURNS SETOF record` — which spDeleteEntityWithCoreDependencies is — is
@@ -1892,9 +1925,9 @@ $if_view_exists$;
     }
     // ─── METADATA MANAGEMENT: COMPLEX SQL GENERATION ─────────────────
     /** @inheritdoc */
-    getPendingEntityFieldsSQL(mjCoreSchema, entityIDs) {
+    getPendingEntityFieldsSQL(mjCoreSchema, entityIDs, excludeSchemas) {
         const qs = pgDialect.QuoteSchema.bind(pgDialect);
-        return this.buildPendingEntityFieldsQuery(mjCoreSchema, qs, entityIDs);
+        return this.buildPendingEntityFieldsQuery(mjCoreSchema, qs, entityIDs, excludeSchemas);
     }
     /** @inheritdoc */
     getCheckConstraintsSchemaFilter(_excludeSchemas) {
@@ -2288,13 +2321,25 @@ WHERE p.prokind IN ('f', 'p')
     buildCreateInsertStrategy(entity, firstKey, insertColumns, insertValues) {
         const viewName = this.getBaseViewName(entity);
         const pkCol = pgDialect.QuoteIdentifier(firstKey.Name);
-        if (firstKey.AutoIncrement) {
+        const identityKey = entity.PrimaryKeys.find((k) => k.AutoIncrement);
+        if (identityKey) {
+            // Identity/serial key. On a composite key such as (TenantID, ID serial) the remaining key
+            // columns are caller-supplied: they must be inserted and included in the row lookup. For a
+            // single-column identity key callerSuppliedKeys is empty and nothing is added.
+            const identityCol = pgDialect.QuoteIdentifier(identityKey.Name);
+            const callerSuppliedKeys = entity.PrimaryKeys.filter((k) => !k.AutoIncrement);
+            const keyColumns = callerSuppliedKeys.map((k) => pgDialect.QuoteIdentifier(k.Name)).join(',\n            ');
+            const keyValues = callerSuppliedKeys.map((k) => pgDialect.ParameterRef(k.CodeName)).join(',\n            ');
+            const keyPredicates = callerSuppliedKeys
+                .map((k) => ` AND ${pgDialect.QuoteIdentifier(k.Name)} = ${pgDialect.ParameterRef(k.CodeName)}`)
+                .join('');
+            const hasNonPkColumns = insertColumns.trim().length > 0;
             return {
                 preInsert: '',
-                returningClause: `RETURNING ${pkCol} INTO v_new_id`,
-                selectClause: `SELECT * FROM ${pgDialect.QuoteSchema(entity.SchemaName, viewName)}\n    WHERE ${pkCol} = v_new_id`,
-                finalColumns: insertColumns,
-                finalValues: insertValues,
+                returningClause: `RETURNING ${identityCol} INTO v_new_id`,
+                selectClause: `SELECT * FROM ${pgDialect.QuoteSchema(entity.SchemaName, viewName)}\n    WHERE ${identityCol} = v_new_id${keyPredicates}`,
+                finalColumns: callerSuppliedKeys.length === 0 ? insertColumns : (hasNonPkColumns ? `${keyColumns},\n            ${insertColumns}` : keyColumns),
+                finalValues: callerSuppliedKeys.length === 0 ? insertValues : (hasNonPkColumns ? `${keyValues},\n            ${insertValues}` : keyValues),
             };
         }
         if ((firstKey.Type.toLowerCase().trim() === 'uniqueidentifier' || firstKey.Type.toLowerCase().trim() === 'uuid') && entity.PrimaryKeys.length === 1) {
@@ -2380,7 +2425,13 @@ WHERE p.prokind IN ('f', 'p')
             return `    -- WARNING: Cannot cascade update ${relatedEntity.Name}.${fkField.Name} to NULL - entity does not allow updates`;
         }
         const updateFnName = this.getCRUDRoutineName(relatedEntity, CRUDType.Update);
-        const whereClause = `${pgDialect.QuoteIdentifier(fkField.Name)} = ${pgDialect.ParameterRef(parentEntity.FirstPrimaryKey.CodeName)}`;
+        const parentKey = this.resolveCascadeParentKeyField(parentEntity, fkField);
+        if (!parentKey) {
+            const warning = this.unresolvedCascadeKeyComment(parentEntity, relatedEntity, fkField);
+            logWarning(`WARNING in ${this.getCRUDRoutineName(parentEntity, CRUDType.Delete)} generation: ${warning.trim()}`);
+            return warning;
+        }
+        const whereClause = `${pgDialect.QuoteIdentifier(fkField.Name)} = ${pgDialect.ParameterRef(parentKey.CodeName)}`;
         return `    -- Cascade: Set ${relatedEntity.Name}.${fkField.Name} to NULL
     FOR v_rec IN
         SELECT ${relatedEntity.PrimaryKeys.map((pk) => pgDialect.QuoteIdentifier(pk.Name)).join(', ')}
@@ -2400,7 +2451,13 @@ WHERE p.prokind IN ('f', 'p')
             return `    -- WARNING: Cannot cascade delete ${relatedEntity.Name} records - entity does not allow deletes`;
         }
         const deleteFnName = this.getCRUDRoutineName(relatedEntity, CRUDType.Delete);
-        const whereClause = `${pgDialect.QuoteIdentifier(fkField.Name)} = ${pgDialect.ParameterRef(parentEntity.FirstPrimaryKey.CodeName)}`;
+        const parentKey = this.resolveCascadeParentKeyField(parentEntity, fkField);
+        if (!parentKey) {
+            const warning = this.unresolvedCascadeKeyComment(parentEntity, relatedEntity, fkField);
+            logWarning(`WARNING in ${this.getCRUDRoutineName(parentEntity, CRUDType.Delete)} generation: ${warning.trim()}`);
+            return warning;
+        }
+        const whereClause = `${pgDialect.QuoteIdentifier(fkField.Name)} = ${pgDialect.ParameterRef(parentKey.CodeName)}`;
         return `    -- Cascade: Delete ${relatedEntity.Name} records via ${fkField.Name}
     FOR v_rec IN
         SELECT ${relatedEntity.PrimaryKeys.map((pk) => pgDialect.QuoteIdentifier(pk.Name)).join(', ')}
@@ -2418,9 +2475,19 @@ WHERE p.prokind IN ('f', 'p')
             if (ep.RoleSQLName && ep.RoleSQLName.length > 0 && !roles.includes(ep.RoleSQLName)) {
                 roles.push(ep.RoleSQLName);
             }
+            else if (!ep.RoleSQLName || ep.RoleSQLName.length === 0) {
+                this.logAppTierOnlyRoleSkip(ep.Role);
+            }
         }
         return roles;
     }
+    logAppTierOnlyRoleSkip(roleName) {
+        const name = (roleName ?? '').trim();
+        if (!name || this._appTierOnlyRolesLogged.has(name))
+            return;
+        this._appTierOnlyRolesLogged.add(name);
+        logStatus(`   ℹ️  Role '${name}' is app-tier-only (no SQLName); no DB grants emitted.`);
+    }
     // ─── DATABASE INTROSPECTION ──────────────────────────────────────────
     /** @inheritdoc */
     getViewDefinitionSQL(schema, viewName) {
@@ -2486,12 +2553,15 @@ WHERE p.prokind IN ('f', 'p')
      * Uses CTEs for FK, PK, and UK caches, then joins against entity metadata
      * to find fields that exist in the database but not in MJ metadata.
      */
-    buildPendingEntityFieldsQuery(schema, qs, entityIDs) {
+    buildPendingEntityFieldsQuery(schema, qs, entityIDs, excludeSchemas) {
         // PG uses lowercase UUIDs; entity IDs from the metadata cache are already
         // normalized so direct string interpolation is safe (internal IDs, not user input).
         const scopeFilter = entityIDs && entityIDs.length > 0
             ? `AND sf."EntityID" IN (${entityIDs.map(id => `'${id}'`).join(',')})`
             : '';
+        const schemaFilter = excludeSchemas && excludeSchemas.length > 0
+            ? `AND e."SchemaName" NOT IN (${excludeSchemas.map(s => `'${s.replace(/'/g, "''")}'`).join(',')})`
+            : '';
         return `
 WITH fk_cache AS (
    SELECT "column", "table", "schema_name", "referenced_table", "referenced_column", "referenced_schema"
@@ -2518,9 +2588,9 @@ numbered_rows AS (
    SELECT
       sf."EntityID",
       COALESCE(ms."MaxSequence", 0) + 100000 + sf."Sequence" AS "Sequence",
-      -- The RAW schema ordinal, carried alongside the temporary Sequence above. The INSERT emitter
-      -- adds it to an apply-time MAX(), so the ordering of newly discovered fields is encoded in the
-      -- emitted VALUE rather than depending on the order the INSERT statements happen to execute.
+      -- The RAW schema ordinal. The INSERT emitter uses it for DefaultInView only; the emitted
+      -- Sequence is an apply-time MAX()+1 subquery. (Sequence above is only this query's ORDER BY
+      -- key — never inserted — and the renumber pass overwrites every row from the schema.)
       sf."Sequence" AS "SourceOrdinal",
       sf."FieldName",
       sf."Description",
@@ -2563,6 +2633,7 @@ numbered_rows AS (
    WHERE
       "EntityFieldID" IS NULL
       ${scopeFilter}
+      ${schemaFilter}
 )
 SELECT *
 FROM numbered_rows