@pgpmjs/core 7.17.0 → 7.18.0

package/apply/materialize.js

@@ -35,11 +35,13 @@ const schemaNameLiteralPass = (content, schemaMapping) => {
 function makeSubsystemStripper(source, spec, instanceName) {
     const selector = { schemas: spec.exclude.schemas };
     const rebinds = (0, transform_1.buildSchemaRouter)({ schemaMap: spec.schemas, routes: spec.route });
-    const fullDeploySql = source.changes
-        .map(c => c.deploy?.sql ?? '')
-        .filter(Boolean)
-        .join('\n');
-    const analysis = (0, slice_1.excludeSubsystem)(fullDeploySql, selector, { rebinds });
+    // One parse per deploy script; the analysis runs over all programs together
+    // (cross-change references into the subsystem are caught by construction)
+    // and returns per-change drop/strip/prune decisions from the same pass.
+    const programs = source.changes
+        .filter(c => c.deploy)
+        .map(c => [c.name, (0, transform_1.parseSqlProgram)(c.deploy.sql)]);
+    const analysis = (0, slice_1.excludeSubsystemPrograms)(programs, selector, { rebinds });
     if (analysis.unsatisfied.length > 0) {
         const detail = [
             ...new Set(analysis.unsatisfied.map(u => `${u.object.schema}.${u.object.name}${u.fk ? ' (foreign key target)' : ''}`))
@@ -49,21 +51,26 @@ function makeSubsystemStripper(source, spec, instanceName) {
             `${detail} with no route/rebind target. Add "route" entries substituting each ` +
             `referenced object, or keep the subsystem.`);
     }
-    // A change whose deploy consists entirely of subsystem statements (plus
-    // transaction control) is excluded *as a change*: its verify/revert scripts
-    // target dropped objects the classifier can't always see (bare DROPs,
-    // catalog probes), so all three scripts are blanked together.
+    // A fully-excluded change is dropped *as a change* — removed from the plan
+    // and deploy order rather than emitted as an empty script (empty scripts
+    // collide on the deploy ledger's script-hash uniqueness). Its verify/revert
+    // scripts target dropped objects the classifier can't always see (bare
+    // DROPs, catalog probes), which is exactly why the whole change is dropped,
+    // not just blanked.
     const excludedChanges = new Set();
-    for (const change of source.changes) {
-        if (!change.deploy)
-            continue;
-        const stripped = (0, slice_1.stripSubsystemSql)(change.deploy.sql, selector);
-        const survivors = stripped.result.kept.filter(i => !stripped.dropped.includes(i) && stripped.result.statements[i].nodeTag !== 'TransactionStmt');
-        if (stripped.dropped.length > 0 && survivors.length === 0) {
-            excludedChanges.add(change.name);
-        }
+    const strippedDeploys = new Map();
+    for (const [name, program] of programs) {
+        const exclusion = analysis.programs.get(name);
+        if (exclusion.fullyExcluded)
+            excludedChanges.add(name);
+        else
+            strippedDeploys.set(program.source, exclusion.sql);
     }
-    const strip = (sql, change) => excludedChanges.has(change) ? (0, slice_1.blankScriptSql)(sql) : (0, slice_1.stripSubsystemSql)(sql, selector).sql;
+    // Surviving changes may still contain stray subsystem statements (a change
+    // that both creates a survivor and touches the excluded subsystem); strip
+    // those in place. Verify/revert scripts are separate sources, stripped on
+    // demand with the same selector.
+    const strip = (sql) => strippedDeploys.get(sql) ?? (0, slice_1.stripSubsystemSql)(sql, selector).sql;
     return { strip, excludedChanges };
 }
 /**
@@ -113,14 +120,20 @@ async function materializeApplyModule(options) {
             assumeSchemasExist: targetSchemas
         }
     });
-    // Excluded changes keep their source identity (an emptied tombstone) —
-    // renaming them into the replacement provider's namespace would be a lie.
+    // Excluded changes are dropped from the artifact entirely (plan + deploy
+    // order + dependency refs); surviving changes get their stray subsystem
+    // statements stripped before the namespace transform.
     const transpiled = (0, bundle_1.transpileBundle)(source, {
+        excludeChange: stripSubsystem
+            ? (name) => stripSubsystem.excludedChanges.has(name)
+            : undefined,
+        // Excluded changes keep their source identity so the plan-prune (which
+        // matches source names) can find them; survivors route normally.
         renameChange: stripSubsystem
             ? (name) => (stripSubsystem.excludedChanges.has(name) ? name : renameChange(name))
             : renameChange,
         transformScript: stripSubsystem
-            ? (sql, ctx) => transformScript(stripSubsystem.strip(sql, ctx.change), ctx)
+            ? (sql, ctx) => transformScript(stripSubsystem.strip(sql), ctx)
             : transformScript,
         renameModule: instanceName,
         provenance: {

package/bundle/artifact.d.ts

@@ -27,6 +27,18 @@ export declare function buildExecutableBundle(moduleDir: string, options?: Creat
  * Emit a module's stored bundle artifact into `sql/`, returning its path.
  */
 export declare function writeBundleArtifact(moduleDir: string, version: string, options?: CreateBundleOptions): Promise<string>;
+/**
+ * Whether a stored bundle still describes what is on disk.
+ *
+ * `verifyBundle` only proves an artifact is internally consistent — it cannot
+ * tell that `deploy/` moved on since the artifact was written. A committed
+ * artifact plus a rebased branch is exactly that case, and using it would
+ * deploy the stale SQL while recording hashes for it, silently.
+ *
+ * The check is deliberately I/O-only (read + sha256, no parse), so it costs a
+ * fraction of the parse/deparse work the artifact exists to avoid.
+ */
+export declare function bundleMatchesModule(moduleDir: string, bundle: MigrationBundle): boolean;
 /**
  * Read a module's stored bundle artifact, or `null` when it has none or the
  * archive cannot be read. Never throws — a broken artifact must degrade to the

package/bundle/artifact.js

@@ -4,9 +4,11 @@ exports.bundleArtifactFileName = bundleArtifactFileName;
 exports.resolveBundleArtifactPath = resolveBundleArtifactPath;
 exports.buildExecutableBundle = buildExecutableBundle;
 exports.writeBundleArtifact = writeBundleArtifact;
+exports.bundleMatchesModule = bundleMatchesModule;
 exports.readBundleArtifact = readBundleArtifact;
 const fs_1 = require("fs");
 const path_1 = require("path");
+const ast_1 = require("@pgpmjs/ast");
 const files_1 = require("@pgpmjs/ast/files");
 const bundle_1 = require("@pgpmjs/bundle");
 const clean_1 = require("../migrate/clean");
@@ -78,6 +80,34 @@ async function writeBundleArtifact(moduleDir, version, options) {
     (0, bundle_1.writeBundleArchiveFile)(bundle, outPath);
     return outPath;
 }
+/**
+ * Whether a stored bundle still describes what is on disk.
+ *
+ * `verifyBundle` only proves an artifact is internally consistent — it cannot
+ * tell that `deploy/` moved on since the artifact was written. A committed
+ * artifact plus a rebased branch is exactly that case, and using it would
+ * deploy the stale SQL while recording hashes for it, silently.
+ *
+ * The check is deliberately I/O-only (read + sha256, no parse), so it costs a
+ * fraction of the parse/deparse work the artifact exists to avoid.
+ */
+function bundleMatchesModule(moduleDir, bundle) {
+    const planPath = (0, path_1.join)(moduleDir, 'pgpm.plan');
+    if (!(0, fs_1.existsSync)(planPath))
+        return false;
+    if ((0, fs_1.readFileSync)(planPath, 'utf-8') !== bundle.plan)
+        return false;
+    for (const change of bundle.changes) {
+        if (!change.deploy)
+            continue;
+        const deployPath = (0, path_1.join)(moduleDir, 'deploy', `${change.name}.sql`);
+        if (!(0, fs_1.existsSync)(deployPath))
+            return false;
+        if ((0, ast_1.hashString)((0, fs_1.readFileSync)(deployPath, 'utf-8')) !== change.deploy.digest)
+            return false;
+    }
+    return true;
+}
 /**
  * Read a module's stored bundle artifact, or `null` when it has none or the
  * archive cannot be read. Never throws — a broken artifact must degrade to the

package/bundle/deploy-bundled.js

@@ -47,11 +47,17 @@ async function loadExecutableBundle(moduleDir) {
     const stored = (0, artifact_1.readBundleArtifact)(moduleDir);
     if (stored) {
         const issues = (0, bundle_1.verifyBundle)(stored);
-        if (issues.length === 0) {
+        if (issues.length > 0) {
+            log.warn(`⚠️ Bundle artifact for ${stored.manifest.name} failed verification ` +
+                `(${issues.map(i => i.kind).join(', ')}); rebuilding from deploy/.`);
+        }
+        else if (!(0, artifact_1.bundleMatchesModule)(moduleDir, stored)) {
+            log.warn(`⚠️ Bundle artifact for ${stored.manifest.name} is stale (deploy/ has ` +
+                `changed since it was packaged); rebuilding from deploy/.`);
+        }
+        else {
             return { bundle: stored, source: 'artifact' };
         }
-        log.warn(`⚠️ Bundle artifact for ${stored.manifest.name} failed verification ` +
-            `(${issues.map(i => i.kind).join(', ')}); rebuilding from deploy/.`);
     }
     return { bundle: await (0, artifact_1.buildExecutableBundle)(moduleDir), source: 'packaged' };
 }

package/esm/apply/materialize.js

@@ -2,8 +2,8 @@ import { mkdtempSync } from 'fs';
 import { tmpdir } from 'os';
 import { join, resolve } from 'path';
 import { bundleFromModule, materializeBundle, transpileBundle, verifyBundle } from '@pgpmjs/bundle';
-import { buildSchemaRouter, loadModule, makeSchemaTranspiler } from '@pgpmjs/transform';
-import { blankScriptSql, excludeSubsystem, stripSubsystemSql } from '@pgpmjs/slice';
+import { buildSchemaRouter, loadModule, makeSchemaTranspiler, parseSqlProgram } from '@pgpmjs/transform';
+import { excludeSubsystemPrograms, stripSubsystemSql } from '@pgpmjs/slice';
 import { hasApplySpec, readApplySpec } from './apply-spec';
 import { loadWorkspaceRoutingProfile, resolveEffectiveApplySpec } from './profile';
 import { isReuseSpec, materializeReuseModule, resolveSharedModuleName } from './reuse';
@@ -30,11 +30,13 @@ const schemaNameLiteralPass = (content, schemaMapping) => {
 function makeSubsystemStripper(source, spec, instanceName) {
     const selector = { schemas: spec.exclude.schemas };
     const rebinds = buildSchemaRouter({ schemaMap: spec.schemas, routes: spec.route });
-    const fullDeploySql = source.changes
-        .map(c => c.deploy?.sql ?? '')
-        .filter(Boolean)
-        .join('\n');
-    const analysis = excludeSubsystem(fullDeploySql, selector, { rebinds });
+    // One parse per deploy script; the analysis runs over all programs together
+    // (cross-change references into the subsystem are caught by construction)
+    // and returns per-change drop/strip/prune decisions from the same pass.
+    const programs = source.changes
+        .filter(c => c.deploy)
+        .map(c => [c.name, parseSqlProgram(c.deploy.sql)]);
+    const analysis = excludeSubsystemPrograms(programs, selector, { rebinds });
     if (analysis.unsatisfied.length > 0) {
         const detail = [
             ...new Set(analysis.unsatisfied.map(u => `${u.object.schema}.${u.object.name}${u.fk ? ' (foreign key target)' : ''}`))
@@ -44,21 +46,26 @@ function makeSubsystemStripper(source, spec, instanceName) {
             `${detail} with no route/rebind target. Add "route" entries substituting each ` +
             `referenced object, or keep the subsystem.`);
     }
-    // A change whose deploy consists entirely of subsystem statements (plus
-    // transaction control) is excluded *as a change*: its verify/revert scripts
-    // target dropped objects the classifier can't always see (bare DROPs,
-    // catalog probes), so all three scripts are blanked together.
+    // A fully-excluded change is dropped *as a change* — removed from the plan
+    // and deploy order rather than emitted as an empty script (empty scripts
+    // collide on the deploy ledger's script-hash uniqueness). Its verify/revert
+    // scripts target dropped objects the classifier can't always see (bare
+    // DROPs, catalog probes), which is exactly why the whole change is dropped,
+    // not just blanked.
     const excludedChanges = new Set();
-    for (const change of source.changes) {
-        if (!change.deploy)
-            continue;
-        const stripped = stripSubsystemSql(change.deploy.sql, selector);
-        const survivors = stripped.result.kept.filter(i => !stripped.dropped.includes(i) && stripped.result.statements[i].nodeTag !== 'TransactionStmt');
-        if (stripped.dropped.length > 0 && survivors.length === 0) {
-            excludedChanges.add(change.name);
-        }
+    const strippedDeploys = new Map();
+    for (const [name, program] of programs) {
+        const exclusion = analysis.programs.get(name);
+        if (exclusion.fullyExcluded)
+            excludedChanges.add(name);
+        else
+            strippedDeploys.set(program.source, exclusion.sql);
     }
-    const strip = (sql, change) => excludedChanges.has(change) ? blankScriptSql(sql) : stripSubsystemSql(sql, selector).sql;
+    // Surviving changes may still contain stray subsystem statements (a change
+    // that both creates a survivor and touches the excluded subsystem); strip
+    // those in place. Verify/revert scripts are separate sources, stripped on
+    // demand with the same selector.
+    const strip = (sql) => strippedDeploys.get(sql) ?? stripSubsystemSql(sql, selector).sql;
     return { strip, excludedChanges };
 }
 /**
@@ -108,14 +115,20 @@ export async function materializeApplyModule(options) {
             assumeSchemasExist: targetSchemas
         }
     });
-    // Excluded changes keep their source identity (an emptied tombstone) —
-    // renaming them into the replacement provider's namespace would be a lie.
+    // Excluded changes are dropped from the artifact entirely (plan + deploy
+    // order + dependency refs); surviving changes get their stray subsystem
+    // statements stripped before the namespace transform.
     const transpiled = transpileBundle(source, {
+        excludeChange: stripSubsystem
+            ? (name) => stripSubsystem.excludedChanges.has(name)
+            : undefined,
+        // Excluded changes keep their source identity so the plan-prune (which
+        // matches source names) can find them; survivors route normally.
         renameChange: stripSubsystem
             ? (name) => (stripSubsystem.excludedChanges.has(name) ? name : renameChange(name))
             : renameChange,
         transformScript: stripSubsystem
-            ? (sql, ctx) => transformScript(stripSubsystem.strip(sql, ctx.change), ctx)
+            ? (sql, ctx) => transformScript(stripSubsystem.strip(sql), ctx)
             : transformScript,
         renameModule: instanceName,
         provenance: {

package/esm/bundle/artifact.js

@@ -1,5 +1,6 @@
 import { existsSync, readdirSync, readFileSync } from 'fs';
 import { join } from 'path';
+import { hashString } from '@pgpmjs/ast';
 import { getExtensionName, parseControlContent } from '@pgpmjs/ast/files';
 import { BUNDLE_ARCHIVE_EXTENSION, bundleFromModule, readBundleArchiveFile, withExecutableSql, writeBundleArchiveFile } from '@pgpmjs/bundle';
 import { cleanSql } from '../migrate/clean';
@@ -71,6 +72,34 @@ export async function writeBundleArtifact(moduleDir, version, options) {
     writeBundleArchiveFile(bundle, outPath);
     return outPath;
 }
+/**
+ * Whether a stored bundle still describes what is on disk.
+ *
+ * `verifyBundle` only proves an artifact is internally consistent — it cannot
+ * tell that `deploy/` moved on since the artifact was written. A committed
+ * artifact plus a rebased branch is exactly that case, and using it would
+ * deploy the stale SQL while recording hashes for it, silently.
+ *
+ * The check is deliberately I/O-only (read + sha256, no parse), so it costs a
+ * fraction of the parse/deparse work the artifact exists to avoid.
+ */
+export function bundleMatchesModule(moduleDir, bundle) {
+    const planPath = join(moduleDir, 'pgpm.plan');
+    if (!existsSync(planPath))
+        return false;
+    if (readFileSync(planPath, 'utf-8') !== bundle.plan)
+        return false;
+    for (const change of bundle.changes) {
+        if (!change.deploy)
+            continue;
+        const deployPath = join(moduleDir, 'deploy', `${change.name}.sql`);
+        if (!existsSync(deployPath))
+            return false;
+        if (hashString(readFileSync(deployPath, 'utf-8')) !== change.deploy.digest)
+            return false;
+    }
+    return true;
+}
 /**
  * Read a module's stored bundle artifact, or `null` when it has none or the
  * archive cannot be read. Never throws — a broken artifact must degrade to the

package/esm/bundle/deploy-bundled.js

@@ -2,7 +2,7 @@ import { Logger } from '@pgpmjs/logger';
 import { verifyBundle } from '@pgpmjs/bundle';
 import { getPgPool } from 'pg-cache';
 import { PgpmMigrate } from '../migrate/client';
-import { buildExecutableBundle, readBundleArtifact } from './artifact';
+import { bundleMatchesModule, buildExecutableBundle, readBundleArtifact } from './artifact';
 const log = new Logger('deploy-fast');
 /** Thrown when the ledger already holds a change with different content. */
 export class BundledDeployConflictError extends Error {
@@ -40,11 +40,17 @@ async function loadExecutableBundle(moduleDir) {
     const stored = readBundleArtifact(moduleDir);
     if (stored) {
         const issues = verifyBundle(stored);
-        if (issues.length === 0) {
+        if (issues.length > 0) {
+            log.warn(`⚠️ Bundle artifact for ${stored.manifest.name} failed verification ` +
+                `(${issues.map(i => i.kind).join(', ')}); rebuilding from deploy/.`);
+        }
+        else if (!bundleMatchesModule(moduleDir, stored)) {
+            log.warn(`⚠️ Bundle artifact for ${stored.manifest.name} is stale (deploy/ has ` +
+                `changed since it was packaged); rebuilding from deploy/.`);
+        }
+        else {
             return { bundle: stored, source: 'artifact' };
         }
-        log.warn(`⚠️ Bundle artifact for ${stored.manifest.name} failed verification ` +
-            `(${issues.map(i => i.kind).join(', ')}); rebuilding from deploy/.`);
     }
     return { bundle: await buildExecutableBundle(moduleDir), source: 'packaged' };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pgpmjs/core",
-  "version": "7.17.0",
+  "version": "7.18.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "PGPM Package and Migration Tools",
   "main": "index.js",
@@ -48,24 +48,24 @@
     "makage": "^0.3.0"
   },
   "dependencies": {
-    "@pgpmjs/ast": "^0.9.4",
-    "@pgpmjs/bundle": "^0.12.2",
-    "@pgpmjs/env": "^2.39.1",
-    "@pgpmjs/logger": "^2.22.0",
-    "@pgpmjs/server-utils": "^3.23.3",
-    "@pgpmjs/slice": "^0.11.0",
-    "@pgpmjs/transform": "^0.12.0",
-    "@pgpmjs/types": "^2.48.0",
-    "csv-to-pg": "^4.8.0",
+    "@pgpmjs/ast": "^0.9.5",
+    "@pgpmjs/bundle": "^0.12.4",
+    "@pgpmjs/env": "^2.39.2",
+    "@pgpmjs/logger": "^2.22.1",
+    "@pgpmjs/server-utils": "^3.23.4",
+    "@pgpmjs/slice": "^0.12.0",
+    "@pgpmjs/transform": "^0.13.0",
+    "@pgpmjs/types": "^2.48.1",
+    "csv-to-pg": "^4.8.1",
     "genomic": "^5.6.2",
     "glob": "^13.0.6",
     "parse-package-name": "^1.0.0",
     "pg": "^8.21.0",
-    "pg-cache": "^3.23.3",
-    "pg-env": "^1.26.0",
+    "pg-cache": "^3.23.4",
+    "pg-env": "^1.26.1",
     "pgsql-deparser": "^18.1.1",
     "pgsql-parser": "^18.1.1",
     "yanse": "^0.2.1"
   },
-  "gitHead": "2832d5632d11eb22e1437df773706ac6a99175fe"
+  "gitHead": "04b34ce4b5efcebfd8e49d64d196e651288d97f3"
 }