latticesql 3.3.2 → 3.3.4

package/dist/cli.js

@@ -1061,13 +1061,24 @@ function moduleContext() {
   return _moduleContext;
 }
 async function registerPostgresPolyfills(run) {
+  let permissionDenied = false;
   for (const { warn, sql } of POSTGRES_POLYFILLS) {
     try {
       await run(sql);
     } catch (err) {
-      console.warn(`[PostgresAdapter] ${warn}`, err instanceof Error ? err.message : err);
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/permission denied/i.test(msg)) {
+        permissionDenied = true;
+      } else {
+        console.warn(`[PostgresAdapter] ${warn}`, msg);
+      }
     }
   }
+  if (permissionDenied) {
+    console.debug(
+      "[PostgresAdapter] SQLite-compat polyfills are owner-managed on this cloud; skipping member-side (re)creation (expected)."
+    );
+  }
 }
 function translateDialect(sql) {
   if (/INSERT\s+OR\s+REPLACE\s+INTO/i.test(sql)) {
@@ -5103,7 +5114,23 @@ var init_lattice = __esm({
       }
       /** Async tail of init(). See {@link init} for the sync-validation phase. */
       async _initAsync(options) {
-        if (options.introspectOnly) {
+        let introspectOnly = options.introspectOnly === true;
+        if (!introspectOnly && this.getDialect() === "postgres") {
+          try {
+            const [marker, role] = await Promise.all([
+              getAsyncOrSync(this._adapter, `SELECT to_regclass('__lattice_owners') AS reg`),
+              getAsyncOrSync(
+                this._adapter,
+                `SELECT rolcreaterole FROM pg_roles WHERE rolname = current_user`
+              )
+            ]);
+            const provisioned = !!marker && marker.reg != null;
+            const canCreateRoles = !!role && role.rolcreaterole === true;
+            introspectOnly = provisioned && !canCreateRoles;
+          } catch {
+          }
+        }
+        if (introspectOnly) {
           for (const tableName of this._schema.getTables().keys()) {
             try {
               const cols = await introspectColumnsAsyncOrSync(this._adapter, tableName);
@@ -57051,7 +57078,7 @@ var appJs = `
         '<div class="view-header">' +
           '<span class="entity-icon">\u2699</span>' +
           '<h1>' + escapeHtml(tableName) + '</h1>' +
-          '<span class="count">' + entry.rowCount + ' row' + (entry.rowCount === 1 ? '' : 's') +
+          '<span class="count">' + (entry.rowCount == null ? 'no access' : (entry.rowCount + ' row' + (entry.rowCount === 1 ? '' : 's'))) +
             ' \xB7 read-only</span>' +
         '</div>' +
         '<div class="muted" style="margin-bottom:12px;font-size:13px;">' +
@@ -61766,6 +61793,52 @@ async function reconcileCloudMemberAccess(db) {
       );
     }
   }
+  const memberSystemGrants = [
+    ["_lattice_gui_meta", "SELECT, INSERT, UPDATE"],
+    ["_lattice_gui_column_meta", "SELECT, INSERT, UPDATE"],
+    ["_lattice_gui_audit", "SELECT, INSERT"],
+    ["__lattice_user_identity", "SELECT, INSERT, UPDATE"]
+  ];
+  for (const [tbl, privs] of memberSystemGrants) {
+    await runAsyncOrSync(
+      db.adapter,
+      `DO $LATTICE$ BEGIN
+         IF to_regclass('${tbl}') IS NOT NULL THEN
+           EXECUTE 'GRANT ${privs} ON "${tbl}" TO ${MEMBER_GROUP}';
+         END IF;
+       END $LATTICE$`
+    );
+  }
+  try {
+    await runAsyncOrSync(
+      db.adapter,
+      `GRANT EXECUTE ON FUNCTION json_extract(text, text), strftime(text, text) TO ${MEMBER_GROUP}`
+    );
+  } catch (err) {
+    console.warn(
+      "[reconcileCloudMemberAccess] could not grant EXECUTE on polyfills (will retry next open):",
+      err instanceof Error ? err.message : String(err)
+    );
+  }
+  for (const table of registered) {
+    if (table.startsWith("__lattice_") || table.startsWith("_lattice_")) continue;
+    const cols = db.getRegisteredColumns(table);
+    if (cols && !("deleted_at" in cols)) {
+      const q3 = `"${table.replace(/"/g, '""')}"`;
+      await runAsyncOrSync(
+        db.adapter,
+        `ALTER TABLE ${q3} ADD COLUMN IF NOT EXISTS "deleted_at" TEXT`
+      );
+    }
+  }
+  await runAsyncOrSync(
+    db.adapter,
+    `DO $LATTICE$ BEGIN
+       IF to_regclass('__lattice_changelog') IS NOT NULL THEN
+         EXECUTE 'GRANT SELECT, INSERT ON "__lattice_changelog" TO ${MEMBER_GROUP}';
+       END IF;
+     END $LATTICE$`
+  );
 }
 async function secureNewCloudTable(db, table, pk) {
   if (db.getDialect() !== "postgres") return;
@@ -61791,14 +61864,6 @@ async function secureCloud(db) {
     await secureNewCloudTable(db, table, db.getPrimaryKey(table));
   }
   await reconcileCloudMemberAccess(db);
-  await runAsyncOrSync(
-    db.adapter,
-    `DO $LATTICE$ BEGIN
-       IF to_regclass('__lattice_user_identity') IS NOT NULL THEN
-         EXECUTE 'GRANT SELECT, INSERT, UPDATE ON "__lattice_user_identity" TO ${MEMBER_GROUP}';
-       END IF;
-     END $LATTICE$`
-  );
 }
 
 // src/gui/meta-gen.ts
@@ -65307,6 +65372,7 @@ async function openConfig(configPath, outputDir, autoRender = false, realtimeWat
           ]);
           const views = viewsRaw;
           const knownTables = /* @__PURE__ */ new Set([...declared, ...discovered.map((t8) => t8.name)]);
+          const memberEntityDefs = [];
           for (const t8 of discovered) {
             if (declared.has(t8.name)) continue;
             if (t8.columns.length === 0) continue;
@@ -65314,17 +65380,25 @@ async function openConfig(configPath, outputDir, autoRender = false, realtimeWat
               discoveredJunctions.add(t8.name);
               continue;
             }
-            db.define(t8.name, {
+            const def = {
               columns: Object.fromEntries(t8.columns.map((c6) => [c6, "TEXT"])),
               ...t8.pk.length > 0 ? { primaryKey: t8.pk.length === 1 ? t8.pk[0] : t8.pk } : {},
               render: () => "",
               outputFile: `${t8.name}/.lattice/${t8.name}.md`
-            });
+            };
+            db.define(t8.name, def);
+            memberEntityDefs.push({ name: t8.name, definition: def });
           }
           for (const { name } of views) {
             const base = name.slice(0, -2);
             if (knownTables.has(base)) maskedReadViews.set(base, name);
           }
+          if (autoRender && memberEntityDefs.length > 0) {
+            const existingContexts = db.entityContexts();
+            for (const { table, definition } of deriveCanonicalContexts(memberEntityDefs)) {
+              if (!existingContexts.has(table)) db.defineEntityContext(table, definition);
+            }
+          }
         }
       }
     } catch {
@@ -66815,9 +66889,18 @@ async function startGuiServer(options) {
           }
           const tables = [];
           for (const r6 of rows) {
-            const cols = await active.db.introspectColumns(r6.name);
-            const rowCount = await active.db.count(r6.name);
-            tables.push({ name: r6.name, columns: cols, rowCount });
+            try {
+              const cols = await active.db.introspectColumns(r6.name);
+              const rowCount = await active.db.count(r6.name);
+              tables.push({ name: r6.name, columns: cols, rowCount });
+            } catch (err) {
+              const msg = err instanceof Error ? err.message : String(err);
+              if (/permission denied|does not exist/i.test(msg)) {
+                tables.push({ name: r6.name, columns: [], rowCount: null });
+              } else {
+                throw err;
+              }
+            }
           }
           sendJson(res, { tables });
           return;
@@ -67783,7 +67866,7 @@ function printHelp() {
   );
 }
 function getVersion() {
-  if (true) return "3.3.2";
+  if (true) return "3.3.4";
   try {
     const pkgPath = new URL("../package.json", import.meta.url).pathname;
     const pkg = JSON.parse(readFileSync18(pkgPath, "utf-8"));

package/dist/index.cjs

@@ -437,13 +437,24 @@ function moduleContext() {
   return _moduleContext;
 }
 async function registerPostgresPolyfills(run) {
+  let permissionDenied = false;
   for (const { warn, sql } of POSTGRES_POLYFILLS) {
     try {
       await run(sql);
     } catch (err) {
-      console.warn(`[PostgresAdapter] ${warn}`, err instanceof Error ? err.message : err);
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/permission denied/i.test(msg)) {
+        permissionDenied = true;
+      } else {
+        console.warn(`[PostgresAdapter] ${warn}`, msg);
+      }
     }
   }
+  if (permissionDenied) {
+    console.debug(
+      "[PostgresAdapter] SQLite-compat polyfills are owner-managed on this cloud; skipping member-side (re)creation (expected)."
+    );
+  }
 }
 function translateDialect(sql) {
   if (/INSERT\s+OR\s+REPLACE\s+INTO/i.test(sql)) {
@@ -5266,7 +5277,23 @@ var init_lattice = __esm({
       }
       /** Async tail of init(). See {@link init} for the sync-validation phase. */
       async _initAsync(options) {
-        if (options.introspectOnly) {
+        let introspectOnly = options.introspectOnly === true;
+        if (!introspectOnly && this.getDialect() === "postgres") {
+          try {
+            const [marker, role] = await Promise.all([
+              getAsyncOrSync(this._adapter, `SELECT to_regclass('__lattice_owners') AS reg`),
+              getAsyncOrSync(
+                this._adapter,
+                `SELECT rolcreaterole FROM pg_roles WHERE rolname = current_user`
+              )
+            ]);
+            const provisioned = !!marker && marker.reg != null;
+            const canCreateRoles = !!role && role.rolcreaterole === true;
+            introspectOnly = provisioned && !canCreateRoles;
+          } catch {
+          }
+        }
+        if (introspectOnly) {
           for (const tableName of this._schema.getTables().keys()) {
             try {
               const cols = await introspectColumnsAsyncOrSync(this._adapter, tableName);
@@ -54016,6 +54043,52 @@ async function reconcileCloudMemberAccess(db) {
       );
     }
   }
+  const memberSystemGrants = [
+    ["_lattice_gui_meta", "SELECT, INSERT, UPDATE"],
+    ["_lattice_gui_column_meta", "SELECT, INSERT, UPDATE"],
+    ["_lattice_gui_audit", "SELECT, INSERT"],
+    ["__lattice_user_identity", "SELECT, INSERT, UPDATE"]
+  ];
+  for (const [tbl, privs] of memberSystemGrants) {
+    await runAsyncOrSync(
+      db.adapter,
+      `DO $LATTICE$ BEGIN
+         IF to_regclass('${tbl}') IS NOT NULL THEN
+           EXECUTE 'GRANT ${privs} ON "${tbl}" TO ${MEMBER_GROUP}';
+         END IF;
+       END $LATTICE$`
+    );
+  }
+  try {
+    await runAsyncOrSync(
+      db.adapter,
+      `GRANT EXECUTE ON FUNCTION json_extract(text, text), strftime(text, text) TO ${MEMBER_GROUP}`
+    );
+  } catch (err) {
+    console.warn(
+      "[reconcileCloudMemberAccess] could not grant EXECUTE on polyfills (will retry next open):",
+      err instanceof Error ? err.message : String(err)
+    );
+  }
+  for (const table of registered) {
+    if (table.startsWith("__lattice_") || table.startsWith("_lattice_")) continue;
+    const cols = db.getRegisteredColumns(table);
+    if (cols && !("deleted_at" in cols)) {
+      const q3 = `"${table.replace(/"/g, '""')}"`;
+      await runAsyncOrSync(
+        db.adapter,
+        `ALTER TABLE ${q3} ADD COLUMN IF NOT EXISTS "deleted_at" TEXT`
+      );
+    }
+  }
+  await runAsyncOrSync(
+    db.adapter,
+    `DO $LATTICE$ BEGIN
+       IF to_regclass('__lattice_changelog') IS NOT NULL THEN
+         EXECUTE 'GRANT SELECT, INSERT ON "__lattice_changelog" TO ${MEMBER_GROUP}';
+       END IF;
+     END $LATTICE$`
+  );
 }
 async function secureNewCloudTable(db, table, pk) {
   if (db.getDialect() !== "postgres") return;
@@ -54041,14 +54114,6 @@ async function secureCloud(db) {
     await secureNewCloudTable(db, table, db.getPrimaryKey(table));
   }
   await reconcileCloudMemberAccess(db);
-  await runAsyncOrSync(
-    db.adapter,
-    `DO $LATTICE$ BEGIN
-       IF to_regclass('__lattice_user_identity') IS NOT NULL THEN
-         EXECUTE 'GRANT SELECT, INSERT, UPDATE ON "__lattice_user_identity" TO ${MEMBER_GROUP}';
-       END IF;
-     END $LATTICE$`
-  );
 }
 
 // src/index.ts
@@ -58921,7 +58986,7 @@ var appJs = `
         '<div class="view-header">' +
           '<span class="entity-icon">\u2699</span>' +
           '<h1>' + escapeHtml(tableName) + '</h1>' +
-          '<span class="count">' + entry.rowCount + ' row' + (entry.rowCount === 1 ? '' : 's') +
+          '<span class="count">' + (entry.rowCount == null ? 'no access' : (entry.rowCount + ' row' + (entry.rowCount === 1 ? '' : 's'))) +
             ' \xB7 read-only</span>' +
         '</div>' +
         '<div class="muted" style="margin-bottom:12px;font-size:13px;">' +
@@ -66479,6 +66544,7 @@ async function openConfig(configPath, outputDir, autoRender = false, realtimeWat
           ]);
           const views = viewsRaw;
           const knownTables = /* @__PURE__ */ new Set([...declared, ...discovered.map((t8) => t8.name)]);
+          const memberEntityDefs = [];
           for (const t8 of discovered) {
             if (declared.has(t8.name)) continue;
             if (t8.columns.length === 0) continue;
@@ -66486,17 +66552,25 @@ async function openConfig(configPath, outputDir, autoRender = false, realtimeWat
               discoveredJunctions.add(t8.name);
               continue;
             }
-            db.define(t8.name, {
+            const def = {
               columns: Object.fromEntries(t8.columns.map((c6) => [c6, "TEXT"])),
               ...t8.pk.length > 0 ? { primaryKey: t8.pk.length === 1 ? t8.pk[0] : t8.pk } : {},
               render: () => "",
               outputFile: `${t8.name}/.lattice/${t8.name}.md`
-            });
+            };
+            db.define(t8.name, def);
+            memberEntityDefs.push({ name: t8.name, definition: def });
           }
           for (const { name } of views) {
             const base = name.slice(0, -2);
             if (knownTables.has(base)) maskedReadViews.set(base, name);
           }
+          if (autoRender && memberEntityDefs.length > 0) {
+            const existingContexts = db.entityContexts();
+            for (const { table, definition } of deriveCanonicalContexts(memberEntityDefs)) {
+              if (!existingContexts.has(table)) db.defineEntityContext(table, definition);
+            }
+          }
         }
       }
     } catch {
@@ -67987,9 +68061,18 @@ async function startGuiServer(options) {
           }
           const tables = [];
           for (const r6 of rows) {
-            const cols = await active.db.introspectColumns(r6.name);
-            const rowCount = await active.db.count(r6.name);
-            tables.push({ name: r6.name, columns: cols, rowCount });
+            try {
+              const cols = await active.db.introspectColumns(r6.name);
+              const rowCount = await active.db.count(r6.name);
+              tables.push({ name: r6.name, columns: cols, rowCount });
+            } catch (err) {
+              const msg = err instanceof Error ? err.message : String(err);
+              if (/permission denied|does not exist/i.test(msg)) {
+                tables.push({ name: r6.name, columns: [], rowCount: null });
+              } else {
+                throw err;
+              }
+            }
           }
           sendJson(res, { tables });
           return;

package/dist/index.js

@@ -430,13 +430,24 @@ function moduleContext() {
   return _moduleContext;
 }
 async function registerPostgresPolyfills(run) {
+  let permissionDenied = false;
   for (const { warn, sql } of POSTGRES_POLYFILLS) {
     try {
       await run(sql);
     } catch (err) {
-      console.warn(`[PostgresAdapter] ${warn}`, err instanceof Error ? err.message : err);
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/permission denied/i.test(msg)) {
+        permissionDenied = true;
+      } else {
+        console.warn(`[PostgresAdapter] ${warn}`, msg);
+      }
     }
   }
+  if (permissionDenied) {
+    console.debug(
+      "[PostgresAdapter] SQLite-compat polyfills are owner-managed on this cloud; skipping member-side (re)creation (expected)."
+    );
+  }
 }
 function translateDialect(sql) {
   if (/INSERT\s+OR\s+REPLACE\s+INTO/i.test(sql)) {
@@ -5262,7 +5273,23 @@ var init_lattice = __esm({
       }
       /** Async tail of init(). See {@link init} for the sync-validation phase. */
       async _initAsync(options) {
-        if (options.introspectOnly) {
+        let introspectOnly = options.introspectOnly === true;
+        if (!introspectOnly && this.getDialect() === "postgres") {
+          try {
+            const [marker, role] = await Promise.all([
+              getAsyncOrSync(this._adapter, `SELECT to_regclass('__lattice_owners') AS reg`),
+              getAsyncOrSync(
+                this._adapter,
+                `SELECT rolcreaterole FROM pg_roles WHERE rolname = current_user`
+              )
+            ]);
+            const provisioned = !!marker && marker.reg != null;
+            const canCreateRoles = !!role && role.rolcreaterole === true;
+            introspectOnly = provisioned && !canCreateRoles;
+          } catch {
+          }
+        }
+        if (introspectOnly) {
           for (const tableName of this._schema.getTables().keys()) {
             try {
               const cols = await introspectColumnsAsyncOrSync(this._adapter, tableName);
@@ -53829,6 +53856,52 @@ async function reconcileCloudMemberAccess(db) {
       );
     }
   }
+  const memberSystemGrants = [
+    ["_lattice_gui_meta", "SELECT, INSERT, UPDATE"],
+    ["_lattice_gui_column_meta", "SELECT, INSERT, UPDATE"],
+    ["_lattice_gui_audit", "SELECT, INSERT"],
+    ["__lattice_user_identity", "SELECT, INSERT, UPDATE"]
+  ];
+  for (const [tbl, privs] of memberSystemGrants) {
+    await runAsyncOrSync(
+      db.adapter,
+      `DO $LATTICE$ BEGIN
+         IF to_regclass('${tbl}') IS NOT NULL THEN
+           EXECUTE 'GRANT ${privs} ON "${tbl}" TO ${MEMBER_GROUP}';
+         END IF;
+       END $LATTICE$`
+    );
+  }
+  try {
+    await runAsyncOrSync(
+      db.adapter,
+      `GRANT EXECUTE ON FUNCTION json_extract(text, text), strftime(text, text) TO ${MEMBER_GROUP}`
+    );
+  } catch (err) {
+    console.warn(
+      "[reconcileCloudMemberAccess] could not grant EXECUTE on polyfills (will retry next open):",
+      err instanceof Error ? err.message : String(err)
+    );
+  }
+  for (const table of registered) {
+    if (table.startsWith("__lattice_") || table.startsWith("_lattice_")) continue;
+    const cols = db.getRegisteredColumns(table);
+    if (cols && !("deleted_at" in cols)) {
+      const q3 = `"${table.replace(/"/g, '""')}"`;
+      await runAsyncOrSync(
+        db.adapter,
+        `ALTER TABLE ${q3} ADD COLUMN IF NOT EXISTS "deleted_at" TEXT`
+      );
+    }
+  }
+  await runAsyncOrSync(
+    db.adapter,
+    `DO $LATTICE$ BEGIN
+       IF to_regclass('__lattice_changelog') IS NOT NULL THEN
+         EXECUTE 'GRANT SELECT, INSERT ON "__lattice_changelog" TO ${MEMBER_GROUP}';
+       END IF;
+     END $LATTICE$`
+  );
 }
 async function secureNewCloudTable(db, table, pk) {
   if (db.getDialect() !== "postgres") return;
@@ -53854,14 +53927,6 @@ async function secureCloud(db) {
     await secureNewCloudTable(db, table, db.getPrimaryKey(table));
   }
   await reconcileCloudMemberAccess(db);
-  await runAsyncOrSync(
-    db.adapter,
-    `DO $LATTICE$ BEGIN
-       IF to_regclass('__lattice_user_identity') IS NOT NULL THEN
-         EXECUTE 'GRANT SELECT, INSERT, UPDATE ON "__lattice_user_identity" TO ${MEMBER_GROUP}';
-       END IF;
-     END $LATTICE$`
-  );
 }
 
 // src/index.ts
@@ -58741,7 +58806,7 @@ var appJs = `
         '<div class="view-header">' +
           '<span class="entity-icon">\u2699</span>' +
           '<h1>' + escapeHtml(tableName) + '</h1>' +
-          '<span class="count">' + entry.rowCount + ' row' + (entry.rowCount === 1 ? '' : 's') +
+          '<span class="count">' + (entry.rowCount == null ? 'no access' : (entry.rowCount + ' row' + (entry.rowCount === 1 ? '' : 's'))) +
             ' \xB7 read-only</span>' +
         '</div>' +
         '<div class="muted" style="margin-bottom:12px;font-size:13px;">' +
@@ -66298,6 +66363,7 @@ async function openConfig(configPath, outputDir, autoRender = false, realtimeWat
           ]);
           const views = viewsRaw;
           const knownTables = /* @__PURE__ */ new Set([...declared, ...discovered.map((t8) => t8.name)]);
+          const memberEntityDefs = [];
           for (const t8 of discovered) {
             if (declared.has(t8.name)) continue;
             if (t8.columns.length === 0) continue;
@@ -66305,17 +66371,25 @@ async function openConfig(configPath, outputDir, autoRender = false, realtimeWat
               discoveredJunctions.add(t8.name);
               continue;
             }
-            db.define(t8.name, {
+            const def = {
               columns: Object.fromEntries(t8.columns.map((c6) => [c6, "TEXT"])),
               ...t8.pk.length > 0 ? { primaryKey: t8.pk.length === 1 ? t8.pk[0] : t8.pk } : {},
               render: () => "",
               outputFile: `${t8.name}/.lattice/${t8.name}.md`
-            });
+            };
+            db.define(t8.name, def);
+            memberEntityDefs.push({ name: t8.name, definition: def });
           }
           for (const { name } of views) {
             const base = name.slice(0, -2);
             if (knownTables.has(base)) maskedReadViews.set(base, name);
           }
+          if (autoRender && memberEntityDefs.length > 0) {
+            const existingContexts = db.entityContexts();
+            for (const { table, definition } of deriveCanonicalContexts(memberEntityDefs)) {
+              if (!existingContexts.has(table)) db.defineEntityContext(table, definition);
+            }
+          }
         }
       }
     } catch {
@@ -67806,9 +67880,18 @@ async function startGuiServer(options) {
           }
           const tables = [];
           for (const r6 of rows) {
-            const cols = await active.db.introspectColumns(r6.name);
-            const rowCount = await active.db.count(r6.name);
-            tables.push({ name: r6.name, columns: cols, rowCount });
+            try {
+              const cols = await active.db.introspectColumns(r6.name);
+              const rowCount = await active.db.count(r6.name);
+              tables.push({ name: r6.name, columns: cols, rowCount });
+            } catch (err) {
+              const msg = err instanceof Error ? err.message : String(err);
+              if (/permission denied|does not exist/i.test(msg)) {
+                tables.push({ name: r6.name, columns: [], rowCount: null });
+              } else {
+                throw err;
+              }
+            }
           }
           sendJson(res, { tables });
           return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "latticesql",
-  "version": "3.3.2",
+  "version": "3.3.4",
   "description": "Persistent structured memory for AI agent systems — pluggable SQLite or Postgres backend, LLM context bridge",
   "type": "module",
   "main": "./dist/index.js",