@ultimat3/db 29.3.2 → 30.0.0

package/src/index.ts

@@ -27,9 +27,23 @@ export type {
   PostgresClientOptions,
   ReservableClient,
 } from './client';
-export { baseClient, db, isReservable, postgresClient, setDbClient } from './client';
+export {
+  baseClient,
+  db,
+  dbClientInstalled,
+  isReservable,
+  postgresClient,
+  setDbClient,
+} from './client';
 export type { ColumnDefaultLike } from './column-default';
 export { defaultExpression } from './column-default';
+export {
+  concurrentIndexTarget,
+  isConcurrentIndexStatement,
+  isNonTransactional,
+  isPartitionedBuildRefusal,
+  NO_TRANSACTION_MARKER,
+} from './concurrent-index';
 export { dbExecutor } from './db-executor';
 export type { DbHealthReport } from './db-health';
 export { checkDb } from './db-health';
@@ -59,11 +73,16 @@ export {
   FRAMEWORK_TABLE_PREFIX,
 } from './drift';
 export { dbDrift } from './drift-errors';
+export type { RowSecurityDifference } from './drift-row-security';
+export { rowSecurityDifferences, rowSecurityDrift } from './drift-row-security';
 export type {
   ColumnDescriptionLike,
+  CounterDescriptionLike,
   EntityDescriptionLike,
+  HistoryDescriptionLike,
   IndexDescriptionLike,
   InvariantDescriptionLike,
+  RetainDescriptionLike,
 } from './entity-shape';
 export type { DbErrorCode, DbErrorInit } from './errors';
 export {
@@ -82,11 +101,39 @@ export {
   serializationExhausted,
   sqlUnsafe,
 } from './errors';
-export { expectedQueryLoop, expectedQueryLoopReason } from './expected-loop';
+export {
+  expectedQueryLoop,
+  expectedQueryLoopReason,
+  expectedSeqScan,
+  expectedSeqScanReason,
+} from './expected-loop';
+export type { FailureSummary, PostgresFailureStore } from './failure-store-pg';
+export {
+  FAILURES_TABLE,
+  failurePurgeTarget,
+  MAX_FAILURE_LIST,
+  postgresFailureStore,
+  SQL_FAILURES_TABLE,
+} from './failure-store-pg';
 export type { RecordedStatement, RecordingClient, StubResponse } from './fake';
 export { recordingClient } from './fake';
 export type { GeneratedMigration, GenerateOptions } from './generate';
 export { generateMigration, migrationStamp, slugify, snapshotOf } from './generate';
+export {
+  counterTrigger,
+  counterTriggerName,
+  recountDriftSql,
+  recountSql,
+} from './generate-counter';
+export {
+  ACTOR_SETTING,
+  HISTORY_GUARD_TRIGGER,
+  HISTORY_TRIGGER,
+  PURGE_SETTING,
+  REQUEST_SETTING,
+} from './generate-history';
+export type { RowSecurityOption, TenantColumnLike } from './generate-row-security';
+export { declaredTriggers } from './generate-triggers';
 export type { IndexMethod } from './index-method';
 export {
   declaredMethod,
@@ -103,6 +150,8 @@ export type {
   IntrospectOptions,
   SchemaDescription,
   TableDescription,
+  TriggerRecord,
+  ViewDescription,
 } from './introspect';
 export { buildSchema, findTable, introspectSchema } from './introspect';
 export {
@@ -112,8 +161,13 @@ export {
   uniqueColumns,
 } from './invariant-ddl';
 export { constraintExpressionUnsafe, constraintNameUnsafe } from './invariant-errors';
+export type { Keyset, KeysetKey, KeysetKind, KeysetOptions, KeysetRow } from './keyset';
+export { keyset } from './keyset';
+export { retainInvalid } from './lifecycle-errors';
 export type { DbSubscription, ListeningClient } from './listen';
 export { canListen } from './listen';
+export type { LocalSettings } from './local-settings';
+export { readLocal, setLocal } from './local-settings';
 export type {
   AppliedMigration,
   LedgerRow,
@@ -140,6 +194,8 @@ export {
 } from './migrate';
 export {
   migrateConcurrent,
+  migrationConcurrentInTransaction,
+  migrationConcurrentPartitioned,
   migrationConflict,
   migrationDestructive,
   migrationIrreversible,
@@ -172,7 +228,23 @@ export type { LinkedExtensions, PgliteExtensionLoader } from './pglite-extension
 export { linkPgliteExtensions } from './pglite-extensions';
 export { pgliteVersion } from './pglite-snapshot';
 export type { PoolProfile } from './pool-profile';
-export { POOL_MAX_ENV, POOL_PROFILES, poolMaxFromEnv, poolProfileFor } from './pool-profile';
+export {
+  POOL_MAX_ENV,
+  POOL_PROFILES,
+  poolMaxFromEnv,
+  poolProfileFor,
+} from './pool-profile';
+export type { PoolerMode, StatementBound } from './pooler';
+export {
+  lostStatementBound,
+  POOLER_ENV,
+  POOLER_WAIT_MS,
+  poolerFromEnv,
+  poolerSessionRequired,
+  statementBound,
+} from './pooler';
+export type { ReadTransactionOptions } from './read-transaction';
+export { withReadTransaction } from './read-transaction';
 export type { ReadOnlyQueryOptions, ReadOnlyQueryResult } from './readonly-query';
 export { READONLY_TIMEOUT_MS, readOnlyQuery } from './readonly-query';
 export type { ReadOnlyRoleOptions } from './readonly-role';
@@ -183,9 +255,53 @@ export type {
   ReplicatedClientOptions,
 } from './replica-client';
 export { BREAKER_COOLDOWN_MS, BREAKER_FAILURES, replicatedClient } from './replica-client';
+export type { ReplayReader } from './replica-position';
+export {
+  formatPosition,
+  POSITION_CACHE_MS,
+  parsePosition,
+  primaryPosition,
+  replayReader,
+} from './replica-position';
 export { type DbNode, isPlainRead } from './replica-route';
-export type { ReplicaScope } from './replica-scope';
+export type { ReplicaReadsOptions, ReplicaScope } from './replica-scope';
 export { markScopeWrote, replicaScope, withReplicaReads } from './replica-scope';
+export { recordRetired } from './retired';
+export type { RollingUnsafeKind, RollingUnsafeStatement } from './rolling';
+export {
+  hasRollingUnsafeMarker,
+  ROLLING_UNSAFE_MARKER,
+  retiredColumnsIn,
+  rollingUnsafeStatements,
+  unretiredColumnsIn,
+} from './rolling';
+export { migrationRollingUnsafe } from './rolling-errors';
+export { rowSecureClient } from './row-secure-client';
+export {
+  CROSS_TENANT_SETTING,
+  dropRowSecuritySql,
+  enableRowSecuritySql,
+  ROW_SECURITY_POLICY,
+  TENANT_SETTING,
+} from './row-security';
+export { holdMigratorRole, migratorOwnershipSql } from './row-security-migrator';
+export type { RowSecurityPlanInput, TenantTable } from './row-security-plan';
+export { rowSecurityAfter, rowSecurityPlan } from './row-security-plan';
+export type { RowSecurityRole } from './row-security-role';
+export {
+  assertRowSecurityBinds,
+  rowSecurityExemption,
+  rowSecurityRole,
+} from './row-security-role';
+export {
+  APP_ROLE,
+  assumeRole,
+  ensureRowSecurityRoles,
+  MIGRATOR_ROLE,
+  rowSecurityRolesSql,
+  serveAsAppRole,
+} from './row-security-roles';
+export { sameTenantKeyName } from './same-tenant';
 export { SIBLING_SCOPE_WAIT_MS } from './sibling-turn';
 export { snapshotJson } from './snapshot-json';
 export { parseSnapshot } from './snapshot-parse';
@@ -203,13 +319,27 @@ export { stripSqlNoise } from './sql-noise';
 export { dollarTagAt, endOfBlockComment } from './sql-scan';
 export type { DbSqlStateCode } from './sqlstate';
 export { DB_SQLSTATE_CODES, isRetryableState, SQLSTATE, sqlState, sqlStateCode } from './sqlstate';
+export type { StatementBoundOptions } from './statement-bound';
+export { withStatementTimeout } from './statement-bound';
 export { statementFingerprint, statementKind, statementVerb } from './statement-shape';
 export { STATEMENT_ATTRIBUTE } from './statement-span';
 export { statementsOf } from './statement-split';
-export { currentTx, liveTxConnection, outsideTransaction, withTransaction } from './transaction';
-export { commitUnknown, siblingScopeTimeout, transactionAborted } from './transaction-errors';
+export {
+  completeTransaction,
+  currentTx,
+  liveTxConnection,
+  outsideTransaction,
+  withTransaction,
+} from './transaction';
+export {
+  commitUnknown,
+  siblingScopeTimeout,
+  transactionAborted,
+} from './transaction-errors';
+export { refuseAbandoned } from './transaction-guard';
 export type { DbTx, IsolationLevel, TransactionOptions } from './transaction-options';
 export { beginStatement } from './transaction-options';
+export { setTransactionSettings, transactionSettings } from './transaction-settings';
 export type { GeneratableForm } from './ungeneratable';
 export { GENERATABLE_FORMS, ungeneratableStatements } from './ungeneratable';
 export type { UnrenderedDeclaration } from './unrendered';

package/src/introspect-catalog.ts

@@ -15,6 +15,7 @@ import {
   unrenderedRows,
   viewRows,
 } from './catalog-objects';
+import { policiesOf, policyRows, rowSecurityOf, rowSecurityRows } from './catalog-policies';
 import {
   columnRows,
   constraintRows,
@@ -23,6 +24,7 @@ import {
   tableRows,
 } from './catalog-relations';
 import { type DbClient, db } from './client';
+import { indexDefinitionOf } from './partition-order';
 
 export interface IntrospectCatalogOptions {
   readonly client?: DbClient | undefined;
@@ -60,7 +62,7 @@ async function typesOf(client: DbClient, schema: string): Promise<readonly Catal
 }
 
 /**
- * Eleven round trips, sequential: a pinned transaction connection answers one statement at a
+ * Fifteen round trips, sequential: a pinned transaction connection answers one statement at a
  * time, and this runs once per `x db gen`, never per request.
  */
 export async function introspectCatalog(
@@ -77,11 +79,15 @@ export async function introspectCatalog(
   const functions = await functionRows(client, schema);
   const triggers = await triggerRows(client, schema);
   const unrendered = await unrenderedRows(client, schema);
+  const security = await rowSecurityRows(client, schema);
+  const policies = await policyRows(client, schema);
   const known = new Set(tables.map((table) => table.name));
+  // A policy loads only onto a table the dump creates — the rule `loadable` states for a trigger.
+  const onKnown = (row: { readonly table_name: string }): boolean => known.has(row.table_name);
   const materialized = new Set(views.filter((view) => view.kind === 'm').map((view) => view.name));
-  // A trigger loads only onto a relation the dump creates: a plain table, or a view (`instead
-  // of`). One on a partitioned table or a partition was filed under `09_triggers/` for a table no
-  // file creates, and the load refused the whole dump with `X_SCHEMA_DUMP_DRIFT`.
+  // A trigger loads only onto a relation the dump creates: a table, or a view (`instead of`). One
+  // on an inheritance child was filed under `09_triggers/` for a table no file creates, and the
+  // load refused the whole dump with `X_SCHEMA_DUMP_DRIFT`.
   const viewNames = new Set(views.map((view) => view.name));
   const loadable = (trigger: { readonly table_name: string }): boolean =>
     known.has(trigger.table_name) || viewNames.has(trigger.table_name);
@@ -99,10 +105,14 @@ export async function introspectCatalog(
     tables: tables
       .map((table) => tableOf(table, columns, constraints, sequences))
       .sort(by((table) => table.name)),
-    // An index on a relation this reading does not render (a partition) has nowhere to load.
+    // An index on a relation this reading does not render (an inheritance child) has nowhere to load.
     indexes: indexes
       .filter((index) => known.has(index.table_name) || materialized.has(index.table_name))
-      .map((row) => ({ table: row.table_name, name: row.name, definition: row.definition }))
+      .map((row) => ({
+        table: row.table_name,
+        name: row.name,
+        definition: indexDefinitionOf(row.definition),
+      }))
       .sort(
         by(
           (index) => index.table,
@@ -124,6 +134,7 @@ export async function introspectCatalog(
         materialized: row.kind === 'm',
         options: row.options,
         definition: row.definition,
+        columns: [...row.columns],
       }))
       .sort(by((view) => view.name)),
     functions: functions
@@ -148,8 +159,17 @@ export async function introspectCatalog(
           (trigger) => trigger.name,
         ),
       ),
+    rowSecurity: rowSecurityOf(security.filter(onKnown)),
+    policies: policiesOf(policies.filter(onKnown)),
     unrendered: [
       ...unrendered,
+      ...policies
+        .filter((policy) => !onKnown(policy))
+        .map((policy) => ({
+          kind: 'row security policy',
+          name: policy.name,
+          table_name: policy.table_name,
+        })),
       // Named rather than dropped, the rule `CatalogUnrendered` states.
       ...triggers
         .filter((trigger) => !loadable(trigger))

package/src/introspect-rows.ts

@@ -0,0 +1,82 @@
+// Single responsibility: the catalog ROWS `introspectSchema()` reads, and the pure helpers that turn
+// one into a description field — a key's rule with its list, a table's `NOT VALID` names. Split
+// from `introspect.ts`, which issues the queries and folds the rows into tables.
+
+export interface ColumnRow {
+  readonly table_name: string;
+  readonly column_name: string;
+  readonly data_type: string;
+  readonly is_nullable: string;
+  readonly column_default: string | null;
+  readonly ordinal_position: number;
+}
+
+export interface IndexRow {
+  readonly table_name: string;
+  readonly index_name: string;
+  readonly is_unique: boolean;
+  readonly is_primary: boolean;
+  readonly columns: readonly string[];
+  readonly predicate: string | null;
+  readonly descending: boolean;
+  readonly method?: string | undefined;
+}
+
+export interface ForeignKeyRow {
+  readonly table_name: string;
+  readonly constraint_name: string;
+  readonly columns: readonly string[];
+  readonly referenced_table: string;
+  readonly referenced_columns: readonly string[];
+  readonly on_delete: string | null;
+  /** `set null (a, b)`'s list as the server prints it. Postgres 15+; `null` for any other rule. */
+  readonly set_null_columns?: string | null | undefined;
+  readonly validated?: boolean | undefined;
+}
+
+/**
+ * A key's rule in the spelling a description holds, list included. The list reads the definition
+ * text, not `confdelsetcols`, which is a column only Postgres 15+ has: this query runs against
+ * whatever an operator points it at. The server quotes a reserved word and a description never
+ * does, so each name is unquoted or `user` is a permanent `changed-foreign-key`.
+ */
+const unquotedName = (name: string): string => {
+  const trimmed = name.trim();
+  return trimmed.startsWith('"') && trimmed.endsWith('"')
+    ? trimmed.slice(1, -1).replaceAll('""', '"')
+    : trimmed;
+};
+
+export const onDeleteOf = (row: ForeignKeyRow): string | null =>
+  row.set_null_columns == null
+    ? row.on_delete
+    : `set null (${row.set_null_columns.split(',').map(unquotedName).join(', ')})`;
+
+/** A CHECK constraint's NAME. There is deliberately no column for its definition — see `checkNames`. */
+export interface CheckRow {
+  readonly table_name: string;
+  readonly constraint_name: string;
+  readonly validated?: boolean | undefined;
+}
+
+/** An enabled trigger's NAME — the half of `appendOnly` the catalog can answer. */
+export interface TriggerNameRow {
+  readonly table_name: string;
+  readonly trigger_name: string;
+}
+
+/** Absent when none: `false` only, so a row a fake client wrote without the field is not one. */
+export const notValidOf = (
+  rows: readonly {
+    readonly table_name: string;
+    readonly constraint_name: string;
+    readonly validated?: boolean | undefined;
+  }[],
+  table: string,
+): { readonly notValidNames?: readonly string[] } => {
+  const names = rows
+    .filter((row) => row.table_name === table && row.validated === false)
+    .map((row) => row.constraint_name)
+    .sort();
+  return names.length === 0 ? {} : { notValidNames: names };
+};

package/src/introspect.ts

@@ -5,6 +5,17 @@
 
 import { nonAppRelations } from './app-relation';
 import { type DbClient, db } from './client';
+import {
+  type CheckRow,
+  type ColumnRow,
+  type ForeignKeyRow,
+  type IndexRow,
+  notValidOf,
+  onDeleteOf,
+  type TriggerNameRow,
+} from './introspect-rows';
+import { partitionedTables } from './partitioned-tables';
+import { type PolicyNameRow, policyNameRows } from './row-security-catalog';
 import { sql } from './sql';
 
 export interface ColumnDescription {
@@ -23,6 +34,12 @@ export interface ColumnDescription {
    * spellings, which is the same rule `IndexDescription.where` states one field down.
    */
   readonly generated?: string | undefined;
+  /**
+   * `true` on a column an entity lists under `retired` and a migration has marked (`retired.ts`):
+   * old pods may still read it, so it stays until a later migration drops it. Absent otherwise, and
+   * always absent on a catalog read: the database has no such idea.
+   */
+  readonly retired?: true | undefined;
 }
 
 export interface IndexDescription {
@@ -109,6 +126,11 @@ export interface TableDescription {
    * read one instead of reporting every declared constraint as missing.
    */
   readonly checkNames?: readonly string[] | undefined;
+  /**
+   * The constraints the catalog holds `NOT VALID` (`convalidated`): rows that predate one are
+   * unchecked. A catalog reading, absent when there are none, and never on a sidecar.
+   */
+  readonly notValidNames?: readonly string[] | undefined;
   /**
    * That a migration set `replica identity full` on this table — what `@ultimat3/realtime` requires
    * of every table a live query subscribes to, and the only reason this generator emits it.
@@ -138,10 +160,57 @@ export interface TableDescription {
    * Written by `introspectSchema()` always, `[]` included; absent means nobody asked the catalog.
    */
   readonly triggerNames?: readonly string[] | undefined;
+  /**
+   * That the catalog holds this table as a PARTITIONED parent (`relkind = 'p'`). A catalog reading,
+   * `true` or absent, never on a sidecar: a partitioned table is declared by a hand edit to the
+   * generated `create table`, which no entity records, and drift compares what still holds on the
+   * parent — columns, keys, indexes. Absent on every ordinary table, so an unpartitioned app's
+   * descriptions are unchanged. Its partitions are Postgres' and appear in no description.
+   */
+  readonly partitioned?: true | undefined;
+  /**
+   * That a migration gave this table the tenant policy, enabled and forced (`row-security-plan.ts`).
+   * The SNAPSHOT's half, `true` or absent for `appendOnly`'s reason; the catalog's is `policyNames`.
+   */
+  readonly rowSecurity?: true | undefined;
+  /**
+   * The CATALOG's half of `rowSecurity`: the policies on the table when its row security is enabled
+   * and forced, `[]` otherwise (`row-security-catalog.ts`). Absent means nobody asked the catalog.
+   */
+  readonly policyNames?: readonly string[] | undefined;
+  /**
+   * The lifecycle triggers a migration installed on this table — history, its guard, counters
+   * (`generate-triggers.ts`). The SNAPSHOT's half, absent when none; the catalog's is `triggerNames`.
+   */
+  readonly triggers?: readonly TriggerRecord[] | undefined;
+  /**
+   * That the entity declares `retain` (`drift-triggers.ts` refuses it on a partitioned parent).
+   * SNAPSHOT-only, `true` or absent for `appendOnly`'s reason.
+   */
+  readonly retain?: true | undefined;
+}
+
+/** One installed trigger: its name, and the statements that install it — the drift repair too. */
+export interface TriggerRecord {
+  readonly name: string;
+  readonly install: readonly string[];
+}
+
+/**
+ * A view `x db gen` wrote (`generate-view.ts`): SNAPSHOT-only, as `checks` is declared-only — the
+ * catalog reading never fills it (`app-relation.ts` keeps every view out of `tables`), so drift
+ * never reports one. `create` is the statements verbatim, which is what the next diff compares.
+ */
+export interface ViewDescription {
+  readonly name: string;
+  readonly materialized?: true | undefined;
+  readonly create: readonly string[];
 }
 
 export interface SchemaDescription {
   readonly tables: readonly TableDescription[];
+  /** Absent on every snapshot written before views existed, and on every catalog reading. */
+  readonly views?: readonly ViewDescription[] | undefined;
 }
 
 export interface IntrospectOptions {
@@ -157,47 +226,6 @@ export interface IntrospectOptions {
   readonly exclude?: readonly string[] | undefined;
 }
 
-interface ColumnRow {
-  readonly table_name: string;
-  readonly column_name: string;
-  readonly data_type: string;
-  readonly is_nullable: string;
-  readonly column_default: string | null;
-  readonly ordinal_position: number;
-}
-
-interface IndexRow {
-  readonly table_name: string;
-  readonly index_name: string;
-  readonly is_unique: boolean;
-  readonly is_primary: boolean;
-  readonly columns: readonly string[];
-  readonly predicate: string | null;
-  readonly descending: boolean;
-  readonly method?: string | undefined;
-}
-
-interface ForeignKeyRow {
-  readonly table_name: string;
-  readonly constraint_name: string;
-  readonly columns: readonly string[];
-  readonly referenced_table: string;
-  readonly referenced_columns: readonly string[];
-  readonly on_delete: string | null;
-}
-
-/** A CHECK constraint's NAME. There is deliberately no column for its definition — see `checkNames`. */
-interface CheckRow {
-  readonly table_name: string;
-  readonly constraint_name: string;
-}
-
-/** An enabled trigger's NAME — the half of `appendOnly` the catalog can answer. */
-interface TriggerNameRow {
-  readonly table_name: string;
-  readonly trigger_name: string;
-}
-
 const byName = (a: { name: string }, b: { name: string }): number => (a.name < b.name ? -1 : 1);
 
 export async function introspectSchema(
@@ -272,7 +300,7 @@ export async function introspectSchema(
     join pg_am am on am.oid = i.relam
     cross join lateral unnest(ix.indkey::smallint[]) with ordinality as k(attnum, ord)
     left join pg_attribute a on a.attrelid = t.oid and a.attnum = k.attnum and k.attnum > 0
-    where n.nspname = ${schema} and t.relkind = 'r' and k.ord <= ix.indnkeyatts
+    where n.nspname = ${schema} and t.relkind in ('r', 'p') and k.ord <= ix.indnkeyatts
     group by
       t.relname, i.relname, ix.indisunique, ix.indisprimary, ix.indpred, ix.indrelid,
       ix.indexrelid, am.amname
@@ -284,6 +312,8 @@ export async function introspectSchema(
   // two-column key came back as four source columns against four referenced ones, duplicated and
   // misaligned. Ordered by `k.ord` (the constraint's own key position), never by `attnum`, for the
   // same reason `indkey` orders the index query: `references t (y, x)` is not `references t (x, y)`.
+  // `conparentid = 0`: a key into a partitioned table makes Postgres add one clone per partition
+  // (`notes_event_fkey_1`, `_2`, …), each a fact of the partitioning and never of a migration.
   const foreignKeys = await client.query<ForeignKeyRow>(sql`
     select
       src.relname as table_name,
@@ -291,7 +321,9 @@ export async function introspectSchema(
       array_agg(sa.attname order by k.ord) as columns,
       tgt.relname as referenced_table,
       array_agg(ta.attname order by k.ord) as referenced_columns,
-      c.confdeltype as on_delete
+      c.confdeltype as on_delete,
+      substring(pg_get_constraintdef(c.oid) from 'ON DELETE SET NULL \\(([^)]*)\\)') as set_null_columns,
+      c.convalidated as validated
     from pg_constraint c
     join pg_class src on src.oid = c.conrelid
     join pg_class tgt on tgt.oid = c.confrelid
@@ -299,8 +331,8 @@ export async function introspectSchema(
     cross join lateral unnest(c.conkey, c.confkey) with ordinality as k(src_attnum, tgt_attnum, ord)
     join pg_attribute sa on sa.attrelid = src.oid and sa.attnum = k.src_attnum
     join pg_attribute ta on ta.attrelid = tgt.oid and ta.attnum = k.tgt_attnum
-    where c.contype = 'f' and n.nspname = ${schema}
-    group by src.relname, c.conname, tgt.relname, c.confdeltype
+    where c.contype = 'f' and n.nspname = ${schema} and c.conparentid = 0
+    group by c.oid, src.relname, c.conname, tgt.relname, c.confdeltype, c.convalidated
     order by src.relname, c.conname
   `);
 
@@ -310,11 +342,11 @@ export async function introspectSchema(
   // a correct database as wrong. `contype = 'c'` is the CHECK constraints alone — Postgres 17
   // onwards records a NOT NULL as `'n'`, and a domain's as `'c'` on the domain rather than here.
   const checks = await client.query<CheckRow>(sql`
-    select src.relname as table_name, c.conname as constraint_name
+    select src.relname as table_name, c.conname as constraint_name, c.convalidated as validated
     from pg_constraint c
     join pg_class src on src.oid = c.conrelid
     join pg_namespace n on n.oid = src.relnamespace
-    where c.contype = 'c' and n.nspname = ${schema} and src.relkind = 'r'
+    where c.contype = 'c' and n.nspname = ${schema} and src.relkind in ('r', 'p')
     order by src.relname, c.conname
   `);
 
@@ -326,11 +358,24 @@ export async function introspectSchema(
     join pg_class src on src.oid = t.tgrelid
     join pg_namespace n on n.oid = src.relnamespace
     where not t.tgisinternal and t.tgenabled in ('O', 'A')
-      and n.nspname = ${schema} and src.relkind = 'r'
+      and n.nspname = ${schema} and src.relkind in ('r', 'p')
     order by src.relname, t.tgname
   `);
 
-  return buildSchema(schema, excluded, columns, indexes, foreignKeys, checks, triggers);
+  const partitioned = await partitionedTables(client, schema);
+  const policies = await policyNameRows(client, schema);
+
+  return buildSchema(
+    schema,
+    excluded,
+    columns,
+    indexes,
+    foreignKeys,
+    checks,
+    triggers,
+    partitioned,
+    policies,
+  );
 }
 
 /** Pure, so the row -> description mapping is testable without a database. */
@@ -343,6 +388,9 @@ export function buildSchema(
   checks: readonly CheckRow[] = [],
   /** Absent leaves `triggerNames` off every table: nobody asked the catalog. */
   triggers?: readonly TriggerNameRow[],
+  partitioned: readonly string[] = [],
+  /** Absent leaves `policyNames` off every table, as `triggers` does `triggerNames`. */
+  policies?: readonly PolicyNameRow[],
 ): SchemaDescription {
   const names = [...new Set(columns.map((row) => row.table_name))]
     .filter((name) => !excluded.includes(name))
@@ -385,7 +433,7 @@ export function buildSchema(
           columns: [...row.columns],
           referencedTable: row.referenced_table,
           referencedColumns: [...row.referenced_columns],
-          onDelete: row.on_delete,
+          onDelete: onDeleteOf(row),
         }))
         .sort(byName),
       // Always written, `[]` included: this reading of a table HAS asked the catalog, and absence
@@ -394,6 +442,7 @@ export function buildSchema(
         .filter((row) => row.table_name === name)
         .map((row) => row.constraint_name)
         .sort(),
+      ...notValidOf([...foreignKeys, ...checks], name),
       ...(triggers === undefined
         ? {}
         : {
@@ -402,6 +451,15 @@ export function buildSchema(
               .map((row) => row.trigger_name)
               .sort(),
           }),
+      ...(partitioned.includes(name) ? { partitioned: true as const } : {}),
+      ...(policies === undefined
+        ? {}
+        : {
+            policyNames: policies
+              .filter((row) => row.table_name === name)
+              .map((row) => row.policy_name)
+              .sort(),
+          }),
     };
   });