@voltro/database 0.24.0 → 0.25.0

package/dist/sql.d.ts

@@ -143,6 +143,25 @@ export declare const applySchema: (tables: ReadonlyArray<AnyTable>, dialect?: Di
  *  raised nothing. */
 cdcChannel?: string) => Effect.Effect<void, never, SqlClient.SqlClient>;
 
+/**
+ * The OPT-IN refuse gate over the advisory. By default (`VOLTRO_ROLLING_DEPLOY`
+ * unset) this never fires — the classifier stays a `db plan` advisory, because
+ * the framework can't know the deploy strategy and a maintenance-window /
+ * scale-to-zero deploy has no overlap window. An operator who DOES rolling
+ * deploys opts in with `VOLTRO_ROLLING_DEPLOY=1`, turning an unsafe `db apply`
+ * into a hard refusal they must split (expand/contract) or explicitly `--force`.
+ *
+ * Pure — the caller supplies the resolved flags + the unsafe-op count (the ⚠
+ * detail is already printed by the plan renderer), so the decision is testable
+ * without a CLI or a DB, and the cloud managed-hosting migration wall can reuse
+ * exactly this verdict.
+ */
+export declare const assessRollingDeployGate: (input: {
+    readonly enabled: boolean;
+    readonly forced: boolean;
+    readonly unsafeCount: number;
+}) => RollingDeployGateVerdict;
+
 /** Per-row backfill body executed by the migration runner. */
 declare type BackfillFunction<TsType = unknown> = (row: Readonly<Record<string, unknown>>) => TsType | Promise<TsType>;
 
@@ -380,6 +399,23 @@ declare interface ColumnDefinition<TsType, Type extends ColumnType = ColumnType,
      * COSTS is per command — see `serverOnly()` below for the matrix.
      */
     readonly serverOnly?: boolean;
+    /**
+     * Optimistic-concurrency marker, set by `.version()`.
+     *
+     * The column the store INCREMENTS on every update, and the one an update may
+     * carry an expectation of. Two clients that read the same row and both write
+     * it are the normal case, not an exotic one — and without this the second
+     * write silently wins, which is the shape of every "my change disappeared"
+     * report ever filed.
+     *
+     * A TIMESTAMP cannot do this job. Two writes in the same millisecond are
+     * indistinguishable, and across replicas the clocks disagree; this repo has
+     * already lost rows to exactly that (an analytics sink dropped 7 of 40 events
+     * written in the same millisecond as the query bounding them). A monotonic
+     * integer has neither problem, and it also answers the other half of the
+     * question — which of two copies is NEWER — without consulting a clock.
+     */
+    readonly versionColumn?: boolean;
     /**
      * Data-sensitivity classification, set by `.sensitive(class)`. Declares that
      * this column holds personal / sensitive data of a given CLASS (`'email'`,
@@ -1671,6 +1707,15 @@ export declare const rollbackFileBasedMigration: (sql: SqlClient.SqlClient, ctx:
     durationMs: number;
 }, unknown>;
 
+export declare interface RollingDeployGateVerdict {
+    /** The apply MUST NOT proceed (opt-in gate tripped, not forced). */
+    readonly refuse: boolean;
+    /** The gate tripped but `--force` waved it through — surface a warning. */
+    readonly warnForced: boolean;
+    /** Empty unless refuse or warnForced. */
+    readonly message: string;
+}
+
 /** Verdict for one operation under a rolling deploy. */
 export declare type RollingDeploySafety = {
     readonly safe: true;

package/dist/sql.js

@@ -1,4 +1,4 @@
-import { H as e, U as t, a as n, c as r, d as i, ft as a, i as o, n as s, o as c, ot as l, q as u, r as d, s as f } from "./frameworkLiveTables-BvPIm2cD.js";
+import { H as e, U as t, a as n, c as r, d as i, ft as a, i as o, n as s, o as c, ot as l, q as u, r as d, s as f } from "./frameworkLiveTables-BQwB8K6R.js";
 import { Effect as p } from "effect";
 import { createLogger as m } from "@voltro/logger";
 import { SqlClient as h } from "@effect/sql";
@@ -3008,10 +3008,26 @@ BEGIN
 		});
 	}
 	return t;
-}, ni = (e, ...t) => ({
+}, ni = (e) => {
+	if (!e.enabled || e.unsafeCount === 0) return {
+		refuse: !1,
+		warnForced: !1,
+		message: ""
+	};
+	let t = `${e.unsafeCount} operation(s) are UNSAFE under a rolling deploy (VOLTRO_ROLLING_DEPLOY=1)`;
+	return e.forced ? {
+		refuse: !1,
+		warnForced: !0,
+		message: `${t} — proceeding anyway (--force). Old instances may error mid-rollout.`
+	} : {
+		refuse: !0,
+		warnForced: !1,
+		message: `${t}. Old instances would break against the new schema mid-rollout. Split into expand → deploy → contract (see the ⚠ list above), deploy with no overlap (maintenance window / scale-to-zero), or pass --force to override.`
+	};
+}, ri = (e, ...t) => ({
 	_tag: "RawSqlFragment",
 	strings: [...e],
 	values: [...t]
-}), ri = (e) => typeof e == "object" && !!e && e._tag === "RawSqlFragment";
+}), ii = (e) => typeof e == "object" && !!e && e._tag === "RawSqlFragment";
 //#endregion
-export { O as DEFAULT_CDC_CHANNEL, o as FILE_MIGRATION_PATTERN, Gr as FileMigrationLedgerError, k as REACTIVE_TRIGGER_PREFIX, re as VOLTRO_MIGRATION_LOCK_KEY, T as acquireMigrationLock, et as applyNamespacedSchema, Tr as applyPlan, Je as applySchema, $t as chunkTables, ei as classifyRollingDeploySafety, I as declaredSnapshot, xe as defaultArrayClause, be as defaultClause, M as defaultJsonClause, Br as describeOutcome, Pr as destructiveScope, ft as detectReactiveTriggerDrift, gn as emitDropColumnDdl, _n as emitDropColumnDdlMysql, qe as emitFrameworkBootstrapSql, Ge as emitNamespaceProvisionDdl, Ke as emitNamespacedSchemaSql, We as emitSchemaSql, P as fingerprintSchema, pt as formatReactiveTriggerDrift, Nr as ignoreTablesFromEnv, U as introspectSchema, n as isFileMigration, ri as isRawSqlFragment, Jt as mapPgType, c as migration, N as numericIdSql, qt as parseEnumCheck, Jr as pendingFileMigrationIds, Kt as planMigrations, tt as provisionTenantNamespace, Fe as reactiveTriggerRepairSql, E as releaseMigrationLock, Mn as renderColumnMysql, Dn as renderColumnPg, Zr as rollbackFileBasedMigration, ti as rollingDeployUnsafeOps, Yr as runFileBasedMigrations, nt as runFrameworkBootstrap, $e as runMigrate, zr as runPlannedMigrations, F as shortFingerprint, ct as snapshotColumn, ni as sql, j as sqlType, Qr as squashMigrationPlans, Ir as unblockLossy, D as withMigrationLock };
+export { O as DEFAULT_CDC_CHANNEL, o as FILE_MIGRATION_PATTERN, Gr as FileMigrationLedgerError, k as REACTIVE_TRIGGER_PREFIX, re as VOLTRO_MIGRATION_LOCK_KEY, T as acquireMigrationLock, et as applyNamespacedSchema, Tr as applyPlan, Je as applySchema, ni as assessRollingDeployGate, $t as chunkTables, ei as classifyRollingDeploySafety, I as declaredSnapshot, xe as defaultArrayClause, be as defaultClause, M as defaultJsonClause, Br as describeOutcome, Pr as destructiveScope, ft as detectReactiveTriggerDrift, gn as emitDropColumnDdl, _n as emitDropColumnDdlMysql, qe as emitFrameworkBootstrapSql, Ge as emitNamespaceProvisionDdl, Ke as emitNamespacedSchemaSql, We as emitSchemaSql, P as fingerprintSchema, pt as formatReactiveTriggerDrift, Nr as ignoreTablesFromEnv, U as introspectSchema, n as isFileMigration, ii as isRawSqlFragment, Jt as mapPgType, c as migration, N as numericIdSql, qt as parseEnumCheck, Jr as pendingFileMigrationIds, Kt as planMigrations, tt as provisionTenantNamespace, Fe as reactiveTriggerRepairSql, E as releaseMigrationLock, Mn as renderColumnMysql, Dn as renderColumnPg, Zr as rollbackFileBasedMigration, ti as rollingDeployUnsafeOps, Yr as runFileBasedMigrations, nt as runFrameworkBootstrap, $e as runMigrate, zr as runPlannedMigrations, F as shortFingerprint, ct as snapshotColumn, ri as sql, j as sqlType, Qr as squashMigrationPlans, Ir as unblockLossy, D as withMigrationLock };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/database",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Browser-safe schema DSL, query builder, and cross-dialect migration planner for Voltro — one schema, every SQL backend.",
   "keywords": [
     "voltro",
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@effect/sql": "^0.52.0",
-    "@voltro/logger": "0.24.0",
+    "@voltro/logger": "0.25.0",
     "typeid-js": "^1.2.0",
     "ulidx": "^2.4.1"
   },