@workerstack/database 0.22.0 → 0.22.1

package/src/migrate/core/apply.ts

@@ -6,8 +6,10 @@
  */
 import { chainText } from "../../error-chain.ts"
 import type { Connection } from "../types.ts"
+import { pastStop } from "./cleanup.ts"
 import { HASH_VERSION } from "./parse.ts"
 import { Refused } from "./refused.ts"
+import { whileStoppable } from "./stopped.ts"
 import { isTransient } from "./transient.ts"
 import { type RetryOptions, withRetry } from "./utils.ts"
 
@@ -24,19 +26,39 @@ const TABLE = `(
       hash_v INTEGER
     )`
 
-/** Whether a unique index of comb's history holds its hash alone, as comb's table did before 0.13 */
-export async function hashUnique(conn: Connection): Promise<boolean> {
+/** Whether a unique index of comb's history holds `column` alone */
+async function uniqueOn(conn: Connection, column: string): Promise<boolean> {
 	const list = await conn.execute("PRAGMA index_list(__drizzle_migrations)")
 	const unique = list.rows.filter((row) => Number(row[list.columns.indexOf("unique")]) === 1)
 	for (const index of unique) {
 		const name = String(index[list.columns.indexOf("name")])
 		const info = await conn.execute(`PRAGMA index_info("${name.replaceAll('"', '""')}")`)
 		const columns = info.rows.map((row) => String(row[info.columns.indexOf("name")]))
-		if (columns.length === 1 && columns[0] === "hash") return true
+		if (columns.length === 1 && columns[0] === column) return true
 	}
 	return false
 }
 
+/** Whether a unique index of comb's history holds its hash alone, as comb's table did before 0.13 */
+export const hashUnique = (conn: Connection): Promise<boolean> => uniqueOn(conn, "hash")
+
+/**
+ * A name recorded once, whoever made the table: a history drizzle's migrator made gains `name` by ALTER
+ * and no UNIQUE with it, so nothing would refuse a second run's record of a file the first applied.
+ * Refused, naming the files, when the history already holds one twice
+ */
+async function keepNameUnique(conn: Connection): Promise<void> {
+	if (await uniqueOn(conn, "name")) return
+	const twice = await conn.execute(
+		"SELECT name FROM __drizzle_migrations WHERE name IS NOT NULL GROUP BY name HAVING count(*) > 1 ORDER BY name",
+	)
+	if (twice.rows.length > 0)
+		throw new Error(
+			`__drizzle_migrations records ${twice.rows.map((row) => String(row[0])).join(", ")} more than once, so comb cannot keep a file from being recorded twice: delete the extra rows of each (keep the first), then run it again`,
+		)
+	await conn.execute("CREATE UNIQUE INDEX IF NOT EXISTS __drizzle_migrations_name ON __drizzle_migrations (name)")
+}
+
 /**
  * comb's history, made where it is missing, named from 0.11, and from a history before 0.13
  * rebuilt in one batch: every row and id kept, each row `renamed` lists taking its new name,
@@ -55,7 +77,7 @@ export async function ensureMigrationsTable(
 	/* a history 0.20 or earlier wrote gains it too, every row it holds left without it */
 	if (!has("hash_v")) await conn.execute("ALTER TABLE __drizzle_migrations ADD COLUMN hash_v INTEGER")
 	/* a history from before 0.13 holds each hash once: rebuilt, in one batch, with every row and id kept */
-	if (!(await hashUnique(conn))) return
+	if (!(await hashUnique(conn))) return keepNameUnique(conn)
 	/* a history made without AUTOINCREMENT has no counter; its largest id is where the new one starts */
 	const sequenced = await conn.execute("SELECT 1 FROM sqlite_master WHERE name = 'sqlite_sequence'")
 	const counted =
@@ -151,7 +173,8 @@ class Unconfirmed extends Error {}
  * record it wrote says it ran, so a retry reads the history first and runs nothing again.
  * When no read of `history` answers after a batch that failed transiently, the failure is an Unconfirmed.
  * The record goes first, so a batch whose file another run recorded while it waited for the lock
- * fails on the name at once and runs nothing; the history then says so, and it is that run's.
+ * fails on the name's unique index at once and runs nothing (ensureMigrationsTable keeps one on every
+ * history, whoever made the table); the history then says so, and it is that run's.
  * Returns who applied it.
  */
 export async function applyRecorded(
@@ -207,24 +230,42 @@ export async function applyEach(
 	{ history, print, retry }: ApplyOptions & { print: (line: string) => void },
 ): Promise<void> {
 	const names = migrations.map(({ filename }) => filename)
-	for (const [at, migration] of migrations.entries()) {
-		print(`Apply: ${migration.filename}`)
-		try {
-			const conn = await open()
+	/* the files that committed, and the batch under way, which a stop waits for: it commits or fails whole */
+	let done = 0
+	let batching: Promise<unknown> = Promise.resolve()
+	const read = async () => {
+		await batching.catch(() => {
+			// reason: a batch that failed committed nothing, which the count it left already says
+		})
+		return { applied: names.slice(0, done), pending: names.slice(done) }
+	}
+	await whileStoppable({ names, print, read }, async () => {
+		for (const [at, migration] of migrations.entries()) {
+			/* a stop parks the run here, whichever connection the next file would open */
+			await pastStop()
+			print(`Apply: ${migration.filename}`)
 			try {
-				if ((await applyRecorded(conn, migration, { history, retry })) === "another run")
-					print(`Skip (applied by another run): ${migration.filename}`)
-			} finally {
-				await conn.close()
+				const conn = await open()
+				try {
+					/* counted with the batch, so a stop that waited for it reads the count it made */
+					const batch = applyRecorded(conn, migration, { history, retry }).then((who) => {
+						done++
+						return who
+					})
+					batching = batch
+					if ((await batch) === "another run") print(`Skip (applied by another run): ${migration.filename}`)
+				} finally {
+					await conn.close()
+				}
+			} catch (error) {
+				const applied = names.slice(0, at)
+				if (applied.length > 0) print(`Applied before the failure: ${applied.join(", ")}`)
+				/* withRetry throws an Error, whatever the batch threw; so does a connection that would not open */
+				const message = (error as Error).message
+				if (error instanceof Unconfirmed)
+					throw new Refused(message, { applied, pending: names.slice(at + 1), unknown: [migration.filename] })
+				throw new Refused(message, { applied, pending: names.slice(at) })
 			}
-		} catch (error) {
-			const done = names.slice(0, at)
-			if (done.length > 0) print(`Applied before the failure: ${done.join(", ")}`)
-			/* withRetry throws an Error, whatever the batch threw; so does a connection that would not open */
-			const message = (error as Error).message
-			if (error instanceof Unconfirmed)
-				throw new Refused(message, { applied: done, pending: names.slice(at + 1), unknown: [migration.filename] })
-			throw new Refused(message, { applied: done, pending: names.slice(at) })
 		}
-	}
+	})
 }

package/src/migrate/core/atlas-apply-runs.ts

@@ -4,11 +4,11 @@
  * reading of a file proves what it leaves on its session: a trigger, a default, a DO block's EXECUTE
  * or code the target holds can each run a SET that outlives its COMMIT.
  */
-import { hold } from "./cleanup.ts"
 import { type Foreign, ownHistory } from "./atlas-foreign.ts"
 import { type AtlasFile, type AtlasStatus, checkHistory } from "./atlas-history.ts"
 import { APPLY_FORMAT, NON_LINEAR, reported } from "./atlas-report.ts"
 import { atlas, type AtlasCommand, atlasStatus } from "./atlas-status.ts"
+import { whileStoppable } from "./stopped.ts"
 
 /**
  * After an Atlas call that ran no file and said nothing, once this apply ran `applied`: done once
@@ -29,27 +29,17 @@ async function ranNothing(
 }
 
 /**
- * What SIGINT or SIGTERM runs once it stopped this apply's Atlas call and that call ended (cleanup.ts
- * runs a child's step before this one): the history read once more, and which approved
- * files it records and which it does not, printed; no further call starts, and the process then ends
- * by the signal
+ * The approved files the history records and those it does not, read once Atlas's call ended after a
+ * stop signal (cleanup.ts runs a child's step before this apply's): what stopped.ts reports
  */
-const stoppedBy =
+const found =
 	(options: AtlasCommand, copy: string, { approved, foreign }: { approved: ReadonlySet<string>; foreign: Foreign }) =>
-	async (signal: NodeJS.Signals): Promise<void> => {
-		try {
-			const { pending } = ownHistory(await atlasStatus(options, copy), foreign, copy)
-			const left = new Set(pending.map((file) => file.Name))
-			const [ran, not] = [
-				[...approved].filter((name) => !left.has(name)),
-				[...approved].filter((name) => left.has(name)),
-			]
-			options.print(
-				`Stopped by ${signal}: applied ${ran.join(", ") || "none"}; not applied ${not.join(", ") || "none"}`,
-			)
-		} catch (error) {
-			// reason: a history read that fails must not hide the stop: the line says what comb could not read, and the process still ends by the signal
-			options.print(`Stopped by ${signal}: comb could not read what was applied: ${(error as Error).message}`)
+	async (): Promise<{ applied: string[]; pending: string[] }> => {
+		const { pending } = ownHistory(await atlasStatus(options, copy), foreign, copy)
+		const left = new Set(pending.map((file) => file.Name))
+		return {
+			applied: [...approved].filter((name) => !left.has(name)),
+			pending: [...approved].filter((name) => left.has(name)),
 		}
 	}
 
@@ -67,12 +57,11 @@ async function applyRuns(
 	{ foreign, report, status }: { foreign: Foreign; report: Parameters<typeof checkHistory>[2]; status: AtlasStatus },
 ): Promise<string[]> {
 	const approved = new Set(status.pending.map((file) => file.Name))
-	const release = hold(stoppedBy(options, copy, { approved, foreign }))
-	try {
-		return await callEach(options, copy, { approved, foreign, report })
-	} finally {
-		release()
-	}
+	/* no further call starts, and the process then ends by the signal, after the report: a stop parks this loop */
+	return whileStoppable(
+		{ names: [...approved], print: options.print, read: found(options, copy, { approved, foreign }) },
+		() => callEach(options, copy, { approved, foreign, report }),
+	)
 }
 
 /** applyRuns' calls, each of the first file still pending, until every approved file ran */

package/src/migrate/core/cleanup.ts

@@ -1,6 +1,6 @@
 /**
  * comb's one cleanup rule: what a run makes outside itself (a scratch
- * directory, a replay database) is held here until the run lets it go, and SIGINT or SIGTERM runs
+ * directory, a replay database) is held here until the run lets it go, and a stop signal runs
  * every step still held before the process ends as the signal would. A scratch directory is named
  * for the process that made it, so a later run removes one a killed process left at once, by
  * whether that process still runs.
@@ -11,14 +11,25 @@ import fs from "node:fs"
 import os from "node:os"
 import path from "node:path"
 
-/** A step a signal runs, told which signal came */
-type Step = (signal: NodeJS.Signals) => unknown
+/**
+ * A step a signal runs, told which signal came and what the steps that ran before it returned, in
+ * that order: a step held first runs last, and reads what the steps held after it found out
+ */
+type Step = (signal: NodeJS.Signals, earlier: readonly unknown[]) => unknown
 
 // per-process-constant: what this process holds now
 const held = /* @__PURE__ */ new Set<Step>()
 
-/* the signals a held step runs on: a Ctrl-C, and what a supervisor, a container stop or a CI step timeout sends */
-const SIGNALS = ["SIGINT", "SIGTERM"] as const
+/**
+ * The signals a held step runs on: every one whose default action ends the process and that a
+ * terminal or a supervisor sends. A Ctrl-C (SIGINT), a Ctrl-\ (SIGQUIT), a container stop or a CI
+ * step timeout (SIGTERM), and a terminal's hangup, as an SSH drop sends it (SIGHUP): a child in a
+ * group of its own gets none of them from the terminal, so comb's forward is its only signal.
+ */
+export const STOP_SIGNALS = ["SIGHUP", "SIGINT", "SIGQUIT", "SIGTERM"] as const
+
+/** One of STOP_SIGNALS */
+export type StopSignal = (typeof STOP_SIGNALS)[number]
 
 // per-process-constant: the steps a signal is running, so a step's own work goes on while what it stops waits
 const inStep = /* @__PURE__ */ new AsyncLocalStorage<true>()
@@ -45,9 +56,10 @@ function newGate(): Gate {
 
 /** Every step, last held first, each once the one before ends: a child stops before the scratch it used goes */
 async function runSteps(steps: readonly Step[], signal: NodeJS.Signals): Promise<void> {
+	const returned: unknown[] = []
 	for (const step of steps.toReversed()) {
 		try {
-			await step(signal)
+			returned.push(await step(signal, [...returned]))
 		} catch {
 			// reason: one step that fails must not keep the rest from cleaning up; the process ends either way
 		}
@@ -77,7 +89,7 @@ function stop(signal: NodeJS.Signals): void {
 		gate = undefined
 		if (process.listenerCount(signal) > 1) return current.let()
 		/* both gone before the signal comes again, so it ends the process, and what waits for this stop waits on */
-		for (const each of SIGNALS) process.off(each, stop)
+		for (const each of STOP_SIGNALS) process.off(each, stop)
 		process.kill(process.pid, signal)
 	})
 }
@@ -101,11 +113,11 @@ export function pastStop(): Promise<void> {
 }
 
 /**
- * Hold `step` until the release this returns, so SIGINT and SIGTERM run it before the process ends.
+ * Hold `step` until the release this returns, so a stop signal runs it before the process ends.
  * The listener is read from the process, not remembered: a host that removed every listener gets it back.
  */
 export function hold(step: Step): () => void {
-	for (const signal of SIGNALS) if (!process.listeners(signal).includes(stop)) process.on(signal, stop)
+	for (const signal of STOP_SIGNALS) if (!process.listeners(signal).includes(stop)) process.on(signal, stop)
 	held.add(step)
 	return () => void held.delete(step)
 }
@@ -199,7 +211,7 @@ export type Scratch = { dir: string; remove(): void }
 
 /**
  * A new directory under the temp directory that only this user can open (0700), named `prefix`, this
- * process's pid and host mark, and removed by `remove`, or by SIGINT or SIGTERM before it. A
+ * process's pid and host mark, and removed by `remove`, or by a stop signal before it. A
  * process's first scratch of a prefix sweeps what killed runs left.
  */
 export function scratchDir(prefix: string): Scratch {

package/src/migrate/core/d1-engine-child.mjs

@@ -9,10 +9,12 @@
  * Then each file as wrangler sends it, the file and the history row it appends, through wrangler's
  * `splitSqlQuery`, in one batch. D1 resolves a function in a trigger body, a view or a generated
  * column only when a statement uses it, so EXPLAIN then compiles each view, and each table's INSERT,
- * UPDATE and DELETE, the file made or changed. What D1 refuses comes back in D1's own words.
+ * UPDATE and DELETE, the file made or changed; a view takes only the writes its INSTEAD OF triggers fire
+ * on (trigger-write.mjs). What D1 refuses comes back in D1's own words.
  */
 import { readFileSync } from "node:fs"
 import { pathToFileURL } from "node:url"
+import { EVENTS, quote, triggerEvent, writeOf } from "./trigger-write.mjs"
 
 /**
  * @typedef {{ all(): Promise<{ results?: Array<Record<string, unknown>> | undefined }> }} D1Statement
@@ -27,9 +29,6 @@ import { pathToFileURL } from "node:url"
  * @typedef {import("./d1-engine-child.d.mts").ProofResult} ProofResult
  */
 
-/** @param {string} name */
-const quote = (name) => `"${name.replaceAll('"', '""')}"`
-
 /**
  * D1's own words for a failure: the cause wrangler's client wraps, when there is one
  * @param {unknown} error
@@ -87,7 +86,8 @@ async function isRowTable(db, table) {
  * @returns {Promise<string[]>}
  */
 async function probes(db, before) {
-	const changed = [...(await master(db))].filter(([key, object]) => before.get(key)?.sql !== object.sql)
+	const after = [...(await master(db))]
+	const changed = after.filter(([key, object]) => before.get(key)?.sql !== object.sql)
 	const views = changed.filter(([, object]) => object.type === "view").map(([, object]) => object.table)
 	const tables = new Set(changed.filter(([, object]) => object.type === "trigger").map(([, object]) => object.table))
 	for (const [, object] of changed)
@@ -96,16 +96,32 @@ async function probes(db, before) {
 	const writes = []
 	for (const table of tables) {
 		const { results = [] } = await db.prepare(`PRAGMA table_xinfo(${quote(table)})`).all()
-		const columns = results.filter((row) => row["hidden"] === 0).map((row) => quote(String(row["name"])))
-		writes.push(
-			`EXPLAIN INSERT INTO ${quote(table)} DEFAULT VALUES`,
-			`EXPLAIN UPDATE ${quote(table)} SET ${columns.map((column) => `${column} = ${column}`).join(", ")}`,
-			`EXPLAIN DELETE FROM ${quote(table)}`,
-		)
+		const columns = results.filter((row) => row["hidden"] === 0).map((row) => String(row["name"]))
+		for (const event of eventsOf(after, table)) writes.push(`EXPLAIN ${writeOf(table, event, columns)}`)
 	}
 	return [...views.map((view) => `EXPLAIN SELECT * FROM ${quote(view)}`), ...writes]
 }
 
+/**
+ * `name` as SQLite compares names, ASCII letters folded alone: a trigger's tbl_name is spelled as its ON clause was
+ * @param {string} name
+ */
+const fold = (name) => name.replace(/[A-Z]/g, (letter) => letter.toLowerCase())
+
+/**
+ * The writes `table` takes in the schema `objects`: a table every one, a view each its triggers fire on
+ * @param {ReadonlyArray<[string, SchemaObject]>} objects
+ * @param {string} table
+ */
+function eventsOf(objects, table) {
+	const on = objects.filter(([, object]) => fold(object.table) === fold(table))
+	if (!on.some(([, object]) => object.type === "view")) return EVENTS
+	const fired = new Set(
+		on.filter(([, object]) => object.type === "trigger").map(([, object]) => triggerEvent(object.sql)),
+	)
+	return EVENTS.filter((event) => fired.has(event))
+}
+
 /**
  * The scratch D1 a proof runs on: what it holds is replayed on a fresh one when workerd crashes,
  * which a disconnect shows ("other side closed"), not a D1 error

package/src/migrate/core/d1-history.ts

@@ -15,7 +15,7 @@ import { executeAll } from "../drivers/d1.ts"
 import { lockedOut } from "../drivers/d1-lock.ts"
 import { assertLocalExists, type D1Target, localMissing, type ReadConfig, resolveBinding } from "./d1-binding.ts"
 import { d1Files, refuseSwallowing } from "./d1-files.ts"
-import { applyFailure, wranglerError } from "./d1-wrangler-error.ts"
+import { refuseUnlike } from "./d1-wrangler-error.ts"
 import { D1_HASH_INTENT_TABLE, D1_HASH_TABLE, DRIZZLE_HISTORY_TABLE } from "./d1-history-tables.ts"
 import {
 	type Hashed,
@@ -37,8 +37,9 @@ import { orphanMessage } from "./history-match.ts"
 import { generateMigrationHash, migrationHashes } from "./parse.ts"
 import { proveOnD1 } from "./d1-engine.ts"
 import { planApply } from "./plan-apply.ts"
-import { runPeer } from "./process.ts"
+import { type RunResult, runPeer } from "./process.ts"
 import { Refused } from "./refused.ts"
+import { whileStoppable } from "./stopped.ts"
 
 /** The files `__drizzle_migrations` records that the migrations table does not */
 function recordedByDrizzle(
@@ -129,27 +130,6 @@ async function appliedAfter(
 	}
 }
 
-/** Refuse a failed run, or one whose table gained (`added`) other than the `names` checked, naming a file never checked */
-function refuseUnlike(
-	ran: { code: number; stderr: string; stdout: string },
-	{ added, locked, names, table }: { added: string[]; locked: boolean; names: string[]; table: string },
-): void {
-	const unchecked = added.filter((name) => !names.includes(name))
-	const rest = names.filter((name) => !added.includes(name))
-	const also =
-		unchecked.length === 0
-			? ""
-			: `; wrangler also applied ${unchecked.join(", ")}, which comb never checked and holds no hash for: check each against git, then run comb migrate baseline <db> --hashes`
-	const now = { applied: added, pending: rest }
-	if (ran.code !== 0) throw new Refused(`wrangler d1 migrations apply failed: ${applyFailure(ran, locked)}${also}`, now)
-	if (unchecked.length > 0 || rest.length > 0) {
-		throw new Refused(
-			`wrangler recorded ${added.join(", ") || "nothing"} in ${table}, where comb checked ${names.join(", ")}; wrangler said: ${wranglerError(ran)}${also}`,
-			now,
-		)
-	}
-}
-
 type D1Apply = {
 	approve(migration: ParsedMigration): Promise<Approval>
 	/** only check: apply nothing */
@@ -158,6 +138,25 @@ type D1Apply = {
 	read: ReadConfig
 }
 
+/**
+ * wrangler's apply of `names`, each announced first. A stop signal ends its run, and the table then
+ * says which of them it recorded (stopped.ts)
+ */
+async function wranglerApply(
+	target: D1Target,
+	{ print, read }: D1Apply,
+	{ names, table }: { names: string[]; table: string },
+): Promise<RunResult> {
+	for (const name of names) print(`Apply: ${name}`)
+	const found = async () => {
+		const recorded = await appliedAfter(target, read, { names, ok: false, table })
+		return { applied: names.filter((name) => recorded.has(name)), pending: names.filter((name) => !recorded.has(name)) }
+	}
+	return whileStoppable({ names, print, read: found }, () =>
+		runPeer(target.exec, target.wrangler)(["d1", "migrations", "apply", target.name, ...target.flags], { input: "" }),
+	)
+}
+
 /** Check the pending migrations and, unless only checking, apply them through wrangler; returns them */
 async function applyD1(target: D1Target, options: D1Apply): Promise<string[]> {
 	const { applied, hasIntents, marks, settle, table } = await history(options.read, target, {
@@ -193,9 +192,7 @@ async function applyD1(target: D1Target, options: D1Apply): Promise<string[]> {
 	/* the intents go first: a lost record then fails before wrangler applies anything */
 	const hashed = pending.map(({ migration, name }) => ({ hash: migration.hash, marked: true, name }))
 	await target.conn.batch([...settleStatements(settle, hasIntents, marks), ...intentStatements(hashed)])
-	for (const name of names) options.print(`Apply: ${name}`)
-	const apply = ["d1", "migrations", "apply", target.name, ...target.flags]
-	const ran = await runPeer(target.exec, target.wrangler)(apply, { input: "" })
+	const ran = await wranglerApply(target, options, { names, table })
 	/* asked before anything else runs, while the lock that failed the apply is most likely still held */
 	const locked = ran.code !== 0 && target.flags.includes("--local") && (await lockedOut(ran, target.held))
 	const after = await appliedAfter(target, options.read, { names, ok: ran.code === 0, table })

package/src/migrate/core/d1-wrangler-error.ts

@@ -1,7 +1,9 @@
 /**
- * What a failed `wrangler d1 migrations apply` says, read for the refusal comb gives.
+ * What a failed `wrangler d1 migrations apply` says, read for the refusal comb gives, and the refusal
+ * of a run whose table records other than the files comb checked.
  */
 import { LOCKER } from "../drivers/d1-lock.ts"
+import { Refused } from "./refused.ts"
 
 type Ran = { stderr: string; stdout: string }
 
@@ -23,3 +25,24 @@ export function applyFailure(ran: Ran, locked: boolean): string {
 		? `the local D1 database was locked by ${LOCKER} while wrangler applied: let it finish and rerun`
 		: wranglerError(ran)
 }
+
+/** Refuse a failed run, or one whose table gained (`added`) other than the `names` checked, naming a file never checked */
+export function refuseUnlike(
+	ran: { code: number; stderr: string; stdout: string },
+	{ added, locked, names, table }: { added: string[]; locked: boolean; names: string[]; table: string },
+): void {
+	const unchecked = added.filter((name) => !names.includes(name))
+	const rest = names.filter((name) => !added.includes(name))
+	const also =
+		unchecked.length === 0
+			? ""
+			: `; wrangler also applied ${unchecked.join(", ")}, which comb never checked and holds no hash for: check each against git, then run comb migrate baseline <db> --hashes`
+	const now = { applied: added, pending: rest }
+	if (ran.code !== 0) throw new Refused(`wrangler d1 migrations apply failed: ${applyFailure(ran, locked)}${also}`, now)
+	if (unchecked.length > 0 || rest.length > 0) {
+		throw new Refused(
+			`wrangler recorded ${added.join(", ") || "nothing"} in ${table}, where comb checked ${names.join(", ")}; wrangler said: ${wranglerError(ran)}${also}`,
+			now,
+		)
+	}
+}

package/src/migrate/core/pg-replay-commit.ts

@@ -2,12 +2,14 @@
  * The replay's transactions and the reads around them (pg-replay.ts): a file's or comb's own
  * statement's transaction, refused before its COMMIT when this backend's counts show it wrote past
  * its database, and the server's shared catalogs read as committed around it and around
- * every bare statement, a change there the file's when it is to an object the file names;
+ * every bare statement, a change there the file's when it is to the replay's own database, or to an
+ * object the file names beside a statement that can run code comb cannot read;
  * a `txmode none` file's statement in a transaction of its own first, bare only when
  * Postgres runs it outside a block alone.
  */
 import { adopt, bareAgain, type Run } from "./pg-replay-roles.ts"
-import { added, type Snapshot, snapshot, snapshotChanges, subscriptionsIn } from "./pg-server-snapshot.ts"
+import { type Hidden, runsHidden } from "./pg-replay-hidden.ts"
+import { type Snapshot, snapshot, snapshotChanges, subscriptionsIn } from "./pg-server-snapshot.ts"
 import {
 	type Change,
 	catalogsOf,
@@ -31,12 +33,13 @@ async function begin(run: Run): Promise<void> {
 }
 
 /**
- * Where a replayed transaction or bare statement is: its file's name and the names it spells, the
- * statement, if bare, and what a refusal stops; told each role the transaction adds that the replay
- * adopts
+ * Where a replayed transaction or bare statement is: its file's name and the names it spells, what
+ * its statements so far can run that comb cannot read (`hidden`), the statement, if bare, and what a
+ * refusal stops; told each role the transaction adds that the replay adopts
  */
 type At = {
 	adopted?: ((role: string) => void) | undefined
+	hidden: Hidden
 	name: string
 	names: ReadonlySet<string>
 	sent: string | undefined
@@ -46,52 +49,52 @@ type At = {
 /* the words that name devUrl's role in a file, as namesIn folds them: CURRENT_USER and its kin */
 const SESSION_ROLE = ["current_role", "current_user", "session_user", "user"]
 
+/** The objects the file `names`, devUrl's role among them where it names that by keyword */
+function spelled(run: Run, names: ReadonlySet<string>): Set<string> {
+	const its = new Set(names)
+	if (SESSION_ROLE.some((word) => names.has(word))) its.add(run.role)
+	return its
+}
+
 /**
- * The server's shared catalogs read as committed against the last read: a change since to an object
- * the file `name` names (`names`), while `sent` or the whole file ran, is refused, and a role or
- * database it added is the cleanup's; a change to any other is another session's. The
- * replay's own database is the file's whatever it spells, as only this replay runs in it, and is
- * the cleanup's too. `read` is that read when the caller took it
+ * The server's shared catalogs read as committed against the last read: a change since to the
+ * replay's own database, or to what it holds, is the file's, as only this replay runs in it, and the
+ * cleanup drops it. A change to an object the file names is the file's when its statements so far
+ * can run code comb cannot read (pg-replay-hidden.ts), the one way a change past the database gets by
+ * the counts, and is refused, but no cleanup drops it: Postgres keeps no creator for a role or a
+ * database, and another session may have made it. A change to any other object, or beside statements
+ * that run only what their parse says, is another session's. `read` is that read when the caller took it
  */
 async function window(run: Run, at: At, read?: Snapshot): Promise<void> {
-	strayed(run, at, read ?? (await snapshot(run.admin)))
+	const now = read ?? (await snapshot(run.admin))
+	strayed(run, { ...at, hid: await hides(run, at, now) }, now)
 }
 
+/* whether a change in `now` to an object the file names may be the file's, as its statements can run code comb cannot read */
+const hides = (run: Run, { hidden, names }: At, now: Snapshot): boolean | Promise<boolean> =>
+	snapshotChanges(run.seen, now, spelled(run, names)).length > 0 && runsHidden(run.sql, hidden)
+
 /**
  * window's verdict on `now`, the server's shared catalogs as committed after the file or `sent`,
- * against the last read; kept apart from window's await, as v8 miscounts a branch after an await
+ * against the last read, the objects the file names counted when it `hid` code comb cannot read;
+ * kept apart from window's await, as v8 miscounts a branch after an await
  */
-function strayed(run: Run, { name, names, sent, stops }: At, now: Snapshot): void {
-	const its = new Set([...names, run.database])
-	if (SESSION_ROLE.some((word) => names.has(word))) its.add(run.role)
-	const changes = snapshotChanges(run.seen, now, its)
-	const { databases, roles, slots } = added(run.seen, now, its)
+function strayed(run: Run, { hid, name, names, sent, stops }: At & { hid: boolean }, now: Snapshot): void {
+	const replays = new Set([run.database])
+	const changes = snapshotChanges(run.seen, now, hid ? new Set([...spelled(run, names), ...replays]) : replays)
+	const own = new Set(snapshotChanges(run.seen, now, replays))
 	const within = subscriptionsIn(run.seen, now, run.database)
 	run.seen = now
 	if (changes.length === 0) return
-	run.strays.databases.push(...databases)
-	run.strays.roles.push(...roles)
-	run.strays.slots.push(...slots)
-	const own = `database ${run.database} `
-	const strays = [
-		...roles.map((role) => `role ${role}`),
-		...databases.map((database) => `database ${database} unless a session is in it`),
-		...slots.map((slot) => `replication slot ${slot} unless a session holds it`),
-	]
-	const replays =
-		changes.some((change) => change.startsWith(own)) || within.length > 0
+	const dropped =
+		own.size > 0
 			? `; comb drops the database it replays in${within.length === 0 ? "" : `, and ${within.join(", ")} in it`}`
 			: ""
-	const dropped = `${strays.length === 0 ? "" : `; comb drops ${strays.join(", ")}, which the file added`}${replays}`
-	/* the read is committed, so a change it shows to an object the file did not add stays */
-	const dropping = new Set([
-		...roles.map((role) => `role ${role} added`),
-		...databases.map((d) => `database ${d} added`),
-		...slots.map((slot) => `replication slot ${slot} added`),
-		...within.map((subject) => `${subject} added`),
-	])
-	const kept = changes.filter((change) => !dropping.has(change) && !change.startsWith(own))
-	const left = kept.length === 0 ? "" : `; devUrl's server keeps ${kept.join(", ")}, which comb cannot undo`
+	const kept = changes.filter((change) => !own.has(change))
+	const left =
+		kept.length === 0
+			? ""
+			: `; comb leaves ${kept.join(", ")} on devUrl's server, as another session may have made ${kept.length === 1 ? "that change" : "those changes"}: undo there each that is the file's`
 	throw new ReplayFailed(
 		`${name}: devUrl's server changed past the database the replay runs in while ${sent === undefined ? "the file" : JSON.stringify(sent)} ran: ${changes.join(", ")}. A change made there, from inside a DO block, a function, EXECUTE or CALL, or over a second connection such as dblink's, apply would make on the target's server, so comb refuses the file; write the change as a statement of its own, which the replay leaves out and apply runs${dropped}${left}; ${stops}`,
 	)