@workerstack/database 0.22.0 → 0.22.1

package/src/migrate/core/pg-replay-drops.ts

@@ -4,8 +4,8 @@
  * which the next replay or apply sweeps. Postgres drops no database that holds a subscription or a
  * logical slot, so both go first, and only from the replay databases it drops: a subscription from
  * a session in its database, the only one that can name it. A drop that fails never decides the
- * verdict, and is said, never left unsaid: what it left, dev's error, and whether a later sweep takes it, as a
- * stray of a refused window carries no tag a sweep finds. The replay database is dropped WITH
+ * verdict, and is said, never left unsaid: what it left and dev's error, which a later sweep takes. The
+ * replay database is dropped WITH
  * (FORCE), so a backend that came in after the cleanup ended the others cannot hold it.
  */
 import { sqlIdentifier } from "../../codegen/utils/case.ts"
@@ -24,14 +24,11 @@ async function settle(step: () => Promise<unknown>): Promise<void> {
 	}
 }
 
-/** What a drop that failed left on devUrl's server, a database, role or slot by name, and whether a later sweep takes it */
-type Left = { swept: boolean; what: string }
-
-/** How a drop that failed is said: what it `left`, with dev's error */
-type Leave = (left: Left, error: unknown) => void
+/** How a drop that failed is said: what it left on devUrl's server, a database, role or slot by name, with dev's error */
+type Leave = (left: string, error: unknown) => void
 
 /** `drop` run, a failure `leave`d: cleaning up never replaces the replay's verdict, and never leaves something unsaid */
-async function dropOr(leave: Leave, left: Left, drop: () => Promise<unknown>): Promise<void> {
+async function dropOr(leave: Leave, left: string, drop: () => Promise<unknown>): Promise<void> {
 	try {
 		await drop()
 	} catch (error) {
@@ -45,9 +42,9 @@ type Drops = { into: (database: string) => Sql; leave: Leave }
 
 /** A `leave` that prints, `failed` naming devUrl in dev's error */
 function leaving(print: (line: string) => void, failed: Parameters<typeof failureOf>[1]): Leave {
-	return ({ swept, what }, error) =>
+	return (left, error) =>
 		print(
-			`comb could not drop ${what}, which a replay left on devUrl's server: ${failureOf(error, failed)}; ${swept ? "the next check or apply that reaches that server drops it" : "drop it there"}`,
+			`comb could not drop ${left}, which a replay left on devUrl's server: ${failureOf(error, failed)}; the next check or apply that reaches that server drops it`,
 		)
 }
 
@@ -80,14 +77,13 @@ async function emptyDatabase(admin: Sql, database: string, { into, leave }: Drop
 	if (subscriptions.length > 0) {
 		const sql = into(database)
 		try {
-			for (const name of subscriptions)
-				await dropOr(leave, { swept: true, what: `subscription ${name}` }, () => dropSubscription(sql, name))
+			for (const name of subscriptions) await dropOr(leave, `subscription ${name}`, () => dropSubscription(sql, name))
 		} finally {
 			await settle(() => sql.end({ timeout: 0 }))
 		}
 	}
 	for (const slot of (holds?.["slots"] ?? []) as string[])
-		await dropOr(leave, { swept: true, what: `replication slot ${slot}` }, () => dropSlot(admin, slot))
+		await dropOr(leave, `replication slot ${slot}`, () => dropSlot(admin, slot))
 }
 
 /**
@@ -132,11 +128,9 @@ async function sweep(admin: Sql, now: number, drops: Drops): Promise<void> {
 		await settle(() => emptyDatabase(admin, name, drops))
 		/* Postgres drops no template, which a committing DO can make the replay's database */
 		if (template) await settle(() => admin.unsafe(`ALTER DATABASE ${sqlIdentifier(name)} IS_TEMPLATE false`, []))
-		await dropOr(leave, { swept: true, what: `database ${name}` }, () =>
-			admin.unsafe(`DROP DATABASE IF EXISTS ${sqlIdentifier(name)}`, []),
-		)
+		await dropOr(leave, `database ${name}`, () => admin.unsafe(`DROP DATABASE IF EXISTS ${sqlIdentifier(name)}`, []))
 	}
-	for (const role of roles) await dropOr(leave, { swept: true, what: `role ${role}` }, () => dropRole(admin, role))
+	for (const role of roles) await dropOr(leave, `role ${role}`, () => dropRole(admin, role))
 }
 
 /* why comb loads postgres.js in an apply */
@@ -196,10 +190,10 @@ async function sweepDev(
 
 /**
  * `run`'s cleanup, each drop that fails `leave`d: its connection closed, a query in flight with it,
- * any backend still in its database ended, the slots a refused window added, which a drop waits on,
- * the database's subscriptions and slots, which keep it from its drop, the database made no
- * template and dropped, forcing out a backend that came in since, each role it made, and that
- * window's roles and idle databases, which no sweep takes
+ * any backend still in its database ended, the database's subscriptions and slots, which keep it
+ * from its drop, the database made no template and dropped, forcing out a backend that came in
+ * since, and each role it made or adopted. It drops nothing else a refused window saw, as Postgres
+ * keeps no creator for a role, a database or a slot, and another session may have made it
  */
 async function cleanUp(run: Run, drops: Drops): Promise<void> {
 	const { leave } = drops
@@ -210,21 +204,12 @@ async function cleanUp(run: Run, drops: Drops): Promise<void> {
 			[run.database],
 		),
 	)
-	for (const slot of run.strays.slots)
-		await dropOr(leave, { swept: false, what: `replication slot ${slot}` }, () => dropSlot(run.admin, slot))
 	await settle(() => emptyDatabase(run.admin, run.database, drops))
 	await settle(() => run.admin.unsafe(`ALTER DATABASE ${run.database} IS_TEMPLATE false`, []))
-	await dropOr(leave, { swept: true, what: `database ${run.database}` }, () =>
+	await dropOr(leave, `database ${run.database}`, () =>
 		run.admin.unsafe(`DROP DATABASE IF EXISTS ${run.database} WITH (FORCE)`, []),
 	)
-	for (const role of run.created)
-		await dropOr(leave, { swept: true, what: `role ${role}` }, () => dropMade(run.admin, role))
-	for (const name of run.strays.databases)
-		await dropOr(leave, { swept: false, what: `database ${name}` }, () =>
-			run.admin.unsafe(`DROP DATABASE IF EXISTS ${sqlIdentifier(name)}`, []),
-		)
-	for (const role of run.strays.roles)
-		await dropOr(leave, { swept: false, what: `role ${role}` }, () => dropRole(run.admin, role))
+	for (const role of run.created) await dropOr(leave, `role ${role}`, () => dropMade(run.admin, role))
 }
 
 export { cleanUp, type Drops, dropMade, dropOr, dropRole, dropSlot, type Leave, leaving, settle, sweep, sweepDev }

package/src/migrate/core/pg-replay-hidden.ts

@@ -0,0 +1,75 @@
+/**
+ * Whether the statements a replay's window covers can run code comb cannot read, the only way one
+ * makes a change past its database that this backend's counts miss (pg-replay-commit.ts): a DO
+ * block, a CALL, an EXECUTE, or a call of a function outside pg_catalog, dblink's among them. A
+ * statement whose tree holds none of those runs only what its parse says, and BEYOND and SERVER_CALLS
+ * (pg-outside-transaction.ts, pg-server-calls.ts) leave out every such statement that reaches past
+ * the database, so a change the server's read shows beside it is another session's. A function
+ * called by a bare name is pg_catalog's only where the replay's database holds no other of that name,
+ * as an overload in a schema on the search path can take the call, and the file makes none of it.
+ * Code Postgres runs for a statement on its own, a trigger, a default, an operator or a cast that
+ * calls a function an earlier file defines, is no call in the tree, so it is not read here; what it
+ * writes in the replay's transaction its counts still see.
+ */
+import type { Sql } from "./pg-replay-database.ts"
+
+/**
+ * What the statements so far can run that comb cannot read: `code` when one surely can, the
+ * functions they call by a bare name (`calls`), which may be pg_catalog's, and those the file makes
+ * (`made`). A file's every later window counts what one ran, as a change a DO block makes in the
+ * file's own block commits at its COMMIT
+ */
+type Hidden = { calls: Set<string>; code: boolean; made: Set<string> }
+
+/** Nothing run yet */
+const nothingHidden = (): Hidden => ({ calls: new Set(), code: false, made: new Set() })
+
+// lookup-table: the statements that run code the parse does not hold: a DO block's body, a procedure, a prepared statement
+const RUNS_CODE: ReadonlySet<string> = /* @__PURE__ */ new Set(["CallStmt", "DoStmt", "ExecuteStmt"])
+
+/** The name parts of a FuncCall's or a CREATE FUNCTION's `funcname`, each a String node, the name last */
+const partsOf = (funcname: unknown): string[] =>
+	(funcname as Array<{ String: { sval: string } }>).map((part) => part.String.sval)
+
+/** `tree`, a parse tree or a part of one, read `into` */
+function readTree(tree: unknown, into: Hidden): void {
+	if (tree === null || typeof tree !== "object") return
+	for (const [key, value] of Object.entries(tree)) {
+		if (RUNS_CODE.has(key)) into.code = true
+		else if (key === "FuncCall" || key === "CreateFunctionStmt") {
+			const parts = partsOf((value as { funcname: unknown }).funcname)
+			/* a funcname holds its name at least */
+			const name = parts.at(-1) as string
+			if (key === "CreateFunctionStmt") into.made.add(name)
+			else if (parts.length === 1) into.calls.add(name)
+			else if (parts.length > 2 || parts[0] !== "pg_catalog") into.code = true
+		}
+		readTree(value, into)
+	}
+}
+
+/** A statement the replay runs, read `into`: one the parser cannot read may run anything */
+function readStatement(tree: unknown, into: Hidden): void {
+	if (tree === undefined) into.code = true
+	else readTree(tree, into)
+}
+
+/* of the functions a JSON array names, whether one is no pg_catalog function, or also one outside it */
+const NOT_CATALOG = `SELECT EXISTS (
+  SELECT FROM jsonb_array_elements_text($1::text::jsonb) f(name)
+  WHERE NOT EXISTS (SELECT FROM pg_proc p WHERE p.proname = f.name AND p.pronamespace = 'pg_catalog'::regnamespace)
+    OR EXISTS (SELECT FROM pg_proc p WHERE p.proname = f.name AND p.pronamespace <> 'pg_catalog'::regnamespace)
+) AS hidden`
+
+/**
+ * Whether what `hidden` holds can run code comb cannot read, a bare name resolved on `sql`, the
+ * replay's connection, which sees what its open transaction made
+ */
+async function runsHidden(sql: Sql, { calls, code, made }: Hidden): Promise<boolean> {
+	if (code || [...calls].some((name) => made.has(name))) return true
+	if (calls.size === 0) return false
+	const rows = await sql.unsafe(NOT_CATALOG, [JSON.stringify([...calls])])
+	return rows.some((row) => row["hidden"] === true)
+}
+
+export { type Hidden, nothingHidden, readStatement, runsHidden }

package/src/migrate/core/pg-replay-roles.ts

@@ -18,7 +18,7 @@
 import { sqlIdentifier } from "../../codegen/utils/case.ts"
 import { codeOf, literal, type Sql, TAG } from "./pg-replay-database.ts"
 import { addWrites, catalogsOf, counts, type Rows, subjectRows, type Writes, writesSince } from "./pg-server-writes.ts"
-import type { Snapshot, Strays } from "./pg-server-snapshot.ts"
+import type { Snapshot } from "./pg-server-snapshot.ts"
 import { flag } from "./pg-nodes.ts"
 
 /**
@@ -26,8 +26,7 @@ import { flag } from "./pg-nodes.ts"
  * that owns it, its role (`role`, which CURRENT_USER and its kin name in a file), whether that role
  * is a superuser, which reads pg_authid, whether it has CREATEROLE (`createrole`), and the roles it made; the
  * open transaction's own writes, comb's CREATE ROLEs', with the rows they left; the shared catalogs
- * as last read committed (`seen`), and the roles, databases and replication slots a refused window
- * added (`strays`), which the cleanup drops
+ * as last read committed (`seen`)
  */
 type Run = {
 	admin: Sql
@@ -39,7 +38,6 @@ type Run = {
 	role: string
 	seen: Snapshot
 	sql: Sql
-	strays: Strays
 	/** the tablespaces it left out the CREATE of, which a statement then runs in pg_default instead */
 	tablespaces: Set<string>
 	superuser: boolean

package/src/migrate/core/pg-replay.ts

@@ -3,11 +3,10 @@
  * catalog query: Postgres, not a model of it, decides what a cascade, a rename or a
  * move leaves, and the two sides compare as one read of two databases.
  *
- * The replay runs as Atlas applies: each file on a session of its own, as apply
- * gives each file an Atlas call, and in a transaction of its own, a `--
- * atlas:txmode none` file statement by statement, each in a transaction of its own first and bare,
- * as Atlas sends it, where Postgres runs it only so, in a database
- * made for it and dropped after (pg-replay-database.ts). One transaction for the whole history
+ * The replay runs as Atlas applies: each file on a session of its own, as apply gives each file an
+ * Atlas call, and in a transaction of its own, a `-- atlas:txmode none` file statement by statement,
+ * each in a transaction of its own first and bare, as Atlas sends it, where Postgres runs it only
+ * so, in a database made for it and dropped after (pg-replay-database.ts). One transaction for the whole history
  * filled Postgres's lock table and left a seed's deferred trigger events pending, and devUrl's own
  * database lent the history what it held. Committed, a statement whose scope is the server or
  * another database would outlive the replay on devUrl's server, the target's own when they share
@@ -29,19 +28,19 @@
  * Bare runs only a statement a block refuses (an outside-only class, a DO block or CALL that
  * commits), one only a block runs (a LOCK, a SAVEPOINT, a cursor not held) and the file's own
  * block, and a change one makes past its database has committed when the read sees it: the refusal
- * names what devUrl's server keeps. The read is the server's, another session's work in it too, so
- * a change there is the file's only when the role, database or other object it is to is one the
- * file names: a name it spells, unquoted and folded as Postgres folds it, quoted and exact, or
- * inside a string a DO body, dblink_exec or format() may run (namesIn in sql-code.ts). That change
- * is refused, naming it, and a role it added is dropped with the cleanup, as is a database it added
- * that no session is in; a change to any other object is another session's and passes. A name the
- * file builds at run time, by concatenation, from a query, or in a function another file defines,
- * is none it spells, so comb neither refuses nor drops that change. A role's password reads from
- * pg_authid alone, so a password a bare statement changes is seen by a superuser's devUrl only.
+ * names what devUrl's server keeps. The read is the server's, another session's work in it too, and
+ * Postgres keeps no creator for a role or a database, so a change there is the file's only beside a
+ * statement that can run code comb cannot read (pg-replay-hidden.ts), and only when it is to an
+ * object the file names: a name it spells, unquoted and folded as Postgres folds it, quoted and
+ * exact, or inside a string a DO body, dblink_exec or format() may run (namesIn in sql-code.ts).
+ * That change is refused, naming it, and left, as another session may have made it; any other is
+ * another session's and passes. A name the file builds at run time, by concatenation, from a query,
+ * or in a function another file defines, is none it spells, so comb does not refuse that change. A
+ * role's password reads from pg_authid alone, so a bare statement's is seen by a superuser's only.
  *
- * A SIGINT or a SIGTERM, a Ctrl-C or a cancelled CI job, skips a `finally`, so either runs the
- * replay's cleanup first, once, and then ends the process as the signal would; a run
- * killed past it is swept by the next replay or apply on the server.
+ * A SIGINT or a SIGTERM, a Ctrl-C or a cancelled CI job, skips a `finally`, so either runs the replay's
+ * cleanup first, once, and then ends the process as the signal would; a run killed past it is swept
+ * by the next replay or apply on the server.
  */
 import { sqlIdentifier } from "../../codegen/utils/case.ts"
 import { type PgTarget, refuseUrlProblems } from "./atlas-target.ts"
@@ -65,6 +64,7 @@ import { prepareSnapshot, snapshot } from "./pg-server-snapshot.ts"
 import { refuseUncounted } from "./pg-server-writes.ts"
 import { pgRead } from "./pg-split.ts"
 import { namesIn } from "./sql-code.ts"
+import { nothingHidden, readStatement } from "./pg-replay-hidden.ts"
 
 /** A history file as baseline reads it */
 type HistoryFile = { name: string; sql: string }
@@ -92,12 +92,14 @@ async function replayFile(run: Run, { name, sql: text }: HistoryFile, replay: Re
 	const inFile = !outsideTransaction(text)
 	const file = {
 		adopted: (role: string) => replay.adopted?.(name, role),
+		hidden: nothingHidden(),
 		name,
 		names: namesIn(text),
 		stops: replay.stops,
 	}
 	const statements = pgRead(text).statements.map(({ sent, tree }) => ({
 		sent,
+		tree,
 		...(tree === undefined ? { node: {}, type: "" } : (([type, node]) => ({ node, type }))(nodeOf(tree))),
 	}))
 	const locks = lockReader(
@@ -110,13 +112,14 @@ async function replayFile(run: Run, { name, sql: text }: HistoryFile, replay: Re
 		await begin(run)
 		await locks.began()
 	}
-	for (const [index, { node, sent, type }] of statements.entries()) {
+	for (const [index, { node, sent, tree, type }] of statements.entries()) {
 		const beyond = (await runsOnMade(run, type, node)) ? undefined : beyondDatabase(type, node)
 		if (beyond !== undefined) {
 			leaveOutTablespace(run.tablespaces, type, node)
 			replay.leftOut(name, sent, beyond)
 			continue
 		}
+		readStatement(tree, file.hidden)
 		await locks.next(index, type, node)
 		const send = () => runStatement(run, { name, node, sent, type }, replay)
 		if (inFile) await send()
@@ -206,7 +209,6 @@ async function opening(
 		owner,
 		seen: new Map(),
 		sql: open(),
-		strays: { databases: [], roles: [], slots: [] },
 		tablespaces: new Set(),
 		...(await devRoleOf(admin)),
 	}

package/src/migrate/core/pg-server-snapshot.ts

@@ -2,8 +2,9 @@
  * The server's shared catalogs read as committed, in one query: what a bare
  * statement changed, which no transaction counts, and what a second connection committed, which this
  * backend's counts never see (pg-server-writes.ts). The read is the server's, another session's work
- * in it too, so each row carries the names of the objects it is about, and a change is a file's only
- * when one is a name the file spells (namesIn in sql-code.ts). A replay's own rows are left out, but
+ * in it too, so each row carries the names of the objects it is about: a change is a file's when it
+ * is to the replay's own database, or to a name the file spells (namesIn in sql-code.ts) beside a
+ * statement that can run code comb cannot read (pg-replay-hidden.ts). A replay's own rows are left out, but
  * for the fields of its own database's row that keep the cleanup from dropping it, which only that
  * replay changes. Beside the catalogs, the server's replication slots, which no catalog
  * holds.
@@ -142,27 +143,6 @@ function snapshotChanges(before: Snapshot, after: Snapshot, names?: ReadonlySet<
 	return changes
 }
 
-/** What the cleanup drops, by the noun its subject starts with */
-type Strays = { databases: string[]; roles: string[]; slots: string[] }
-
-// lookup-table: the nouns of what a file adds that the cleanup drops, by where it keeps them
-const DROPPED: ReadonlyArray<[keyof Strays, string]> = [
-	["databases", "database "],
-	["roles", "role "],
-	["slots", "replication slot "],
-]
-
-/** The roles, databases and replication slots named in `names` that `after` holds and `before` does not */
-function added(before: Snapshot, after: Snapshot, names: ReadonlySet<string>): Strays {
-	const out: Strays = { databases: [], roles: [], slots: [] }
-	for (const subject of after.keys()) {
-		if (before.has(subject) || !about(subject, { after, before }, names)) continue
-		const [where, noun] = DROPPED.find(([, prefix]) => subject.startsWith(prefix)) ?? []
-		if (where !== undefined) out[where].push(subject.slice(noun?.length))
-	}
-	return out
-}
-
 /** The subscriptions `after` holds in `database` and `before` does not, by subject: its drop takes them */
 const subscriptionsIn = (before: Snapshot, after: Snapshot, database: string): string[] =>
 	[...after]
@@ -171,4 +151,4 @@ const subscriptionsIn = (before: Snapshot, after: Snapshot, database: string): s
 		)
 		.map(([subject]) => subject)
 
-export { added, prepareSnapshot, type Snapshot, snapshot, snapshotChanges, type Strays, subscriptionsIn }
+export { prepareSnapshot, type Snapshot, snapshot, snapshotChanges, subscriptionsIn }

package/src/migrate/core/proof-readers.ts

@@ -0,0 +1,80 @@
+/**
+ * What a file leaves unable to run: SQLite's DROP TABLE and DROP VIEW check no view or trigger that names what they
+ * drop, and SQLite, D1 and libsql resolve those names only when a statement runs. So a file can apply and leave every
+ * read of a view, or every write a trigger fires on, failing. After a file applies to the proof's copy, each view and
+ * trigger that survives it and names an object the file dropped or changed is compiled: a view's read, a trigger's
+ * own write on its table or view (trigger-write.mjs). SQLite resolves a name only by name, and the copy holds every
+ * reader that names a table a file reaches (proof-scope.ts), so this finds every reader the file breaks.
+ */
+import type { LocalDb } from "../drivers/local-db.ts"
+import type { LiveObject } from "./proof-copy.ts"
+import { referencesOf } from "./proof-scope.ts"
+import { asciiFold } from "./sql-code.ts"
+import { quote, triggerEvent, writeOf } from "./trigger-write.mjs"
+
+/** The copy's schema, each object by type and folded name */
+function schemaOf(db: LocalDb): Map<string, LiveObject> {
+	const rows = db.all("SELECT type, name, sql, tbl_name FROM main.sqlite_master WHERE sql IS NOT NULL")
+	return new Map(
+		rows.map((row) => {
+			const object = {
+				name: String(row["name"]),
+				sql: String(row["sql"]),
+				table: String(row["tbl_name"]),
+				type: String(row["type"]),
+			}
+			return [`${object.type} ${asciiFold(object.name)}`, object]
+		}),
+	)
+}
+
+/** SQLite's error compiling `sql`, or undefined */
+function compileError(db: LocalDb, sql: string): string | undefined {
+	try {
+		db.all(`EXPLAIN ${sql}`)
+		return undefined
+	} catch (error) {
+		// reason: what SQLite refuses to compile is the finding
+		return (error as Error).message
+	}
+}
+
+/** Why `reader`, a view or a trigger, fails on `db`, or undefined */
+function brokenRead(db: LocalDb, reader: LiveObject): string | undefined {
+	if (reader.type === "view") {
+		const error = compileError(db, `SELECT * FROM ${quote(reader.name)}`)
+		return error === undefined ? undefined : `view ${reader.name} cannot be read: ${error}`
+	}
+	const event = triggerEvent(reader.sql)
+	const columns = db
+		.all(`PRAGMA main.table_xinfo(${quote(reader.table)})`)
+		.filter((row) => row["hidden"] === 0)
+		.map((row) => String(row["name"]))
+	const error = compileError(db, writeOf(reader.table, event, columns))
+	return error === undefined
+		? undefined
+		: `every ${event} on ${reader.table} fails, as a trigger it fires cannot compile: ${error}`
+}
+
+/**
+ * Throws when a file that turned the copy's schema `before` into `db`'s leaves a view or trigger unable to run,
+ * naming it and SQLite's error: no approval overrides, since every read or write through it would fail
+ */
+function refuseBrokenReaders(db: LocalDb, before: ReadonlyMap<string, LiveObject>): void {
+	const after = schemaOf(db)
+	const touched = new Set(
+		[...before]
+			.filter(([key, object]) => after.get(key)?.sql !== object.sql)
+			.map(([, object]) => asciiFold(object.name)),
+	)
+	if (touched.size === 0) return
+	for (const reader of after.values()) {
+		if (reader.type !== "view" && reader.type !== "trigger") continue
+		if (![...referencesOf(reader)].some((name) => touched.has(name))) continue
+		const broken = brokenRead(db, reader)
+		if (broken !== undefined)
+			throw new Error(`after this file, ${broken}; drop or change it in this file, or keep what it uses`)
+	}
+}
+
+export { refuseBrokenReaders, schemaOf }

package/src/migrate/core/proof-run.ts

@@ -12,7 +12,8 @@
  * Seeded rows cannot meet every predicate a file holds, so what each statement writes is read from
  * SQLite itself as it runs (proof-engine.ts): an update of a column that was there before, a
  * delete, a trigger fired or a temp shadow is unsafe whichever rows it meets, and a backfill of the
- * file's own columns is cautious. A file the copy cannot run is unproven, and unproven is unsafe.
+ * file's own columns is cautious. A file the copy cannot run is unproven, and unproven is unsafe. A
+ * file that leaves a view or trigger unable to run is refused outright (proof-readers.ts).
  */
 import { isMirror, mirrorFindings, mirrorRows } from "./proof-mirror.ts"
 import { type LocalDb, openScratch, type ScratchEngine } from "../drivers/local-db.ts"
@@ -21,6 +22,7 @@ import { notEngineTables } from "./engine-tables.ts"
 import { compare, type Shape } from "./proof-compare.ts"
 import { type Copy, copyOf, buildCopy, creatable, jsonColumns, type LiveObject, liveObjects } from "./proof-copy.ts"
 import { applyToCopy, engineFindings } from "./proof-engine.ts"
+import { refuseBrokenReaders, schemaOf } from "./proof-readers.ts"
 import { quote } from "./proof-seed.ts"
 import { observable } from "./proof-scope.ts"
 import { asciiFold } from "./sql-code.ts"
@@ -174,7 +176,10 @@ function snapshotAfter(db: Copy["db"]): Map<string, Shape> | string {
 	}
 }
 
-/** The proof of a file that applied as `run`, from the copy's tables and mirrored rows before it and its tables after */
+/**
+ * The proof of file `name`, which applied as `run`, from the copy's tables, mirrored rows and schema before it and its
+ * tables after; throws, naming the file, when it leaves a view or trigger unable to run, which no approval overrides
+ */
 function appliedProof(
 	copy: Copy,
 	run: ReturnType<typeof applyToCopy>,
@@ -182,8 +187,17 @@ function appliedProof(
 		after,
 		before,
 		mirrors,
-	}: { after: Map<string, Shape>; before: Map<string, Shape>; mirrors: ReturnType<typeof mirrorRows> },
+		name,
+		schema,
+	}: {
+		after: Map<string, Shape>
+		before: Map<string, Shape>
+		mirrors: ReturnType<typeof mirrorRows>
+		name: string
+		schema: ReturnType<typeof schemaOf>
+	},
 ): Proof {
+	named(name, () => refuseBrokenReaders(copy.db, schema))
 	const found = compare(copy.db, new Map([...before].filter(([table]) => !copy.unproven.has(table))), after)
 	const steps = engineFindings(run.steps, run.start)
 	return {
@@ -228,7 +242,7 @@ async function provePending(
 				proofs.set(name, failedProof(copy, failed))
 				continue
 			}
-			let [before, mirrors] = [snapshot(copy.db), mirrorRows(copy.db)]
+			let [before, mirrors, schema] = [snapshot(copy.db), mirrorRows(copy.db), schemaOf(copy.db)]
 			let run = named(name, () => applyToCopy(copy.db, sql))
 			const retry = run.error === undefined ? undefined : await reseeded(objects, applied, making)
 			if (retry !== undefined) {
@@ -263,7 +277,7 @@ async function provePending(
 				failed = `an earlier pending file, ${name}, left a table SQLite cannot read, so this one is unproven`
 				continue
 			}
-			proofs.set(name, appliedProof(copy, run, { after, before, mirrors }))
+			proofs.set(name, appliedProof(copy, run, { after, before, mirrors, name, schema }))
 		}
 	} finally {
 		copy.db.close()

package/src/migrate/core/proof-scope.ts

@@ -3,15 +3,17 @@
  * can observe, created, and the tables whose rows they can observe, seeded, so the copy refuses what the whole
  * schema would and costs what the files reach.
  *
- * - An object's references are every name its text spells (sql-code's lexer, compared folded, never as a substring)
- *   and, for a virtual table, each string and quoted name among its module's arguments, whole. A table's FK parents
- *   are the other tables it references; a reader is a view, a trigger or a virtual table, and reads what it references.
+ * - An object's references are every name its text spells where SQLite's grammar takes a name (sql-code's lexer,
+ *   compared folded, never as a substring: the `TABLE` of `CREATE TABLE` is no name) and, for a virtual table, each
+ *   word, string and quoted name among its module's arguments, whole. A table's FK parents are the other tables it
+ *   references; a reader is a view, a trigger or a virtual table, and reads what it references.
  * - N: each live object whose name a file spells, and the history table; S is N's tables, which a file creates,
  *   alters, drops, renames or writes.
  * - Rows go to S, each table a reader reached from S references (to a fixpoint), D (their FK descendants: a cascade
  *   reaches them) and A (the FK ancestors of all those: their keys must be met).
  * - The copy creates N, the seeded tables, and each reader that references an S table (SQLite checks views and
- *   triggers on DROP COLUMN and RENAME COLUMN, and a rename rewrites them). Then to a fixpoint each index and trigger
+ *   triggers on DROP COLUMN and RENAME COLUMN, and a rename rewrites them) or a view of N (a file that drops the
+ *   view leaves the reader unable to run, which the proof compiles it to see). Then to a fixpoint each index and trigger
  *   on a created table or view (a view's INSTEAD OF triggers carry out a write through it), each table and view a
  *   created reader references, and each created table's FK ancestors, which a write to it compiles checks against.
  * - Reflection reads the schema itself: a name with SQLite's reserved `sqlite_` prefix (its catalogs, sqlite_sequence,
@@ -66,24 +68,31 @@ const nameOf = ({ kind, text }: Token): string =>
 	asciiFold(kind === "literal" ? text.slice(1, -1).replaceAll("''", "'") : unquote(text))
 
 /**
- * Virtual table `object`'s module, the name after USING however it is written, and each string and quoted name among
- * the module's arguments, which the module may read as a table's name (fts5vocab, content=)
+ * Virtual table `object`'s module, the name after USING however it is written, each string and quoted name among
+ * the module's arguments, which the module may read as a table's name (fts5vocab, content=), and each bare word there
  */
-function virtualOf(object: LiveObject): { args: string[]; module: string } | undefined {
+function virtualOf(object: LiveObject): { args: string[]; module: string; words: string[] } | undefined {
 	if (!isVirtual(object)) return undefined
 	const tokens = tokensOf(object.sql)
 	const at = tokens.findIndex(({ kind, text }) => kind === "code" && /^using$/i.test(text)) + 1
-	const args = tokens[at + 1]?.text === "(" ? tokens.slice(at + 2).filter(({ kind }) => kind !== "code") : []
-	return { args: args.map(nameOf), module: nameOf(tokens[at] as Token) }
+	const inside = tokens[at + 1]?.text === "(" ? tokens.slice(at + 2) : []
+	return {
+		args: inside.filter(({ kind }) => kind !== "code").map(nameOf),
+		module: nameOf(tokens[at] as Token),
+		words: inside.filter(({ kind, text }) => kind === "code" && /^[A-Za-z_\u0080-\uffff]/.test(text)).map(nameOf),
+	}
 }
 
 /** The folded names of the shadow tables virtual table `object`'s module makes */
 const shadowsOf = (object: LiveObject): string[] =>
 	(SHADOWS[virtualOf(object)?.module as string] ?? []).map((suffix) => asciiFold(`${object.name}_${suffix}`))
 
-/** Every name `object` references, folded (see the module's comment) */
+/**
+ * Every name `object` references, folded (see the module's comment). A virtual table's module reads its own arguments,
+ * not SQL, so each bare word among them may name a table, `group` in `content=group` among them
+ */
 const referencesOf = (object: LiveObject): Set<string> =>
-	new Set([...sqliteNames(object.sql), ...(virtualOf(object)?.args ?? [])])
+	new Set([...sqliteNames(object.sql), ...(virtualOf(object)?.args ?? []), ...(virtualOf(object)?.words ?? [])])
 
 /* a name SQLite reserves for its own tables, or a pragma's table-valued function: either reads the schema itself */
 const REFLECTION = /^(?:sqlite_|pragma_)/
@@ -216,9 +225,13 @@ function observable(
 	const statements = files.flatMap(({ sql }) => splitSqlStatements(sql))
 	const checks = objects.filter((object) => object.type === "view" || object.type === "trigger")
 	/* a rename rewrites the text of each view and trigger naming an S table, and D1 then compiles the writes to its
-	   table; a virtual table reading one reads the rows a file writes */
+	   table; a virtual table reading one reads the rows a file writes; a drop of a view of N breaks each reading it */
+	const reached = new Set([
+		...s,
+		...n.filter((object) => object.type === "view").map((object) => asciiFold(object.name)),
+	])
 	const rewritten = objects.filter(
-		(object) => isReader(object) && [...(graph.names.get(object) as Set<string>)].some((name) => s.has(name)),
+		(object) => isReader(object) && [...(graph.names.get(object) as Set<string>)].some((name) => reached.has(name)),
 	)
 	/* a write to a created table compiles its keys' checks, which need each parent table */
 	let made = forward(graph, [...n, ...objectsOf(graph, seeded), ...rewritten])
@@ -240,4 +253,4 @@ function observable(
 	return { objects: kept, seeded }
 }
 
-export { isVirtual, observable, type Scope, shadowsOf, virtualOf }
+export { isVirtual, observable, referencesOf, type Scope, shadowsOf, virtualOf }

package/src/migrate/core/sql-code.ts

@@ -4,7 +4,8 @@
  * an action list splits only at its top-level commas.
  */
 import type { Dialect } from "../types.ts"
-import { bodyText, joined, segments } from "../../sql-lexer.ts"
+import { bodyText, segments } from "../../sql-lexer.ts"
+import { NEVER_NAMES } from "./sqlite-keywords.ts"
 
 /** One name part: double-quoted, backtick or bracket quoted, or bare */
 const IDENT: string = `(?:"(?:[^"]|"")*"|\`[^\`]*\`|\\[[^\\]]*\\]|[A-Za-z_\\u0080-\\uffff][\\w$\\u0080-\\uffff]*)`
@@ -100,13 +101,43 @@ function pragmaOf(code: string): Pragma | undefined {
 const qualifiedKey = (name: string): string =>
 	[...name.matchAll(PARTS)].map((match) => partKey(match[0], "sqlite")).join(".")
 
+/* the words and punctuation of SQLite code: a bare word, or one character that breaks a run of words */
+const CODE_TOKEN = /[A-Za-z_\u0080-\uffff][\w$\u0080-\uffff]*|\S/g
+
 /**
- * Every name SQLite code can spell, as SQLite resolves one: each bare word and each quoted name unquoted, and each
- * word of a string, which SQLite reads as a name where one stands (`FROM 'post'`) and a module as its option's
- * (`content='post'`), folded by asciiFold; never a word of a comment
+ * Every name SQLite code can spell, as SQLite resolves one: each quoted name unquoted, each word of a string, which
+ * SQLite reads as a name where one stands (`FROM 'post'`) and a module as its option's (`content='post'`), and each
+ * bare word that can be one, all folded by asciiFold; never a word of a comment. A bare keyword is no name
+ * where SQLite's grammar takes none: `TABLE`, `CREATE`, `NULL` and the rest of NEVER_NAMES whenever it is bare, and
+ * `KEY` after `PRIMARY` or `FOREIGN`, which no name can follow. So a table named `table` is named by `"table"` and
+ * not by the `CREATE TABLE` of every file. Any other bare word may be a name and is read as one: a name read
+ * where there is none only widens what a proof copies, a name missed would narrow it
  */
 function sqliteNames(sql: string): Set<string> {
-	return new Set([...joined(sql, "sqlite", true).matchAll(PARTS)].map((match) => partKey(match[0], "sqlite")))
+	const names = new Set<string>()
+	const quoted = (text: string) => {
+		for (const match of text.matchAll(PARTS)) names.add(partKey(match[0], "sqlite"))
+	}
+	let before: string | undefined
+	for (const { kind, text } of segments(sql, "sqlite")) {
+		if (kind === "comment") continue
+		if (kind !== "code") {
+			quoted(text)
+			before = undefined
+			continue
+		}
+		for (const [token] of text.matchAll(CODE_TOKEN)) {
+			if (!/^[A-Za-z_\u0080-\uffff]/.test(token)) {
+				before = undefined
+				continue
+			}
+			const word = asciiFold(token)
+			const keyword = NEVER_NAMES.has(word) || (word === "key" && (before === "primary" || before === "foreign"))
+			if (!keyword) names.add(word)
+			before = word
+		}
+	}
+	return names
 }
 
 /* a bare word in Postgres code, which may be a name */