@quereus/quereus 4.7.0 → 4.9.0

package/dist/src/schema/object-dependency-closure.d.ts

@@ -0,0 +1,127 @@
+import type * as AST from '../parser/ast.js';
+import type { Database } from '../core/database.js';
+import { type ResolveObjectRef, type TableRenameOpts } from './rename-rewriter.js';
+import type { ObjectRefResolvers } from './object-ref-resolver.js';
+/**
+ * The catalog query "can this stored body REACH that object?", as opposed to the
+ * one-hop "does this stored body NAME that object?" the rename walkers answer.
+ *
+ * A DROP guard that only asks the one-hop question is defeated by a view: an
+ * assertion body reading `v` where `create view v as select * from t` names `t`
+ * nowhere, so `drop table t` is accepted and every later write to the whole
+ * database fails on an assertion whose text does not mention `t`. Reach is the
+ * closure over STORED bodies — an assertion body names views and materialized
+ * views, whose bodies name further views and base tables — and this module is
+ * the one place that closure is computed, so the guard families that consume it
+ * cannot end up disagreeing about what "reaches" means.
+ *
+ * Each body is walked under ITS OWN home-schema resolver, so an unqualified
+ * name in a view body means what the planner would make of it *in that body*,
+ * not what it would mean in the root body. That is the whole reason
+ * {@link ObjectRefResolvers} is a per-home-schema factory over one snapshot.
+ *
+ * Scope-awareness survives the widening because the walk is
+ * {@link collectTableRefsInAst}, the third sink over the very traversal the
+ * rename uses: a body whose `with t as (…)` merely shadows the name still
+ * contributes no reference, so the closure cannot false-refuse where the direct
+ * probe already does not.
+ */
+/**
+ * One stored body the closure walked, and how the root got to it.
+ *
+ * The root body itself is a `ReachedBody` with an empty {@link path} and no
+ * {@link ownerKey} — it is an assertion's CHECK, or a table's CHECK / DEFAULT /
+ * generated expression, none of which is a catalog object with a key of its own.
+ */
+export interface ReachedBody {
+    /**
+     * Canonical `<schema>.<name>` key of the view / materialized view owning this
+     * body, or `undefined` for the ROOT body the closure started from.
+     */
+    ownerKey: string | undefined;
+    /**
+     * The stored bodies traversed from the root to this one INCLUSIVE, root-first,
+     * each described for an error message: `view 'v'`, `materialized view 'm'`.
+     * Empty for the root body itself, which is what tells a caller its match is
+     * direct and needs no "reaches it through …" clause.
+     */
+    path: ReadonlyArray<string>;
+    /** The AST to walk — an assertion/CHECK expression at the root, a view body below it. */
+    body: AST.AstNode;
+    /** Planner-parity resolver for THIS body's home schema. */
+    resolve: ResolveObjectRef;
+}
+/** What {@link reachableObjects} returns: the walked bodies, and who named what. */
+export interface ObjectReach {
+    /**
+     * The root body followed by every stored body reached from it, breadth-first.
+     * A caller asking a question the closure does not answer itself — "does any
+     * body in the reach name `t.x`?" — probes these in order.
+     */
+    readonly bodies: ReadonlyArray<ReachedBody>;
+    /**
+     * The body that NAMES `key`, or `undefined` when nothing in the reach does.
+     * Breadth-first, so the answer is the shortest chain from the root and its
+     * {@link ReachedBody.path} is the shortest path to quote in an error.
+     *
+     * NOTE: two chains of EQUAL length to the same object tie on queue order,
+     * i.e. the order the parent bodies happened to name their children. Harmless
+     * while the path is advisory — either chain is a true one, and dropping the
+     * rule is the escape hatch for both — but a caller that ever needs a
+     * deterministic chain (a stable error-message fixture, say) has to order the
+     * candidates itself.
+     */
+    namerOf(key: string): ReachedBody | undefined;
+}
+/**
+ * Every object reachable from `root` through stored view / materialized-view
+ * bodies, plus the bodies traversed to get there.
+ *
+ * `homeSchemaName` is the root body's OWN schema — the assertion's schema, or
+ * the schema of the table carrying the CHECK / DEFAULT — because that is what
+ * the root's unqualified names resolve against.
+ *
+ * `resolvers` is REQUIRED rather than built here, and the reason is snapshot
+ * discipline (see {@link import('./object-ref-resolver.js').snapshotObjectRefResolvers}):
+ * a caller looping over many roots must share ONE pre-mutation snapshot, and a
+ * default would silently give each root its own.
+ *
+ * Termination is a visited set of object keys, so a mutually-referencing or
+ * otherwise malformed catalog is walked once per object rather than forever. A
+ * body naming an object that does not exist is not an error: the resolver's
+ * miss→home fallback keys it stably and the expansion below simply finds
+ * nothing to expand.
+ *
+ * `rootOpts` applies to the ROOT body's collection ONLY, never to a body
+ * reached below it. Every reached body is a view / materialized-view body — a
+ * relation, with no written-row context — so
+ * {@link import('./rename/table-rename.js').TableRenameOpts.rowImageContext}
+ * would be wrong there. It is REQUIRED at a root that is a table's CHECK
+ * constraint or column DEFAULT / generated body, where a bare `new.a` names the
+ * row image: rooted there without the flag, a table literally called `new`
+ * would land in the reach and false-refuse its own drop
+ * (`schema/expression-dependents.ts` passes it for exactly that reason). The
+ * assertion guards pass nothing: an assertion CHECK owns no `new.` / `old.`
+ * namespace either.
+ *
+ * Root-only stays correct even though a reached body CAN carry a bare unbound
+ * `new.` qualifier — a `with inverse` / `with defaults` expression holds one
+ * legitimately (`CREATE VIEW` accepts it there; the refs name the enclosing
+ * select's output row) — because the walker suppresses those SUBTREES itself,
+ * unconditionally, wherever the walk entered (`rename/table-rename.ts`,
+ * `visitRowImageSubtree`). The suppression travels with the position, not with
+ * this flag, so a reached view body self-suppresses and leaking `rootOpts`
+ * downward would change no answer. Pinned by
+ * `test/logic/41.10.4-drop-object-expression-dependents.sqllogic` (drop of a
+ * table named `new` reached through a `with inverse` view).
+ */
+export declare function reachableObjects(db: Database, root: AST.AstNode, homeSchemaName: string, resolvers: ObjectRefResolvers, rootOpts?: TableRenameOpts): ObjectReach;
+/**
+ * The `reaches it through view 'v2' -> view 'v1'` clause for a
+ * {@link ReachedBody.path}, or the empty string when the match is direct.
+ * Shared so every guard consuming the closure phrases an indirect refusal the
+ * same way — a user told to fix a rule whose body does not mention the dropped
+ * object needs the chain, or the message is unactionable.
+ */
+export declare function describeReachPath(path: ReadonlyArray<string>): string;
+//# sourceMappingURL=object-dependency-closure.d.ts.map

package/dist/src/schema/object-dependency-closure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-dependency-closure.d.ts","sourceRoot":"","sources":["../../../src/schema/object-dependency-closure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,GAAG,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAA6C,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC9H,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC3B;;;OAGG;IACH,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B;;;;;OAKG;IACH,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,yFAAyF;IACzF,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC;IAClB,2DAA2D;IAC3D,OAAO,EAAE,gBAAgB,CAAC;CAC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,WAAW;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC5C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,gBAAgB,CAC/B,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,GAAG,CAAC,OAAO,EACjB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,kBAAkB,EAC7B,QAAQ,CAAC,EAAE,eAAe,GACxB,WAAW,CA+Bb;AAgDD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,CAErE"}

package/dist/src/schema/object-dependency-closure.js

@@ -0,0 +1,117 @@
+import { collectTableRefsInAst, objectRefKeySchema } from './rename-rewriter.js';
+import { isMaintainedTable } from './derivation.js';
+/**
+ * Every object reachable from `root` through stored view / materialized-view
+ * bodies, plus the bodies traversed to get there.
+ *
+ * `homeSchemaName` is the root body's OWN schema — the assertion's schema, or
+ * the schema of the table carrying the CHECK / DEFAULT — because that is what
+ * the root's unqualified names resolve against.
+ *
+ * `resolvers` is REQUIRED rather than built here, and the reason is snapshot
+ * discipline (see {@link import('./object-ref-resolver.js').snapshotObjectRefResolvers}):
+ * a caller looping over many roots must share ONE pre-mutation snapshot, and a
+ * default would silently give each root its own.
+ *
+ * Termination is a visited set of object keys, so a mutually-referencing or
+ * otherwise malformed catalog is walked once per object rather than forever. A
+ * body naming an object that does not exist is not an error: the resolver's
+ * miss→home fallback keys it stably and the expansion below simply finds
+ * nothing to expand.
+ *
+ * `rootOpts` applies to the ROOT body's collection ONLY, never to a body
+ * reached below it. Every reached body is a view / materialized-view body — a
+ * relation, with no written-row context — so
+ * {@link import('./rename/table-rename.js').TableRenameOpts.rowImageContext}
+ * would be wrong there. It is REQUIRED at a root that is a table's CHECK
+ * constraint or column DEFAULT / generated body, where a bare `new.a` names the
+ * row image: rooted there without the flag, a table literally called `new`
+ * would land in the reach and false-refuse its own drop
+ * (`schema/expression-dependents.ts` passes it for exactly that reason). The
+ * assertion guards pass nothing: an assertion CHECK owns no `new.` / `old.`
+ * namespace either.
+ *
+ * Root-only stays correct even though a reached body CAN carry a bare unbound
+ * `new.` qualifier — a `with inverse` / `with defaults` expression holds one
+ * legitimately (`CREATE VIEW` accepts it there; the refs name the enclosing
+ * select's output row) — because the walker suppresses those SUBTREES itself,
+ * unconditionally, wherever the walk entered (`rename/table-rename.ts`,
+ * `visitRowImageSubtree`). The suppression travels with the position, not with
+ * this flag, so a reached view body self-suppresses and leaking `rootOpts`
+ * downward would change no answer. Pinned by
+ * `test/logic/41.10.4-drop-object-expression-dependents.sqllogic` (drop of a
+ * table named `new` reached through a `with inverse` view).
+ */
+export function reachableObjects(db, root, homeSchemaName, resolvers, rootOpts) {
+    const bodies = [];
+    const namer = new Map();
+    /** Object keys already expanded (or found not to be a stored body). */
+    const visited = new Set();
+    const queue = [{
+            ownerKey: undefined,
+            path: [],
+            body: root,
+            resolve: resolvers.forHomeSchema(homeSchemaName),
+        }];
+    // Breadth-first: `namer` and `path` then carry the SHORTEST chain to each
+    // object, which is the one an error message should quote.
+    for (let head = 0; head < queue.length; head++) {
+        const current = queue[head];
+        bodies.push(current);
+        // `ownerKey === undefined` identifies the ROOT uniquely — every body reached
+        // below it gets one from `childBody`.
+        const opts = current.ownerKey === undefined ? rootOpts : undefined;
+        for (const [key, nameLower] of collectTableRefsInAst(current.body, current.resolve, opts)) {
+            if (!namer.has(key))
+                namer.set(key, current);
+            if (visited.has(key))
+                continue;
+            visited.add(key);
+            const child = expandStoredBody(db, key, nameLower, resolvers, current);
+            if (child)
+                queue.push(child);
+        }
+    }
+    return { bodies, namerOf: key => namer.get(key) };
+}
+/**
+ * The stored body of the object `key` names, as a child of `parent` — or
+ * `undefined` when the key names something with no body to follow: a base table,
+ * or nothing at all.
+ *
+ * A materialized view is looked up as a TABLE (one `TableSchema`, one catalog
+ * name) and its body hangs off `derivation.selectAst`; see `schema/derivation.ts`.
+ */
+function expandStoredBody(db, key, nameLower, resolvers, parent) {
+    const schema = db.schemaManager.getSchema(objectRefKeySchema(key, nameLower));
+    if (!schema)
+        return undefined;
+    const view = schema.getView(nameLower);
+    if (view)
+        return childBody(key, `view '${view.name}'`, view.selectAst, view.schemaName, resolvers, parent);
+    const table = schema.getTable(nameLower);
+    if (isMaintainedTable(table)) {
+        return childBody(key, `materialized view '${table.name}'`, table.derivation.selectAst, table.schemaName, resolvers, parent);
+    }
+    return undefined;
+}
+/** A reached stored body, with the parent's path extended by its own description. */
+function childBody(ownerKey, describe, body, ownerSchemaName, resolvers, parent) {
+    return {
+        ownerKey,
+        path: [...parent.path, describe],
+        body,
+        resolve: resolvers.forHomeSchema(ownerSchemaName),
+    };
+}
+/**
+ * The `reaches it through view 'v2' -> view 'v1'` clause for a
+ * {@link ReachedBody.path}, or the empty string when the match is direct.
+ * Shared so every guard consuming the closure phrases an indirect refusal the
+ * same way — a user told to fix a rule whose body does not mention the dropped
+ * object needs the chain, or the message is unactionable.
+ */
+export function describeReachPath(path) {
+    return path.length === 0 ? '' : ` through ${path.join(' -> ')}`;
+}
+//# sourceMappingURL=object-dependency-closure.js.map

package/dist/src/schema/object-dependency-closure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-dependency-closure.js","sourceRoot":"","sources":["../../../src/schema/object-dependency-closure.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAA+C,MAAM,sBAAsB,CAAC;AAE9H,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AA4EpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,gBAAgB,CAC/B,EAAY,EACZ,IAAiB,EACjB,cAAsB,EACtB,SAA6B,EAC7B,QAA0B;IAE1B,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,uEAAuE;IACvE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,MAAM,KAAK,GAAkB,CAAC;YAC7B,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,SAAS,CAAC,aAAa,CAAC,cAAc,CAAC;SAChD,CAAC,CAAC;IAEH,0EAA0E;IAC1E,0DAA0D;IAC1D,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,6EAA6E;QAC7E,sCAAsC;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC3F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7C,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC/B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACvE,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CACxB,EAAY,EACZ,GAAW,EACX,SAAiB,EACjB,SAA6B,EAC7B,MAAmB;IAEnB,MAAM,MAAM,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAE3G,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,GAAG,EAAE,sBAAsB,KAAK,CAAC,IAAI,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,EACpF,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CACjB,QAAgB,EAChB,QAAgB,EAChB,IAAmB,EACnB,eAAuB,EACvB,SAA6B,EAC7B,MAAmB;IAEnB,OAAO;QACN,QAAQ;QACR,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;QAChC,IAAI;QACJ,OAAO,EAAE,SAAS,CAAC,aAAa,CAAC,eAAe,CAAC;KACjD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA2B;IAC5D,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/dist/src/schema/object-ref-resolver.d.ts

@@ -0,0 +1,83 @@
+import type { Database } from '../core/database.js';
+import { type ResolveObjectRef, type TableRenameTarget } from './rename-rewriter.js';
+/**
+ * Per-home-schema {@link ResolveObjectRef} factory over ONE catalog snapshot.
+ * The rename propagation walks dependents living in many schemas, and each
+ * dependent's unqualified names resolve under ITS OWN home schema path — so
+ * one statement needs one snapshot and many resolvers derived from it.
+ */
+export interface ObjectRefResolvers {
+    /** Resolver for a stored body owned by `homeSchemaName`. Cached per home schema. */
+    forHomeSchema(homeSchemaName: string): ResolveObjectRef;
+    /**
+     * A sibling snapshot with one table rename applied — the catalog as it will
+     * look AFTER the statement. Used only to check the rename post-condition
+     * ({@link import('./rename/table-rename.js').renameTableInAst}: a rewritten
+     * reference must still resolve to the renamed object). Derived from this
+     * snapshot's name sets, never the live catalog, so the SNAPSHOT DISCIPLINE
+     * below holds for both.
+     */
+    withTableRenamed(schemaName: string, oldName: string, newName: string): ObjectRefResolvers;
+}
+/**
+ * The catalog-backed {@link ResolveObjectRef} the rename walkers consult to decide
+ * whether a table/view reference written in a stored body denotes the object being
+ * renamed / probed. It answers the way the PLANNER answers for that body — against
+ * the owning object's home schema path ({@link Database._homeSchemaPath}:
+ * `[homeSchema, ...session default path]`) — not against a single "default schema".
+ *
+ * Resolution rules:
+ * - **Qualified** (`schema` present) → `objectRefKey(schema, name)`, no catalog
+ *   lookup. A qualified name means what it says even when the object does not
+ *   exist (it may be the one about to be created, or the one just renamed away).
+ * - **Unqualified** → the first schema in the home path holding a table or view
+ *   (a materialized view is a table) of that name.
+ * - **Miss in every schema** → the home schema's key, so a body naming an object
+ *   that does not exist still gets a stable key rather than `undefined` —
+ *   `undefined` is reserved for "no resolver could be consulted at all".
+ *
+ * NOTE: "the way the planner answers" is exact for the body kinds that plan under
+ * {@link Database._homeSchemaPath} — view bodies, materialized-view bodies, and
+ * assertion checks (`planner/stored-body-context.ts`). A CHECK constraint or a
+ * column DEFAULT / generated expression is stricter still: it plans under
+ * `schemaAuthoredContext` (`planner/building/schema-authored-context.ts`), the
+ * owning schema and NOTHING else, so an unqualified name the owning schema does
+ * not hold is an error there rather than a fallthrough down the session path.
+ * This resolver applies the looser home-path rule to all of them, which is
+ * deliberately safe rather than exact: the two rules can only disagree when the
+ * home schema lacks the name, and such a CHECK / DEFAULT cannot be evaluated at
+ * all — so no VALID body is ever matched (or missed) differently. Tighten to a
+ * per-body-kind path only if a rename ever needs to be right about a body the
+ * planner itself rejects.
+ *
+ * SNAPSHOT DISCIPLINE — the single most likely way to get this wrong: build the
+ * snapshot (`snapshotObjectRefResolvers` / `buildObjectRefResolver`) BEFORE the
+ * statement's first catalog mutation, and pass the same instance through the whole
+ * statement. Name-set lookups answer from the snapshot, NOT the live catalog, and
+ * that is load-bearing: rename propagation runs after the catalog swap, when the
+ * old name is gone — a live lookup of a bare `t` under `[main, temp]` after
+ * `main.t` was renamed would fall through to `temp.t` and silently match (or miss)
+ * the wrong object. The pre-mutation snapshot resolves every reference the way the
+ * body planned before the statement started, which is the question the rename is
+ * asking. (The session `schema_path` option is read at resolver-derivation time;
+ * it cannot change mid-statement.)
+ */
+export declare function snapshotObjectRefResolvers(db: Database): ObjectRefResolvers;
+/**
+ * Per-home-schema {@link TableRenameTarget} factory for one `ALTER TABLE … RENAME TO`
+ * statement: binds the renamed object's identity to a pre-mutation `resolve` and a
+ * post-rename `resolveAfter` (the {@link ObjectRefResolvers.withTableRenamed} sibling),
+ * both derived per body-owning home schema. One statement builds this once and hands
+ * every walk the target for the walked body's owner, which is what lets the rewrite
+ * enforce its post-condition — a rewritten reference must still resolve to the renamed
+ * object — at the sink.
+ */
+export declare function tableRenameTargetsFor(resolvers: ObjectRefResolvers, schemaName: string, oldName: string, newName: string): (homeSchemaName: string) => TableRenameTarget;
+/**
+ * Single-home convenience over {@link snapshotObjectRefResolvers}, for callers
+ * that walk bodies of one owning schema only (the DROP guards, a store module's
+ * own-table rewrite). Same snapshot discipline: build before the statement's
+ * first catalog mutation.
+ */
+export declare function buildObjectRefResolver(db: Database, homeSchemaName: string): ResolveObjectRef;
+//# sourceMappingURL=object-ref-resolver.d.ts.map

package/dist/src/schema/object-ref-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-ref-resolver.d.ts","sourceRoot":"","sources":["../../../src/schema/object-ref-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAgB,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEnG;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IAClC,oFAAoF;IACpF,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACxD;;;;;;;OAOG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAAC;CAC3F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,QAAQ,GAAG,kBAAkB,CAa3E;AAqCD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACpC,SAAS,EAAE,kBAAkB,EAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACb,CAAC,cAAc,EAAE,MAAM,KAAK,iBAAiB,CAiB/C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,GAAG,gBAAgB,CAE7F"}

package/dist/src/schema/object-ref-resolver.js

@@ -0,0 +1,135 @@
+import { objectRefKey } from './rename-rewriter.js';
+/**
+ * The catalog-backed {@link ResolveObjectRef} the rename walkers consult to decide
+ * whether a table/view reference written in a stored body denotes the object being
+ * renamed / probed. It answers the way the PLANNER answers for that body — against
+ * the owning object's home schema path ({@link Database._homeSchemaPath}:
+ * `[homeSchema, ...session default path]`) — not against a single "default schema".
+ *
+ * Resolution rules:
+ * - **Qualified** (`schema` present) → `objectRefKey(schema, name)`, no catalog
+ *   lookup. A qualified name means what it says even when the object does not
+ *   exist (it may be the one about to be created, or the one just renamed away).
+ * - **Unqualified** → the first schema in the home path holding a table or view
+ *   (a materialized view is a table) of that name.
+ * - **Miss in every schema** → the home schema's key, so a body naming an object
+ *   that does not exist still gets a stable key rather than `undefined` —
+ *   `undefined` is reserved for "no resolver could be consulted at all".
+ *
+ * NOTE: "the way the planner answers" is exact for the body kinds that plan under
+ * {@link Database._homeSchemaPath} — view bodies, materialized-view bodies, and
+ * assertion checks (`planner/stored-body-context.ts`). A CHECK constraint or a
+ * column DEFAULT / generated expression is stricter still: it plans under
+ * `schemaAuthoredContext` (`planner/building/schema-authored-context.ts`), the
+ * owning schema and NOTHING else, so an unqualified name the owning schema does
+ * not hold is an error there rather than a fallthrough down the session path.
+ * This resolver applies the looser home-path rule to all of them, which is
+ * deliberately safe rather than exact: the two rules can only disagree when the
+ * home schema lacks the name, and such a CHECK / DEFAULT cannot be evaluated at
+ * all — so no VALID body is ever matched (or missed) differently. Tighten to a
+ * per-body-kind path only if a rename ever needs to be right about a body the
+ * planner itself rejects.
+ *
+ * SNAPSHOT DISCIPLINE — the single most likely way to get this wrong: build the
+ * snapshot (`snapshotObjectRefResolvers` / `buildObjectRefResolver`) BEFORE the
+ * statement's first catalog mutation, and pass the same instance through the whole
+ * statement. Name-set lookups answer from the snapshot, NOT the live catalog, and
+ * that is load-bearing: rename propagation runs after the catalog swap, when the
+ * old name is gone — a live lookup of a bare `t` under `[main, temp]` after
+ * `main.t` was renamed would fall through to `temp.t` and silently match (or miss)
+ * the wrong object. The pre-mutation snapshot resolves every reference the way the
+ * body planned before the statement started, which is the question the rename is
+ * asking. (The session `schema_path` option is read at resolver-derivation time;
+ * it cannot change mid-statement.)
+ */
+export function snapshotObjectRefResolvers(db) {
+    // NOTE: snapshots every schema's table+view name set on each DDL statement, and
+    // resolves per reference after that; both are Map/Set work over handfuls of
+    // names. If a schema-heavy workload ever shows this hot, snapshot lazily per
+    // schema actually consulted.
+    const bySchema = new Map();
+    for (const schema of db.schemaManager._getAllSchemas()) {
+        const names = new Set();
+        for (const table of schema.getAllTables())
+            names.add(table.name.toLowerCase());
+        for (const view of schema.getAllViews())
+            names.add(view.name.toLowerCase());
+        bySchema.set(schema.name.toLowerCase(), names);
+    }
+    return buildResolvers(db, bySchema);
+}
+/** The shared builder over `(db, bySchema)`, so a {@link ObjectRefResolvers.withTableRenamed}
+ *  sibling reuses the base snapshot's resolution logic over its own name-set map. */
+function buildResolvers(db, bySchema) {
+    const cache = new Map();
+    return {
+        forHomeSchema(homeSchemaName) {
+            const homeLower = homeSchemaName.toLowerCase();
+            const cached = cache.get(homeLower);
+            if (cached)
+                return cached;
+            const path = db._homeSchemaPath(homeSchemaName).map(s => s.toLowerCase());
+            const resolve = (schema, name) => {
+                if (schema !== undefined)
+                    return objectRefKey(schema, name);
+                const nameLower = name.toLowerCase();
+                for (const schemaLower of path) {
+                    if (bySchema.get(schemaLower)?.has(nameLower))
+                        return `${schemaLower}.${nameLower}`;
+                }
+                return `${homeLower}.${nameLower}`;
+            };
+            cache.set(homeLower, resolve);
+            return resolve;
+        },
+        withTableRenamed(schemaName, oldName, newName) {
+            // Copy the affected schema's Set and the outer Map shallowly — the base
+            // snapshot must keep answering pre-rename.
+            const schemaLower = schemaName.toLowerCase();
+            const sibling = new Map(bySchema);
+            const names = new Set(bySchema.get(schemaLower) ?? []);
+            names.delete(oldName.toLowerCase());
+            names.add(newName.toLowerCase());
+            sibling.set(schemaLower, names);
+            return buildResolvers(db, sibling);
+        },
+    };
+}
+/**
+ * Per-home-schema {@link TableRenameTarget} factory for one `ALTER TABLE … RENAME TO`
+ * statement: binds the renamed object's identity to a pre-mutation `resolve` and a
+ * post-rename `resolveAfter` (the {@link ObjectRefResolvers.withTableRenamed} sibling),
+ * both derived per body-owning home schema. One statement builds this once and hands
+ * every walk the target for the walked body's owner, which is what lets the rewrite
+ * enforce its post-condition — a rewritten reference must still resolve to the renamed
+ * object — at the sink.
+ */
+export function tableRenameTargetsFor(resolvers, schemaName, oldName, newName) {
+    const after = resolvers.withTableRenamed(schemaName, oldName, newName);
+    const cache = new Map();
+    return homeSchemaName => {
+        const homeLower = homeSchemaName.toLowerCase();
+        const cached = cache.get(homeLower);
+        if (cached)
+            return cached;
+        const target = {
+            oldName,
+            newName,
+            schemaName,
+            resolve: resolvers.forHomeSchema(homeSchemaName),
+            resolveAfter: after.forHomeSchema(homeSchemaName),
+        };
+        cache.set(homeLower, target);
+        return target;
+    };
+}
+/**
+ * Single-home convenience over {@link snapshotObjectRefResolvers}, for callers
+ * that walk bodies of one owning schema only (the DROP guards, a store module's
+ * own-table rewrite). Same snapshot discipline: build before the statement's
+ * first catalog mutation.
+ */
+export function buildObjectRefResolver(db, homeSchemaName) {
+    return snapshotObjectRefResolvers(db).forHomeSchema(homeSchemaName);
+}
+//# sourceMappingURL=object-ref-resolver.js.map

package/dist/src/schema/object-ref-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-ref-resolver.js","sourceRoot":"","sources":["../../../src/schema/object-ref-resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAiD,MAAM,sBAAsB,CAAC;AAsBnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,0BAA0B,CAAC,EAAY;IACtD,gFAAgF;IAChF,4EAA4E;IAC5E,6EAA6E;IAC7E,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5E,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED;qFACqF;AACrF,SAAS,cAAc,CAAC,EAAY,EAAE,QAAkD;IACvF,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAClD,OAAO;QACN,aAAa,CAAC,cAAsB;YACnC,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,IAAI,GAAG,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBAClD,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrC,KAAK,MAAM,WAAW,IAAI,IAAI,EAAE,CAAC;oBAChC,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC;wBAAE,OAAO,GAAG,WAAW,IAAI,SAAS,EAAE,CAAC;gBACrF,CAAC;gBACD,OAAO,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;YACpC,CAAC,CAAC;YACF,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9B,OAAO,OAAO,CAAC;QAChB,CAAC;QACD,gBAAgB,CAAC,UAAkB,EAAE,OAAe,EAAE,OAAe;YACpE,wEAAwE;YACxE,2CAA2C;YAC3C,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;YACpC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;KACD,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACpC,SAA6B,EAC7B,UAAkB,EAClB,OAAe,EACf,OAAe;IAEf,MAAM,KAAK,GAAG,SAAS,CAAC,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAC;IACnD,OAAO,cAAc,CAAC,EAAE;QACvB,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,MAAM,GAAsB;YACjC,OAAO;YACP,OAAO;YACP,UAAU;YACV,OAAO,EAAE,SAAS,CAAC,aAAa,CAAC,cAAc,CAAC;YAChD,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC;SACjD,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IACf,CAAC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAY,EAAE,cAAsB;IAC1E,OAAO,0BAA0B,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;AACrE,CAAC"}