@noormdev/sdk 1.0.0-alpha.34 → 1.0.0-alpha.36

package/dist/index.js

@@ -1,8 +1,8 @@
 import { createRequire } from 'module';
 import { processFile, DtReader, isTemplate, FORMAT_VERSION, DT_EXTENSIONS, encryptWithPassphrase, ENCODED_TYPES } from './chunk-5AYPF5D5.js';
 import './chunk-UOFJT5PY.js';
-import { initializeVault, getVaultStatus, setVaultSecret, getVaultSecret, getAllVaultSecrets, listVaultSecretKeys, deleteVaultSecret, vaultSecretExists, getVaultKey, noormDb, getNoormTables, encryptVaultKey } from './chunk-DE3NJ22A.js';
-import { makeNestedConfig, gigabytes, observer, attempt, retry, attemptSync, clone, merge, ObserverRelay } from './chunk-DLQES4PM.js';
+import { initializeVault, getVaultStatus, setVaultSecret, getVaultSecret, getAllVaultSecrets, listVaultSecretKeys, deleteVaultSecret, vaultSecretExists, getVaultKey, noormDb, getNoormTables, encryptVaultKey } from './chunk-WFVWNXTV.js';
+import { makeNestedConfig, gigabytes, observer, attempt, attemptSync, retry, clone, merge, ObserverRelay } from './chunk-DLQES4PM.js';
 import { dist_default } from './chunk-TBRUDUBQ.js';
 import { require_dist } from './chunk-YJBKNUTP.js';
 import { __commonJS, __export, __toESM } from './chunk-D2XW2UOP.js';
@@ -15797,7 +15797,7 @@ async function getDialectFactory(dialect) {
     case "mysql":
       return (await import('./mysql-UPMQUBLE.js')).createMysqlConnection;
     case "mssql":
-      return (await import('./mssql-3NNVV77C.js')).createMssqlConnection;
+      return (await import('./mssql-NIABT3Z4.js')).createMssqlConnection;
     default:
       throw new Error(`Unsupported dialect: ${dialect}`);
   }
@@ -16938,6 +16938,16 @@ function isTvp(value) {
 }
 
 // src/sdk/sql.ts
+function quoteIdent(dialect, name) {
+  const parts = name.includes(".") ? name.split(".", 2) : [name];
+  if (dialect === "postgres") {
+    return parts.map((p) => '"' + p.replace(/"/g, '""') + '"').join(".");
+  }
+  if (dialect === "mssql") {
+    return parts.map((p) => "[" + p.replace(/]/g, "]]") + "]").join(".");
+  }
+  return parts.map((p) => "`" + p.replace(/`/g, "``") + "`").join(".");
+}
 function buildProcCall(dialect, name, params) {
   if (dialect === "sqlite") {
     throw new Error("SQLite does not support stored procedures.");
@@ -16945,7 +16955,7 @@ function buildProcCall(dialect, name, params) {
   if (params && hasTvpParam(params) && dialect !== "mssql") {
     throw new Error("Table-valued parameters (TVP) are only supported on MSSQL.");
   }
-  const rawName = sql.raw(name);
+  const rawName = sql.raw(quoteIdent(dialect, name));
   if (!params || Array.isArray(params) && params.length === 0 || !Array.isArray(params) && Object.keys(params).length === 0) {
     if (dialect === "mssql") {
       return sql`EXEC ${rawName}`;
@@ -16967,8 +16977,8 @@ function buildFuncCall(dialect, name, column, params) {
   if (params && hasTvpParam(params) && dialect !== "mssql") {
     throw new Error("Table-valued parameters (TVP) are only supported on MSSQL.");
   }
-  const rawName = sql.raw(name);
-  const rawCol = sql.raw(column);
+  const rawName = sql.raw(quoteIdent(dialect, name));
+  const rawCol = sql.raw(quoteIdent(dialect, column));
   if (!params || Array.isArray(params) && params.length === 0 || !Array.isArray(params) && Object.keys(params).length === 0) {
     return sql`SELECT ${rawName}() AS ${rawCol}`;
   }
@@ -16977,7 +16987,7 @@ function buildFuncCall(dialect, name, column, params) {
   }
   if (dialect === "postgres" && !Array.isArray(params)) {
     const parts = Object.entries(params).map(
-      ([key, val]) => sql`${sql.raw(key)} => ${val}`
+      ([key, val]) => sql`${sql.raw(quoteIdent("postgres", key))} => ${val}`
     );
     return sql`SELECT ${rawName}(${sql.join(parts)}) AS ${rawCol}`;
   }
@@ -17004,7 +17014,7 @@ function buildTvfCall(dialect, name, params) {
   if (params && hasTvpParam(params) && dialect !== "mssql") {
     throw new Error("Table-valued parameters (TVP) are only supported on MSSQL.");
   }
-  const rawName = sql.raw(name);
+  const rawName = sql.raw(quoteIdent(dialect, name));
   if (!params || Array.isArray(params) && params.length === 0 || !Array.isArray(params) && Object.keys(params).length === 0) {
     return sql`SELECT * FROM ${rawName}()`;
   }
@@ -17013,7 +17023,7 @@ function buildTvfCall(dialect, name, params) {
   }
   if (dialect === "postgres" && !Array.isArray(params)) {
     const parts = Object.entries(params).map(
-      ([key, val]) => sql`${sql.raw(key)} => ${val}`
+      ([key, val]) => sql`${sql.raw(quoteIdent("postgres", key))} => ${val}`
     );
     return sql`SELECT * FROM ${rawName}(${sql.join(parts)})`;
   }
@@ -17040,7 +17050,7 @@ function buildPostgresProc(rawName, params) {
     return sql`CALL ${rawName}(${joined})`;
   }
   const parts = Object.entries(params).map(
-    ([key, val]) => sql`${sql.raw(key)} => ${val}`
+    ([key, val]) => sql`${sql.raw(quoteIdent("postgres", key))} => ${val}`
   );
   return sql`CALL ${rawName}(${sql.join(parts)})`;
 }
@@ -20233,9 +20243,16 @@ var ChangesNamespace = class {
   /**
    * Apply a specific change.
    *
+   * Pass `dryRun: true` to render the change to `tmp/` without
+   * touching the database, or `preview: true` to emit rendered SQL.
+   *
    * @example
    * ```typescript
    * const result = await ctx.noorm.changes.apply('2024-01-15-add-users')
+   * const dry = await ctx.noorm.changes.apply(
+   *     '2024-01-15-add-users',
+   *     { dryRun: true },
+   * )
    * ```
    */
   async apply(name, options) {
@@ -20244,9 +20261,16 @@ var ChangesNamespace = class {
   /**
    * Revert a specific change.
    *
+   * Pass `dryRun: true` to render the revert files to `tmp/` without
+   * touching the database, or `preview: true` to emit rendered SQL.
+   *
    * @example
    * ```typescript
    * const result = await ctx.noorm.changes.revert('2024-01-15-add-users')
+   * const dry = await ctx.noorm.changes.revert(
+   *     '2024-01-15-add-users',
+   *     { dryRun: true },
+   * )
    * ```
    */
   async revert(name, options) {
@@ -20256,25 +20280,37 @@ var ChangesNamespace = class {
   /**
    * Apply all pending changes.
    *
+   * Pass `dryRun: true` to render each change to `tmp/` without
+   * touching the database. Pass `preview: true` to emit rendered
+   * SQL (also without DB writes). When omitted, both default to
+   * `false` and changes are applied normally.
+   *
    * @example
    * ```typescript
    * const result = await ctx.noorm.changes.ff()
+   * const dry = await ctx.noorm.changes.ff({ dryRun: true })
+   * const forced = await ctx.noorm.changes.ff({ force: true })
    * ```
    */
-  async ff() {
-    return this.#getManager().ff();
+  async ff(options) {
+    return this.#getManager().ff(options);
   }
   /**
    * Apply the next N pending changes (default 1).
    *
+   * Pass `dryRun: true` to render the changes to `tmp/` without
+   * touching the database. Pass `preview: true` to emit rendered
+   * SQL (also without DB writes).
+   *
    * @example
    * ```typescript
    * const result = await ctx.noorm.changes.next()
    * const result = await ctx.noorm.changes.next(3)
+   * const dry = await ctx.noorm.changes.next(2, { dryRun: true })
    * ```
    */
-  async next(count = 1) {
-    return this.#getManager().next(count);
+  async next(count = 1, options) {
+    return this.#getManager().next(count, options);
   }
   // ─────────────────────────────────────────────────────
   // Status & history (connected)
@@ -20405,6 +20441,48 @@ var ChangesNamespace = class {
     return this.#manager;
   }
 };
+function splitMssqlBatches(content) {
+  const batches = content.split(/^\s*GO\s*$/mi);
+  return batches.map((b) => b.trim()).filter((b) => b.length > 0 && !isCommentOnly(b));
+}
+function isCommentOnly(batch) {
+  for (const line of batch.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.length > 0 && !trimmed.startsWith("--")) {
+      return false;
+    }
+  }
+  return true;
+}
+async function executeSqlBody(context, sqlContent) {
+  if (context.dialect !== "mssql") {
+    const [, execErr] = await attempt(() => sql.raw(sqlContent).execute(context.db));
+    if (execErr) {
+      return getSqlErrorMessage(execErr);
+    }
+    return null;
+  }
+  const batches = splitMssqlBatches(sqlContent);
+  if (batches.length === 0) {
+    return null;
+  }
+  if (batches.length === 1) {
+    const [, execErr] = await attempt(() => sql.raw(batches[0]).execute(context.db));
+    if (execErr) {
+      return getSqlErrorMessage(execErr);
+    }
+    return null;
+  }
+  for (let i = 0; i < batches.length; i++) {
+    const [, execErr] = await attempt(() => sql.raw(batches[i]).execute(context.db));
+    if (execErr) {
+      return `[batch ${i + 1} of ${batches.length}] ${getSqlErrorMessage(execErr)}`;
+    }
+  }
+  return null;
+}
+
+// src/core/runner/runner.ts
 var SQL_EXTENSIONS2 = [".sql", ".sql.tmpl"];
 var FILE_HEADER_TEMPLATE = `-- ============================================================
 -- File: %FILE%
@@ -20770,14 +20848,14 @@ async function executeSingleFileWithUpdate(context, filepath, checksum, options,
       return result2;
     }
   }
-  const [, execErr] = await attempt(() => sql.raw(sqlContent).execute(context.db));
+  const execErrMsg = await executeSqlBody(context, sqlContent);
   const durationMs = performance.now() - start;
-  if (execErr) {
+  if (execErrMsg) {
     const result2 = {
       filepath,
       checksum: finalChecksum,
       status: "failed",
-      error: getSqlErrorMessage(execErr),
+      error: execErrMsg,
       durationMs
     };
     await tracker.updateFileExecution(
@@ -20785,13 +20863,13 @@ async function executeSingleFileWithUpdate(context, filepath, checksum, options,
       relFilepath,
       "failed",
       Math.round(durationMs),
-      getSqlErrorMessage(execErr)
+      execErrMsg
     );
     observer.emit("file:after", {
       filepath,
       status: "failed",
       durationMs,
-      error: getSqlErrorMessage(execErr)
+      error: execErrMsg
     });
     return result2;
   }
@@ -20894,14 +20972,14 @@ async function executeSingleFile(context, filepath, options, tracker, operationI
     });
     return result2;
   }
-  const [, execErr] = await attempt(() => sql.raw(sqlContent).execute(context.db));
+  const execErrMsg = await executeSqlBody(context, sqlContent);
   const durationMs = performance.now() - start;
-  if (execErr) {
+  if (execErrMsg) {
     const result2 = {
       filepath,
       checksum,
       status: "failed",
-      error: getSqlErrorMessage(execErr),
+      error: execErrMsg,
       durationMs
     };
     await tracker.recordExecution({
@@ -20909,14 +20987,14 @@ async function executeSingleFile(context, filepath, options, tracker, operationI
       filepath: relFilepath,
       checksum,
       status: "failed",
-      errorMessage: getSqlErrorMessage(execErr),
+      errorMessage: execErrMsg,
       durationMs: Math.round(durationMs)
     });
     observer.emit("file:after", {
       filepath,
       status: "failed",
       durationMs,
-      error: getSqlErrorMessage(execErr)
+      error: execErrMsg
     });
     return result2;
   }
@@ -23442,10 +23520,10 @@ var { quote, qualifiedName } = createDialectQuoting({
   escape: '""'
 });
 var postgresTeardownOperations = {
-  disableForeignKeyChecks() {
+  disableForeignKeyChecks(_tables) {
     return "SET session_replication_role = 'replica'";
   },
-  enableForeignKeyChecks() {
+  enableForeignKeyChecks(_tables) {
     return "SET session_replication_role = 'origin'";
   },
   truncateTable(tableName, schema, restartIdentity = true) {
@@ -23480,10 +23558,10 @@ var { quote: quote2, qualifiedName: qualifiedName2 } = createDialectQuoting({
   escape: "``"
 });
 var mysqlTeardownOperations = {
-  disableForeignKeyChecks() {
+  disableForeignKeyChecks(_tables) {
     return "SET FOREIGN_KEY_CHECKS = 0";
   },
-  enableForeignKeyChecks() {
+  enableForeignKeyChecks(_tables) {
     return "SET FOREIGN_KEY_CHECKS = 1";
   },
   truncateTable(tableName, schema, _restartIdentity = true) {
@@ -23516,10 +23594,16 @@ var { quote: quote3, qualifiedName: qualifiedName3 } = createDialectQuoting({
   escape: "]]"
 });
 var mssqlTeardownOperations = {
-  disableForeignKeyChecks() {
+  disableForeignKeyChecks(tables) {
+    if (tables && tables.length > 0) {
+      return tables.map((t) => `ALTER TABLE ${qualifiedName3(t)} NOCHECK CONSTRAINT ALL`);
+    }
     return "EXEC sp_MSforeachtable 'ALTER TABLE ? NOCHECK CONSTRAINT ALL'";
   },
-  enableForeignKeyChecks() {
+  enableForeignKeyChecks(tables) {
+    if (tables && tables.length > 0) {
+      return tables.map((t) => `ALTER TABLE ${qualifiedName3(t)} CHECK CONSTRAINT ALL`);
+    }
     return "EXEC sp_MSforeachtable 'ALTER TABLE ? CHECK CONSTRAINT ALL'";
   },
   truncateTable(tableName, schema, restartIdentity = true) {
@@ -23548,6 +23632,15 @@ var mssqlTeardownOperations = {
   },
   dropForeignKey(constraintName, tableName, schema) {
     return `ALTER TABLE ${qualifiedName3(tableName, schema)} DROP CONSTRAINT ${quote3(constraintName)}`;
+  },
+  dropCheckConstraints() {
+    return [
+      "DECLARE @noorm_drop_checks NVARCHAR(MAX) = N'';",
+      "SELECT @noorm_drop_checks += N'ALTER TABLE ' + QUOTENAME(SCHEMA_NAME(t.schema_id)) + N'.' + QUOTENAME(t.name) + N' DROP CONSTRAINT ' + QUOTENAME(cc.name) + N';'",
+      "FROM sys.check_constraints cc INNER JOIN sys.tables t ON cc.parent_object_id = t.object_id",
+      "WHERE SCHEMA_NAME(t.schema_id) <> 'noorm';",
+      "EXEC sp_executesql @noorm_drop_checks;"
+    ].join("\n");
   }
 };
 
@@ -23558,10 +23651,10 @@ var { quote: quote4 } = createDialectQuoting({
   escape: '""'
 });
 var sqliteTeardownOperations = {
-  disableForeignKeyChecks() {
+  disableForeignKeyChecks(_tables) {
     return "PRAGMA foreign_keys = OFF";
   },
-  enableForeignKeyChecks() {
+  enableForeignKeyChecks(_tables) {
     return "PRAGMA foreign_keys = ON";
   },
   truncateTable(tableName, _schema, _restartIdentity = false) {
@@ -23611,6 +23704,13 @@ function isNoormTable2(name) {
   if (name.startsWith("__noorm_")) return true;
   return false;
 }
+function pushFlat(out, value) {
+  if (Array.isArray(value)) {
+    out.push(...value);
+    return;
+  }
+  out.push(value);
+}
 async function truncateData(db, dialect, options = {}) {
   const startTime = performance.now();
   const ops = getTeardownOperations(dialect);
@@ -23640,11 +23740,13 @@ async function truncateData(db, dialect, options = {}) {
     }
     truncated.push(tableName);
   }
-  statements.push(ops.disableForeignKeyChecks());
-  for (const tableName of truncated) {
-    statements.push(ops.truncateTable(tableName, void 0, options.restartIdentity ?? true));
+  if (truncated.length > 0) {
+    pushFlat(statements, ops.disableForeignKeyChecks(truncated));
+    for (const tableName of truncated) {
+      statements.push(ops.truncateTable(tableName, void 0, options.restartIdentity ?? true));
+    }
+    pushFlat(statements, ops.enableForeignKeyChecks(truncated));
   }
-  statements.push(ops.enableForeignKeyChecks());
   if (!options.dryRun) {
     for (const stmt of statements) {
       if (stmt.startsWith("--")) continue;
@@ -23716,6 +23818,21 @@ async function teardownSchema(db, dialect, options = {}) {
     dropped.foreignKeys.push(fk.name);
     statements.push(ops.dropForeignKey(fk.name, tableName, fk.schema));
   }
+  if (!options.keepFunctions && ops.dropCheckConstraints) {
+    statements.push(ops.dropCheckConstraints());
+  }
+  if (!options.keepProcedures) {
+    for (const proc of procedures) {
+      dropped.procedures.push(proc.name);
+      statements.push(ops.dropProcedure(proc.name, proc.schema));
+    }
+  }
+  if (!options.keepFunctions) {
+    for (const fn of functions) {
+      dropped.functions.push(fn.name);
+      statements.push(ops.dropFunction(fn.name, fn.schema));
+    }
+  }
   if (!options.keepViews) {
     for (const view of views) {
       dropped.views.push(view.name);
@@ -23735,18 +23852,6 @@ async function teardownSchema(db, dialect, options = {}) {
     dropped.tables.push(tableName);
     statements.push(ops.dropTable(tableName, table.schema));
   }
-  if (!options.keepFunctions) {
-    for (const fn of functions) {
-      dropped.functions.push(fn.name);
-      statements.push(ops.dropFunction(fn.name, fn.schema));
-    }
-  }
-  if (!options.keepProcedures) {
-    for (const proc of procedures) {
-      dropped.procedures.push(proc.name);
-      statements.push(ops.dropProcedure(proc.name, proc.schema));
-    }
-  }
   const skipTypesDueToKeptRoutines = dialect === "mssql" && (options.keepFunctions || options.keepProcedures);
   if (!options.keepTypes && !skipTypesDueToKeptRoutines) {
     const sortedTypes = [...types].sort((a, b) => {
@@ -24058,7 +24163,11 @@ var DbNamespace = class {
    */
   async reset() {
     checkProtectedConfig(this.#state.config, "reset");
-    await this.teardown();
+    await teardownSchema(this.#kysely, this.#dialect, {
+      configName: this.#state.config.name,
+      executedBy: formatIdentity(this.#state.identity),
+      postScript: this.#state.settings.teardown?.postScript
+    });
     if (this.#buildFn) {
       await this.#buildFn({ force: true });
     }
@@ -24406,25 +24515,60 @@ async function copyVaultSecrets(sourceConfig, destConfig, keys, identityHash, pr
 // src/sdk/namespaces/vault.ts
 var VaultNamespace = class {
   #state;
+  #cryptoIdentity = null;
   constructor(state) {
     this.#state = state;
   }
+  /**
+   * Load the cryptographic identity (with publicKey + identityHash) on
+   * demand. The Context's state.identity is the audit identity (name +
+   * email only); the crypto fields needed for vault encryption live in
+   * `~/.noorm/identity.json` (or a NOORM_IDENTITY_* env override).
+   *
+   * Cached after the first call so repeated vault ops don't re-read disk.
+   */
+  async #getCryptoIdentity() {
+    if (this.#cryptoIdentity) return this.#cryptoIdentity;
+    const loaded = await loadIdentityMetadata();
+    if (!loaded) {
+      throw new Error(
+        "Vault operations require a cryptographic identity at ~/.noorm/identity.json. Run `noorm identity init` or set NOORM_IDENTITY_* env vars in CI."
+      );
+    }
+    this.#cryptoIdentity = loaded;
+    return loaded;
+  }
   // ─────────────────────────────────────────────────────
   // Lifecycle
   // ─────────────────────────────────────────────────────
   /**
    * Initialize the vault for this database.
    *
+   * Idempotent. Returns the vault key on first init; returns [null, null]
+   * on subsequent calls when the vault already exists. Returns [null, Error]
+   * only on real failures (DB errors, encryption errors).
+   *
+   * The `vault:initialized` observer event fires only on first init, never
+   * on repeat calls.
+   *
    * @example
    * ```typescript
-   * const [vaultKey, err] = await ctx.noorm.vault.init()
+   * const [vaultKey, err] = await ctx.noorm.vault.init();
+   * if (err) throw err;
+   * if (vaultKey) {
+   *     // first-time init — set initial secrets, etc.
+   * }
+   * else {
+   *     // already initialized — vault.get / vault.set with private key
+   * }
    * ```
    */
   async init() {
+    const crypto = await this.#getCryptoIdentity();
     return initializeVault(
       this.#kysely,
-      this.#identityHash,
-      this.#publicKey,
+      crypto.identityHash,
+      crypto.publicKey,
       this.#dialect
     );
   }
@@ -24437,9 +24581,10 @@ var VaultNamespace = class {
    * ```
    */
   async status() {
+    const crypto = await this.#getCryptoIdentity();
     return getVaultStatus(
       this.#kysely,
-      this.#identityHash,
+      crypto.identityHash,
       this.#dialect
     );
   }
@@ -24576,13 +24721,14 @@ var VaultNamespace = class {
    * ```
    */
   async copy(destConfig, keys, privateKey, options) {
+    const crypto = await this.#getCryptoIdentity();
     return copyVaultSecrets(
       this.#state.config,
       destConfig,
       keys,
-      this.#identityHash,
+      crypto.identityHash,
       privateKey,
-      this.#publicKey,
+      crypto.publicKey,
       options
     );
   }
@@ -24595,21 +24741,14 @@ var VaultNamespace = class {
     }
     return this.#state.connection.db;
   }
-  get #identityHash() {
-    const identity = this.#state.identity;
-    return identity["identityHash"] ?? "";
-  }
-  get #publicKey() {
-    const identity = this.#state.identity;
-    return identity["publicKey"] ?? "";
-  }
   get #dialect() {
     return this.#state.config.connection.dialect;
   }
   async #getVaultKey(privateKey) {
+    const crypto = await this.#getCryptoIdentity();
     return getVaultKey(
       this.#kysely,
-      this.#identityHash,
+      crypto.identityHash,
       privateKey,
       this.#dialect
     );
@@ -24695,7 +24834,7 @@ function isSameServer(source, dest) {
   }
   return true;
 }
-function quoteIdent(name) {
+function quoteIdent2(name) {
   return `"${name.replace(/"/g, '""')}"`;
 }
 var postgresTransferOperations = {
@@ -24712,20 +24851,20 @@ var postgresTransferOperations = {
     return null;
   },
   getResetSequenceSql(table, column, schema) {
-    const fullTable = schema ? `${quoteIdent(schema)}.${quoteIdent(table)}` : quoteIdent(table);
+    const fullTable = schema ? `${quoteIdent2(schema)}.${quoteIdent2(table)}` : quoteIdent2(table);
     return `
             SELECT setval(
                 pg_get_serial_sequence('${schema ? schema + "." : ""}${table}', '${column}'),
-                COALESCE((SELECT MAX(${quoteIdent(column)}) FROM ${fullTable}), 0) + 1,
+                COALESCE((SELECT MAX(${quoteIdent2(column)}) FROM ${fullTable}), 0) + 1,
                 false
             )
         `.trim();
   },
   buildConflictInsert(table, columns, primaryKey, strategy) {
-    const quotedCols = columns.map(quoteIdent).join(", ");
+    const quotedCols = columns.map(quoteIdent2).join(", ");
     const placeholders = columns.map((_, i) => `$${i + 1}`).join(", ");
-    const pkCols = primaryKey.map(quoteIdent).join(", ");
-    let insertSql = `INSERT INTO ${quoteIdent(table)} (${quotedCols}) OVERRIDING SYSTEM VALUE VALUES (${placeholders})`;
+    const pkCols = primaryKey.map(quoteIdent2).join(", ");
+    let insertSql = `INSERT INTO ${quoteIdent2(table)} (${quotedCols}) OVERRIDING SYSTEM VALUE VALUES (${placeholders})`;
     switch (strategy) {
       case "fail":
         break;
@@ -24735,7 +24874,7 @@ var postgresTransferOperations = {
       case "update": {
         const updateCols = columns.filter((c) => !primaryKey.includes(c));
         if (updateCols.length > 0) {
-          const setClauses = updateCols.map((c) => `${quoteIdent(c)} = EXCLUDED.${quoteIdent(c)}`).join(", ");
+          const setClauses = updateCols.map((c) => `${quoteIdent2(c)} = EXCLUDED.${quoteIdent2(c)}`).join(", ");
           insertSql += ` ON CONFLICT (${pkCols}) DO UPDATE SET ${setClauses}`;
         } else {
           insertSql += ` ON CONFLICT (${pkCols}) DO NOTHING`;
@@ -24744,7 +24883,7 @@ var postgresTransferOperations = {
       }
       case "replace":
         {
-          const setClauses = columns.map((c) => `${quoteIdent(c)} = EXCLUDED.${quoteIdent(c)}`).join(", ");
+          const setClauses = columns.map((c) => `${quoteIdent2(c)} = EXCLUDED.${quoteIdent2(c)}`).join(", ");
           insertSql += ` ON CONFLICT (${pkCols}) DO UPDATE SET ${setClauses}`;
         }
         break;
@@ -24752,9 +24891,9 @@ var postgresTransferOperations = {
     return insertSql;
   },
   buildDirectTransfer(srcDb, srcTable, dstTable, columns, srcSchema = "public", dstSchema = "public") {
-    const quotedCols = columns.map(quoteIdent).join(", ");
-    const srcFull = `${quoteIdent(srcSchema)}.${quoteIdent(srcTable)}`;
-    const dstFull = `${quoteIdent(dstSchema)}.${quoteIdent(dstTable)}`;
+    const quotedCols = columns.map(quoteIdent2).join(", ");
+    const srcFull = `${quoteIdent2(srcSchema)}.${quoteIdent2(srcTable)}`;
+    const dstFull = `${quoteIdent2(dstSchema)}.${quoteIdent2(dstTable)}`;
     return `INSERT INTO ${dstFull} (${quotedCols}) OVERRIDING SYSTEM VALUE SELECT ${quotedCols} FROM ${srcFull}`;
   },
   async executeDisableFK(db) {
@@ -24764,7 +24903,7 @@ var postgresTransferOperations = {
     await sql.raw(this.getEnableFKSql()).execute(db);
   }
 };
-function quoteIdent2(name) {
+function quoteIdent3(name) {
   return `\`${name.replace(/`/g, "``")}\``;
 }
 var mysqlTransferOperations = {
@@ -24781,32 +24920,32 @@ var mysqlTransferOperations = {
     return null;
   },
   getResetSequenceSql(table, _column, _schema) {
-    return `ALTER TABLE ${quoteIdent2(table)} AUTO_INCREMENT = 1`;
+    return `ALTER TABLE ${quoteIdent3(table)} AUTO_INCREMENT = 1`;
   },
   buildConflictInsert(table, columns, primaryKey, strategy) {
-    const quotedCols = columns.map(quoteIdent2).join(", ");
+    const quotedCols = columns.map(quoteIdent3).join(", ");
     const placeholders = columns.map(() => "?").join(", ");
     switch (strategy) {
       case "fail":
-        return `INSERT INTO ${quoteIdent2(table)} (${quotedCols}) VALUES (${placeholders})`;
+        return `INSERT INTO ${quoteIdent3(table)} (${quotedCols}) VALUES (${placeholders})`;
       case "skip":
-        return `INSERT IGNORE INTO ${quoteIdent2(table)} (${quotedCols}) VALUES (${placeholders})`;
+        return `INSERT IGNORE INTO ${quoteIdent3(table)} (${quotedCols}) VALUES (${placeholders})`;
       case "update": {
         const updateCols = columns.filter((c) => !primaryKey.includes(c));
         if (updateCols.length > 0) {
-          const setClauses = updateCols.map((c) => `${quoteIdent2(c)} = VALUES(${quoteIdent2(c)})`).join(", ");
-          return `INSERT INTO ${quoteIdent2(table)} (${quotedCols}) VALUES (${placeholders}) ON DUPLICATE KEY UPDATE ${setClauses}`;
+          const setClauses = updateCols.map((c) => `${quoteIdent3(c)} = VALUES(${quoteIdent3(c)})`).join(", ");
+          return `INSERT INTO ${quoteIdent3(table)} (${quotedCols}) VALUES (${placeholders}) ON DUPLICATE KEY UPDATE ${setClauses}`;
         }
-        return `INSERT IGNORE INTO ${quoteIdent2(table)} (${quotedCols}) VALUES (${placeholders})`;
+        return `INSERT IGNORE INTO ${quoteIdent3(table)} (${quotedCols}) VALUES (${placeholders})`;
       }
       case "replace":
-        return `REPLACE INTO ${quoteIdent2(table)} (${quotedCols}) VALUES (${placeholders})`;
+        return `REPLACE INTO ${quoteIdent3(table)} (${quotedCols}) VALUES (${placeholders})`;
     }
   },
   buildDirectTransfer(srcDb, srcTable, dstTable, columns, _srcSchema, _dstSchema) {
-    const quotedCols = columns.map(quoteIdent2).join(", ");
-    const srcFull = `${quoteIdent2(srcDb)}.${quoteIdent2(srcTable)}`;
-    const dstFull = quoteIdent2(dstTable);
+    const quotedCols = columns.map(quoteIdent3).join(", ");
+    const srcFull = `${quoteIdent3(srcDb)}.${quoteIdent3(srcTable)}`;
+    const dstFull = quoteIdent3(dstTable);
     return `INSERT INTO ${dstFull} (${quotedCols}) SELECT ${quotedCols} FROM ${srcFull}`;
   },
   async executeDisableFK(db) {
@@ -24816,7 +24955,7 @@ var mysqlTransferOperations = {
     await sql.raw(this.getEnableFKSql()).execute(db);
   }
 };
-function quoteIdent3(name) {
+function quoteIdent4(name) {
   return `[${name.replace(/\]/g, "]]")}]`;
 }
 var mssqlTransferOperations = {
@@ -24827,27 +24966,27 @@ var mssqlTransferOperations = {
     return "-- FK enable per-table";
   },
   getEnableIdentityInsertSql(table) {
-    return `SET IDENTITY_INSERT ${quoteIdent3(table)} ON`;
+    return `SET IDENTITY_INSERT ${quoteIdent4(table)} ON`;
   },
   getDisableIdentityInsertSql(table) {
-    return `SET IDENTITY_INSERT ${quoteIdent3(table)} OFF`;
+    return `SET IDENTITY_INSERT ${quoteIdent4(table)} OFF`;
   },
   getResetSequenceSql(table, _column, _schema) {
     return `DBCC CHECKIDENT ('${table}', RESEED)`;
   },
   buildConflictInsert(table, columns, primaryKey, strategy) {
-    const quotedCols = columns.map(quoteIdent3).join(", ");
+    const quotedCols = columns.map(quoteIdent4).join(", ");
     const placeholders = columns.map((_, i) => `@p${i}`).join(", ");
     switch (strategy) {
       case "fail":
-        return `INSERT INTO ${quoteIdent3(table)} (${quotedCols}) VALUES (${placeholders})`;
+        return `INSERT INTO ${quoteIdent4(table)} (${quotedCols}) VALUES (${placeholders})`;
       case "skip":
       case "update":
       case "replace": {
-        const pkConditions = primaryKey.map((pk) => `target.${quoteIdent3(pk)} = source.${quoteIdent3(pk)}`).join(" AND ");
-        const sourceValues = columns.map((c, i) => `@p${i} AS ${quoteIdent3(c)}`).join(", ");
+        const pkConditions = primaryKey.map((pk) => `target.${quoteIdent4(pk)} = source.${quoteIdent4(pk)}`).join(" AND ");
+        const sourceValues = columns.map((c, i) => `@p${i} AS ${quoteIdent4(c)}`).join(", ");
         let mergeSql = `
-                MERGE INTO ${quoteIdent3(table)} AS target
+                MERGE INTO ${quoteIdent4(table)} AS target
                 USING (SELECT ${sourceValues}) AS source
                 ON (${pkConditions})
             `.trim();
@@ -24855,12 +24994,12 @@ var mssqlTransferOperations = {
           mergeSql += `
                     WHEN NOT MATCHED THEN
                         INSERT (${quotedCols})
-                        VALUES (${columns.map((c) => `source.${quoteIdent3(c)}`).join(", ")})
+                        VALUES (${columns.map((c) => `source.${quoteIdent4(c)}`).join(", ")})
                 `;
         } else if (strategy === "update") {
           const updateCols = columns.filter((c) => !primaryKey.includes(c));
           if (updateCols.length > 0) {
-            const setClauses = updateCols.map((c) => `target.${quoteIdent3(c)} = source.${quoteIdent3(c)}`).join(", ");
+            const setClauses = updateCols.map((c) => `target.${quoteIdent4(c)} = source.${quoteIdent4(c)}`).join(", ");
             mergeSql += `
                         WHEN MATCHED THEN
                             UPDATE SET ${setClauses}
@@ -24869,16 +25008,16 @@ var mssqlTransferOperations = {
           mergeSql += `
                     WHEN NOT MATCHED THEN
                         INSERT (${quotedCols})
-                        VALUES (${columns.map((c) => `source.${quoteIdent3(c)}`).join(", ")})
+                        VALUES (${columns.map((c) => `source.${quoteIdent4(c)}`).join(", ")})
                 `;
         } else {
-          const setClauses = columns.map((c) => `target.${quoteIdent3(c)} = source.${quoteIdent3(c)}`).join(", ");
+          const setClauses = columns.map((c) => `target.${quoteIdent4(c)} = source.${quoteIdent4(c)}`).join(", ");
           mergeSql += `
                     WHEN MATCHED THEN
                         UPDATE SET ${setClauses}
                     WHEN NOT MATCHED THEN
                         INSERT (${quotedCols})
-                        VALUES (${columns.map((c) => `source.${quoteIdent3(c)}`).join(", ")})
+                        VALUES (${columns.map((c) => `source.${quoteIdent4(c)}`).join(", ")})
                 `;
         }
         mergeSql += ";";
@@ -24887,19 +25026,19 @@ var mssqlTransferOperations = {
     }
   },
   buildDirectTransfer(srcDb, srcTable, dstTable, columns, srcSchema = "dbo", dstSchema = "dbo") {
-    const quotedCols = columns.map(quoteIdent3).join(", ");
-    const srcFull = `${quoteIdent3(srcDb)}.${quoteIdent3(srcSchema)}.${quoteIdent3(srcTable)}`;
-    const dstFull = `${quoteIdent3(dstSchema)}.${quoteIdent3(dstTable)}`;
+    const quotedCols = columns.map(quoteIdent4).join(", ");
+    const srcFull = `${quoteIdent4(srcDb)}.${quoteIdent4(srcSchema)}.${quoteIdent4(srcTable)}`;
+    const dstFull = `${quoteIdent4(dstSchema)}.${quoteIdent4(dstTable)}`;
     return `INSERT INTO ${dstFull} (${quotedCols}) SELECT ${quotedCols} FROM ${srcFull}`;
   },
   async executeDisableFK(db, tables) {
     for (const table of tables) {
-      await sql.raw(`ALTER TABLE ${quoteIdent3(table)} NOCHECK CONSTRAINT ALL`).execute(db);
+      await sql.raw(`ALTER TABLE ${quoteIdent4(table)} NOCHECK CONSTRAINT ALL`).execute(db);
     }
   },
   async executeEnableFK(db, tables) {
     for (const table of tables) {
-      await sql.raw(`ALTER TABLE ${quoteIdent3(table)} WITH CHECK CHECK CONSTRAINT ALL`).execute(db);
+      await sql.raw(`ALTER TABLE ${quoteIdent4(table)} WITH CHECK CHECK CONSTRAINT ALL`).execute(db);
     }
   }
 };
@@ -26439,10 +26578,10 @@ async function transferTableCrossDialect(ctx, plan, transferPlan, options) {
   }, null];
 }
 async function fetchBatch(db, dialect, table, columns, limit, offset, _schema) {
-  const quoteIdent4 = dialect === "mssql" ? (c) => `[${c}]` : dialect === "mysql" ? (c) => `\`${c}\`` : (c) => `"${c}"`;
-  const columnList = columns.map(quoteIdent4).join(", ");
+  const quoteIdent5 = dialect === "mssql" ? (c) => `[${c}]` : dialect === "mysql" ? (c) => `\`${c}\`` : (c) => `"${c}"`;
+  const columnList = columns.map(quoteIdent5).join(", ");
   if (dialect === "mssql") {
-    const orderCol = quoteIdent4(columns[0]);
+    const orderCol = quoteIdent5(columns[0]);
     const result2 = await sql`
             SELECT ${sql.raw(columnList)}
             FROM ${sql.table(table)}
@@ -27108,9 +27247,9 @@ async function exportTableWithWorkers(ctx) {
     totalRows = Number(firstRow?.["cnt"] ?? 0);
   }
   const columns = dtSchema.columns.map((c) => c.name);
-  const quoteIdent4 = getQuoteIdent(dialect);
-  const columnList = columns.map(quoteIdent4).join(", ");
-  const orderCol = quoteIdent4(columns[0]);
+  const quoteIdent5 = getQuoteIdent(dialect);
+  const columnList = columns.map(quoteIdent5).join(", ");
+  const orderCol = quoteIdent5(columns[0]);
   let globalIndex = 0;
   let loaded = 0;
   let processed = 0;
@@ -27868,10 +28007,40 @@ var Context = class {
       throw new Error("SQLite does not support stored procedures.");
     }
     const params = args[0];
+    if (this.dialect === "postgres") {
+      return this.#executeProcPostgres(name, params);
+    }
     const query = buildProcCall(this.dialect, name, params);
     const result = await query.execute(this.kysely);
     return result.rows ?? [];
   }
+  /**
+   * Execute a stored procedure on PostgreSQL with FUNCTION fallback.
+   *
+   * PostgreSQL distinguishes between PROCEDURE and FUNCTION objects:
+   * `CALL` only works against true procedures and raises SQLSTATE 42809
+   * (`<name>(...) is not a procedure`) when the target is a function.
+   *
+   * The noorm playbook tells schema authors to use `CREATE PROCEDURE`
+   * for void-returning ops and `CREATE FUNCTION` for row-returning ops,
+   * and `ctx.proc()` is expected to handle both. So if `CALL` fails
+   * with the wrong-object-type error, we retry with
+   * `SELECT * FROM <name>(...)`, which works for both scalar and
+   * set-returning PG functions.
+   */
+  async #executeProcPostgres(name, params) {
+    const callQuery = buildProcCall("postgres", name, params);
+    const [callResult, callErr] = await attempt(() => callQuery.execute(this.kysely));
+    if (!callErr) {
+      return callResult.rows ?? [];
+    }
+    if (!isFunctionNotProcedureError(callErr)) {
+      throw callErr;
+    }
+    const tvfQuery = buildTvfCall("postgres", name, params);
+    const tvfResult = await tvfQuery.execute(this.kysely);
+    return tvfResult.rows ?? [];
+  }
   /**
    * Call a database function and return the scalar result.
    *
@@ -27987,6 +28156,14 @@ var Context = class {
     return ready;
   }
 };
+function isFunctionNotProcedureError(err) {
+  if (!err || typeof err !== "object") return false;
+  const obj = err;
+  if (obj.code !== "42809" && obj.code !== "42883") return false;
+  const msg = String(obj.message ?? "");
+  const hint = String(obj.hint ?? "");
+  return msg.includes("is not a procedure") || msg.includes("procedure") || hint.includes("use SELECT");
+}
 
 // src/sdk/index.ts
 function toSettingsProvider(manager) {