@noormdev/sdk 1.0.2 → 1.2.0

package/README.md

@@ -71,6 +71,29 @@ await ctx.proc('refresh_cache');
 `createContext<DB, Procs, Funcs, Tvfs>` takes a map per routine kind. Plain `void` is shorthand for "no arguments, no meaningful return".
 
 
+## Schema scoping
+
+`ctx.withSchema<SDB>(name)` derives a `Context` scoped to one schema — same connection, pool, and lifecycle as the parent, just qualified generics and query builder.
+
+```typescript
+const acct = ctx.withSchema<AcctDB>('accounting');
+
+const invoices = await acct.kysely.selectFrom('invoices').selectAll().execute();
+// select * from "accounting"."invoices" — typed against AcctDB
+
+await acct.proc('rebuild_ledger', { year: 2026 });
+// CALL "accounting"."rebuild_ledger"("year" => $1)
+
+await ctx.kysely.selectFrom('users').execute(); // parent untouched, no prefix
+
+await ctx.disconnect(); // one lifecycle closes both
+```
+
+Calling `withSchema` again replaces the schema instead of stacking it, and a `proc`/`func`/`tvf` name that already contains a `.` passes through unqualified. Raw `` sql`…` `` fragments are not rewritten — they resolve against the connection's default schema regardless of `withSchema`.
+
+Non-goals: no config/connection-level schema field (the connection stays schema-agnostic); no schema-defaulting of `ctx.noorm.db.describe*`'s `schema?` arg; no per-dialect gating — the qualifier means whatever the dialect makes of it (a schema on postgres/mssql, a database on mysql, an ATTACHed database on sqlite).
+
+
 ## Requires
 
 Node >= 22.13. Supports **PostgreSQL**, **MySQL**, **SQLite**, and **SQL Server**.

package/dist/{chunk-2RW4SL2O.js → chunk-FSVO6NAJ.js}

@@ -1,5 +1,5 @@
 import { createRequire } from 'module';
-import { attempt, observer, attemptSync, shouldSkipConfirmations } from './chunk-QAECL4RN.js';
+import { attempt, observer, attemptSync, shouldSkipConfirmations } from './chunk-LY2F7ZFI.js';
 import { __commonJS, __toESM } from './chunk-D2XW2UOP.js';
 import { generateKeyPairSync, randomBytes, createCipheriv, createPrivateKey, createPublicKey, diffieHellman, hkdfSync, createDecipheriv } from 'crypto';
 
@@ -97660,5 +97660,5 @@ async function listVaultSecretKeysChecked(gate, db, dialect) {
 }
 
 export { assertPolicy, assertVaultPolicy, checkConfigPolicy, deleteVaultSecret, deleteVaultSecretChecked, detectAgentHarness, encryptVaultKey, getAllVaultSecrets, getNoormTables, getVaultKey, getVaultKeyChecked, getVaultSecret, getVaultStatus, guarded, initializeVault, initializeVaultChecked, listVaultSecretKeys, listVaultSecretKeysChecked, noormDb, resolveLegacyAccess, setVaultSecret, setVaultSecretChecked, vaultSecretExists };
-//# sourceMappingURL=chunk-2RW4SL2O.js.map
-//# sourceMappingURL=chunk-2RW4SL2O.js.map
+//# sourceMappingURL=chunk-FSVO6NAJ.js.map
+//# sourceMappingURL=chunk-FSVO6NAJ.js.map

package/dist/{chunk-DSXHOXDE.js → chunk-G4B7EHL7.js}

@@ -1,5 +1,5 @@
 import { createRequire } from 'module';
-import { attemptSync, observer, attempt } from './chunk-QAECL4RN.js';
+import { attemptSync, observer, attempt } from './chunk-LY2F7ZFI.js';
 import { dist_default } from './chunk-TBRUDUBQ.js';
 import { readFile as readFile$1, readdir, stat } from 'fs/promises';
 import * as fs from 'fs';
@@ -2505,7 +2505,7 @@ function createIncludeHelper(templateDir, projectRoot, options) {
       throw new Error(`Include path escapes project root: ${includePath}`);
     }
     if (resolved.endsWith(".tmpl")) {
-      const { processFile: processFile2 } = await import('./engine-S4DX3V33.js');
+      const { processFile: processFile2 } = await import('./engine-MZQ364EH.js');
       const result = await processFile2(resolved, options);
       return result.sql;
     }
@@ -2587,5 +2587,5 @@ voca/es/index.js:
 */
 
 export { DT_EXTENSIONS, DtReader, ENCODED_TYPES, FORMAT_VERSION, encryptWithPassphrase, es_default, eta, isTemplate, processFile, processFiles, renderTemplate };
-//# sourceMappingURL=chunk-DSXHOXDE.js.map
-//# sourceMappingURL=chunk-DSXHOXDE.js.map
+//# sourceMappingURL=chunk-G4B7EHL7.js.map
+//# sourceMappingURL=chunk-G4B7EHL7.js.map

package/dist/{chunk-QAECL4RN.js → chunk-LY2F7ZFI.js}

@@ -3367,6 +3367,6 @@ var observer = new ObserverEngine({
   spy: isDebug() ? (action) => console.error(`[noorm:${action.fn}] ${String(action.event)}`) : void 0
 });
 
-export { ObserverRelay, attempt, attemptSync, clone, equals, getEnvConfigName, gigabytes, isDebug, makeNestedConfig, merge, observer, retry, runWithTimeout, shouldSkipConfirmations, wait };
-//# sourceMappingURL=chunk-QAECL4RN.js.map
-//# sourceMappingURL=chunk-QAECL4RN.js.map
+export { ObserverRelay, attempt, attemptSync, clone, equals, getEnvConfigName, gigabytes, isDebug, isTimeoutError, makeNestedConfig, merge, observer, retry, runWithTimeout, shouldSkipConfirmations, wait };
+//# sourceMappingURL=chunk-LY2F7ZFI.js.map
+//# sourceMappingURL=chunk-LY2F7ZFI.js.map

package/dist/{chunk-SPU42W75.js → chunk-WE2JLJMT.js}

@@ -13772,8 +13772,16 @@ var DEFAULT_PORTS = {
   // Not applicable
   mssql: 1433
 };
+var DEFAULT_CONNECT_TIMEOUT_MS = 15e3;
+function connectTimeoutFor(config2) {
+  const configured = config2.connectTimeoutMs;
+  if (typeof configured === "number" && Number.isFinite(configured) && configured > 0) {
+    return configured;
+  }
+  return DEFAULT_CONNECT_TIMEOUT_MS;
+}
 var PortSchema = external_exports.number().int().min(1, "Port must be at least 1").max(65535, "Port must be at most 65535");
 
-export { DEFAULT_PORTS, PortSchema, external_exports };
-//# sourceMappingURL=chunk-SPU42W75.js.map
-//# sourceMappingURL=chunk-SPU42W75.js.map
+export { DEFAULT_PORTS, PortSchema, connectTimeoutFor, external_exports };
+//# sourceMappingURL=chunk-WE2JLJMT.js.map
+//# sourceMappingURL=chunk-WE2JLJMT.js.map

package/dist/{engine-S4DX3V33.js → engine-MZQ364EH.js}

@@ -1,11 +1,11 @@
 import { createRequire } from 'module';
-export { eta, isTemplate, processFile, processFiles, renderTemplate } from './chunk-DSXHOXDE.js';
+export { eta, isTemplate, processFile, processFiles, renderTemplate } from './chunk-G4B7EHL7.js';
 import './chunk-UOFJT5PY.js';
-import './chunk-QAECL4RN.js';
+import './chunk-LY2F7ZFI.js';
 import './chunk-TBRUDUBQ.js';
 import './chunk-YJBKNUTP.js';
 import './chunk-D2XW2UOP.js';
 
 createRequire(import.meta.url);
-//# sourceMappingURL=engine-S4DX3V33.js.map
-//# sourceMappingURL=engine-S4DX3V33.js.map
+//# sourceMappingURL=engine-MZQ364EH.js.map
+//# sourceMappingURL=engine-MZQ364EH.js.map

package/dist/index.d.ts

@@ -38,6 +38,15 @@ export interface ConnectionConfig {
 		min?: number;
 		max?: number;
 	};
+	/**
+	 * Milliseconds a single connection attempt may spend before the driver
+	 * gives up. Defaults to `DEFAULT_CONNECT_TIMEOUT_MS`.
+	 *
+	 * Raise it for a link that is slow but working — a serverless database
+	 * resuming from auto-pause is the case that motivates it, since the resume
+	 * can outlast any timeout tuned for a handshake.
+	 */
+	connectTimeoutMs?: number;
 	ssl?: boolean | {
 		rejectUnauthorized?: boolean;
 		ca?: string;
@@ -1035,6 +1044,31 @@ export interface TeardownConfig {
 	/** SQL script to run after schema teardown (relative to project root) */
 	postScript?: string;
 }
+/**
+ * Terminal UI configuration.
+ *
+ * Only affects `noorm ui`; headless commands ignore it.
+ *
+ * @example
+ * ```yaml
+ * ui:
+ *     mouse: false
+ * ```
+ */
+export interface UiConfig {
+	/**
+	 * Answer mouse clicks and wheel notches in lists and result grids.
+	 *
+	 * Absent means on — `isMouseEnabled` in `./defaults.js` is where that is
+	 * decided, so read it rather than this field. Written `false` is the only
+	 * thing that turns tracking off, and it is worth writing: enabling any
+	 * tracking mode takes click-drag text selection away from the terminal
+	 * unless the user holds a modifier (Option on macOS Terminal and iTerm2,
+	 * Shift elsewhere). The symptom a user reports is "text selection stopped
+	 * working", which does not point at noorm on its own.
+	 */
+	mouse?: boolean;
+}
 /**
  * Complete settings configuration.
  *
@@ -1057,6 +1091,8 @@ export interface Settings {
 	secrets?: StageSecret[];
 	/** Database teardown/reset configuration */
 	teardown?: TeardownConfig;
+	/** Terminal UI behaviour */
+	ui?: UiConfig;
 }
 /**
  * Settings events emitted by the settings module.
@@ -3820,6 +3856,31 @@ export declare class Context<DB = unknown, Procs = object, Funcs = object, Tvfs
 	get dialect(): Dialect;
 	get connected(): boolean;
 	get kysely(): Kysely<DB>;
+	/**
+	 * Derive a schema-scoped Context sharing this context's connection,
+	 * pool, and #heldConnections — same lifecycle, fresh generics for the
+	 * schema's own table/routine shape.
+	 *
+	 * Replaces rather than stacks: calling withSchema() again on an
+	 * already-derived context swaps the schema instead of nesting it,
+	 * because every derived context re-derives its `.kysely` from the
+	 * shared connection's bare instance, never from another derived
+	 * context's already-wrapped one.
+	 *
+	 * `sql`-tagged raw fragments are not rewritten by this — they resolve
+	 * against the connection's default schema regardless of this call.
+	 *
+	 * @throws Error synchronously if `name` fails identifier validation,
+	 * before any connection is borrowed or shared state is touched.
+	 *
+	 * @example
+	 * ```typescript
+	 * const acct = ctx.withSchema<AcctDB>('acct');
+	 * const rows = await acct.kysely.selectFrom('ledger').selectAll().execute();
+	 * await acct.proc('rebuild_ledger', { id: 1 }); // -> acct.rebuild_ledger
+	 * ```
+	 */
+	withSchema<SDB = DB, SProcs = Procs, SFuncs = Funcs, STvfs = Tvfs>(name: string): Context<SDB, SProcs, SFuncs, STvfs>;
 	/**
 	 * Noorm management operations.
 	 *

package/dist/index.js

@@ -1,10 +1,10 @@
 import { createRequire } from 'module';
-import { processFile, es_default, DtReader, isTemplate, FORMAT_VERSION, DT_EXTENSIONS, encryptWithPassphrase, ENCODED_TYPES } from './chunk-DSXHOXDE.js';
+import { processFile, es_default, DtReader, isTemplate, FORMAT_VERSION, DT_EXTENSIONS, encryptWithPassphrase, ENCODED_TYPES } from './chunk-G4B7EHL7.js';
 import './chunk-UOFJT5PY.js';
-import { resolveLegacyAccess, checkConfigPolicy, initializeVault, getVaultStatus, setVaultSecret, getVaultSecret, getAllVaultSecrets, listVaultSecretKeys, deleteVaultSecret, vaultSecretExists, getVaultKey, noormDb, getNoormTables, encryptVaultKey, assertVaultPolicy, assertPolicy, detectAgentHarness, guarded } from './chunk-2RW4SL2O.js';
-import { makeNestedConfig, gigabytes, attempt, observer, attemptSync, retry, getEnvConfigName, clone, merge, equals, ObserverRelay, isDebug, runWithTimeout, wait } from './chunk-QAECL4RN.js';
-export { observer as noormObserver } from './chunk-QAECL4RN.js';
-import { external_exports, PortSchema, DEFAULT_PORTS } from './chunk-SPU42W75.js';
+import { resolveLegacyAccess, checkConfigPolicy, initializeVault, getVaultStatus, setVaultSecret, getVaultSecret, getAllVaultSecrets, listVaultSecretKeys, deleteVaultSecret, vaultSecretExists, getVaultKey, noormDb, getNoormTables, encryptVaultKey, assertVaultPolicy, assertPolicy, detectAgentHarness, guarded } from './chunk-FSVO6NAJ.js';
+import { makeNestedConfig, gigabytes, attempt, observer, attemptSync, getEnvConfigName, clone, merge, equals, retry, runWithTimeout, isTimeoutError, ObserverRelay, isDebug, wait } from './chunk-LY2F7ZFI.js';
+export { observer as noormObserver } from './chunk-LY2F7ZFI.js';
+import { external_exports, PortSchema, connectTimeoutFor, DEFAULT_PORTS } from './chunk-WE2JLJMT.js';
 import { dist_default } from './chunk-TBRUDUBQ.js';
 import { require_dist } from './chunk-YJBKNUTP.js';
 import { __commonJS, __toESM } from './chunk-D2XW2UOP.js';
@@ -353,7 +353,8 @@ var ConnectionSchema = external_exports.object({
   password: external_exports.string().optional(),
   ssl: SSLSchema.optional(),
   pool: PoolSchema.optional(),
-  tlsServerName: external_exports.string().optional()
+  tlsServerName: external_exports.string().optional(),
+  connectTimeoutMs: external_exports.number().int().positive().optional()
 }).refine((conn) => conn.dialect === "sqlite" || conn.host, {
   message: "Host is required for non-SQLite databases",
   path: ["host"]
@@ -385,7 +386,8 @@ var PartialConnectionSchema = external_exports.object({
   password: external_exports.string().optional(),
   ssl: SSLSchema.optional(),
   pool: PoolSchema.optional(),
-  tlsServerName: external_exports.string().optional()
+  tlsServerName: external_exports.string().optional(),
+  connectTimeoutMs: external_exports.number().int().positive().optional()
 });
 external_exports.object({
   name: external_exports.string().regex(/^[a-z0-9_-]+$/i).optional(),
@@ -1722,6 +1724,48 @@ async function initState(projectRoot) {
   return manager;
 }
 
+// src/core/settings/defaults.ts
+var DEFAULT_BUILD_CONFIG = {
+  include: [],
+  exclude: []
+};
+var DEFAULT_PATH_CONFIG = {
+  sql: "./sql",
+  changes: "./changes"
+};
+var DEFAULT_STRICT_CONFIG = {
+  enabled: false,
+  stages: []
+};
+var DEFAULT_LOGGING_CONFIG = {
+  enabled: true,
+  level: "info",
+  file: ".noorm/state/noorm.log",
+  maxSize: "10mb",
+  maxFiles: 5
+};
+var DEFAULT_UI_MOUSE = true;
+var DEFAULT_SETTINGS = {
+  build: DEFAULT_BUILD_CONFIG,
+  paths: DEFAULT_PATH_CONFIG,
+  strict: DEFAULT_STRICT_CONFIG,
+  logging: DEFAULT_LOGGING_CONFIG
+};
+function createDefaultSettings() {
+  return {
+    build: {
+      include: [...DEFAULT_BUILD_CONFIG.include ?? []],
+      exclude: [...DEFAULT_BUILD_CONFIG.exclude ?? []]
+    },
+    paths: { ...DEFAULT_PATH_CONFIG },
+    rules: [],
+    stages: {},
+    strict: { ...DEFAULT_STRICT_CONFIG, stages: [...DEFAULT_STRICT_CONFIG.stages ?? []] },
+    logging: { ...DEFAULT_LOGGING_CONFIG }
+  };
+}
+var SETTINGS_DIR_PATH = ".noorm";
+
 // src/core/settings/schema.ts
 var DialectSchema2 = external_exports.enum(["postgres", "mysql", "sqlite", "mssql"]);
 var SecretTypeSchema = external_exports.enum(["string", "password", "api_key", "connection_string"]);
@@ -1791,6 +1835,9 @@ var TeardownConfigSchema = external_exports.object({
   preserveTables: external_exports.array(external_exports.string()).optional(),
   postScript: external_exports.string().optional()
 });
+var UiConfigSchema = external_exports.object({
+  mouse: external_exports.boolean().default(DEFAULT_UI_MOUSE)
+});
 var SettingsSchema = external_exports.object({
   build: BuildConfigSchema.optional(),
   paths: PathConfigSchema.optional(),
@@ -1799,7 +1846,8 @@ var SettingsSchema = external_exports.object({
   strict: StrictConfigSchema.optional(),
   logging: LoggingConfigSchema.optional(),
   secrets: external_exports.array(StageSecretSchema).optional(),
-  teardown: TeardownConfigSchema.optional()
+  teardown: TeardownConfigSchema.optional(),
+  ui: UiConfigSchema.optional()
 });
 var SettingsValidationError = class extends Error {
   constructor(message, field, issues) {
@@ -1833,47 +1881,6 @@ function parseSettings(settings) {
   return result.data;
 }
 
-// src/core/settings/defaults.ts
-var DEFAULT_BUILD_CONFIG = {
-  include: [],
-  exclude: []
-};
-var DEFAULT_PATH_CONFIG = {
-  sql: "./sql",
-  changes: "./changes"
-};
-var DEFAULT_STRICT_CONFIG = {
-  enabled: false,
-  stages: []
-};
-var DEFAULT_LOGGING_CONFIG = {
-  enabled: true,
-  level: "info",
-  file: ".noorm/state/noorm.log",
-  maxSize: "10mb",
-  maxFiles: 5
-};
-var DEFAULT_SETTINGS = {
-  build: DEFAULT_BUILD_CONFIG,
-  paths: DEFAULT_PATH_CONFIG,
-  strict: DEFAULT_STRICT_CONFIG,
-  logging: DEFAULT_LOGGING_CONFIG
-};
-function createDefaultSettings() {
-  return {
-    build: {
-      include: [...DEFAULT_BUILD_CONFIG.include ?? []],
-      exclude: [...DEFAULT_BUILD_CONFIG.exclude ?? []]
-    },
-    paths: { ...DEFAULT_PATH_CONFIG },
-    rules: [],
-    stages: {},
-    strict: { ...DEFAULT_STRICT_CONFIG, stages: [...DEFAULT_STRICT_CONFIG.stages ?? []] },
-    logging: { ...DEFAULT_LOGGING_CONFIG }
-  };
-}
-var SETTINGS_DIR_PATH = ".noorm";
-
 // src/core/settings/rules.ts
 function isConfigGuarded(config) {
   return guarded(config);
@@ -2692,6 +2699,47 @@ async function loadExistingIdentity() {
   };
 }
 
+// src/core/shared/abort.ts
+var OperationAbortedError = class extends Error {
+  name = "OperationAbortedError";
+  constructor(message = "Stopped waiting for the database") {
+    super(message);
+  }
+};
+function throwIfAborted(signal, message) {
+  if (signal?.aborted) {
+    throw new OperationAbortedError(message);
+  }
+}
+function raceAbort(work, signal, onAbandoned) {
+  if (!signal) return work;
+  let abandoned = signal.aborted;
+  void work.then(
+    (value) => {
+      if (abandoned) onAbandoned?.(value);
+    },
+    () => void 0
+  );
+  throwIfAborted(signal);
+  return new Promise((resolve3, reject) => {
+    const onAbort = () => {
+      abandoned = true;
+      reject(new OperationAbortedError());
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    void work.then(
+      (value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve3(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      }
+    );
+  });
+}
+
 // src/core/connection/manager.ts
 var ConnectionManager = class {
   #cached = /* @__PURE__ */ new Map();
@@ -2874,11 +2922,11 @@ async function getDialectFactory(dialect) {
       }
       return (await import('./sqlite-F3ZSSDUM.js')).createSqliteConnection;
     case "postgres":
-      return (await import('./postgres-NIL5BE3O.js')).createPostgresConnection;
+      return (await import('./postgres-MXXRYPOY.js')).createPostgresConnection;
     case "mysql":
-      return (await import('./mysql-5P43DYBY.js')).createMysqlConnection;
+      return (await import('./mysql-32B4SXWA.js')).createMysqlConnection;
     case "mssql":
-      return (await import('./mssql-NL6OHOMO.js')).createMssqlConnection;
+      return (await import('./mssql-3BQB6ACD.js')).createMssqlConnection;
     default:
       throw new Error(`Unsupported dialect: ${dialect}`);
   }
@@ -2892,8 +2940,19 @@ function getInstallCommand(dialect) {
   };
   return commands[dialect];
 }
-async function createConnection(config, configName = "__default__", retryOptions = {}) {
+var DISCARD_TIMEOUT_MS = 5e3;
+var PROBE_GRACE_MS = 2e3;
+async function discardConnection(conn, timeoutMs = DISCARD_TIMEOUT_MS) {
+  const [, err] = await attempt(
+    () => runWithTimeout(() => conn.destroy(), { timeout: timeoutMs, throws: true })
+  );
+  if (err) {
+    observer.emit("error", { source: "connection", error: err });
+  }
+}
+async function openConnection(config, configName, retryOptions, signal) {
   const { retries = 3, delay = 1e3, backoff = 2 } = retryOptions;
+  const connectTimeout = connectTimeoutFor(config);
   const [conn, err] = await attempt(
     () => retry(
       async () => {
@@ -2911,7 +2970,25 @@ async function createConnection(config, configName = "__default__", retryOptions
           throw importErr;
         }
         const conn2 = await createFn(config);
-        await sql`SELECT 1`.execute(conn2.db);
+        if (signal?.aborted) {
+          void discardConnection(conn2);
+          throw new OperationAbortedError();
+        }
+        const [, probeErr] = await attempt(
+          () => runWithTimeout(() => sql`SELECT 1`.execute(conn2.db), {
+            timeout: connectTimeout + PROBE_GRACE_MS,
+            throws: true
+          })
+        );
+        if (probeErr) {
+          void discardConnection(conn2);
+          if (isTimeoutError(probeErr)) {
+            throw new Error(
+              `Database did not respond within ${connectTimeout + PROBE_GRACE_MS}ms`
+            );
+          }
+          throw probeErr;
+        }
         return conn2;
       },
       {
@@ -2919,7 +2996,9 @@ async function createConnection(config, configName = "__default__", retryOptions
         delay,
         backoff,
         jitterFactor: 0.1,
+        signal,
         shouldRetry: (err2) => {
+          if (err2 instanceof OperationAbortedError) return false;
           const msg = err2.message.toLowerCase();
           if (msg.includes("authentication")) return false;
           if (msg.includes("password")) return false;
@@ -2960,6 +3039,14 @@ async function createConnection(config, configName = "__default__", retryOptions
   });
   return trackedConn;
 }
+async function createConnection(config, configName = "__default__", retryOptions = {}, signal) {
+  throwIfAborted(signal);
+  return raceAbort(
+    openConnection(config, configName, retryOptions, signal),
+    signal,
+    discardConnection
+  );
+}
 var SYSTEM_DATABASES = {
   postgres: "postgres",
   mysql: void 0,
@@ -2987,8 +3074,13 @@ async function testConnection(config, options = {}) {
       return { ok: true };
     }
   }
-  const [conn, err] = await attempt(() => createConnection(testConfig, "__test__"));
+  const [conn, err] = await attempt(
+    () => createConnection(testConfig, "__test__", {}, options.signal)
+  );
   if (err) {
+    if (err instanceof OperationAbortedError) {
+      return { ok: false, error: err.message, aborted: true };
+    }
     return { ok: false, error: err.message };
   }
   await conn.destroy();
@@ -7454,7 +7546,7 @@ async function resolveVaultKey(db, dialect) {
 async function buildSecretsContext(stateManager, configName, db, vaultKey, dialect) {
   const secrets = {};
   if (db && vaultKey) {
-    const { getAllVaultSecrets: getAllVaultSecrets2 } = await import('./storage-6QBJ55SB.js');
+    const { getAllVaultSecrets: getAllVaultSecrets2 } = await import('./storage-V5I67ANZ.js');
     const vaultSecrets = await getAllVaultSecrets2(db, vaultKey, dialect ?? "postgres");
     for (const [key, secret] of Object.entries(vaultSecrets)) {
       secrets[key] = secret.value;
@@ -15486,7 +15578,19 @@ function buildScope(db, revertFn, dialect) {
 }
 
 // src/sdk/context.ts
-var Context = class {
+var VALID_SCHEMA_NAME = /^[a-zA-Z0-9_-]+$/;
+function validateSchemaName(name) {
+  if (!name || !VALID_SCHEMA_NAME.test(name)) {
+    throw new Error(
+      `Invalid schema name: "${name}". Only alphanumeric characters, underscores, and hyphens are allowed.`
+    );
+  }
+}
+function qualifyName(schema, name) {
+  if (!schema || name.includes(".")) return name;
+  return `${schema}.${name}`;
+}
+var Context = class _Context {
   #state;
   #noorm = null;
   /**
@@ -15496,6 +15600,12 @@ var Context = class {
    * pool can never reclaim, and the context never closes.
    */
   #heldConnections = /* @__PURE__ */ new Set();
+  /**
+   * Schema this context is scoped to, or `null` for the root context.
+   * Set once by withSchema() and never mutated afterward — a chained
+   * withSchema() call derives a new Context rather than changing this.
+   */
+  #schema = null;
   constructor(config, settings, identity, options, projectRoot) {
     this.#state = {
       connection: null,
@@ -15517,7 +15627,49 @@ var Context = class {
     return this.#state.connection !== null;
   }
   get kysely() {
-    return requireConnection(this.#state).db;
+    const db = requireConnection(this.#state).db;
+    return this.#schema === null ? db : db.withSchema(this.#schema);
+  }
+  // ─────────────────────────────────────────────────────────
+  // Schema Scoping
+  // ─────────────────────────────────────────────────────────
+  /**
+   * Derive a schema-scoped Context sharing this context's connection,
+   * pool, and #heldConnections — same lifecycle, fresh generics for the
+   * schema's own table/routine shape.
+   *
+   * Replaces rather than stacks: calling withSchema() again on an
+   * already-derived context swaps the schema instead of nesting it,
+   * because every derived context re-derives its `.kysely` from the
+   * shared connection's bare instance, never from another derived
+   * context's already-wrapped one.
+   *
+   * `sql`-tagged raw fragments are not rewritten by this — they resolve
+   * against the connection's default schema regardless of this call.
+   *
+   * @throws Error synchronously if `name` fails identifier validation,
+   * before any connection is borrowed or shared state is touched.
+   *
+   * @example
+   * ```typescript
+   * const acct = ctx.withSchema<AcctDB>('acct');
+   * const rows = await acct.kysely.selectFrom('ledger').selectAll().execute();
+   * await acct.proc('rebuild_ledger', { id: 1 }); // -> acct.rebuild_ledger
+   * ```
+   */
+  withSchema(name) {
+    validateSchemaName(name);
+    const derived = new _Context(
+      this.#state.config,
+      this.#state.settings,
+      this.#state.identity,
+      this.#state.options,
+      this.#state.projectRoot
+    );
+    derived.#state = this.#state;
+    derived.#heldConnections = this.#heldConnections;
+    derived.#schema = name;
+    return derived;
   }
   // ─────────────────────────────────────────────────────────
   // Noorm Namespace
@@ -15622,10 +15774,11 @@ var Context = class {
    */
   async proc(name, ...args) {
     const params = args[0];
+    const qualifiedName4 = qualifyName(this.#schema, name);
     if (this.dialect === "postgres") {
-      return this.#executeProcPostgres(name, params);
+      return this.#executeProcPostgres(qualifiedName4, params);
     }
-    const query = buildProcCall(this.dialect, name, params);
+    const query = buildProcCall(this.dialect, qualifiedName4, params);
     const result = await query.execute(this.kysely);
     return result.rows ?? [];
   }
@@ -15678,7 +15831,7 @@ var Context = class {
     const hasParams = !(args.length === 1 && typeof args[0] === "string");
     const params = hasParams ? args[0] : void 0;
     const column = hasParams ? args[1] : args[0];
-    const query = buildFuncCall(this.dialect, name, column, params);
+    const query = buildFuncCall(this.dialect, qualifyName(this.#schema, name), column, params);
     const result = await query.execute(this.kysely);
     return result.rows?.[0] ?? null;
   }
@@ -15706,7 +15859,7 @@ var Context = class {
    */
   async tvf(name, ...args) {
     const params = args[0];
-    const query = buildTvfCall(this.dialect, name, params);
+    const query = buildTvfCall(this.dialect, qualifyName(this.#schema, name), params);
     const result = await query.execute(this.kysely);
     return result.rows ?? [];
   }

package/dist/{mssql-NL6OHOMO.js → mssql-3BQB6ACD.js}

@@ -1,5 +1,5 @@
 import { createRequire } from 'module';
-import { DEFAULT_PORTS } from './chunk-SPU42W75.js';
+import { DEFAULT_PORTS, connectTimeoutFor } from './chunk-WE2JLJMT.js';
 import './chunk-D2XW2UOP.js';
 import { isIP } from 'net';
 import { Kysely, MssqlDialect, sql, OperationNodeTransformer } from 'kysely';
@@ -88,7 +88,13 @@ function buildTediousOptions(config, database) {
       database: database ?? config.database,
       trustServerCertificate: !config.ssl,
       encrypt: true,
-      serverName: resolveTlsServerName(config)
+      serverName: resolveTlsServerName(config),
+      // Matches tedious's own default, so mssql keeps the behaviour it
+      // had while becoming overridable alongside the other dialects.
+      // `requestTimeout` is deliberately left alone: a long-running
+      // query is legitimate, and Escape is the answer for that, not a
+      // deadline nobody asked for.
+      connectTimeout: connectTimeoutFor(config)
     }
   };
 }
@@ -157,5 +163,5 @@ async function createMssqlConnection(config) {
 }
 
 export { MssqlTlsServerNameError, UNVERIFIED_TLS_SERVER_NAME, buildTediousOptions, createMssqlConnection, resolveTlsServerName };
-//# sourceMappingURL=mssql-NL6OHOMO.js.map
-//# sourceMappingURL=mssql-NL6OHOMO.js.map
+//# sourceMappingURL=mssql-3BQB6ACD.js.map
+//# sourceMappingURL=mssql-3BQB6ACD.js.map

package/dist/{mysql-5P43DYBY.js → mysql-32B4SXWA.js}

@@ -1,5 +1,5 @@
 import { createRequire } from 'module';
-import { DEFAULT_PORTS } from './chunk-SPU42W75.js';
+import { DEFAULT_PORTS, connectTimeoutFor } from './chunk-WE2JLJMT.js';
 import './chunk-D2XW2UOP.js';
 import { Kysely, MysqlDialect } from 'kysely';
 
@@ -14,7 +14,10 @@ async function createMysqlConnection(config) {
     password: config.password,
     database: config.database,
     connectionLimit: config.pool?.max ?? 10,
-    ssl: config.ssl ? {} : void 0
+    ssl: config.ssl ? {} : void 0,
+    // mysql2 defaults this to 10s. Set explicitly so every dialect gives
+    // up on the same schedule and one override moves all of them.
+    connectTimeout: connectTimeoutFor(config)
   });
   const db = new Kysely({
     dialect: new MysqlDialect({ pool })
@@ -27,5 +30,5 @@ async function createMysqlConnection(config) {
 }
 
 export { createMysqlConnection };
-//# sourceMappingURL=mysql-5P43DYBY.js.map
-//# sourceMappingURL=mysql-5P43DYBY.js.map
+//# sourceMappingURL=mysql-32B4SXWA.js.map
+//# sourceMappingURL=mysql-32B4SXWA.js.map

package/dist/{postgres-NIL5BE3O.js → postgres-MXXRYPOY.js}

@@ -1,5 +1,5 @@
 import { createRequire } from 'module';
-import { DEFAULT_PORTS } from './chunk-SPU42W75.js';
+import { DEFAULT_PORTS, connectTimeoutFor } from './chunk-WE2JLJMT.js';
 import './chunk-D2XW2UOP.js';
 import { Kysely, PostgresDialect } from 'kysely';
 
@@ -15,7 +15,10 @@ async function createPostgresConnection(config) {
     database: config.database,
     min: config.pool?.min ?? 0,
     max: config.pool?.max ?? 10,
-    ssl: config.ssl
+    ssl: config.ssl,
+    // pg's own default is 0, meaning wait forever: an unreachable host
+    // never comes back without this.
+    connectionTimeoutMillis: connectTimeoutFor(config)
   });
   const db = new Kysely({
     dialect: new PostgresDialect({ pool })
@@ -28,5 +31,5 @@ async function createPostgresConnection(config) {
 }
 
 export { createPostgresConnection };
-//# sourceMappingURL=postgres-NIL5BE3O.js.map
-//# sourceMappingURL=postgres-NIL5BE3O.js.map
+//# sourceMappingURL=postgres-MXXRYPOY.js.map
+//# sourceMappingURL=postgres-MXXRYPOY.js.map

package/dist/{storage-6QBJ55SB.js → storage-V5I67ANZ.js}

@@ -1,8 +1,8 @@
 import { createRequire } from 'module';
-export { deleteVaultSecret, deleteVaultSecretChecked, getAllVaultSecrets, getVaultKey, getVaultKeyChecked, getVaultSecret, getVaultStatus, initializeVault, initializeVaultChecked, listVaultSecretKeys, listVaultSecretKeysChecked, setVaultSecret, setVaultSecretChecked, vaultSecretExists } from './chunk-2RW4SL2O.js';
-import './chunk-QAECL4RN.js';
+export { deleteVaultSecret, deleteVaultSecretChecked, getAllVaultSecrets, getVaultKey, getVaultKeyChecked, getVaultSecret, getVaultStatus, initializeVault, initializeVaultChecked, listVaultSecretKeys, listVaultSecretKeysChecked, setVaultSecret, setVaultSecretChecked, vaultSecretExists } from './chunk-FSVO6NAJ.js';
+import './chunk-LY2F7ZFI.js';
 import './chunk-D2XW2UOP.js';
 
 createRequire(import.meta.url);
-//# sourceMappingURL=storage-6QBJ55SB.js.map
-//# sourceMappingURL=storage-6QBJ55SB.js.map
+//# sourceMappingURL=storage-V5I67ANZ.js.map
+//# sourceMappingURL=storage-V5I67ANZ.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noormdev/sdk",
-  "version": "1.0.2",
+  "version": "1.2.0",
   "description": "Database schema & changeset manager SDK",
   "type": "module",
   "main": "./dist/index.js",