@noormdev/sdk 1.0.0-alpha.33 → 1.0.0-alpha.35

package/dist/index.js

@@ -1,8 +1,8 @@
 import { createRequire } from 'module';
 import { processFile, DtReader, isTemplate, FORMAT_VERSION, DT_EXTENSIONS, encryptWithPassphrase, ENCODED_TYPES } from './chunk-5AYPF5D5.js';
 import './chunk-UOFJT5PY.js';
-import { initializeVault, getVaultStatus, setVaultSecret, getVaultSecret, getAllVaultSecrets, listVaultSecretKeys, deleteVaultSecret, vaultSecretExists, getVaultKey, noormDb, getNoormTables, encryptVaultKey } from './chunk-DE3NJ22A.js';
-import { makeNestedConfig, gigabytes, observer, attempt, retry, clone, merge, attemptSync, ObserverRelay } from './chunk-DLQES4PM.js';
+import { initializeVault, getVaultStatus, setVaultSecret, getVaultSecret, getAllVaultSecrets, listVaultSecretKeys, deleteVaultSecret, vaultSecretExists, getVaultKey, noormDb, getNoormTables, encryptVaultKey } from './chunk-WFVWNXTV.js';
+import { makeNestedConfig, gigabytes, observer, attempt, attemptSync, retry, clone, merge, ObserverRelay } from './chunk-DLQES4PM.js';
 import { dist_default } from './chunk-TBRUDUBQ.js';
 import { require_dist } from './chunk-YJBKNUTP.js';
 import { __commonJS, __export, __toESM } from './chunk-D2XW2UOP.js';
@@ -10,7 +10,7 @@ import { constants, existsSync, readFileSync, mkdirSync, writeFileSync, createWr
 import path, { join, dirname, resolve } from 'path';
 import { homedir, availableParallelism, userInfo } from 'os';
 import { stat, mkdir, writeFile, unlink, rename, rm, readdir, readFile, access } from 'fs/promises';
-import { createHash, createDecipheriv, randomBytes, createCipheriv, randomUUID, hkdfSync } from 'crypto';
+import { createHash, createPrivateKey, createPublicKey, createDecipheriv, randomBytes, createCipheriv, randomUUID, hkdfSync } from 'crypto';
 import { execSync } from 'child_process';
 import { sql } from 'kysely';
 import { Worker, parentPort, workerData } from 'worker_threads';
@@ -304,6 +304,9 @@ var PRIVATE_KEY_PATH = join(NOORM_HOME, "identity.key");
 var PUBLIC_KEY_PATH = join(NOORM_HOME, "identity.pub");
 var IDENTITY_METADATA_PATH = join(NOORM_HOME, "identity.json");
 async function loadIdentityMetadata() {
+  if (identityOverride) {
+    return identityOverride;
+  }
   const [content, err] = await attempt(
     () => readFile(IDENTITY_METADATA_PATH, { encoding: "utf8" })
   );
@@ -320,6 +323,9 @@ async function loadIdentityMetadata() {
   return parsed;
 }
 async function loadPrivateKey() {
+  if (keyOverride) {
+    return keyOverride;
+  }
   const [content, err] = await attempt(() => readFile(PRIVATE_KEY_PATH, { encoding: "utf8" }));
   if (err) {
     if (err.code === "ENOENT") {
@@ -339,6 +345,34 @@ async function loadPublicKey() {
   }
   return content.trim();
 }
+function isValidKeyHex(hex4) {
+  if (!/^[0-9a-f]+$/i.test(hex4)) {
+    return false;
+  }
+  const validLengths = [88, 96];
+  return validLengths.includes(hex4.length);
+}
+var keyOverride = null;
+function setKeyOverride(key) {
+  keyOverride = key;
+}
+var identityOverride = null;
+function setIdentityOverride(identity) {
+  identityOverride = identity;
+}
+function derivePublicKeyFromPrivate(privateKeyHex) {
+  const privateKeyObj = createPrivateKey({
+    key: Buffer.from(privateKeyHex, "hex"),
+    format: "der",
+    type: "pkcs8"
+  });
+  const publicKeyObj = createPublicKey(privateKeyObj);
+  const publicKeyDer = publicKeyObj.export({
+    type: "spki",
+    format: "der"
+  });
+  return publicKeyDer.toString("hex");
+}
 function deriveStateKey(privateKey) {
   const privateKeyBuffer = Buffer.from(privateKey, "hex");
   return Buffer.from(
@@ -14866,199 +14900,26 @@ function getEffectiveBuildPaths(buildInclude, buildExclude, rules, config2) {
 
 // src/core/settings/manager.ts
 var import_yaml = __toESM(require_dist(), 1);
-
-// src/core/config/schema.ts
-var DialectSchema2 = external_exports.enum(["postgres", "mysql", "sqlite", "mssql"]);
-var ConfigNameSchema = external_exports.string().min(1, "Config name is required").regex(
-  /^[a-z0-9_-]+$/i,
-  "Config name must contain only letters, numbers, hyphens, and underscores"
-);
-var PortSchema2 = external_exports.number().int().min(1, "Port must be at least 1").max(65535, "Port must be at most 65535");
-var PoolSchema = external_exports.object({
-  min: external_exports.number().int().min(0).optional(),
-  max: external_exports.number().int().min(1).optional()
-});
-var SSLSchema = external_exports.union([
-  external_exports.boolean(),
-  external_exports.object({
-    rejectUnauthorized: external_exports.boolean().optional(),
-    ca: external_exports.string().optional(),
-    cert: external_exports.string().optional(),
-    key: external_exports.string().optional()
-  })
-]);
-var ConnectionSchema = external_exports.object({
-  dialect: DialectSchema2,
-  host: external_exports.string().optional(),
-  port: PortSchema2.optional(),
-  database: external_exports.string().min(1, "Database name is required"),
-  filename: external_exports.string().optional(),
-  user: external_exports.string().optional(),
-  password: external_exports.string().optional(),
-  ssl: SSLSchema.optional(),
-  pool: PoolSchema.optional()
-}).refine((conn) => conn.dialect === "sqlite" || conn.host, {
-  message: "Host is required for non-SQLite databases",
-  path: ["host"]
-});
-var ConfigSchema = external_exports.object({
-  name: ConfigNameSchema,
-  type: external_exports.enum(["local", "remote"]).default("local"),
-  isTest: external_exports.boolean().default(false),
-  protected: external_exports.boolean().default(false),
-  connection: ConnectionSchema,
-  identity: external_exports.string().optional()
-});
-var PartialConnectionSchema = external_exports.object({
-  dialect: DialectSchema2.optional(),
-  host: external_exports.string().optional(),
-  port: PortSchema2.optional(),
-  database: external_exports.string().optional(),
-  filename: external_exports.string().optional(),
-  user: external_exports.string().optional(),
-  password: external_exports.string().optional(),
-  ssl: SSLSchema.optional(),
-  pool: PoolSchema.optional()
-});
-external_exports.object({
-  name: external_exports.string().regex(/^[a-z0-9_-]+$/i).optional(),
-  type: external_exports.enum(["local", "remote"]).optional(),
-  isTest: external_exports.boolean().optional(),
-  protected: external_exports.boolean().optional(),
-  connection: PartialConnectionSchema.optional(),
-  identity: external_exports.string().optional()
-});
-ConfigSchema.extend({
-  name: ConfigNameSchema.optional()
-});
-var ConfigValidationError = class extends Error {
-  constructor(message, field, issues) {
-    super(message);
-    this.field = field;
-    this.issues = issues;
-    this.name = "ConfigValidationError";
-  }
-};
-function parseConfig(config2) {
-  const result = ConfigSchema.safeParse(config2);
-  if (!result.success) {
-    const firstIssue = result.error.issues[0];
-    throw new ConfigValidationError(
-      firstIssue?.message ?? "Validation failed",
-      firstIssue?.path.join(".") || "unknown",
-      result.error.issues
-    );
-  }
-  return result.data;
-}
-
-// src/core/environment.ts
-function getEnvConfigName() {
-  return process.env["NOORM_CONFIG"];
-}
-
-// src/core/config/resolver.ts
-var SettingsProvider = class {
-  #manager;
-  constructor(manager) {
-    this.#manager = manager;
-  }
-  /** Get a stage by name */
-  getStage(name) {
-    return this.#manager.getStage(name) ?? null;
-  }
-  /** Get stage that matches a config name (for auto-linking) */
-  findStageForConfig(configName) {
-    return this.#manager.getStage(configName) ?? null;
-  }
-};
-var DEFAULTS = {
-  type: "local",
-  isTest: false,
-  protected: false,
-  connection: {
-    host: "localhost",
-    pool: { min: 0, max: 10 }
-  },
-  log: {
-    level: "info"
-  }
-};
-function resolveConfig(state, options = {}) {
-  const configName = options.name ?? getEnvConfigName() ?? state.getActiveConfigName();
-  if (!configName) {
-    const envConfig2 = getEnvConfig();
-    if (envConfig2.connection?.dialect && envConfig2.connection?.database) {
-      return resolveFromEnvOnly(envConfig2, options.flags, options.stage, options.settings);
-    }
-    return null;
-  }
-  const stored = state.getConfig(configName);
-  if (!stored) {
-    throw new Error(`Config "${configName}" not found`);
-  }
-  const stageDefaults = getStageDefaults(configName, options.stage, options.settings);
-  const envConfig = getEnvConfig();
-  let merged = clone(DEFAULTS);
-  if (stageDefaults) {
-    merged = merge(merged, stageDefaults);
-  }
-  merged = merge(merged, stored);
-  merged = merge(merged, envConfig);
-  merged = merge(merged, options.flags ?? {});
-  return parseConfig(merged);
-}
-function getStageDefaults(configName, stageName, settings) {
-  if (!settings) return null;
-  if (stageName) return settings.getStage(stageName)?.defaults ?? null;
-  return settings.findStageForConfig(configName)?.defaults ?? null;
-}
-function resolveFromEnvOnly(envConfig, flags, stageName, settings) {
-  const name = envConfig.name ?? flags?.name ?? "__env__";
-  const stageDefaults = getStageDefaults(name, stageName, settings);
-  let merged = clone(DEFAULTS);
-  if (stageDefaults) {
-    merged = merge(merged, stageDefaults);
-  }
-  merged = merge(merged, envConfig);
-  merged = merge(merged, flags ?? {});
-  if (!merged.name) {
-    merged.name = "__env__";
-  }
-  return parseConfig(merged);
-}
-
-// src/core/config/index.ts
-var META_ENV_VARS = /* @__PURE__ */ new Set([
+var META_SETTINGS_ENV_VARS = /* @__PURE__ */ new Set([
   "NOORM_CONFIG",
-  // Config selection
   "NOORM_YES",
-  // Skip confirmations
-  "NOORM_JSON"
-  // JSON output mode
+  "NOORM_JSON",
+  "NOORM_HEADLESS",
+  "NOORM_DEBUG",
+  "NOORM_DEV",
+  "NOORM_CI_CONFIG_NAME",
+  "NOORM_LOGGER_DEBUG",
+  "NOORM_IDENTITY"
 ]);
-var VALID_DIALECTS = ["postgres", "mysql", "sqlite", "mssql"];
-var { allConfigs, getConfig } = makeNestedConfig(process.env, {
-  filter: (key) => key.startsWith("NOORM_") && !META_ENV_VARS.has(key),
-  stripPrefix: "NOORM_",
-  forceAllCapToLower: true,
-  memoizeOpts: false,
-  skipConversion: (key) => key.toLowerCase().includes("password")
-});
-function getEnvConfig() {
-  const config2 = allConfigs();
-  if (config2.connection?.dialect) {
-    const result = DialectSchema2.safeParse(config2.connection.dialect);
-    if (!result.success) {
-      throw new Error(
-        `Invalid NOORM_CONNECTION_DIALECT: must be one of ${VALID_DIALECTS.join(", ")}`
-      );
-    }
-  }
-  return config2;
+function allSettingsEnv() {
+  const { allConfigs: allConfigs2 } = makeNestedConfig(process.env, {
+    filter: (key) => key.startsWith("NOORM_") && !META_SETTINGS_ENV_VARS.has(key) && !key.startsWith("NOORM_IDENTITY_") && !key.startsWith("NOORM_CONNECTION_"),
+    stripPrefix: "NOORM_",
+    forceAllCapToLower: true,
+    memoizeOpts: false
+  });
+  return allConfigs2();
 }
-
-// src/core/settings/manager.ts
 var SettingsManager = class {
   #projectRoot;
   #settingsDir;
@@ -15134,7 +14995,7 @@ var SettingsManager = class {
       }
       fromFile = true;
     }
-    this.#settings = merge(this.#settings, allConfigs());
+    this.#settings = merge(this.#settings, allSettingsEnv());
     this.#loaded = true;
     observer.emit("settings:loaded", {
       path: this.settingsFilePath,
@@ -15718,6 +15579,13 @@ function formatIdentity(identity) {
   }
   return identity.name;
 }
+function computeIdentityHash(input) {
+  if (!input.email || !input.name || !input.machine || false) {
+    throw new Error("All fields required for identity hash: email, name, machine, os");
+  }
+  const hashInput = [input.email, input.name, input.machine, input.os].join("\0");
+  return createHash("sha256").update(hashInput, "utf8").digest("hex");
+}
 
 // src/core/identity/factory.ts
 async function loadExistingIdentity() {
@@ -16638,6 +16506,11 @@ function createDialectQuoting(opts) {
   return { quote: quote5, qualifiedName: qualifiedName4 };
 }
 
+// src/core/environment.ts
+function getEnvConfigName() {
+  return process.env["NOORM_CONFIG"];
+}
+
 // src/core/logger/logger.ts
 __toESM(require_dayjs_min(), 1);
 
@@ -16765,6 +16638,50 @@ async function registerIdentity(db, identity, dialect) {
   return { ok: true, registered: true };
 }
 
+// src/core/identity/env.ts
+var CI_ENV_VARS = {
+  privateKey: "NOORM_IDENTITY_PRIVATE_KEY",
+  name: "NOORM_IDENTITY_NAME",
+  email: "NOORM_IDENTITY_EMAIL"
+};
+function loadIdentityFromEnv() {
+  const rawKey = process.env[CI_ENV_VARS.privateKey];
+  const rawName = process.env[CI_ENV_VARS.name];
+  const rawEmail = process.env[CI_ENV_VARS.email];
+  if (!rawKey || !rawName || !rawEmail) {
+    return null;
+  }
+  const privateKey = rawKey.trim();
+  const name = rawName.trim();
+  const email3 = rawEmail.trim();
+  if (!name || !email3) {
+    return null;
+  }
+  if (!isValidKeyHex(privateKey)) {
+    return null;
+  }
+  const [publicKey, deriveErr] = attemptSync(() => derivePublicKeyFromPrivate(privateKey));
+  if (deriveErr || !publicKey) {
+    return null;
+  }
+  const identityHash = computeIdentityHash({
+    email: email3,
+    name,
+    machine: publicKey,
+    os: "env"
+  });
+  const identity = {
+    identityHash,
+    name,
+    email: email3,
+    publicKey,
+    machine: "ci",
+    os: "env",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  return { identity, privateKey, source: "env" };
+}
+
 // src/core/identity/index.ts
 var cachedIdentity = null;
 function resolveIdentity2(options = {}) {
@@ -16791,6 +16708,205 @@ async function waitForIdentityToLoad(db, dialect) {
   });
 }
 
+// src/core/config/schema.ts
+var DialectSchema2 = external_exports.enum(["postgres", "mysql", "sqlite", "mssql"]);
+var ConfigNameSchema = external_exports.string().min(1, "Config name is required").regex(
+  /^[a-z0-9_-]+$/i,
+  "Config name must contain only letters, numbers, hyphens, and underscores"
+);
+var PortSchema2 = external_exports.number().int().min(1, "Port must be at least 1").max(65535, "Port must be at most 65535");
+var PoolSchema = external_exports.object({
+  min: external_exports.number().int().min(0).optional(),
+  max: external_exports.number().int().min(1).optional()
+});
+var SSLSchema = external_exports.union([
+  external_exports.boolean(),
+  external_exports.object({
+    rejectUnauthorized: external_exports.boolean().optional(),
+    ca: external_exports.string().optional(),
+    cert: external_exports.string().optional(),
+    key: external_exports.string().optional()
+  })
+]);
+var ConnectionSchema = external_exports.object({
+  dialect: DialectSchema2,
+  host: external_exports.string().optional(),
+  port: PortSchema2.optional(),
+  database: external_exports.string().min(1, "Database name is required"),
+  filename: external_exports.string().optional(),
+  user: external_exports.string().optional(),
+  password: external_exports.string().optional(),
+  ssl: SSLSchema.optional(),
+  pool: PoolSchema.optional()
+}).refine((conn) => conn.dialect === "sqlite" || conn.host, {
+  message: "Host is required for non-SQLite databases",
+  path: ["host"]
+});
+var ConfigSchema = external_exports.object({
+  name: ConfigNameSchema,
+  type: external_exports.enum(["local", "remote"]).default("local"),
+  isTest: external_exports.boolean().default(false),
+  protected: external_exports.boolean().default(false),
+  connection: ConnectionSchema,
+  identity: external_exports.string().optional()
+});
+var PartialConnectionSchema = external_exports.object({
+  dialect: DialectSchema2.optional(),
+  host: external_exports.string().optional(),
+  port: PortSchema2.optional(),
+  database: external_exports.string().optional(),
+  filename: external_exports.string().optional(),
+  user: external_exports.string().optional(),
+  password: external_exports.string().optional(),
+  ssl: SSLSchema.optional(),
+  pool: PoolSchema.optional()
+});
+external_exports.object({
+  name: external_exports.string().regex(/^[a-z0-9_-]+$/i).optional(),
+  type: external_exports.enum(["local", "remote"]).optional(),
+  isTest: external_exports.boolean().optional(),
+  protected: external_exports.boolean().optional(),
+  connection: PartialConnectionSchema.optional(),
+  identity: external_exports.string().optional()
+});
+ConfigSchema.extend({
+  name: ConfigNameSchema.optional()
+});
+var ConfigValidationError = class extends Error {
+  constructor(message, field, issues) {
+    super(message);
+    this.field = field;
+    this.issues = issues;
+    this.name = "ConfigValidationError";
+  }
+};
+function parseConfig(config2) {
+  const result = ConfigSchema.safeParse(config2);
+  if (!result.success) {
+    const firstIssue = result.error.issues[0];
+    throw new ConfigValidationError(
+      firstIssue?.message ?? "Validation failed",
+      firstIssue?.path.join(".") || "unknown",
+      result.error.issues
+    );
+  }
+  return result.data;
+}
+
+// src/core/config/index.ts
+var META_ENV_VARS = /* @__PURE__ */ new Set([
+  "NOORM_CONFIG",
+  // Config selection
+  "NOORM_YES",
+  // Skip confirmations
+  "NOORM_JSON",
+  // JSON output mode
+  "NOORM_HEADLESS",
+  // Headless mode detection
+  "NOORM_DEBUG",
+  // Debug logging
+  "NOORM_DEV",
+  // Dev mode detection
+  "NOORM_CI_CONFIG_NAME",
+  // ci init config name override
+  "NOORM_LOGGER_DEBUG"
+  // Logger-internal debug
+]);
+var NON_CONFIG_ENV_PREFIXES = [
+  "NOORM_IDENTITY_"
+];
+var VALID_DIALECTS = ["postgres", "mysql", "sqlite", "mssql"];
+var { allConfigs, getConfig } = makeNestedConfig(process.env, {
+  filter: (key) => key.startsWith("NOORM_") && !META_ENV_VARS.has(key) && !NON_CONFIG_ENV_PREFIXES.some((prefix) => key.startsWith(prefix)),
+  stripPrefix: "NOORM_",
+  forceAllCapToLower: true,
+  memoizeOpts: false,
+  skipConversion: (key) => key.toLowerCase().includes("password")
+});
+function getEnvConfig() {
+  const config2 = allConfigs();
+  if (config2.connection?.dialect) {
+    const result = DialectSchema2.safeParse(config2.connection.dialect);
+    if (!result.success) {
+      throw new Error(
+        `Invalid NOORM_CONNECTION_DIALECT: must be one of ${VALID_DIALECTS.join(", ")}`
+      );
+    }
+  }
+  return config2;
+}
+
+// src/core/config/resolver.ts
+var SettingsProvider = class {
+  #manager;
+  constructor(manager) {
+    this.#manager = manager;
+  }
+  /** Get a stage by name */
+  getStage(name) {
+    return this.#manager.getStage(name) ?? null;
+  }
+  /** Get stage that matches a config name (for auto-linking) */
+  findStageForConfig(configName) {
+    return this.#manager.getStage(configName) ?? null;
+  }
+};
+var DEFAULTS = {
+  type: "local",
+  isTest: false,
+  protected: false,
+  connection: {
+    host: "localhost",
+    pool: { min: 0, max: 10 }
+  },
+  log: {
+    level: "info"
+  }
+};
+function resolveConfig(state, options = {}) {
+  const configName = options.name ?? getEnvConfigName() ?? state.getActiveConfigName();
+  if (!configName) {
+    const envConfig2 = getEnvConfig();
+    if (envConfig2.connection?.dialect && envConfig2.connection?.database) {
+      return resolveFromEnvOnly(envConfig2, options.flags, options.stage, options.settings);
+    }
+    return null;
+  }
+  const stored = state.getConfig(configName);
+  if (!stored) {
+    throw new Error(`Config "${configName}" not found`);
+  }
+  const stageDefaults = getStageDefaults(configName, options.stage, options.settings);
+  const envConfig = getEnvConfig();
+  let merged = clone(DEFAULTS);
+  if (stageDefaults) {
+    merged = merge(merged, stageDefaults);
+  }
+  merged = merge(merged, stored);
+  merged = merge(merged, envConfig);
+  merged = merge(merged, options.flags ?? {});
+  return parseConfig(merged);
+}
+function getStageDefaults(configName, stageName, settings) {
+  if (!settings) return null;
+  if (stageName) return settings.getStage(stageName)?.defaults ?? null;
+  return settings.findStageForConfig(configName)?.defaults ?? null;
+}
+function resolveFromEnvOnly(envConfig, flags, stageName, settings) {
+  const name = envConfig.name ?? flags?.name ?? "__env__";
+  const stageDefaults = getStageDefaults(name, stageName, settings);
+  let merged = clone(DEFAULTS);
+  if (stageDefaults) {
+    merged = merge(merged, stageDefaults);
+  }
+  merged = merge(merged, envConfig);
+  merged = merge(merged, flags ?? {});
+  if (!merged.name) {
+    merged.name = "__env__";
+  }
+  return parseConfig(merged);
+}
+
 // src/sdk/tvp.ts
 var MSSQL_PARAM_LIMIT = 2100;
 function tvp(typeName, rows) {
@@ -16822,6 +16938,16 @@ function isTvp(value) {
 }
 
 // src/sdk/sql.ts
+function quoteIdent(dialect, name) {
+  const parts = name.includes(".") ? name.split(".", 2) : [name];
+  if (dialect === "postgres") {
+    return parts.map((p) => '"' + p.replace(/"/g, '""') + '"').join(".");
+  }
+  if (dialect === "mssql") {
+    return parts.map((p) => "[" + p.replace(/]/g, "]]") + "]").join(".");
+  }
+  return parts.map((p) => "`" + p.replace(/`/g, "``") + "`").join(".");
+}
 function buildProcCall(dialect, name, params) {
   if (dialect === "sqlite") {
     throw new Error("SQLite does not support stored procedures.");
@@ -16829,7 +16955,7 @@ function buildProcCall(dialect, name, params) {
   if (params && hasTvpParam(params) && dialect !== "mssql") {
     throw new Error("Table-valued parameters (TVP) are only supported on MSSQL.");
   }
-  const rawName = sql.raw(name);
+  const rawName = sql.raw(quoteIdent(dialect, name));
   if (!params || Array.isArray(params) && params.length === 0 || !Array.isArray(params) && Object.keys(params).length === 0) {
     if (dialect === "mssql") {
       return sql`EXEC ${rawName}`;
@@ -16851,8 +16977,8 @@ function buildFuncCall(dialect, name, column, params) {
   if (params && hasTvpParam(params) && dialect !== "mssql") {
     throw new Error("Table-valued parameters (TVP) are only supported on MSSQL.");
   }
-  const rawName = sql.raw(name);
-  const rawCol = sql.raw(column);
+  const rawName = sql.raw(quoteIdent(dialect, name));
+  const rawCol = sql.raw(quoteIdent(dialect, column));
   if (!params || Array.isArray(params) && params.length === 0 || !Array.isArray(params) && Object.keys(params).length === 0) {
     return sql`SELECT ${rawName}() AS ${rawCol}`;
   }
@@ -16861,7 +16987,7 @@ function buildFuncCall(dialect, name, column, params) {
   }
   if (dialect === "postgres" && !Array.isArray(params)) {
     const parts = Object.entries(params).map(
-      ([key, val]) => sql`${sql.raw(key)} => ${val}`
+      ([key, val]) => sql`${sql.raw(quoteIdent("postgres", key))} => ${val}`
     );
     return sql`SELECT ${rawName}(${sql.join(parts)}) AS ${rawCol}`;
   }
@@ -16888,7 +17014,7 @@ function buildTvfCall(dialect, name, params) {
   if (params && hasTvpParam(params) && dialect !== "mssql") {
     throw new Error("Table-valued parameters (TVP) are only supported on MSSQL.");
   }
-  const rawName = sql.raw(name);
+  const rawName = sql.raw(quoteIdent(dialect, name));
   if (!params || Array.isArray(params) && params.length === 0 || !Array.isArray(params) && Object.keys(params).length === 0) {
     return sql`SELECT * FROM ${rawName}()`;
   }
@@ -16897,7 +17023,7 @@ function buildTvfCall(dialect, name, params) {
   }
   if (dialect === "postgres" && !Array.isArray(params)) {
     const parts = Object.entries(params).map(
-      ([key, val]) => sql`${sql.raw(key)} => ${val}`
+      ([key, val]) => sql`${sql.raw(quoteIdent("postgres", key))} => ${val}`
     );
     return sql`SELECT * FROM ${rawName}(${sql.join(parts)})`;
   }
@@ -16924,7 +17050,7 @@ function buildPostgresProc(rawName, params) {
     return sql`CALL ${rawName}(${joined})`;
   }
   const parts = Object.entries(params).map(
-    ([key, val]) => sql`${sql.raw(key)} => ${val}`
+    ([key, val]) => sql`${sql.raw(quoteIdent("postgres", key))} => ${val}`
   );
   return sql`CALL ${rawName}(${sql.join(parts)})`;
 }
@@ -19119,7 +19245,7 @@ async function executeChange(context, change, options = {}) {
   const [, lockErr] = await attempt(
     () => lockManager.acquire(context.db, context.configName, identity, {
       reason: `Change: ${change.name}`,
-      dialect: context.dialect
+      dialect: context.dialect ?? "postgres"
     })
   );
   if (lockErr) {
@@ -19191,7 +19317,7 @@ async function revertChange(context, change, options = {}) {
   const [, lockErr] = await attempt(
     () => lockManager.acquire(context.db, context.configName, identity, {
       reason: `Revert: ${change.name}`,
-      dialect: context.dialect
+      dialect: context.dialect ?? "postgres"
     })
   );
   if (lockErr) {
@@ -20117,9 +20243,16 @@ var ChangesNamespace = class {
   /**
    * Apply a specific change.
    *
+   * Pass `dryRun: true` to render the change to `tmp/` without
+   * touching the database, or `preview: true` to emit rendered SQL.
+   *
    * @example
    * ```typescript
    * const result = await ctx.noorm.changes.apply('2024-01-15-add-users')
+   * const dry = await ctx.noorm.changes.apply(
+   *     '2024-01-15-add-users',
+   *     { dryRun: true },
+   * )
    * ```
    */
   async apply(name, options) {
@@ -20128,9 +20261,16 @@ var ChangesNamespace = class {
   /**
    * Revert a specific change.
    *
+   * Pass `dryRun: true` to render the revert files to `tmp/` without
+   * touching the database, or `preview: true` to emit rendered SQL.
+   *
    * @example
    * ```typescript
    * const result = await ctx.noorm.changes.revert('2024-01-15-add-users')
+   * const dry = await ctx.noorm.changes.revert(
+   *     '2024-01-15-add-users',
+   *     { dryRun: true },
+   * )
    * ```
    */
   async revert(name, options) {
@@ -20140,25 +20280,37 @@ var ChangesNamespace = class {
   /**
    * Apply all pending changes.
    *
+   * Pass `dryRun: true` to render each change to `tmp/` without
+   * touching the database. Pass `preview: true` to emit rendered
+   * SQL (also without DB writes). When omitted, both default to
+   * `false` and changes are applied normally.
+   *
    * @example
    * ```typescript
    * const result = await ctx.noorm.changes.ff()
+   * const dry = await ctx.noorm.changes.ff({ dryRun: true })
+   * const forced = await ctx.noorm.changes.ff({ force: true })
    * ```
    */
-  async ff() {
-    return this.#getManager().ff();
+  async ff(options) {
+    return this.#getManager().ff(options);
   }
   /**
    * Apply the next N pending changes (default 1).
    *
+   * Pass `dryRun: true` to render the changes to `tmp/` without
+   * touching the database. Pass `preview: true` to emit rendered
+   * SQL (also without DB writes).
+   *
    * @example
    * ```typescript
    * const result = await ctx.noorm.changes.next()
    * const result = await ctx.noorm.changes.next(3)
+   * const dry = await ctx.noorm.changes.next(2, { dryRun: true })
    * ```
    */
-  async next(count = 1) {
-    return this.#getManager().next(count);
+  async next(count = 1, options) {
+    return this.#getManager().next(count, options);
   }
   // ─────────────────────────────────────────────────────
   // Status & history (connected)
@@ -20266,8 +20418,12 @@ var ChangesNamespace = class {
   }
   #createChangeContext() {
     const state = getStateManager(this.#state.projectRoot);
+    if (!this.#state.connection) {
+      throw new Error("Not connected. Call connect() first.");
+    }
     return {
       db: this.#kysely,
+      dialect: this.#state.connection.dialect,
       configName: this.#state.config.name,
       identity: this.#state.identity,
       projectRoot: this.#state.projectRoot,
@@ -20285,6 +20441,48 @@ var ChangesNamespace = class {
     return this.#manager;
   }
 };
+function splitMssqlBatches(content) {
+  const batches = content.split(/^\s*GO\s*$/mi);
+  return batches.map((b) => b.trim()).filter((b) => b.length > 0 && !isCommentOnly(b));
+}
+function isCommentOnly(batch) {
+  for (const line of batch.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.length > 0 && !trimmed.startsWith("--")) {
+      return false;
+    }
+  }
+  return true;
+}
+async function executeSqlBody(context, sqlContent) {
+  if (context.dialect !== "mssql") {
+    const [, execErr] = await attempt(() => sql.raw(sqlContent).execute(context.db));
+    if (execErr) {
+      return getSqlErrorMessage(execErr);
+    }
+    return null;
+  }
+  const batches = splitMssqlBatches(sqlContent);
+  if (batches.length === 0) {
+    return null;
+  }
+  if (batches.length === 1) {
+    const [, execErr] = await attempt(() => sql.raw(batches[0]).execute(context.db));
+    if (execErr) {
+      return getSqlErrorMessage(execErr);
+    }
+    return null;
+  }
+  for (let i = 0; i < batches.length; i++) {
+    const [, execErr] = await attempt(() => sql.raw(batches[i]).execute(context.db));
+    if (execErr) {
+      return `[batch ${i + 1} of ${batches.length}] ${getSqlErrorMessage(execErr)}`;
+    }
+  }
+  return null;
+}
+
+// src/core/runner/runner.ts
 var SQL_EXTENSIONS2 = [".sql", ".sql.tmpl"];
 var FILE_HEADER_TEMPLATE = `-- ============================================================
 -- File: %FILE%
@@ -20650,14 +20848,14 @@ async function executeSingleFileWithUpdate(context, filepath, checksum, options,
       return result2;
     }
   }
-  const [, execErr] = await attempt(() => sql.raw(sqlContent).execute(context.db));
+  const execErrMsg = await executeSqlBody(context, sqlContent);
   const durationMs = performance.now() - start;
-  if (execErr) {
+  if (execErrMsg) {
     const result2 = {
       filepath,
       checksum: finalChecksum,
       status: "failed",
-      error: getSqlErrorMessage(execErr),
+      error: execErrMsg,
       durationMs
     };
     await tracker.updateFileExecution(
@@ -20665,13 +20863,13 @@ async function executeSingleFileWithUpdate(context, filepath, checksum, options,
       relFilepath,
       "failed",
       Math.round(durationMs),
-      getSqlErrorMessage(execErr)
+      execErrMsg
     );
     observer.emit("file:after", {
       filepath,
       status: "failed",
       durationMs,
-      error: getSqlErrorMessage(execErr)
+      error: execErrMsg
     });
     return result2;
   }
@@ -20774,14 +20972,14 @@ async function executeSingleFile(context, filepath, options, tracker, operationI
     });
     return result2;
   }
-  const [, execErr] = await attempt(() => sql.raw(sqlContent).execute(context.db));
+  const execErrMsg = await executeSqlBody(context, sqlContent);
   const durationMs = performance.now() - start;
-  if (execErr) {
+  if (execErrMsg) {
     const result2 = {
       filepath,
       checksum,
       status: "failed",
-      error: getSqlErrorMessage(execErr),
+      error: execErrMsg,
       durationMs
     };
     await tracker.recordExecution({
@@ -20789,14 +20987,14 @@ async function executeSingleFile(context, filepath, options, tracker, operationI
       filepath: relFilepath,
       checksum,
       status: "failed",
-      errorMessage: getSqlErrorMessage(execErr),
+      errorMessage: execErrMsg,
       durationMs: Math.round(durationMs)
     });
     observer.emit("file:after", {
       filepath,
       status: "failed",
       durationMs,
-      error: getSqlErrorMessage(execErr)
+      error: execErrMsg
     });
     return result2;
   }
@@ -23322,10 +23520,10 @@ var { quote, qualifiedName } = createDialectQuoting({
   escape: '""'
 });
 var postgresTeardownOperations = {
-  disableForeignKeyChecks() {
+  disableForeignKeyChecks(_tables) {
     return "SET session_replication_role = 'replica'";
   },
-  enableForeignKeyChecks() {
+  enableForeignKeyChecks(_tables) {
     return "SET session_replication_role = 'origin'";
   },
   truncateTable(tableName, schema, restartIdentity = true) {
@@ -23360,10 +23558,10 @@ var { quote: quote2, qualifiedName: qualifiedName2 } = createDialectQuoting({
   escape: "``"
 });
 var mysqlTeardownOperations = {
-  disableForeignKeyChecks() {
+  disableForeignKeyChecks(_tables) {
     return "SET FOREIGN_KEY_CHECKS = 0";
   },
-  enableForeignKeyChecks() {
+  enableForeignKeyChecks(_tables) {
     return "SET FOREIGN_KEY_CHECKS = 1";
   },
   truncateTable(tableName, schema, _restartIdentity = true) {
@@ -23396,10 +23594,16 @@ var { quote: quote3, qualifiedName: qualifiedName3 } = createDialectQuoting({
   escape: "]]"
 });
 var mssqlTeardownOperations = {
-  disableForeignKeyChecks() {
+  disableForeignKeyChecks(tables) {
+    if (tables && tables.length > 0) {
+      return tables.map((t) => `ALTER TABLE ${qualifiedName3(t)} NOCHECK CONSTRAINT ALL`);
+    }
     return "EXEC sp_MSforeachtable 'ALTER TABLE ? NOCHECK CONSTRAINT ALL'";
   },
-  enableForeignKeyChecks() {
+  enableForeignKeyChecks(tables) {
+    if (tables && tables.length > 0) {
+      return tables.map((t) => `ALTER TABLE ${qualifiedName3(t)} CHECK CONSTRAINT ALL`);
+    }
     return "EXEC sp_MSforeachtable 'ALTER TABLE ? CHECK CONSTRAINT ALL'";
   },
   truncateTable(tableName, schema, restartIdentity = true) {
@@ -23438,10 +23642,10 @@ var { quote: quote4 } = createDialectQuoting({
   escape: '""'
 });
 var sqliteTeardownOperations = {
-  disableForeignKeyChecks() {
+  disableForeignKeyChecks(_tables) {
     return "PRAGMA foreign_keys = OFF";
   },
-  enableForeignKeyChecks() {
+  enableForeignKeyChecks(_tables) {
     return "PRAGMA foreign_keys = ON";
   },
   truncateTable(tableName, _schema, _restartIdentity = false) {
@@ -23491,6 +23695,13 @@ function isNoormTable2(name) {
   if (name.startsWith("__noorm_")) return true;
   return false;
 }
+function pushFlat(out, value) {
+  if (Array.isArray(value)) {
+    out.push(...value);
+    return;
+  }
+  out.push(value);
+}
 async function truncateData(db, dialect, options = {}) {
   const startTime = performance.now();
   const ops = getTeardownOperations(dialect);
@@ -23520,11 +23731,13 @@ async function truncateData(db, dialect, options = {}) {
     }
     truncated.push(tableName);
   }
-  statements.push(ops.disableForeignKeyChecks());
-  for (const tableName of truncated) {
-    statements.push(ops.truncateTable(tableName, void 0, options.restartIdentity ?? true));
+  if (truncated.length > 0) {
+    pushFlat(statements, ops.disableForeignKeyChecks(truncated));
+    for (const tableName of truncated) {
+      statements.push(ops.truncateTable(tableName, void 0, options.restartIdentity ?? true));
+    }
+    pushFlat(statements, ops.enableForeignKeyChecks(truncated));
   }
-  statements.push(ops.enableForeignKeyChecks());
   if (!options.dryRun) {
     for (const stmt of statements) {
       if (stmt.startsWith("--")) continue;
@@ -23596,6 +23809,18 @@ async function teardownSchema(db, dialect, options = {}) {
     dropped.foreignKeys.push(fk.name);
     statements.push(ops.dropForeignKey(fk.name, tableName, fk.schema));
   }
+  if (!options.keepProcedures) {
+    for (const proc of procedures) {
+      dropped.procedures.push(proc.name);
+      statements.push(ops.dropProcedure(proc.name, proc.schema));
+    }
+  }
+  if (!options.keepFunctions) {
+    for (const fn of functions) {
+      dropped.functions.push(fn.name);
+      statements.push(ops.dropFunction(fn.name, fn.schema));
+    }
+  }
   if (!options.keepViews) {
     for (const view of views) {
       dropped.views.push(view.name);
@@ -23615,18 +23840,6 @@ async function teardownSchema(db, dialect, options = {}) {
     dropped.tables.push(tableName);
     statements.push(ops.dropTable(tableName, table.schema));
   }
-  if (!options.keepFunctions) {
-    for (const fn of functions) {
-      dropped.functions.push(fn.name);
-      statements.push(ops.dropFunction(fn.name, fn.schema));
-    }
-  }
-  if (!options.keepProcedures) {
-    for (const proc of procedures) {
-      dropped.procedures.push(proc.name);
-      statements.push(ops.dropProcedure(proc.name, proc.schema));
-    }
-  }
   const skipTypesDueToKeptRoutines = dialect === "mssql" && (options.keepFunctions || options.keepProcedures);
   if (!options.keepTypes && !skipTypesDueToKeptRoutines) {
     const sortedTypes = [...types].sort((a, b) => {
@@ -24286,25 +24499,60 @@ async function copyVaultSecrets(sourceConfig, destConfig, keys, identityHash, pr
 // src/sdk/namespaces/vault.ts
 var VaultNamespace = class {
   #state;
+  #cryptoIdentity = null;
   constructor(state) {
     this.#state = state;
   }
+  /**
+   * Load the cryptographic identity (with publicKey + identityHash) on
+   * demand. The Context's state.identity is the audit identity (name +
+   * email only); the crypto fields needed for vault encryption live in
+   * `~/.noorm/identity.json` (or a NOORM_IDENTITY_* env override).
+   *
+   * Cached after the first call so repeated vault ops don't re-read disk.
+   */
+  async #getCryptoIdentity() {
+    if (this.#cryptoIdentity) return this.#cryptoIdentity;
+    const loaded = await loadIdentityMetadata();
+    if (!loaded) {
+      throw new Error(
+        "Vault operations require a cryptographic identity at ~/.noorm/identity.json. Run `noorm identity init` or set NOORM_IDENTITY_* env vars in CI."
+      );
+    }
+    this.#cryptoIdentity = loaded;
+    return loaded;
+  }
   // ─────────────────────────────────────────────────────
   // Lifecycle
   // ─────────────────────────────────────────────────────
   /**
    * Initialize the vault for this database.
    *
+   * Idempotent. Returns the vault key on first init; returns [null, null]
+   * on subsequent calls when the vault already exists. Returns [null, Error]
+   * only on real failures (DB errors, encryption errors).
+   *
+   * The `vault:initialized` observer event fires only on first init, never
+   * on repeat calls.
+   *
    * @example
    * ```typescript
-   * const [vaultKey, err] = await ctx.noorm.vault.init()
+   * const [vaultKey, err] = await ctx.noorm.vault.init();
+   * if (err) throw err;
+   * if (vaultKey) {
+   *     // first-time init — set initial secrets, etc.
+   * }
+   * else {
+   *     // already initialized — vault.get / vault.set with private key
+   * }
    * ```
    */
   async init() {
+    const crypto = await this.#getCryptoIdentity();
     return initializeVault(
       this.#kysely,
-      this.#identityHash,
-      this.#publicKey,
+      crypto.identityHash,
+      crypto.publicKey,
       this.#dialect
     );
   }
@@ -24317,9 +24565,10 @@ var VaultNamespace = class {
    * ```
    */
   async status() {
+    const crypto = await this.#getCryptoIdentity();
     return getVaultStatus(
       this.#kysely,
-      this.#identityHash,
+      crypto.identityHash,
       this.#dialect
     );
   }
@@ -24456,13 +24705,14 @@ var VaultNamespace = class {
    * ```
    */
   async copy(destConfig, keys, privateKey, options) {
+    const crypto = await this.#getCryptoIdentity();
     return copyVaultSecrets(
       this.#state.config,
       destConfig,
       keys,
-      this.#identityHash,
+      crypto.identityHash,
       privateKey,
-      this.#publicKey,
+      crypto.publicKey,
       options
     );
   }
@@ -24475,21 +24725,14 @@ var VaultNamespace = class {
     }
     return this.#state.connection.db;
   }
-  get #identityHash() {
-    const identity = this.#state.identity;
-    return identity["identityHash"] ?? "";
-  }
-  get #publicKey() {
-    const identity = this.#state.identity;
-    return identity["publicKey"] ?? "";
-  }
   get #dialect() {
     return this.#state.config.connection.dialect;
   }
   async #getVaultKey(privateKey) {
+    const crypto = await this.#getCryptoIdentity();
     return getVaultKey(
       this.#kysely,
-      this.#identityHash,
+      crypto.identityHash,
       privateKey,
       this.#dialect
     );
@@ -24575,7 +24818,7 @@ function isSameServer(source, dest) {
   }
   return true;
 }
-function quoteIdent(name) {
+function quoteIdent2(name) {
   return `"${name.replace(/"/g, '""')}"`;
 }
 var postgresTransferOperations = {
@@ -24592,20 +24835,20 @@ var postgresTransferOperations = {
     return null;
   },
   getResetSequenceSql(table, column, schema) {
-    const fullTable = schema ? `${quoteIdent(schema)}.${quoteIdent(table)}` : quoteIdent(table);
+    const fullTable = schema ? `${quoteIdent2(schema)}.${quoteIdent2(table)}` : quoteIdent2(table);
     return `
             SELECT setval(
                 pg_get_serial_sequence('${schema ? schema + "." : ""}${table}', '${column}'),
-                COALESCE((SELECT MAX(${quoteIdent(column)}) FROM ${fullTable}), 0) + 1,
+                COALESCE((SELECT MAX(${quoteIdent2(column)}) FROM ${fullTable}), 0) + 1,
                 false
             )
         `.trim();
   },
   buildConflictInsert(table, columns, primaryKey, strategy) {
-    const quotedCols = columns.map(quoteIdent).join(", ");
+    const quotedCols = columns.map(quoteIdent2).join(", ");
     const placeholders = columns.map((_, i) => `$${i + 1}`).join(", ");
-    const pkCols = primaryKey.map(quoteIdent).join(", ");
-    let insertSql = `INSERT INTO ${quoteIdent(table)} (${quotedCols}) OVERRIDING SYSTEM VALUE VALUES (${placeholders})`;
+    const pkCols = primaryKey.map(quoteIdent2).join(", ");
+    let insertSql = `INSERT INTO ${quoteIdent2(table)} (${quotedCols}) OVERRIDING SYSTEM VALUE VALUES (${placeholders})`;
     switch (strategy) {
       case "fail":
         break;
@@ -24615,7 +24858,7 @@ var postgresTransferOperations = {
       case "update": {
         const updateCols = columns.filter((c) => !primaryKey.includes(c));
         if (updateCols.length > 0) {
-          const setClauses = updateCols.map((c) => `${quoteIdent(c)} = EXCLUDED.${quoteIdent(c)}`).join(", ");
+          const setClauses = updateCols.map((c) => `${quoteIdent2(c)} = EXCLUDED.${quoteIdent2(c)}`).join(", ");
           insertSql += ` ON CONFLICT (${pkCols}) DO UPDATE SET ${setClauses}`;
         } else {
           insertSql += ` ON CONFLICT (${pkCols}) DO NOTHING`;
@@ -24624,7 +24867,7 @@ var postgresTransferOperations = {
       }
       case "replace":
         {
-          const setClauses = columns.map((c) => `${quoteIdent(c)} = EXCLUDED.${quoteIdent(c)}`).join(", ");
+          const setClauses = columns.map((c) => `${quoteIdent2(c)} = EXCLUDED.${quoteIdent2(c)}`).join(", ");
           insertSql += ` ON CONFLICT (${pkCols}) DO UPDATE SET ${setClauses}`;
         }
         break;
@@ -24632,9 +24875,9 @@ var postgresTransferOperations = {
     return insertSql;
   },
   buildDirectTransfer(srcDb, srcTable, dstTable, columns, srcSchema = "public", dstSchema = "public") {
-    const quotedCols = columns.map(quoteIdent).join(", ");
-    const srcFull = `${quoteIdent(srcSchema)}.${quoteIdent(srcTable)}`;
-    const dstFull = `${quoteIdent(dstSchema)}.${quoteIdent(dstTable)}`;
+    const quotedCols = columns.map(quoteIdent2).join(", ");
+    const srcFull = `${quoteIdent2(srcSchema)}.${quoteIdent2(srcTable)}`;
+    const dstFull = `${quoteIdent2(dstSchema)}.${quoteIdent2(dstTable)}`;
     return `INSERT INTO ${dstFull} (${quotedCols}) OVERRIDING SYSTEM VALUE SELECT ${quotedCols} FROM ${srcFull}`;
   },
   async executeDisableFK(db) {
@@ -24644,7 +24887,7 @@ var postgresTransferOperations = {
     await sql.raw(this.getEnableFKSql()).execute(db);
   }
 };
-function quoteIdent2(name) {
+function quoteIdent3(name) {
   return `\`${name.replace(/`/g, "``")}\``;
 }
 var mysqlTransferOperations = {
@@ -24661,32 +24904,32 @@ var mysqlTransferOperations = {
     return null;
   },
   getResetSequenceSql(table, _column, _schema) {
-    return `ALTER TABLE ${quoteIdent2(table)} AUTO_INCREMENT = 1`;
+    return `ALTER TABLE ${quoteIdent3(table)} AUTO_INCREMENT = 1`;
   },
   buildConflictInsert(table, columns, primaryKey, strategy) {
-    const quotedCols = columns.map(quoteIdent2).join(", ");
+    const quotedCols = columns.map(quoteIdent3).join(", ");
     const placeholders = columns.map(() => "?").join(", ");
     switch (strategy) {
       case "fail":
-        return `INSERT INTO ${quoteIdent2(table)} (${quotedCols}) VALUES (${placeholders})`;
+        return `INSERT INTO ${quoteIdent3(table)} (${quotedCols}) VALUES (${placeholders})`;
       case "skip":
-        return `INSERT IGNORE INTO ${quoteIdent2(table)} (${quotedCols}) VALUES (${placeholders})`;
+        return `INSERT IGNORE INTO ${quoteIdent3(table)} (${quotedCols}) VALUES (${placeholders})`;
       case "update": {
         const updateCols = columns.filter((c) => !primaryKey.includes(c));
         if (updateCols.length > 0) {
-          const setClauses = updateCols.map((c) => `${quoteIdent2(c)} = VALUES(${quoteIdent2(c)})`).join(", ");
-          return `INSERT INTO ${quoteIdent2(table)} (${quotedCols}) VALUES (${placeholders}) ON DUPLICATE KEY UPDATE ${setClauses}`;
+          const setClauses = updateCols.map((c) => `${quoteIdent3(c)} = VALUES(${quoteIdent3(c)})`).join(", ");
+          return `INSERT INTO ${quoteIdent3(table)} (${quotedCols}) VALUES (${placeholders}) ON DUPLICATE KEY UPDATE ${setClauses}`;
         }
-        return `INSERT IGNORE INTO ${quoteIdent2(table)} (${quotedCols}) VALUES (${placeholders})`;
+        return `INSERT IGNORE INTO ${quoteIdent3(table)} (${quotedCols}) VALUES (${placeholders})`;
       }
       case "replace":
-        return `REPLACE INTO ${quoteIdent2(table)} (${quotedCols}) VALUES (${placeholders})`;
+        return `REPLACE INTO ${quoteIdent3(table)} (${quotedCols}) VALUES (${placeholders})`;
     }
   },
   buildDirectTransfer(srcDb, srcTable, dstTable, columns, _srcSchema, _dstSchema) {
-    const quotedCols = columns.map(quoteIdent2).join(", ");
-    const srcFull = `${quoteIdent2(srcDb)}.${quoteIdent2(srcTable)}`;
-    const dstFull = quoteIdent2(dstTable);
+    const quotedCols = columns.map(quoteIdent3).join(", ");
+    const srcFull = `${quoteIdent3(srcDb)}.${quoteIdent3(srcTable)}`;
+    const dstFull = quoteIdent3(dstTable);
     return `INSERT INTO ${dstFull} (${quotedCols}) SELECT ${quotedCols} FROM ${srcFull}`;
   },
   async executeDisableFK(db) {
@@ -24696,7 +24939,7 @@ var mysqlTransferOperations = {
     await sql.raw(this.getEnableFKSql()).execute(db);
   }
 };
-function quoteIdent3(name) {
+function quoteIdent4(name) {
   return `[${name.replace(/\]/g, "]]")}]`;
 }
 var mssqlTransferOperations = {
@@ -24707,27 +24950,27 @@ var mssqlTransferOperations = {
     return "-- FK enable per-table";
   },
   getEnableIdentityInsertSql(table) {
-    return `SET IDENTITY_INSERT ${quoteIdent3(table)} ON`;
+    return `SET IDENTITY_INSERT ${quoteIdent4(table)} ON`;
   },
   getDisableIdentityInsertSql(table) {
-    return `SET IDENTITY_INSERT ${quoteIdent3(table)} OFF`;
+    return `SET IDENTITY_INSERT ${quoteIdent4(table)} OFF`;
   },
   getResetSequenceSql(table, _column, _schema) {
     return `DBCC CHECKIDENT ('${table}', RESEED)`;
   },
   buildConflictInsert(table, columns, primaryKey, strategy) {
-    const quotedCols = columns.map(quoteIdent3).join(", ");
+    const quotedCols = columns.map(quoteIdent4).join(", ");
     const placeholders = columns.map((_, i) => `@p${i}`).join(", ");
     switch (strategy) {
       case "fail":
-        return `INSERT INTO ${quoteIdent3(table)} (${quotedCols}) VALUES (${placeholders})`;
+        return `INSERT INTO ${quoteIdent4(table)} (${quotedCols}) VALUES (${placeholders})`;
       case "skip":
       case "update":
       case "replace": {
-        const pkConditions = primaryKey.map((pk) => `target.${quoteIdent3(pk)} = source.${quoteIdent3(pk)}`).join(" AND ");
-        const sourceValues = columns.map((c, i) => `@p${i} AS ${quoteIdent3(c)}`).join(", ");
+        const pkConditions = primaryKey.map((pk) => `target.${quoteIdent4(pk)} = source.${quoteIdent4(pk)}`).join(" AND ");
+        const sourceValues = columns.map((c, i) => `@p${i} AS ${quoteIdent4(c)}`).join(", ");
         let mergeSql = `
-                MERGE INTO ${quoteIdent3(table)} AS target
+                MERGE INTO ${quoteIdent4(table)} AS target
                 USING (SELECT ${sourceValues}) AS source
                 ON (${pkConditions})
             `.trim();
@@ -24735,12 +24978,12 @@ var mssqlTransferOperations = {
           mergeSql += `
                     WHEN NOT MATCHED THEN
                         INSERT (${quotedCols})
-                        VALUES (${columns.map((c) => `source.${quoteIdent3(c)}`).join(", ")})
+                        VALUES (${columns.map((c) => `source.${quoteIdent4(c)}`).join(", ")})
                 `;
         } else if (strategy === "update") {
           const updateCols = columns.filter((c) => !primaryKey.includes(c));
           if (updateCols.length > 0) {
-            const setClauses = updateCols.map((c) => `target.${quoteIdent3(c)} = source.${quoteIdent3(c)}`).join(", ");
+            const setClauses = updateCols.map((c) => `target.${quoteIdent4(c)} = source.${quoteIdent4(c)}`).join(", ");
             mergeSql += `
                         WHEN MATCHED THEN
                             UPDATE SET ${setClauses}
@@ -24749,16 +24992,16 @@ var mssqlTransferOperations = {
           mergeSql += `
                     WHEN NOT MATCHED THEN
                         INSERT (${quotedCols})
-                        VALUES (${columns.map((c) => `source.${quoteIdent3(c)}`).join(", ")})
+                        VALUES (${columns.map((c) => `source.${quoteIdent4(c)}`).join(", ")})
                 `;
         } else {
-          const setClauses = columns.map((c) => `target.${quoteIdent3(c)} = source.${quoteIdent3(c)}`).join(", ");
+          const setClauses = columns.map((c) => `target.${quoteIdent4(c)} = source.${quoteIdent4(c)}`).join(", ");
           mergeSql += `
                     WHEN MATCHED THEN
                         UPDATE SET ${setClauses}
                     WHEN NOT MATCHED THEN
                         INSERT (${quotedCols})
-                        VALUES (${columns.map((c) => `source.${quoteIdent3(c)}`).join(", ")})
+                        VALUES (${columns.map((c) => `source.${quoteIdent4(c)}`).join(", ")})
                 `;
         }
         mergeSql += ";";
@@ -24767,19 +25010,19 @@ var mssqlTransferOperations = {
     }
   },
   buildDirectTransfer(srcDb, srcTable, dstTable, columns, srcSchema = "dbo", dstSchema = "dbo") {
-    const quotedCols = columns.map(quoteIdent3).join(", ");
-    const srcFull = `${quoteIdent3(srcDb)}.${quoteIdent3(srcSchema)}.${quoteIdent3(srcTable)}`;
-    const dstFull = `${quoteIdent3(dstSchema)}.${quoteIdent3(dstTable)}`;
+    const quotedCols = columns.map(quoteIdent4).join(", ");
+    const srcFull = `${quoteIdent4(srcDb)}.${quoteIdent4(srcSchema)}.${quoteIdent4(srcTable)}`;
+    const dstFull = `${quoteIdent4(dstSchema)}.${quoteIdent4(dstTable)}`;
     return `INSERT INTO ${dstFull} (${quotedCols}) SELECT ${quotedCols} FROM ${srcFull}`;
   },
   async executeDisableFK(db, tables) {
     for (const table of tables) {
-      await sql.raw(`ALTER TABLE ${quoteIdent3(table)} NOCHECK CONSTRAINT ALL`).execute(db);
+      await sql.raw(`ALTER TABLE ${quoteIdent4(table)} NOCHECK CONSTRAINT ALL`).execute(db);
     }
   },
   async executeEnableFK(db, tables) {
     for (const table of tables) {
-      await sql.raw(`ALTER TABLE ${quoteIdent3(table)} WITH CHECK CHECK CONSTRAINT ALL`).execute(db);
+      await sql.raw(`ALTER TABLE ${quoteIdent4(table)} WITH CHECK CHECK CONSTRAINT ALL`).execute(db);
     }
   }
 };
@@ -26319,10 +26562,10 @@ async function transferTableCrossDialect(ctx, plan, transferPlan, options) {
   }, null];
 }
 async function fetchBatch(db, dialect, table, columns, limit, offset, _schema) {
-  const quoteIdent4 = dialect === "mssql" ? (c) => `[${c}]` : dialect === "mysql" ? (c) => `\`${c}\`` : (c) => `"${c}"`;
-  const columnList = columns.map(quoteIdent4).join(", ");
+  const quoteIdent5 = dialect === "mssql" ? (c) => `[${c}]` : dialect === "mysql" ? (c) => `\`${c}\`` : (c) => `"${c}"`;
+  const columnList = columns.map(quoteIdent5).join(", ");
   if (dialect === "mssql") {
-    const orderCol = quoteIdent4(columns[0]);
+    const orderCol = quoteIdent5(columns[0]);
     const result2 = await sql`
             SELECT ${sql.raw(columnList)}
             FROM ${sql.table(table)}
@@ -26988,9 +27231,9 @@ async function exportTableWithWorkers(ctx) {
     totalRows = Number(firstRow?.["cnt"] ?? 0);
   }
   const columns = dtSchema.columns.map((c) => c.name);
-  const quoteIdent4 = getQuoteIdent(dialect);
-  const columnList = columns.map(quoteIdent4).join(", ");
-  const orderCol = quoteIdent4(columns[0]);
+  const quoteIdent5 = getQuoteIdent(dialect);
+  const columnList = columns.map(quoteIdent5).join(", ");
+  const orderCol = quoteIdent5(columns[0]);
   let globalIndex = 0;
   let loaded = 0;
   let processed = 0;
@@ -27748,10 +27991,40 @@ var Context = class {
       throw new Error("SQLite does not support stored procedures.");
     }
     const params = args[0];
+    if (this.dialect === "postgres") {
+      return this.#executeProcPostgres(name, params);
+    }
     const query = buildProcCall(this.dialect, name, params);
     const result = await query.execute(this.kysely);
     return result.rows ?? [];
   }
+  /**
+   * Execute a stored procedure on PostgreSQL with FUNCTION fallback.
+   *
+   * PostgreSQL distinguishes between PROCEDURE and FUNCTION objects:
+   * `CALL` only works against true procedures and raises SQLSTATE 42809
+   * (`<name>(...) is not a procedure`) when the target is a function.
+   *
+   * The noorm playbook tells schema authors to use `CREATE PROCEDURE`
+   * for void-returning ops and `CREATE FUNCTION` for row-returning ops,
+   * and `ctx.proc()` is expected to handle both. So if `CALL` fails
+   * with the wrong-object-type error, we retry with
+   * `SELECT * FROM <name>(...)`, which works for both scalar and
+   * set-returning PG functions.
+   */
+  async #executeProcPostgres(name, params) {
+    const callQuery = buildProcCall("postgres", name, params);
+    const [callResult, callErr] = await attempt(() => callQuery.execute(this.kysely));
+    if (!callErr) {
+      return callResult.rows ?? [];
+    }
+    if (!isFunctionNotProcedureError(callErr)) {
+      throw callErr;
+    }
+    const tvfQuery = buildTvfCall("postgres", name, params);
+    const tvfResult = await tvfQuery.execute(this.kysely);
+    return tvfResult.rows ?? [];
+  }
   /**
    * Call a database function and return the scalar result.
    *
@@ -27867,6 +28140,14 @@ var Context = class {
     return ready;
   }
 };
+function isFunctionNotProcedureError(err) {
+  if (!err || typeof err !== "object") return false;
+  const obj = err;
+  if (obj.code !== "42809" && obj.code !== "42883") return false;
+  const msg = String(obj.message ?? "");
+  const hint = String(obj.hint ?? "");
+  return msg.includes("is not a procedure") || msg.includes("procedure") || hint.includes("use SELECT");
+}
 
 // src/sdk/index.ts
 function toSettingsProvider(manager) {
@@ -27874,6 +28155,11 @@ function toSettingsProvider(manager) {
 }
 async function createContext(options = {}) {
   const projectRoot = options.projectRoot ?? process.cwd();
+  const envIdentity = loadIdentityFromEnv();
+  if (envIdentity) {
+    setKeyOverride(envIdentity.privateKey);
+    setIdentityOverride(envIdentity.identity);
+  }
   await initState(projectRoot);
   const state = getStateManager(projectRoot);
   const settingsManager = getSettingsManager(projectRoot);