@workerstack/database 0.21.0 → 0.22.1

package/src/migrate/core/d1-engine-child.mjs

@@ -9,10 +9,12 @@
  * Then each file as wrangler sends it, the file and the history row it appends, through wrangler's
  * `splitSqlQuery`, in one batch. D1 resolves a function in a trigger body, a view or a generated
  * column only when a statement uses it, so EXPLAIN then compiles each view, and each table's INSERT,
- * UPDATE and DELETE, the file made or changed. What D1 refuses comes back in D1's own words.
+ * UPDATE and DELETE, the file made or changed; a view takes only the writes its INSTEAD OF triggers fire
+ * on (trigger-write.mjs). What D1 refuses comes back in D1's own words.
  */
 import { readFileSync } from "node:fs"
 import { pathToFileURL } from "node:url"
+import { EVENTS, quote, triggerEvent, writeOf } from "./trigger-write.mjs"
 
 /**
  * @typedef {{ all(): Promise<{ results?: Array<Record<string, unknown>> | undefined }> }} D1Statement
@@ -27,9 +29,6 @@ import { pathToFileURL } from "node:url"
  * @typedef {import("./d1-engine-child.d.mts").ProofResult} ProofResult
  */
 
-/** @param {string} name */
-const quote = (name) => `"${name.replaceAll('"', '""')}"`
-
 /**
  * D1's own words for a failure: the cause wrangler's client wraps, when there is one
  * @param {unknown} error
@@ -87,7 +86,8 @@ async function isRowTable(db, table) {
  * @returns {Promise<string[]>}
  */
 async function probes(db, before) {
-	const changed = [...(await master(db))].filter(([key, object]) => before.get(key)?.sql !== object.sql)
+	const after = [...(await master(db))]
+	const changed = after.filter(([key, object]) => before.get(key)?.sql !== object.sql)
 	const views = changed.filter(([, object]) => object.type === "view").map(([, object]) => object.table)
 	const tables = new Set(changed.filter(([, object]) => object.type === "trigger").map(([, object]) => object.table))
 	for (const [, object] of changed)
@@ -96,16 +96,32 @@ async function probes(db, before) {
 	const writes = []
 	for (const table of tables) {
 		const { results = [] } = await db.prepare(`PRAGMA table_xinfo(${quote(table)})`).all()
-		const columns = results.filter((row) => row["hidden"] === 0).map((row) => quote(String(row["name"])))
-		writes.push(
-			`EXPLAIN INSERT INTO ${quote(table)} DEFAULT VALUES`,
-			`EXPLAIN UPDATE ${quote(table)} SET ${columns.map((column) => `${column} = ${column}`).join(", ")}`,
-			`EXPLAIN DELETE FROM ${quote(table)}`,
-		)
+		const columns = results.filter((row) => row["hidden"] === 0).map((row) => String(row["name"]))
+		for (const event of eventsOf(after, table)) writes.push(`EXPLAIN ${writeOf(table, event, columns)}`)
 	}
 	return [...views.map((view) => `EXPLAIN SELECT * FROM ${quote(view)}`), ...writes]
 }
 
+/**
+ * `name` as SQLite compares names, ASCII letters folded alone: a trigger's tbl_name is spelled as its ON clause was
+ * @param {string} name
+ */
+const fold = (name) => name.replace(/[A-Z]/g, (letter) => letter.toLowerCase())
+
+/**
+ * The writes `table` takes in the schema `objects`: a table every one, a view each its triggers fire on
+ * @param {ReadonlyArray<[string, SchemaObject]>} objects
+ * @param {string} table
+ */
+function eventsOf(objects, table) {
+	const on = objects.filter(([, object]) => fold(object.table) === fold(table))
+	if (!on.some(([, object]) => object.type === "view")) return EVENTS
+	const fired = new Set(
+		on.filter(([, object]) => object.type === "trigger").map(([, object]) => triggerEvent(object.sql)),
+	)
+	return EVENTS.filter((event) => fired.has(event))
+}
+
 /**
  * The scratch D1 a proof runs on: what it holds is replayed on a fresh one when workerd crashes,
  * which a disconnect shows ("other side closed"), not a D1 error

package/src/migrate/core/d1-history.ts

@@ -15,7 +15,7 @@ import { executeAll } from "../drivers/d1.ts"
 import { lockedOut } from "../drivers/d1-lock.ts"
 import { assertLocalExists, type D1Target, localMissing, type ReadConfig, resolveBinding } from "./d1-binding.ts"
 import { d1Files, refuseSwallowing } from "./d1-files.ts"
-import { applyFailure, wranglerError } from "./d1-wrangler-error.ts"
+import { refuseUnlike } from "./d1-wrangler-error.ts"
 import { D1_HASH_INTENT_TABLE, D1_HASH_TABLE, DRIZZLE_HISTORY_TABLE } from "./d1-history-tables.ts"
 import {
 	type Hashed,
@@ -37,8 +37,9 @@ import { orphanMessage } from "./history-match.ts"
 import { generateMigrationHash, migrationHashes } from "./parse.ts"
 import { proveOnD1 } from "./d1-engine.ts"
 import { planApply } from "./plan-apply.ts"
-import { runPeer } from "./process.ts"
+import { type RunResult, runPeer } from "./process.ts"
 import { Refused } from "./refused.ts"
+import { whileStoppable } from "./stopped.ts"
 
 /** The files `__drizzle_migrations` records that the migrations table does not */
 function recordedByDrizzle(
@@ -129,27 +130,6 @@ async function appliedAfter(
 	}
 }
 
-/** Refuse a failed run, or one whose table gained (`added`) other than the `names` checked, naming a file never checked */
-function refuseUnlike(
-	ran: { code: number; stderr: string; stdout: string },
-	{ added, locked, names, table }: { added: string[]; locked: boolean; names: string[]; table: string },
-): void {
-	const unchecked = added.filter((name) => !names.includes(name))
-	const rest = names.filter((name) => !added.includes(name))
-	const also =
-		unchecked.length === 0
-			? ""
-			: `; wrangler also applied ${unchecked.join(", ")}, which comb never checked and holds no hash for: check each against git, then run comb migrate baseline <db> --hashes`
-	const now = { applied: added, pending: rest }
-	if (ran.code !== 0) throw new Refused(`wrangler d1 migrations apply failed: ${applyFailure(ran, locked)}${also}`, now)
-	if (unchecked.length > 0 || rest.length > 0) {
-		throw new Refused(
-			`wrangler recorded ${added.join(", ") || "nothing"} in ${table}, where comb checked ${names.join(", ")}; wrangler said: ${wranglerError(ran)}${also}`,
-			now,
-		)
-	}
-}
-
 type D1Apply = {
 	approve(migration: ParsedMigration): Promise<Approval>
 	/** only check: apply nothing */
@@ -158,6 +138,25 @@ type D1Apply = {
 	read: ReadConfig
 }
 
+/**
+ * wrangler's apply of `names`, each announced first. A stop signal ends its run, and the table then
+ * says which of them it recorded (stopped.ts)
+ */
+async function wranglerApply(
+	target: D1Target,
+	{ print, read }: D1Apply,
+	{ names, table }: { names: string[]; table: string },
+): Promise<RunResult> {
+	for (const name of names) print(`Apply: ${name}`)
+	const found = async () => {
+		const recorded = await appliedAfter(target, read, { names, ok: false, table })
+		return { applied: names.filter((name) => recorded.has(name)), pending: names.filter((name) => !recorded.has(name)) }
+	}
+	return whileStoppable({ names, print, read: found }, () =>
+		runPeer(target.exec, target.wrangler)(["d1", "migrations", "apply", target.name, ...target.flags], { input: "" }),
+	)
+}
+
 /** Check the pending migrations and, unless only checking, apply them through wrangler; returns them */
 async function applyD1(target: D1Target, options: D1Apply): Promise<string[]> {
 	const { applied, hasIntents, marks, settle, table } = await history(options.read, target, {
@@ -193,9 +192,7 @@ async function applyD1(target: D1Target, options: D1Apply): Promise<string[]> {
 	/* the intents go first: a lost record then fails before wrangler applies anything */
 	const hashed = pending.map(({ migration, name }) => ({ hash: migration.hash, marked: true, name }))
 	await target.conn.batch([...settleStatements(settle, hasIntents, marks), ...intentStatements(hashed)])
-	for (const name of names) options.print(`Apply: ${name}`)
-	const apply = ["d1", "migrations", "apply", target.name, ...target.flags]
-	const ran = await runPeer(target.exec, target.wrangler)(apply, { input: "" })
+	const ran = await wranglerApply(target, options, { names, table })
 	/* asked before anything else runs, while the lock that failed the apply is most likely still held */
 	const locked = ran.code !== 0 && target.flags.includes("--local") && (await lockedOut(ran, target.held))
 	const after = await appliedAfter(target, options.read, { names, ok: ran.code === 0, table })

package/src/migrate/core/d1-wrangler-error.ts

@@ -1,7 +1,9 @@
 /**
- * What a failed `wrangler d1 migrations apply` says, read for the refusal comb gives.
+ * What a failed `wrangler d1 migrations apply` says, read for the refusal comb gives, and the refusal
+ * of a run whose table records other than the files comb checked.
  */
 import { LOCKER } from "../drivers/d1-lock.ts"
+import { Refused } from "./refused.ts"
 
 type Ran = { stderr: string; stdout: string }
 
@@ -23,3 +25,24 @@ export function applyFailure(ran: Ran, locked: boolean): string {
 		? `the local D1 database was locked by ${LOCKER} while wrangler applied: let it finish and rerun`
 		: wranglerError(ran)
 }
+
+/** Refuse a failed run, or one whose table gained (`added`) other than the `names` checked, naming a file never checked */
+export function refuseUnlike(
+	ran: { code: number; stderr: string; stdout: string },
+	{ added, locked, names, table }: { added: string[]; locked: boolean; names: string[]; table: string },
+): void {
+	const unchecked = added.filter((name) => !names.includes(name))
+	const rest = names.filter((name) => !added.includes(name))
+	const also =
+		unchecked.length === 0
+			? ""
+			: `; wrangler also applied ${unchecked.join(", ")}, which comb never checked and holds no hash for: check each against git, then run comb migrate baseline <db> --hashes`
+	const now = { applied: added, pending: rest }
+	if (ran.code !== 0) throw new Refused(`wrangler d1 migrations apply failed: ${applyFailure(ran, locked)}${also}`, now)
+	if (unchecked.length > 0 || rest.length > 0) {
+		throw new Refused(
+			`wrangler recorded ${added.join(", ") || "nothing"} in ${table}, where comb checked ${names.join(", ")}; wrangler said: ${wranglerError(ran)}${also}`,
+			now,
+		)
+	}
+}

package/src/migrate/core/pg-replay-commit.ts

@@ -2,12 +2,14 @@
  * The replay's transactions and the reads around them (pg-replay.ts): a file's or comb's own
  * statement's transaction, refused before its COMMIT when this backend's counts show it wrote past
  * its database, and the server's shared catalogs read as committed around it and around
- * every bare statement, a change there the file's when it is to an object the file names;
+ * every bare statement, a change there the file's when it is to the replay's own database, or to an
+ * object the file names beside a statement that can run code comb cannot read;
  * a `txmode none` file's statement in a transaction of its own first, bare only when
  * Postgres runs it outside a block alone.
  */
 import { adopt, bareAgain, type Run } from "./pg-replay-roles.ts"
-import { added, type Snapshot, snapshot, snapshotChanges, subscriptionsIn } from "./pg-server-snapshot.ts"
+import { type Hidden, runsHidden } from "./pg-replay-hidden.ts"
+import { type Snapshot, snapshot, snapshotChanges, subscriptionsIn } from "./pg-server-snapshot.ts"
 import {
 	type Change,
 	catalogsOf,
@@ -31,12 +33,13 @@ async function begin(run: Run): Promise<void> {
 }
 
 /**
- * Where a replayed transaction or bare statement is: its file's name and the names it spells, the
- * statement, if bare, and what a refusal stops; told each role the transaction adds that the replay
- * adopts
+ * Where a replayed transaction or bare statement is: its file's name and the names it spells, what
+ * its statements so far can run that comb cannot read (`hidden`), the statement, if bare, and what a
+ * refusal stops; told each role the transaction adds that the replay adopts
  */
 type At = {
 	adopted?: ((role: string) => void) | undefined
+	hidden: Hidden
 	name: string
 	names: ReadonlySet<string>
 	sent: string | undefined
@@ -46,52 +49,52 @@ type At = {
 /* the words that name devUrl's role in a file, as namesIn folds them: CURRENT_USER and its kin */
 const SESSION_ROLE = ["current_role", "current_user", "session_user", "user"]
 
+/** The objects the file `names`, devUrl's role among them where it names that by keyword */
+function spelled(run: Run, names: ReadonlySet<string>): Set<string> {
+	const its = new Set(names)
+	if (SESSION_ROLE.some((word) => names.has(word))) its.add(run.role)
+	return its
+}
+
 /**
- * The server's shared catalogs read as committed against the last read: a change since to an object
- * the file `name` names (`names`), while `sent` or the whole file ran, is refused, and a role or
- * database it added is the cleanup's; a change to any other is another session's. The
- * replay's own database is the file's whatever it spells, as only this replay runs in it, and is
- * the cleanup's too. `read` is that read when the caller took it
+ * The server's shared catalogs read as committed against the last read: a change since to the
+ * replay's own database, or to what it holds, is the file's, as only this replay runs in it, and the
+ * cleanup drops it. A change to an object the file names is the file's when its statements so far
+ * can run code comb cannot read (pg-replay-hidden.ts), the one way a change past the database gets by
+ * the counts, and is refused, but no cleanup drops it: Postgres keeps no creator for a role or a
+ * database, and another session may have made it. A change to any other object, or beside statements
+ * that run only what their parse says, is another session's. `read` is that read when the caller took it
  */
 async function window(run: Run, at: At, read?: Snapshot): Promise<void> {
-	strayed(run, at, read ?? (await snapshot(run.admin)))
+	const now = read ?? (await snapshot(run.admin))
+	strayed(run, { ...at, hid: await hides(run, at, now) }, now)
 }
 
+/* whether a change in `now` to an object the file names may be the file's, as its statements can run code comb cannot read */
+const hides = (run: Run, { hidden, names }: At, now: Snapshot): boolean | Promise<boolean> =>
+	snapshotChanges(run.seen, now, spelled(run, names)).length > 0 && runsHidden(run.sql, hidden)
+
 /**
  * window's verdict on `now`, the server's shared catalogs as committed after the file or `sent`,
- * against the last read; kept apart from window's await, as v8 miscounts a branch after an await
+ * against the last read, the objects the file names counted when it `hid` code comb cannot read;
+ * kept apart from window's await, as v8 miscounts a branch after an await
  */
-function strayed(run: Run, { name, names, sent, stops }: At, now: Snapshot): void {
-	const its = new Set([...names, run.database])
-	if (SESSION_ROLE.some((word) => names.has(word))) its.add(run.role)
-	const changes = snapshotChanges(run.seen, now, its)
-	const { databases, roles, slots } = added(run.seen, now, its)
+function strayed(run: Run, { hid, name, names, sent, stops }: At & { hid: boolean }, now: Snapshot): void {
+	const replays = new Set([run.database])
+	const changes = snapshotChanges(run.seen, now, hid ? new Set([...spelled(run, names), ...replays]) : replays)
+	const own = new Set(snapshotChanges(run.seen, now, replays))
 	const within = subscriptionsIn(run.seen, now, run.database)
 	run.seen = now
 	if (changes.length === 0) return
-	run.strays.databases.push(...databases)
-	run.strays.roles.push(...roles)
-	run.strays.slots.push(...slots)
-	const own = `database ${run.database} `
-	const strays = [
-		...roles.map((role) => `role ${role}`),
-		...databases.map((database) => `database ${database} unless a session is in it`),
-		...slots.map((slot) => `replication slot ${slot} unless a session holds it`),
-	]
-	const replays =
-		changes.some((change) => change.startsWith(own)) || within.length > 0
+	const dropped =
+		own.size > 0
 			? `; comb drops the database it replays in${within.length === 0 ? "" : `, and ${within.join(", ")} in it`}`
 			: ""
-	const dropped = `${strays.length === 0 ? "" : `; comb drops ${strays.join(", ")}, which the file added`}${replays}`
-	/* the read is committed, so a change it shows to an object the file did not add stays */
-	const dropping = new Set([
-		...roles.map((role) => `role ${role} added`),
-		...databases.map((d) => `database ${d} added`),
-		...slots.map((slot) => `replication slot ${slot} added`),
-		...within.map((subject) => `${subject} added`),
-	])
-	const kept = changes.filter((change) => !dropping.has(change) && !change.startsWith(own))
-	const left = kept.length === 0 ? "" : `; devUrl's server keeps ${kept.join(", ")}, which comb cannot undo`
+	const kept = changes.filter((change) => !own.has(change))
+	const left =
+		kept.length === 0
+			? ""
+			: `; comb leaves ${kept.join(", ")} on devUrl's server, as another session may have made ${kept.length === 1 ? "that change" : "those changes"}: undo there each that is the file's`
 	throw new ReplayFailed(
 		`${name}: devUrl's server changed past the database the replay runs in while ${sent === undefined ? "the file" : JSON.stringify(sent)} ran: ${changes.join(", ")}. A change made there, from inside a DO block, a function, EXECUTE or CALL, or over a second connection such as dblink's, apply would make on the target's server, so comb refuses the file; write the change as a statement of its own, which the replay leaves out and apply runs${dropped}${left}; ${stops}`,
 	)

package/src/migrate/core/pg-replay-drops.ts

@@ -4,8 +4,8 @@
  * which the next replay or apply sweeps. Postgres drops no database that holds a subscription or a
  * logical slot, so both go first, and only from the replay databases it drops: a subscription from
  * a session in its database, the only one that can name it. A drop that fails never decides the
- * verdict, and is said, never left unsaid: what it left, dev's error, and whether a later sweep takes it, as a
- * stray of a refused window carries no tag a sweep finds. The replay database is dropped WITH
+ * verdict, and is said, never left unsaid: what it left and dev's error, which a later sweep takes. The
+ * replay database is dropped WITH
  * (FORCE), so a backend that came in after the cleanup ended the others cannot hold it.
  */
 import { sqlIdentifier } from "../../codegen/utils/case.ts"
@@ -24,14 +24,11 @@ async function settle(step: () => Promise<unknown>): Promise<void> {
 	}
 }
 
-/** What a drop that failed left on devUrl's server, a database, role or slot by name, and whether a later sweep takes it */
-type Left = { swept: boolean; what: string }
-
-/** How a drop that failed is said: what it `left`, with dev's error */
-type Leave = (left: Left, error: unknown) => void
+/** How a drop that failed is said: what it left on devUrl's server, a database, role or slot by name, with dev's error */
+type Leave = (left: string, error: unknown) => void
 
 /** `drop` run, a failure `leave`d: cleaning up never replaces the replay's verdict, and never leaves something unsaid */
-async function dropOr(leave: Leave, left: Left, drop: () => Promise<unknown>): Promise<void> {
+async function dropOr(leave: Leave, left: string, drop: () => Promise<unknown>): Promise<void> {
 	try {
 		await drop()
 	} catch (error) {
@@ -45,9 +42,9 @@ type Drops = { into: (database: string) => Sql; leave: Leave }
 
 /** A `leave` that prints, `failed` naming devUrl in dev's error */
 function leaving(print: (line: string) => void, failed: Parameters<typeof failureOf>[1]): Leave {
-	return ({ swept, what }, error) =>
+	return (left, error) =>
 		print(
-			`comb could not drop ${what}, which a replay left on devUrl's server: ${failureOf(error, failed)}; ${swept ? "the next check or apply that reaches that server drops it" : "drop it there"}`,
+			`comb could not drop ${left}, which a replay left on devUrl's server: ${failureOf(error, failed)}; the next check or apply that reaches that server drops it`,
 		)
 }
 
@@ -80,14 +77,13 @@ async function emptyDatabase(admin: Sql, database: string, { into, leave }: Drop
 	if (subscriptions.length > 0) {
 		const sql = into(database)
 		try {
-			for (const name of subscriptions)
-				await dropOr(leave, { swept: true, what: `subscription ${name}` }, () => dropSubscription(sql, name))
+			for (const name of subscriptions) await dropOr(leave, `subscription ${name}`, () => dropSubscription(sql, name))
 		} finally {
 			await settle(() => sql.end({ timeout: 0 }))
 		}
 	}
 	for (const slot of (holds?.["slots"] ?? []) as string[])
-		await dropOr(leave, { swept: true, what: `replication slot ${slot}` }, () => dropSlot(admin, slot))
+		await dropOr(leave, `replication slot ${slot}`, () => dropSlot(admin, slot))
 }
 
 /**
@@ -132,11 +128,9 @@ async function sweep(admin: Sql, now: number, drops: Drops): Promise<void> {
 		await settle(() => emptyDatabase(admin, name, drops))
 		/* Postgres drops no template, which a committing DO can make the replay's database */
 		if (template) await settle(() => admin.unsafe(`ALTER DATABASE ${sqlIdentifier(name)} IS_TEMPLATE false`, []))
-		await dropOr(leave, { swept: true, what: `database ${name}` }, () =>
-			admin.unsafe(`DROP DATABASE IF EXISTS ${sqlIdentifier(name)}`, []),
-		)
+		await dropOr(leave, `database ${name}`, () => admin.unsafe(`DROP DATABASE IF EXISTS ${sqlIdentifier(name)}`, []))
 	}
-	for (const role of roles) await dropOr(leave, { swept: true, what: `role ${role}` }, () => dropRole(admin, role))
+	for (const role of roles) await dropOr(leave, `role ${role}`, () => dropRole(admin, role))
 }
 
 /* why comb loads postgres.js in an apply */
@@ -196,10 +190,10 @@ async function sweepDev(
 
 /**
  * `run`'s cleanup, each drop that fails `leave`d: its connection closed, a query in flight with it,
- * any backend still in its database ended, the slots a refused window added, which a drop waits on,
- * the database's subscriptions and slots, which keep it from its drop, the database made no
- * template and dropped, forcing out a backend that came in since, each role it made, and that
- * window's roles and idle databases, which no sweep takes
+ * any backend still in its database ended, the database's subscriptions and slots, which keep it
+ * from its drop, the database made no template and dropped, forcing out a backend that came in
+ * since, and each role it made or adopted. It drops nothing else a refused window saw, as Postgres
+ * keeps no creator for a role, a database or a slot, and another session may have made it
  */
 async function cleanUp(run: Run, drops: Drops): Promise<void> {
 	const { leave } = drops
@@ -210,21 +204,12 @@ async function cleanUp(run: Run, drops: Drops): Promise<void> {
 			[run.database],
 		),
 	)
-	for (const slot of run.strays.slots)
-		await dropOr(leave, { swept: false, what: `replication slot ${slot}` }, () => dropSlot(run.admin, slot))
 	await settle(() => emptyDatabase(run.admin, run.database, drops))
 	await settle(() => run.admin.unsafe(`ALTER DATABASE ${run.database} IS_TEMPLATE false`, []))
-	await dropOr(leave, { swept: true, what: `database ${run.database}` }, () =>
+	await dropOr(leave, `database ${run.database}`, () =>
 		run.admin.unsafe(`DROP DATABASE IF EXISTS ${run.database} WITH (FORCE)`, []),
 	)
-	for (const role of run.created)
-		await dropOr(leave, { swept: true, what: `role ${role}` }, () => dropMade(run.admin, role))
-	for (const name of run.strays.databases)
-		await dropOr(leave, { swept: false, what: `database ${name}` }, () =>
-			run.admin.unsafe(`DROP DATABASE IF EXISTS ${sqlIdentifier(name)}`, []),
-		)
-	for (const role of run.strays.roles)
-		await dropOr(leave, { swept: false, what: `role ${role}` }, () => dropRole(run.admin, role))
+	for (const role of run.created) await dropOr(leave, `role ${role}`, () => dropMade(run.admin, role))
 }
 
 export { cleanUp, type Drops, dropMade, dropOr, dropRole, dropSlot, type Leave, leaving, settle, sweep, sweepDev }

package/src/migrate/core/pg-replay-hidden.ts

@@ -0,0 +1,75 @@
+/**
+ * Whether the statements a replay's window covers can run code comb cannot read, the only way one
+ * makes a change past its database that this backend's counts miss (pg-replay-commit.ts): a DO
+ * block, a CALL, an EXECUTE, or a call of a function outside pg_catalog, dblink's among them. A
+ * statement whose tree holds none of those runs only what its parse says, and BEYOND and SERVER_CALLS
+ * (pg-outside-transaction.ts, pg-server-calls.ts) leave out every such statement that reaches past
+ * the database, so a change the server's read shows beside it is another session's. A function
+ * called by a bare name is pg_catalog's only where the replay's database holds no other of that name,
+ * as an overload in a schema on the search path can take the call, and the file makes none of it.
+ * Code Postgres runs for a statement on its own, a trigger, a default, an operator or a cast that
+ * calls a function an earlier file defines, is no call in the tree, so it is not read here; what it
+ * writes in the replay's transaction its counts still see.
+ */
+import type { Sql } from "./pg-replay-database.ts"
+
+/**
+ * What the statements so far can run that comb cannot read: `code` when one surely can, the
+ * functions they call by a bare name (`calls`), which may be pg_catalog's, and those the file makes
+ * (`made`). A file's every later window counts what one ran, as a change a DO block makes in the
+ * file's own block commits at its COMMIT
+ */
+type Hidden = { calls: Set<string>; code: boolean; made: Set<string> }
+
+/** Nothing run yet */
+const nothingHidden = (): Hidden => ({ calls: new Set(), code: false, made: new Set() })
+
+// lookup-table: the statements that run code the parse does not hold: a DO block's body, a procedure, a prepared statement
+const RUNS_CODE: ReadonlySet<string> = /* @__PURE__ */ new Set(["CallStmt", "DoStmt", "ExecuteStmt"])
+
+/** The name parts of a FuncCall's or a CREATE FUNCTION's `funcname`, each a String node, the name last */
+const partsOf = (funcname: unknown): string[] =>
+	(funcname as Array<{ String: { sval: string } }>).map((part) => part.String.sval)
+
+/** `tree`, a parse tree or a part of one, read `into` */
+function readTree(tree: unknown, into: Hidden): void {
+	if (tree === null || typeof tree !== "object") return
+	for (const [key, value] of Object.entries(tree)) {
+		if (RUNS_CODE.has(key)) into.code = true
+		else if (key === "FuncCall" || key === "CreateFunctionStmt") {
+			const parts = partsOf((value as { funcname: unknown }).funcname)
+			/* a funcname holds its name at least */
+			const name = parts.at(-1) as string
+			if (key === "CreateFunctionStmt") into.made.add(name)
+			else if (parts.length === 1) into.calls.add(name)
+			else if (parts.length > 2 || parts[0] !== "pg_catalog") into.code = true
+		}
+		readTree(value, into)
+	}
+}
+
+/** A statement the replay runs, read `into`: one the parser cannot read may run anything */
+function readStatement(tree: unknown, into: Hidden): void {
+	if (tree === undefined) into.code = true
+	else readTree(tree, into)
+}
+
+/* of the functions a JSON array names, whether one is no pg_catalog function, or also one outside it */
+const NOT_CATALOG = `SELECT EXISTS (
+  SELECT FROM jsonb_array_elements_text($1::text::jsonb) f(name)
+  WHERE NOT EXISTS (SELECT FROM pg_proc p WHERE p.proname = f.name AND p.pronamespace = 'pg_catalog'::regnamespace)
+    OR EXISTS (SELECT FROM pg_proc p WHERE p.proname = f.name AND p.pronamespace <> 'pg_catalog'::regnamespace)
+) AS hidden`
+
+/**
+ * Whether what `hidden` holds can run code comb cannot read, a bare name resolved on `sql`, the
+ * replay's connection, which sees what its open transaction made
+ */
+async function runsHidden(sql: Sql, { calls, code, made }: Hidden): Promise<boolean> {
+	if (code || [...calls].some((name) => made.has(name))) return true
+	if (calls.size === 0) return false
+	const rows = await sql.unsafe(NOT_CATALOG, [JSON.stringify([...calls])])
+	return rows.some((row) => row["hidden"] === true)
+}
+
+export { type Hidden, nothingHidden, readStatement, runsHidden }

package/src/migrate/core/pg-replay-roles.ts

@@ -18,7 +18,7 @@
 import { sqlIdentifier } from "../../codegen/utils/case.ts"
 import { codeOf, literal, type Sql, TAG } from "./pg-replay-database.ts"
 import { addWrites, catalogsOf, counts, type Rows, subjectRows, type Writes, writesSince } from "./pg-server-writes.ts"
-import type { Snapshot, Strays } from "./pg-server-snapshot.ts"
+import type { Snapshot } from "./pg-server-snapshot.ts"
 import { flag } from "./pg-nodes.ts"
 
 /**
@@ -26,8 +26,7 @@ import { flag } from "./pg-nodes.ts"
  * that owns it, its role (`role`, which CURRENT_USER and its kin name in a file), whether that role
  * is a superuser, which reads pg_authid, whether it has CREATEROLE (`createrole`), and the roles it made; the
  * open transaction's own writes, comb's CREATE ROLEs', with the rows they left; the shared catalogs
- * as last read committed (`seen`), and the roles, databases and replication slots a refused window
- * added (`strays`), which the cleanup drops
+ * as last read committed (`seen`)
  */
 type Run = {
 	admin: Sql
@@ -39,7 +38,6 @@ type Run = {
 	role: string
 	seen: Snapshot
 	sql: Sql
-	strays: Strays
 	/** the tablespaces it left out the CREATE of, which a statement then runs in pg_default instead */
 	tablespaces: Set<string>
 	superuser: boolean

package/src/migrate/core/pg-replay.ts

@@ -3,11 +3,10 @@
  * catalog query: Postgres, not a model of it, decides what a cascade, a rename or a
  * move leaves, and the two sides compare as one read of two databases.
  *
- * The replay runs as Atlas applies: each file on a session of its own, as apply
- * gives each file an Atlas call, and in a transaction of its own, a `--
- * atlas:txmode none` file statement by statement, each in a transaction of its own first and bare,
- * as Atlas sends it, where Postgres runs it only so, in a database
- * made for it and dropped after (pg-replay-database.ts). One transaction for the whole history
+ * The replay runs as Atlas applies: each file on a session of its own, as apply gives each file an
+ * Atlas call, and in a transaction of its own, a `-- atlas:txmode none` file statement by statement,
+ * each in a transaction of its own first and bare, as Atlas sends it, where Postgres runs it only
+ * so, in a database made for it and dropped after (pg-replay-database.ts). One transaction for the whole history
  * filled Postgres's lock table and left a seed's deferred trigger events pending, and devUrl's own
  * database lent the history what it held. Committed, a statement whose scope is the server or
  * another database would outlive the replay on devUrl's server, the target's own when they share
@@ -29,19 +28,19 @@
  * Bare runs only a statement a block refuses (an outside-only class, a DO block or CALL that
  * commits), one only a block runs (a LOCK, a SAVEPOINT, a cursor not held) and the file's own
  * block, and a change one makes past its database has committed when the read sees it: the refusal
- * names what devUrl's server keeps. The read is the server's, another session's work in it too, so
- * a change there is the file's only when the role, database or other object it is to is one the
- * file names: a name it spells, unquoted and folded as Postgres folds it, quoted and exact, or
- * inside a string a DO body, dblink_exec or format() may run (namesIn in sql-code.ts). That change
- * is refused, naming it, and a role it added is dropped with the cleanup, as is a database it added
- * that no session is in; a change to any other object is another session's and passes. A name the
- * file builds at run time, by concatenation, from a query, or in a function another file defines,
- * is none it spells, so comb neither refuses nor drops that change. A role's password reads from
- * pg_authid alone, so a password a bare statement changes is seen by a superuser's devUrl only.
+ * names what devUrl's server keeps. The read is the server's, another session's work in it too, and
+ * Postgres keeps no creator for a role or a database, so a change there is the file's only beside a
+ * statement that can run code comb cannot read (pg-replay-hidden.ts), and only when it is to an
+ * object the file names: a name it spells, unquoted and folded as Postgres folds it, quoted and
+ * exact, or inside a string a DO body, dblink_exec or format() may run (namesIn in sql-code.ts).
+ * That change is refused, naming it, and left, as another session may have made it; any other is
+ * another session's and passes. A name the file builds at run time, by concatenation, from a query,
+ * or in a function another file defines, is none it spells, so comb does not refuse that change. A
+ * role's password reads from pg_authid alone, so a bare statement's is seen by a superuser's only.
  *
- * A SIGINT or a SIGTERM, a Ctrl-C or a cancelled CI job, skips a `finally`, so either runs the
- * replay's cleanup first, once, and then ends the process as the signal would; a run
- * killed past it is swept by the next replay or apply on the server.
+ * A SIGINT or a SIGTERM, a Ctrl-C or a cancelled CI job, skips a `finally`, so either runs the replay's
+ * cleanup first, once, and then ends the process as the signal would; a run killed past it is swept
+ * by the next replay or apply on the server.
  */
 import { sqlIdentifier } from "../../codegen/utils/case.ts"
 import { type PgTarget, refuseUrlProblems } from "./atlas-target.ts"
@@ -65,6 +64,7 @@ import { prepareSnapshot, snapshot } from "./pg-server-snapshot.ts"
 import { refuseUncounted } from "./pg-server-writes.ts"
 import { pgRead } from "./pg-split.ts"
 import { namesIn } from "./sql-code.ts"
+import { nothingHidden, readStatement } from "./pg-replay-hidden.ts"
 
 /** A history file as baseline reads it */
 type HistoryFile = { name: string; sql: string }
@@ -92,12 +92,14 @@ async function replayFile(run: Run, { name, sql: text }: HistoryFile, replay: Re
 	const inFile = !outsideTransaction(text)
 	const file = {
 		adopted: (role: string) => replay.adopted?.(name, role),
+		hidden: nothingHidden(),
 		name,
 		names: namesIn(text),
 		stops: replay.stops,
 	}
 	const statements = pgRead(text).statements.map(({ sent, tree }) => ({
 		sent,
+		tree,
 		...(tree === undefined ? { node: {}, type: "" } : (([type, node]) => ({ node, type }))(nodeOf(tree))),
 	}))
 	const locks = lockReader(
@@ -110,13 +112,14 @@ async function replayFile(run: Run, { name, sql: text }: HistoryFile, replay: Re
 		await begin(run)
 		await locks.began()
 	}
-	for (const [index, { node, sent, type }] of statements.entries()) {
+	for (const [index, { node, sent, tree, type }] of statements.entries()) {
 		const beyond = (await runsOnMade(run, type, node)) ? undefined : beyondDatabase(type, node)
 		if (beyond !== undefined) {
 			leaveOutTablespace(run.tablespaces, type, node)
 			replay.leftOut(name, sent, beyond)
 			continue
 		}
+		readStatement(tree, file.hidden)
 		await locks.next(index, type, node)
 		const send = () => runStatement(run, { name, node, sent, type }, replay)
 		if (inFile) await send()
@@ -206,7 +209,6 @@ async function opening(
 		owner,
 		seen: new Map(),
 		sql: open(),
-		strays: { databases: [], roles: [], slots: [] },
 		tablespaces: new Set(),
 		...(await devRoleOf(admin)),
 	}