@ultimat3/db 29.4.0 → 30.0.0

package/src/generate.ts

@@ -4,15 +4,19 @@
 // field. Every generated migration must be reversible; a drop that loses data refuses instead.
 
 import { systemClock } from '@ultimat3/core';
-import { checkClauses, checkPlan, declaredChecks } from './check-ddl';
-import { alterColumnInPlace } from './column-alter';
+import { checkClauses, checkPlan } from './check-ddl';
+import { alterColumnInPlace, retypeOverDefault, wantedDefault } from './column-alter';
 import { defaultExpression } from './column-default';
 import { type ConcurrentPlan, emptyConcurrentPlan } from './concurrent-plan';
 import { dropOrder } from './drop-order';
 import type { ColumnDescriptionLike, EntityDescriptionLike } from './entity-shape';
-import { type ConstraintPlans, foreignKeyPlan, foreignKeysOf, type Plan } from './foreign-key-plan';
+import { type ConstraintPlans, foreignKeyPlan, type Plan } from './foreign-key-plan';
 import { appendOnlyBackfillRefused, appendOnlyPlan } from './generate-append-only';
+import { type RowSecurityOption, rowSecurityInput } from './generate-row-security';
+import { snapshotOf } from './generate-snapshot';
 import { assembleSteps } from './generate-steps';
+import { recordTriggers, triggerPlan } from './generate-triggers';
+import { splitViews, viewPlan } from './generate-view';
 import type { Regeneration } from './generated-column';
 import { generatedClause, isGenerated, regenerate } from './generated-column';
 import { createIndex, impliedByColumnClause } from './index-ddl';
@@ -28,9 +32,13 @@ import { migrationIrreversible } from './migration-errors';
 import { addChangedKey, dropChangedKey, migrationNameArg } from './primary-key';
 import type { ReplicaIdentityInput } from './replica-identity';
 import { replicaIdentityFullAfter, replicaIdentityPlan } from './replica-identity';
+import { contractsMarkerFor, recordRetired, retirePlan } from './retired';
 import type { MovedAside } from './retype-dependents';
 import { moveDependentsAside } from './retype-dependents';
 import { moveKeysAside, retypedColumns, retypedIn } from './retype-keys';
+import { columnDropNotRetired } from './rolling-errors';
+import { rowSecurityAfter, rowSecurityPlan } from './row-security-plan';
+import { withSameTenantIndexes } from './same-tenant';
 import { identifier } from './sql';
 import { sqlType } from './sql-type';
 import { type UnrenderedDeclaration, unrenderedOf } from './unrendered';
@@ -60,67 +68,6 @@ function columnClause(column: ColumnDescriptionLike): string {
   return parts.join(' ');
 }
 
-/** No table subscribed to, which is what every caller outside `generateMigration` describes. */
-const NONE: ReadonlySet<string> = new Set();
-
-export function snapshotOf(
-  entities: readonly EntityDescriptionLike[],
-  replicaIdentityFull: ReadonlySet<string> = NONE,
-): SchemaDescription {
-  const tables = [...entities]
-    .sort((a, b) => (a.table < b.table ? -1 : 1))
-    .map((entity): TableDescription => {
-      const columns: ColumnDescription[] = [...entity.columns]
-        .sort((a, b) => (a.column < b.column ? -1 : 1))
-        .map((column, index) => ({
-          name: column.column,
-          dataType: sqlType(column.kind),
-          nullable: !column.notNull,
-          default: defaultExpression(column),
-          position: index + 1,
-          // Only when one was declared — absent stays absent, so no snapshot written before this
-          // field existed gains a key and no app's sidecar regenerates over a fact already true.
-          ...(column.generated === undefined ? {} : { generated: column.generated }),
-        }));
-      const checks = declaredChecks(entity);
-      return {
-        schema: 'public',
-        name: entity.table,
-        columns,
-        primaryKey: [...entity.primaryKey],
-        // Whole, never partly: a snapshot that recorded the name and dropped the predicate made
-        // the next generation blind to a `where` or an `order` changing, and a partial index
-        // silently kept as a total one is a constraint the entity no longer declares.
-        //
-        // `declaredIndexes`, so a `unique` invariant's index is recorded exactly like an entity's
-        // own — a statement emitted and not recorded is `42P07` on the very next `x db gen`.
-        indexes: declaredIndexes(entity).map((index) => ({
-          name: index.name,
-          columns: [...index.columns],
-          unique: index.unique,
-          primary: false,
-          where: index.where,
-          order: index.order,
-          // Only when one was declared. Writing `using: 'btree'` out for every index would rewrite
-          // every sidecar in every app on the next `x db gen` — a diff on every file for a fact
-          // that was already true, which `indexMethodOf` reads out of the absence anyway.
-          ...(index.using === undefined ? {} : { using: index.using }),
-        })),
-        foreignKeys: foreignKeysOf(entity),
-        // Absent, never `[]`, on a table declaring none: a sidecar that predates this field must
-        // read as "nothing recorded" so the next generation adds the constraints the database is
-        // genuinely missing — the rule `using` and `generated` already state one field up.
-        ...(checks.length === 0 ? {} : { checks }),
-        // The same rule once more: `true` or absent, never `false`. This is what makes the ALTER
-        // beside it a one-time statement rather than a line every `x db gen` writes again.
-        ...(replicaIdentityFull.has(entity.table) ? { replicaIdentityFull: true as const } : {}),
-        // `true` or absent once more — the record that makes the trigger a one-time statement.
-        ...(entity.appendOnly === true ? { appendOnly: true as const } : {}),
-      };
-    });
-  return { tables };
-}
-
 function createTable(entity: EntityDescriptionLike): readonly string[] {
   const clauses = entity.columns.map(columnClause);
   if (entity.primaryKey.length > 0) {
@@ -177,8 +124,8 @@ function retypeColumn(
   const alter = (type: string): string =>
     `alter table ${identifier(table).text} alter column ${identifier(column.column).text} ` +
     `type ${type} using ${identifier(column.column).text}::${type};`;
-  plan.up.push(alter(wanted));
-  plan.down.push(alter(recorded.dataType));
+  retypeOverDefault(table, column, recorded, plan, alter(wanted), alter(recorded.dataType));
+  moved.defaults.add(column.column);
   return 'altered';
 }
 
@@ -195,16 +142,27 @@ function diffTable(
   // over it has to be stated again even though its own definition never moved.
   const rebuilt = new Set<string>();
   // What a retype dropped ahead of itself, read by the two arms below.
-  const moved: MovedAside = { indexes: new Set(), checks: new Set() };
+  const moved: MovedAside = { indexes: new Set(), checks: new Set(), defaults: new Set() };
   for (const column of entity.columns) {
     const recorded = existing.get(column.column);
     if (recorded !== undefined) {
       if (retypeColumn(live, column, recorded, plan, moved, retyped) === 'rebuilt') {
         rebuilt.add(column.column);
       } else {
-        // After any retype, so a new default is set against the column's new type. A rebuilt
-        // column was re-added carrying its whole clause, so it has nothing left to move.
-        alterColumnInPlace(entity, column, recorded, plan);
+        // After any retype, so nullability moves on the column's new type. A rebuilt column was
+        // re-added carrying its whole clause, so it has nothing left to move. A retype already
+        // moved the default, across the type (`column-alter.ts`).
+        alterColumnInPlace(
+          entity,
+          column,
+          moved.defaults.has(column.column)
+            ? {
+                ...recorded,
+                default: wantedDefault(column, recorded),
+              }
+            : recorded,
+          plan,
+        );
       }
       continue;
     }
@@ -241,9 +199,11 @@ function diffTable(
   // that does not exist yet is `42703`. `check-ddl.ts` owns which of them move; `rebuilt` because a
   // column dropped and re-added lost its constraint while the snapshot still records it, and
   // `moved.checks` because a retype already dropped the ones written against the old type.
-  checkPlan(entity, live, plan, rebuilt, moved.checks);
+  checkPlan(entity, live, plan, rebuilt, moved.checks, concurrent);
 }
 
+export { snapshotOf } from './generate-snapshot';
+
 export interface GenerateOptions {
   readonly entities: readonly EntityDescriptionLike[];
   /** The schema migrations already declare — `expectedSchema(migrations, ledger)`. */
@@ -252,6 +212,12 @@ export interface GenerateOptions {
   readonly now?: Date | undefined;
   /** Allow a DROP COLUMN whose down cannot restore the data. `x db gen --allow-destructive`. */
   readonly allowDestructive?: boolean | undefined;
+  /**
+   * Drop a column that was never retired, for an app that stops before it starts: one instance, or
+   * `strategy: Recreate`. `x db gen --rolling-unsafe`. Consent to the outage and not to the loss,
+   * so `allowDestructive` is still asked of it.
+   */
+  readonly rollingUnsafe?: boolean | undefined;
   /**
    * Tables a live query subscribes to, so logical replication carries the old row —
    * `@ultimat3/realtime` refuses a subscription without it. Absent or empty emits nothing.
@@ -263,6 +229,12 @@ export interface GenerateOptions {
    * is the one caller that can answer it.
    */
   readonly replicaIdentityFull?: readonly string[] | undefined;
+  /**
+   * `database.rowSecurity` and each tenant table's column (`describeTenancy()`): a parameter for
+   * `replicaIdentityFull`'s reason — a config fact no entity carries. Absent is off, so a recorded
+   * policy is dropped: `@ultimat3/cli`'s `db-generate.ts` passes it on every run.
+   */
+  readonly rowSecurity?: RowSecurityOption | undefined;
 }
 
 export interface GeneratedMigration {
@@ -278,6 +250,11 @@ export interface GeneratedMigration {
    * cannot be written unmarked and then refused by `x verify` for lacking the mark.
    */
   readonly destructive: boolean;
+  /**
+   * `true` when `--rolling-unsafe` let this `up` drop a column it never retired. Absent otherwise.
+   * `x db gen` writes it as `-- rolling-unsafe: true`, the line the `drift` step's rail reads.
+   */
+  readonly rollingUnsafe?: boolean | undefined;
   /**
    * Every declaration this generator could not write down. Empty on a migration that carries the
    * whole schema, which is what makes it readable as a verdict rather than as noise — and the same
@@ -310,7 +287,12 @@ export function slugify(name: string): string {
     .replace(/^_+|_+$/g, '');
 }
 
-export function generateMigration(options: GenerateOptions): GeneratedMigration {
+export function generateMigration(given: GenerateOptions): GeneratedMigration {
+  // One list for every arm below: a target's same-tenant index is declared by whoever points at it,
+  // and neither `createTable`, `diffTable` nor a snapshot may hold a different answer.
+  // Views leave here, before any table arm: none of them is a table (`generate-view.ts`).
+  const { tables, views } = splitViews(given.entities);
+  const options = { ...given, entities: withSameTenantIndexes(tables, given.current) };
   const current = options.current ?? { tables: [] };
   const plan: Plan = { up: [], down: [] };
   // Applied AFTER `plan`, outside its transaction, in a step of its own (`concurrent-plan.ts`).
@@ -336,11 +318,11 @@ export function generateMigration(options: GenerateOptions): GeneratedMigration
   // and the key that a retype of its column breaks is recorded on whichever table OWNS the key.
   const retyped = retypedColumns(options.entities, current);
   const predropped = moveKeysAside(current, retyped, doomed, preAlters);
-  const plans: ConstraintPlans = { constraints, preDrops, doomed, predropped };
+  const plans: ConstraintPlans = { constraints, preDrops, doomed, predropped, concurrent };
+  let droppedUnretired = false;
 
   for (const entity of options.entities) {
     const live = findTable(current, entity.table);
-    foreignKeyPlan(entity, live, plans);
     if (live === undefined) {
       plan.up.push(...createTable(entity));
       plan.down.push(`drop table ${identifier(entity.table).text};`);
@@ -349,17 +331,36 @@ export function generateMigration(options: GenerateOptions): GeneratedMigration
     }
     // The key first and last, around every column statement of the table (`primary-key.ts`): the
     // snapshot below records `entity.primaryKey`, and until this arm existed nothing produced it.
+    retirePlan(entity, live, plan, options.entities);
     dropChangedKey(entity, live, current, plan, options.name);
     diffTable(entity, live, plan, retypedIn(retyped, entity.table), concurrent);
-    const kept = new Set(entity.columns.map((column) => column.column));
+    const kept = new Set([
+      ...entity.columns.map((column) => column.column),
+      ...(entity.retired ?? []),
+    ]);
     for (const column of live.columns) {
       if (kept.has(column.name)) continue;
+      // Order matters: the release boundary first, with the flag or without it. Retiring is what
+      // earns the next question; it is never consent to losing the rows, so that one still stands.
+      if (column.retired !== true && options.rollingUnsafe !== true) {
+        throw columnDropNotRetired(
+          entity.name,
+          entity.table,
+          column.name,
+          migrationNameArg(options.name),
+        );
+      }
       if (options.allowDestructive !== true) {
         throw migrationIrreversible(
           `dropping "${entity.table}"."${column.name}" discards its rows and cannot be undone`,
-          `x db gen ${migrationNameArg(options.name)} --allow-destructive   # or keep the column and deprecate it`,
+          `x db gen ${migrationNameArg(options.name)} --allow-destructive   # or put "${column.name}" back in columns and keep it`,
         );
       }
+      if (column.retired === true) {
+        plan.up.push(contractsMarkerFor(entity.table, column.name));
+      } else {
+        droppedUnretired = true;
+      }
       plan.up.push(
         `alter table ${identifier(entity.table).text} drop column ${identifier(column.name).text};`,
       );
@@ -372,6 +373,11 @@ export function generateMigration(options: GenerateOptions): GeneratedMigration
     addChangedKey(entity, live, plan, options.name);
   }
 
+  // After every table's diff, so the deferred step already says which target indexes it builds.
+  for (const entity of options.entities) {
+    foreignKeyPlan(entity, findTable(current, entity.table), plans);
+  }
+
   const order = dropOrder(current.tables.filter((table) => !wanted.has(table.name)));
   for (const table of order.tables) {
     if (options.allowDestructive !== true) {
@@ -397,6 +403,11 @@ export function generateMigration(options: GenerateOptions): GeneratedMigration
 
   // After every table exists, so a `create table` in this same migration is already above it.
   appendOnlyPlan(plan, options.entities, current, created);
+  // History, its guard and counters, the same way: after every table they name exists.
+  triggerPlan(plan, options.entities, current);
+  // Then each tenant table's policy, both directions (`row-security-plan.ts`), on tables that exist.
+  const rowSecurity = rowSecurityInput(options.entities, current, options.rowSecurity);
+  rowSecurityPlan(plan, rowSecurity);
 
   // Dead last in `up`, and it is the only placement that is right for every arm: the table has to
   // exist, and a `create table` in this same migration is the reason it might not. It is ordered
@@ -424,16 +435,31 @@ export function generateMigration(options: GenerateOptions): GeneratedMigration
   // `current`, not the entities alone: an `assert` whose CHECK a previous migration recorded is a
   // loss only because THIS plan drops it, and the recorded schema is the only thing that knows.
   const unrendered = unrenderedOf(options.entities, current);
+  // Dropped ahead of every table statement and created after the last one: a view compiled against
+  // a column this migration retypes or drops is `0A000`/`2BP01` otherwise.
+  const viewed = viewPlan(views, current, [...preAlters.up, ...plan.up]);
   return assembleSteps({
     id,
     name: options.name,
-    up: [...preAlters.up, ...plan.up],
+    up: [...viewed.before.up, ...preAlters.up, ...plan.up, ...viewed.after.up],
     // Reverse order: the last thing created is the first thing dropped. `preAlters` goes in at the
     // FRONT here precisely so reversal puts it last — a key is added back only once both of its
     // ends have been retyped back, which is every other statement in the script.
-    down: [...preAlters.down, ...plan.down].reverse(),
+    down: [...viewed.before.down, ...preAlters.down, ...plan.down, ...viewed.after.down].reverse(),
     concurrent,
-    snapshot: snapshotOf(options.entities, replicaIdentityFullAfter(replicaIdentity)),
+    snapshot: recordTriggers(
+      recordRetired(
+        snapshotOf(
+          [...options.entities, ...views],
+          replicaIdentityFullAfter(replicaIdentity),
+          rowSecurityAfter(rowSecurity),
+        ),
+        options.entities,
+        current,
+      ),
+      options.entities,
+    ),
     unrendered,
+    ...(droppedUnretired ? { rollingUnsafe: true } : {}),
   });
 }

package/src/index.ts

@@ -27,13 +27,21 @@ export type {
   PostgresClientOptions,
   ReservableClient,
 } from './client';
-export { baseClient, db, isReservable, postgresClient, setDbClient } from './client';
+export {
+  baseClient,
+  db,
+  dbClientInstalled,
+  isReservable,
+  postgresClient,
+  setDbClient,
+} from './client';
 export type { ColumnDefaultLike } from './column-default';
 export { defaultExpression } from './column-default';
 export {
   concurrentIndexTarget,
   isConcurrentIndexStatement,
   isNonTransactional,
+  isPartitionedBuildRefusal,
   NO_TRANSACTION_MARKER,
 } from './concurrent-index';
 export { dbExecutor } from './db-executor';
@@ -65,11 +73,16 @@ export {
   FRAMEWORK_TABLE_PREFIX,
 } from './drift';
 export { dbDrift } from './drift-errors';
+export type { RowSecurityDifference } from './drift-row-security';
+export { rowSecurityDifferences, rowSecurityDrift } from './drift-row-security';
 export type {
   ColumnDescriptionLike,
+  CounterDescriptionLike,
   EntityDescriptionLike,
+  HistoryDescriptionLike,
   IndexDescriptionLike,
   InvariantDescriptionLike,
+  RetainDescriptionLike,
 } from './entity-shape';
 export type { DbErrorCode, DbErrorInit } from './errors';
 export {
@@ -88,11 +101,39 @@ export {
   serializationExhausted,
   sqlUnsafe,
 } from './errors';
-export { expectedQueryLoop, expectedQueryLoopReason } from './expected-loop';
+export {
+  expectedQueryLoop,
+  expectedQueryLoopReason,
+  expectedSeqScan,
+  expectedSeqScanReason,
+} from './expected-loop';
+export type { FailureSummary, PostgresFailureStore } from './failure-store-pg';
+export {
+  FAILURES_TABLE,
+  failurePurgeTarget,
+  MAX_FAILURE_LIST,
+  postgresFailureStore,
+  SQL_FAILURES_TABLE,
+} from './failure-store-pg';
 export type { RecordedStatement, RecordingClient, StubResponse } from './fake';
 export { recordingClient } from './fake';
 export type { GeneratedMigration, GenerateOptions } from './generate';
 export { generateMigration, migrationStamp, slugify, snapshotOf } from './generate';
+export {
+  counterTrigger,
+  counterTriggerName,
+  recountDriftSql,
+  recountSql,
+} from './generate-counter';
+export {
+  ACTOR_SETTING,
+  HISTORY_GUARD_TRIGGER,
+  HISTORY_TRIGGER,
+  PURGE_SETTING,
+  REQUEST_SETTING,
+} from './generate-history';
+export type { RowSecurityOption, TenantColumnLike } from './generate-row-security';
+export { declaredTriggers } from './generate-triggers';
 export type { IndexMethod } from './index-method';
 export {
   declaredMethod,
@@ -109,6 +150,8 @@ export type {
   IntrospectOptions,
   SchemaDescription,
   TableDescription,
+  TriggerRecord,
+  ViewDescription,
 } from './introspect';
 export { buildSchema, findTable, introspectSchema } from './introspect';
 export {
@@ -118,8 +161,13 @@ export {
   uniqueColumns,
 } from './invariant-ddl';
 export { constraintExpressionUnsafe, constraintNameUnsafe } from './invariant-errors';
+export type { Keyset, KeysetKey, KeysetKind, KeysetOptions, KeysetRow } from './keyset';
+export { keyset } from './keyset';
+export { retainInvalid } from './lifecycle-errors';
 export type { DbSubscription, ListeningClient } from './listen';
 export { canListen } from './listen';
+export type { LocalSettings } from './local-settings';
+export { readLocal, setLocal } from './local-settings';
 export type {
   AppliedMigration,
   LedgerRow,
@@ -147,6 +195,7 @@ export {
 export {
   migrateConcurrent,
   migrationConcurrentInTransaction,
+  migrationConcurrentPartitioned,
   migrationConflict,
   migrationDestructive,
   migrationIrreversible,
@@ -179,7 +228,23 @@ export type { LinkedExtensions, PgliteExtensionLoader } from './pglite-extension
 export { linkPgliteExtensions } from './pglite-extensions';
 export { pgliteVersion } from './pglite-snapshot';
 export type { PoolProfile } from './pool-profile';
-export { POOL_MAX_ENV, POOL_PROFILES, poolMaxFromEnv, poolProfileFor } from './pool-profile';
+export {
+  POOL_MAX_ENV,
+  POOL_PROFILES,
+  poolMaxFromEnv,
+  poolProfileFor,
+} from './pool-profile';
+export type { PoolerMode, StatementBound } from './pooler';
+export {
+  lostStatementBound,
+  POOLER_ENV,
+  POOLER_WAIT_MS,
+  poolerFromEnv,
+  poolerSessionRequired,
+  statementBound,
+} from './pooler';
+export type { ReadTransactionOptions } from './read-transaction';
+export { withReadTransaction } from './read-transaction';
 export type { ReadOnlyQueryOptions, ReadOnlyQueryResult } from './readonly-query';
 export { READONLY_TIMEOUT_MS, readOnlyQuery } from './readonly-query';
 export type { ReadOnlyRoleOptions } from './readonly-role';
@@ -190,9 +255,53 @@ export type {
   ReplicatedClientOptions,
 } from './replica-client';
 export { BREAKER_COOLDOWN_MS, BREAKER_FAILURES, replicatedClient } from './replica-client';
+export type { ReplayReader } from './replica-position';
+export {
+  formatPosition,
+  POSITION_CACHE_MS,
+  parsePosition,
+  primaryPosition,
+  replayReader,
+} from './replica-position';
 export { type DbNode, isPlainRead } from './replica-route';
-export type { ReplicaScope } from './replica-scope';
+export type { ReplicaReadsOptions, ReplicaScope } from './replica-scope';
 export { markScopeWrote, replicaScope, withReplicaReads } from './replica-scope';
+export { recordRetired } from './retired';
+export type { RollingUnsafeKind, RollingUnsafeStatement } from './rolling';
+export {
+  hasRollingUnsafeMarker,
+  ROLLING_UNSAFE_MARKER,
+  retiredColumnsIn,
+  rollingUnsafeStatements,
+  unretiredColumnsIn,
+} from './rolling';
+export { migrationRollingUnsafe } from './rolling-errors';
+export { rowSecureClient } from './row-secure-client';
+export {
+  CROSS_TENANT_SETTING,
+  dropRowSecuritySql,
+  enableRowSecuritySql,
+  ROW_SECURITY_POLICY,
+  TENANT_SETTING,
+} from './row-security';
+export { holdMigratorRole, migratorOwnershipSql } from './row-security-migrator';
+export type { RowSecurityPlanInput, TenantTable } from './row-security-plan';
+export { rowSecurityAfter, rowSecurityPlan } from './row-security-plan';
+export type { RowSecurityRole } from './row-security-role';
+export {
+  assertRowSecurityBinds,
+  rowSecurityExemption,
+  rowSecurityRole,
+} from './row-security-role';
+export {
+  APP_ROLE,
+  assumeRole,
+  ensureRowSecurityRoles,
+  MIGRATOR_ROLE,
+  rowSecurityRolesSql,
+  serveAsAppRole,
+} from './row-security-roles';
+export { sameTenantKeyName } from './same-tenant';
 export { SIBLING_SCOPE_WAIT_MS } from './sibling-turn';
 export { snapshotJson } from './snapshot-json';
 export { parseSnapshot } from './snapshot-parse';
@@ -210,13 +319,27 @@ export { stripSqlNoise } from './sql-noise';
 export { dollarTagAt, endOfBlockComment } from './sql-scan';
 export type { DbSqlStateCode } from './sqlstate';
 export { DB_SQLSTATE_CODES, isRetryableState, SQLSTATE, sqlState, sqlStateCode } from './sqlstate';
+export type { StatementBoundOptions } from './statement-bound';
+export { withStatementTimeout } from './statement-bound';
 export { statementFingerprint, statementKind, statementVerb } from './statement-shape';
 export { STATEMENT_ATTRIBUTE } from './statement-span';
 export { statementsOf } from './statement-split';
-export { currentTx, liveTxConnection, outsideTransaction, withTransaction } from './transaction';
-export { commitUnknown, siblingScopeTimeout, transactionAborted } from './transaction-errors';
+export {
+  completeTransaction,
+  currentTx,
+  liveTxConnection,
+  outsideTransaction,
+  withTransaction,
+} from './transaction';
+export {
+  commitUnknown,
+  siblingScopeTimeout,
+  transactionAborted,
+} from './transaction-errors';
+export { refuseAbandoned } from './transaction-guard';
 export type { DbTx, IsolationLevel, TransactionOptions } from './transaction-options';
 export { beginStatement } from './transaction-options';
+export { setTransactionSettings, transactionSettings } from './transaction-settings';
 export type { GeneratableForm } from './ungeneratable';
 export { GENERATABLE_FORMS, ungeneratableStatements } from './ungeneratable';
 export type { UnrenderedDeclaration } from './unrendered';

package/src/introspect-catalog.ts

@@ -15,6 +15,7 @@ import {
   unrenderedRows,
   viewRows,
 } from './catalog-objects';
+import { policiesOf, policyRows, rowSecurityOf, rowSecurityRows } from './catalog-policies';
 import {
   columnRows,
   constraintRows,
@@ -23,6 +24,7 @@ import {
   tableRows,
 } from './catalog-relations';
 import { type DbClient, db } from './client';
+import { indexDefinitionOf } from './partition-order';
 
 export interface IntrospectCatalogOptions {
   readonly client?: DbClient | undefined;
@@ -60,7 +62,7 @@ async function typesOf(client: DbClient, schema: string): Promise<readonly Catal
 }
 
 /**
- * Eleven round trips, sequential: a pinned transaction connection answers one statement at a
+ * Fifteen round trips, sequential: a pinned transaction connection answers one statement at a
  * time, and this runs once per `x db gen`, never per request.
  */
 export async function introspectCatalog(
@@ -77,11 +79,15 @@ export async function introspectCatalog(
   const functions = await functionRows(client, schema);
   const triggers = await triggerRows(client, schema);
   const unrendered = await unrenderedRows(client, schema);
+  const security = await rowSecurityRows(client, schema);
+  const policies = await policyRows(client, schema);
   const known = new Set(tables.map((table) => table.name));
+  // A policy loads only onto a table the dump creates — the rule `loadable` states for a trigger.
+  const onKnown = (row: { readonly table_name: string }): boolean => known.has(row.table_name);
   const materialized = new Set(views.filter((view) => view.kind === 'm').map((view) => view.name));
-  // A trigger loads only onto a relation the dump creates: a plain table, or a view (`instead
-  // of`). One on a partitioned table or a partition was filed under `09_triggers/` for a table no
-  // file creates, and the load refused the whole dump with `X_SCHEMA_DUMP_DRIFT`.
+  // A trigger loads only onto a relation the dump creates: a table, or a view (`instead of`). One
+  // on an inheritance child was filed under `09_triggers/` for a table no file creates, and the
+  // load refused the whole dump with `X_SCHEMA_DUMP_DRIFT`.
   const viewNames = new Set(views.map((view) => view.name));
   const loadable = (trigger: { readonly table_name: string }): boolean =>
     known.has(trigger.table_name) || viewNames.has(trigger.table_name);
@@ -99,10 +105,14 @@ export async function introspectCatalog(
     tables: tables
       .map((table) => tableOf(table, columns, constraints, sequences))
       .sort(by((table) => table.name)),
-    // An index on a relation this reading does not render (a partition) has nowhere to load.
+    // An index on a relation this reading does not render (an inheritance child) has nowhere to load.
     indexes: indexes
       .filter((index) => known.has(index.table_name) || materialized.has(index.table_name))
-      .map((row) => ({ table: row.table_name, name: row.name, definition: row.definition }))
+      .map((row) => ({
+        table: row.table_name,
+        name: row.name,
+        definition: indexDefinitionOf(row.definition),
+      }))
       .sort(
         by(
           (index) => index.table,
@@ -124,6 +134,7 @@ export async function introspectCatalog(
         materialized: row.kind === 'm',
         options: row.options,
         definition: row.definition,
+        columns: [...row.columns],
       }))
       .sort(by((view) => view.name)),
     functions: functions
@@ -148,8 +159,17 @@ export async function introspectCatalog(
           (trigger) => trigger.name,
         ),
       ),
+    rowSecurity: rowSecurityOf(security.filter(onKnown)),
+    policies: policiesOf(policies.filter(onKnown)),
     unrendered: [
       ...unrendered,
+      ...policies
+        .filter((policy) => !onKnown(policy))
+        .map((policy) => ({
+          kind: 'row security policy',
+          name: policy.name,
+          table_name: policy.table_name,
+        })),
       // Named rather than dropped, the rule `CatalogUnrendered` states.
       ...triggers
         .filter((trigger) => !loadable(trigger))