okengine 0.17.2 → 0.18.4

package/src/elements/store/sql-rls-stamp.test.ts

@@ -15,10 +15,12 @@ import { createSqlStoreHandle } from "./sql-session.ts";
 function createTinyPoolClient(size = 2): PostgresClientLike & {
   readonly reserveCalls: { n: number };
   readonly rootBegins: { n: number };
+  readonly helperInstalls: { n: number };
 } {
   const slots = Array.from({ length: size }, () => ({ held: false }));
   const reserveCalls = { n: 0 };
   const rootBegins = { n: 0 };
+  const helperInstalls = { n: 0 };
 
   function checkout(): { held: boolean } {
     const idle = slots.find((slot) => !slot.held);
@@ -35,15 +37,18 @@ function createTinyPoolClient(size = 2): PostgresClientLike & {
   const client: PostgresClientLike & {
     readonly reserveCalls: { n: number };
     readonly rootBegins: { n: number };
+    readonly helperInstalls: { n: number };
   } = {
     reserveCalls,
     rootBegins,
+    helperInstalls,
     async reserve() {
       reserveCalls.n += 1;
       const slot = checkout();
       slot.held = true;
       return {
         async unsafe(sql) {
+          if (/CREATE OR REPLACE FUNCTION oke\.gate\(\)/.test(sql)) helperInstalls.n += 1;
           return rowsFor(sql);
         },
         release() {
@@ -53,6 +58,7 @@ function createTinyPoolClient(size = 2): PostgresClientLike & {
     },
     async unsafe(sql) {
       const slot = checkout();
+      if (/CREATE OR REPLACE FUNCTION oke\.gate\(\)/.test(sql)) helperInstalls.n += 1;
       const head = sql.trim().split(/\s+/)[0]?.toUpperCase();
       if (head === "BEGIN") {
         rootBegins.n += 1;
@@ -114,4 +120,25 @@ describe("sql-session RLS stamp on pooled postgres", () => {
     await expect(pool.unsafe("BEGIN")).resolves.toEqual([]);
     await expect(pool.unsafe("SET LOCAL ROLE oke_app")).rejects.toThrow("checkout timeout");
   });
+
+  test("concurrent identity bags on one connection install helpers exactly once (G8c fix)", async () => {
+    const pool = createTinyPoolClient(8);
+    const connection = await connectPostgres({ client: pool, role: "primary" });
+    // Fresh handles per identity — the pre-fix code installed per handle.
+    const mk = (userId: string) =>
+      createSqlStoreHandle("sql:app", {
+        connection,
+        classifications: new Map(),
+        routedRole: "primary",
+        domainDdl: "off",
+        rls: { gate: "member", userId, scopes: ["member"] },
+      });
+    const sessions = Array.from({ length: 6 }, (_, i) => mk(`user-${i}`));
+
+    await Promise.all(sessions.map((s) => s.raw(`SELECT id, owner FROM notes`)));
+
+    // One shared-conn install — concurrent CREATE OR REPLACE would otherwise
+    // race pg_proc (`tuple concurrently updated`).
+    expect(pool.helperInstalls.n).toBe(1);
+  });
 });

package/src/elements/store/sql-session.ts

@@ -14,6 +14,7 @@ import {
   type RlsIdentity,
 } from "../../drivers/pg-rls.ts";
 import { throwOke } from "../../kernel/errors.ts";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { maskRows, tableFromSql } from "./classify.ts";
 import { isMissingDomainRelationError } from "./missing-relation.ts";
 import {
@@ -46,6 +47,109 @@ export type InferSelectRow<T> = T extends { readonly $inferSelect: infer R } ? R
 /** Serialize stamp frames on a shared connection so concurrent identities cannot interleave. */
 const rlsStampTails = new WeakMap<SqlConnection, Promise<unknown>>();
 
+/**
+ * Runtime CDC sink — set once by the store runtime at boot. Write hooks call
+ * {@link notifySqlCdc} after committed DML; the sink feeds LiveQueryRuntime
+ * and (when a driver owns an outbox) durable multi-host delivery.
+ */
+export interface SqlCdcSink {
+  /** Deliver one captured change. */
+  (event: {
+    readonly tableName: string;
+    readonly op: "insert" | "update" | "delete";
+    readonly before: Record<string, unknown> | null;
+    readonly after: Record<string, unknown> | null;
+    /** Echoed `X-Oke-Mutation-Id` when the write rode an HTTP request. */
+    readonly mutationId?: string;
+  }): void | Promise<void>;
+}
+
+let sqlCdcSink: SqlCdcSink | null = null;
+
+/**
+ * Install the process-wide CDC sink. Idempotent — last install wins.
+ *
+ * @param sink - Store-runtime-owned delivery target
+ */
+export function setSqlCdcSink(sink: SqlCdcSink | null): void {
+  sqlCdcSink = sink;
+}
+
+/**
+ * True when `sql` starts with INSERT/UPDATE/DELETE on a domain table
+ * (excludes stamp preludes, txn control, DDL — see {@link isRlsStampExemptSql}).
+ *
+ * @param sql - Statement text with any placeholder style
+ */
+export function isCdcCandidateSql(sql: string): boolean {
+  return (
+    /^(insert|update|delete)\b/i.test(sql.trim()) && !/^(delete\s+from\s+oke_)/i.test(sql.trim())
+  );
+}
+
+/** Fire-and-forget CDC notification (never blocks or fails the write path). */
+function notifySqlCdc(event: {
+  readonly tableName: string;
+  readonly op: "insert" | "update" | "delete";
+  readonly before: Record<string, unknown> | null;
+  readonly after: Record<string, unknown> | null;
+}): void {
+  if (!sqlCdcSink) return;
+  const mutationId = currentCdcMutationId();
+  try {
+    const result = sqlCdcSink(mutationId !== undefined ? { ...event, mutationId } : event);
+    if (result instanceof Promise) void result.catch(() => undefined);
+  } catch {
+    // Telemetry must never break writes.
+  }
+}
+
+/**
+ * Ambient mutation id for the current async chain — read from the
+ * `X-Oke-Mutation-Id` request header by the HTTP layer and echoed onto CDC
+ * events so clients can dedupe their own writes (Realtime optimistic race
+ * contract).
+ */
+const cdcMutationStorage = new AsyncLocalStorage<{ readonly mutationId: string }>();
+
+/**
+ * Read the ambient mutation id, or `undefined` outside a stamped request.
+ */
+export function currentCdcMutationId(): string | undefined {
+  return cdcMutationStorage.getStore()?.mutationId;
+}
+
+/**
+ * Run `fn` with `mutationId` as the ambient CDC mutation id.
+ *
+ * @param mutationId - Client-supplied mutation correlation id
+ * @param fn - Flow execution whose store writes carry the id
+ */
+export async function withCdcMutationId<T>(mutationId: string, fn: () => Promise<T>): Promise<T> {
+  return cdcMutationStorage.run({ mutationId }, fn);
+}
+
+/**
+ * One helper-installation per CONNECTION, not per session handle.
+ *
+ * Concurrent identity bags share `sharedSqlConn`; installing per handle races
+ * `CREATE OR REPLACE FUNCTION oke.*` on the same `pg_proc` tuple and fails
+ * with `tuple concurrently updated`. The install promise is shared so the
+ * first stamped op installs and everyone else awaits it.
+ */
+const rlsHelperInstalls = new WeakMap<SqlConnection, Promise<void>>();
+
+async function ensureOkeRlsHelpers(connection: SqlConnection): Promise<void> {
+  let installing = rlsHelperInstalls.get(connection);
+  if (!installing) {
+    installing = installOkeRlsHelpers((sql) => connection.exec(sql));
+    rlsHelperInstalls.set(connection, installing);
+    // Failed install must not poison the cache — allow a retry.
+    void installing.catch(() => rlsHelperInstalls.delete(connection));
+  }
+  await installing;
+}
+
 /**
  * True when SQL must not enter an RLS identity frame (txn control or DDL).
  *
@@ -405,7 +509,6 @@ export function createSqlStoreHandle(
 ): SqlStoreHandle {
   const { connection, classifications, revealPii, rls } = options;
   const domainDdl: DomainDdlMode = options.domainDdl ?? "ensure";
-  let helpersReady = false;
 
   function mask(rows: SqlRow[], table?: string): SqlRow[] {
     return maskRows(rows, { classifications, table, revealPii });
@@ -448,10 +551,7 @@ export function createSqlStoreHandle(
 
   async function applyRlsStamp<T>(fn: (conn: SqlConnection) => Promise<T>): Promise<T> {
     if (!rls) return fn(connection);
-    if (!helpersReady) {
-      await installOkeRlsHelpers((sql) => connection.exec(sql));
-      helpersReady = true;
-    }
+    await ensureOkeRlsHelpers(connection);
     const frame = async (tx: SqlConnection): Promise<T> => {
       for (const stmt of buildRlsIdentityPreludeSql(rls)) {
         await tx.exec(stmt.sql, stmt.params ?? []);
@@ -470,13 +570,12 @@ export function createSqlStoreHandle(
     if (cols.length === 0) return;
     const name = resolveTableName(table);
     const pk = cols.find((c) => c.primary)?.sqlName;
-    // Postgres/PGLite INTEGER is 32-bit — abstract `integer` (ms timestamps via
-    // `now`) must map to BIGINT. SQLite INTEGER is flexible up to 64-bit.
-    const pgWideInt = connection.driverId === "postgres" || connection.driverId === "pglite";
+    // ddlTypeOf already widens the int family to BIGINT; memory/SQLite accept
+    // it too (dynamic typing), so no per-driver remap is needed.
+    void connection.driverId;
     const colSql = cols
       .map((c) => {
-        const base = pgWideInt && c.sqlType === "INTEGER" ? "BIGINT" : c.sqlType;
-        const typ = pk && c.sqlName === pk ? `${base} PRIMARY KEY` : base;
+        const typ = pk && c.sqlName === pk ? `${c.sqlType} PRIMARY KEY` : c.sqlType;
         return `${quoteIdent(c.sqlName)} ${typ}`;
       })
       .join(", ");
@@ -513,6 +612,30 @@ export function createSqlStoreHandle(
     return compileWhere(where);
   }
 
+  /**
+   * Postgres `row_to_json` images come back as JSON strings on pglite and
+   * objects on Bun.SQL — normalize to the JS row mapping (snake→camel).
+   *
+   * @param table - Table handle for column remapping
+   * @param image - Raw RETURNING cell
+   */
+  function jsonImageToJs(table: TableHandle | unknown, image: unknown): SqlRow | null {
+    if (image === null || image === undefined) return null;
+    let obj: Record<string, unknown>;
+    if (typeof image === "string") {
+      try {
+        obj = JSON.parse(image) as Record<string, unknown>;
+      } catch {
+        return null;
+      }
+    } else if (typeof image === "object") {
+      obj = image as Record<string, unknown>;
+    } else {
+      return null;
+    }
+    return toJs(table, [obj])[0] ?? null;
+  }
+
   /** Accumulated select state across the fluent chain. */
   interface SelectPlan {
     readonly where?: unknown;
@@ -641,8 +764,14 @@ export function createSqlStoreHandle(
             const placeholders = cols.map(() => "?").join(", ");
             const colList = cols.map(quoteIdent).join(", ");
             const params = cols.map((c) => prepared[c]);
-            const sql = `INSERT INTO ${quoteIdent(name)} (${colList}) VALUES (${placeholders})`;
-            await exec(sql, params);
+            const sql = `INSERT INTO ${quoteIdent(name)} (${colList}) VALUES (${placeholders}) RETURNING *`;
+            const inserted = await query(sql, params);
+            notifySqlCdc({
+              tableName: name,
+              op: "insert",
+              before: null,
+              after: toJs(table, inserted)[0] ?? null,
+            });
           };
           return {
             async returning() {
@@ -654,6 +783,12 @@ export function createSqlStoreHandle(
               const params = cols.map((c) => prepared[c]);
               const sql = `INSERT INTO ${quoteIdent(name)} (${colList}) VALUES (${placeholders}) RETURNING *`;
               const rows = await query(sql, params);
+              notifySqlCdc({
+                tableName: name,
+                op: "insert",
+                before: null,
+                after: (toJs(table, rows)[0] as Record<string, unknown>) ?? null,
+              });
               return mask(toJs(table, rows), name);
             },
             execute: runExecute,
@@ -680,11 +815,53 @@ export function createSqlStoreHandle(
               if (!compiled.clause) {
                 throw new Error("update().set().where(): condition required");
               }
-              const params = [...setEntries.map(([, v]) => v), ...compiled.params];
+              const pk = resolvePkColumn(table);
+              const setParams = setEntries.map(([, v]) => v);
+
+              // Single-statement before capture (postgres / pglite): the
+              // `__oke_old` CTE snapshots matched pre-images FOR UPDATE,
+              // joins the UPDATE, and RETURNING emits both JSON images in
+              // one round-trip. Binding order follows marker appearance:
+              // CTE(where) params first, then SET values.
+              if (RLS_CONTEXT_DRIVERS.has(connection.driverId)) {
+                const sql =
+                  `WITH __oke_old AS (` +
+                  `SELECT * FROM ${quoteIdent(name)} WHERE ${compiled.clause} FOR UPDATE` +
+                  `)` +
+                  ` UPDATE ${quoteIdent(name)} SET ${setSql}` +
+                  ` FROM __oke_old` +
+                  ` WHERE ${quoteIdent(name)}.${quoteIdent(pk)} = __oke_old.${quoteIdent(pk)}` +
+                  ` RETURNING row_to_json(__oke_old) AS __oke_before_data, row_to_json(${quoteIdent(name)}) AS __oke_after_data`;
+                const result = await query(sql, [...compiled.params, ...setParams]);
+                for (const rawRow of result) {
+                  notifySqlCdc({
+                    tableName: name,
+                    op: "update",
+                    before: jsonImageToJs(table, rawRow.__oke_before_data),
+                    after: jsonImageToJs(table, rawRow.__oke_after_data),
+                  });
+                }
+                return result.length;
+              }
+
+              // Fallback (memory): explicit pre-read then plain DML — the
+              // hook still emits true before-images, just via two statements.
+              const prior = await query(
+                `SELECT * FROM ${quoteIdent(name)} WHERE ${compiled.clause}`,
+                compiled.params,
+              );
               const result = await exec(
                 `UPDATE ${quoteIdent(name)} SET ${setSql} WHERE ${compiled.clause}`,
-                params,
+                [...setParams, ...compiled.params],
               );
+              for (const beforeRow of toJs(table, prior)) {
+                notifySqlCdc({
+                  tableName: name,
+                  op: "update",
+                  before: beforeRow,
+                  after: { ...beforeRow },
+                });
+              }
               return result.changes;
             },
           };
@@ -709,10 +886,19 @@ export function createSqlStoreHandle(
           await ensureFromMeta(table);
           const name = resolveTableName(table);
           const pk = resolvePkColumn(table);
-          const result = await exec(`DELETE FROM ${quoteIdent(name)} WHERE ${quoteIdent(pk)} = ?`, [
-            idValue,
-          ]);
-          return result.changes > 0;
+          // DELETE ... RETURNING * gives the full last image in one statement.
+          const rows = await query(
+            `DELETE FROM ${quoteIdent(name)} WHERE ${quoteIdent(pk)} = ? RETURNING *`,
+            [idValue],
+          );
+          if (rows.length === 0) return false;
+          notifySqlCdc({
+            tableName: name,
+            op: "delete",
+            before: toJs(table, rows)[0] ?? null,
+            after: null,
+          });
+          return true;
         })();
       }
       const builder: DeleteBuilder = {
@@ -723,11 +909,14 @@ export function createSqlStoreHandle(
           if (!compiled.clause) {
             throw new Error("delete().where(): condition required");
           }
-          const result = await exec(
-            `DELETE FROM ${quoteIdent(name)} WHERE ${compiled.clause}`,
+          const rows = await query(
+            `DELETE FROM ${quoteIdent(name)} WHERE ${compiled.clause} RETURNING *`,
             compiled.params,
           );
-          return result.changes;
+          for (const beforeRow of toJs(table, rows)) {
+            notifySqlCdc({ tableName: name, op: "delete", before: beforeRow, after: null });
+          }
+          return rows.length;
         },
       };
       return builder;
@@ -773,7 +962,16 @@ export function createSqlStoreHandle(
         const placeholders = cols.map(() => "?").join(", ");
         const colList = cols.map(quoteIdent).join(", ");
         const params = cols.map((c) => prepared[c]);
-        await exec(`INSERT INTO ${quoteIdent(name)} (${colList}) VALUES (${placeholders})`, params);
+        const rows = await query(
+          `INSERT INTO ${quoteIdent(name)} (${colList}) VALUES (${placeholders}) RETURNING *`,
+          params,
+        );
+        notifySqlCdc({
+          tableName: name,
+          op: "insert",
+          before: null,
+          after: toJs(table, rows)[0] ?? null,
+        });
         return { status: "upserted" as const };
       }
       if (upsertOptions?.onExisting !== "update") {
@@ -784,7 +982,45 @@ export function createSqlStoreHandle(
       if (setEntries.length === 0) return { status: "changed" as const };
       const setSql = setEntries.map(([col]) => `${quoteIdent(col)} = ?`).join(", ");
       const params = [...setEntries.map(([, v]) => v), ...compiled.params];
+      if (RLS_CONTEXT_DRIVERS.has(connection.driverId)) {
+        // Single-statement before/after capture — same shape as update().
+        // SET may include the PK (upsert keys) — exclude it from the UPDATE
+        // list to keep param order and row identity stable.
+        const pkCol = resolvePkColumn(table);
+        const setEntriesNoPk = setEntries.filter(([col]) => col !== pkCol);
+        const setSqlNoPk = setEntriesNoPk.map(([col]) => `${quoteIdent(col)} = ?`).join(", ");
+        const sql =
+          `WITH __oke_old AS (` +
+          `SELECT * FROM ${quoteIdent(name)} WHERE ${compiled.clause} FOR UPDATE` +
+          `)` +
+          ` UPDATE ${quoteIdent(name)} SET ${setSqlNoPk}` +
+          ` FROM __oke_old` +
+          ` WHERE ${quoteIdent(name)}.${quoteIdent(pkCol)} = __oke_old.${quoteIdent(pkCol)}` +
+          ` RETURNING row_to_json(__oke_old) AS __oke_before_data, row_to_json(${quoteIdent(name)}) AS __oke_after_data`;
+        const result = await query(sql, [...compiled.params, ...setEntriesNoPk.map(([, v]) => v)]);
+        for (const rawRow of result) {
+          notifySqlCdc({
+            tableName: name,
+            op: "update",
+            before: jsonImageToJs(table, rawRow.__oke_before_data),
+            after: jsonImageToJs(table, rawRow.__oke_after_data),
+          });
+        }
+        return { status: "changed" as const };
+      }
+      const prior = await query(
+        `SELECT * FROM ${quoteIdent(name)} WHERE ${compiled.clause}`,
+        compiled.params,
+      );
       await exec(`UPDATE ${quoteIdent(name)} SET ${setSql} WHERE ${compiled.clause}`, params);
+      for (const beforeRow of toJs(table, prior)) {
+        notifySqlCdc({
+          tableName: name,
+          op: "update",
+          before: beforeRow,
+          after: { ...beforeRow, ...values },
+        });
+      }
       return { status: "changed" as const };
     },
 
@@ -796,6 +1032,38 @@ export function createSqlStoreHandle(
       const colMeta = cols.find((c) => c.key === column || c.sqlName === column);
       const sqlCol = colMeta?.sqlName ?? column;
       const col = quoteIdent(sqlCol);
+      if (RLS_CONTEXT_DRIVERS.has(connection.driverId)) {
+        // Single statement: the CTE locks the row and carries only the PK
+        // (projecting more would make the bare SET target ambiguous against
+        // __oke_old's columns), UPDATE returns the after-image and new value
+        // in one round-trip.
+        const sql =
+          `WITH __oke_old AS (` +
+          `SELECT ${quoteIdent(pk)} FROM ${quoteIdent(name)} WHERE ${quoteIdent(pk)} = ? FOR UPDATE` +
+          `)` +
+          ` UPDATE ${quoteIdent(name)} SET ${col} = ${col} + ?` +
+          ` FROM __oke_old` +
+          ` WHERE ${quoteIdent(name)}.${quoteIdent(pk)} = __oke_old.${quoteIdent(pk)}` +
+          ` RETURNING row_to_json(${quoteIdent(name)}) AS __oke_after_data, ${col}`;
+        const result = await query(sql, [idValue, by]);
+        const row = result[0];
+        if (!row) {
+          throw new Error(`increment(): no row with ${pk} ${JSON.stringify(idValue)} in ${name}`);
+        }
+        notifySqlCdc({
+          tableName: name,
+          op: "update",
+          // No full pre-image in this single statement — the CTE projects
+          // just the PK. The runtime classifies a numeric-only mutation as
+          // an upsert event; revocation never needs this before-image.
+          before: null,
+          after: jsonImageToJs(table, row.__oke_after_data),
+        });
+        return asNumber(row[sqlCol], sqlCol);
+      }
+      const prior = await query(`SELECT * FROM ${quoteIdent(name)} WHERE ${quoteIdent(pk)} = ?`, [
+        idValue,
+      ]);
       const rows = await query(
         `UPDATE ${quoteIdent(name)} SET ${col} = ${col} + ? WHERE ${quoteIdent(pk)} = ? RETURNING ${col}`,
         [by, idValue],
@@ -804,6 +1072,12 @@ export function createSqlStoreHandle(
       if (!row) {
         throw new Error(`increment(): no row with ${pk} ${JSON.stringify(idValue)} in ${name}`);
       }
+      notifySqlCdc({
+        tableName: name,
+        op: "update",
+        before: toJs(table, prior)[0] ?? null,
+        after: null,
+      });
       return asNumber(row[sqlCol], sqlCol);
     },
 
@@ -863,21 +1137,9 @@ export function createSqlStoreHandle(
     async ensureTable(table: TableHandle) {
       const cols = Object.values(table.columns);
       const pk = resolvePkColumn(table);
-      const intType =
-        connection.driverId === "postgres" || connection.driverId === "pglite"
-          ? "BIGINT"
-          : "INTEGER";
       const colSql = cols
         .map((c) => {
-          const typ =
-            c.name === pk
-              ? "TEXT PRIMARY KEY"
-              : c.name === "clicks" ||
-                  c.name === "qty" ||
-                  c.name === "createdAt" ||
-                  c.name === "created_at"
-                ? intType
-                : "TEXT";
+          const typ = c.name === pk ? "TEXT PRIMARY KEY" : "TEXT";
           return `${quoteIdent(c.name)} ${typ}`;
         })
         .join(", ");

package/src/elements/store/table.ts

@@ -6,6 +6,7 @@
  */
 
 import type { ColumnClassification } from "../../manifest/types.ts";
+import { okid } from "../../okid.ts";
 
 /** Column descriptor with optional classification. */
 export interface ColumnDef {
@@ -59,8 +60,22 @@ export interface ResolvedColumn {
   readonly sqlName: string;
   /** Whether this column is the primary key. */
   readonly primary: boolean;
-  /** SQL type hint for DDL. */
-  readonly sqlType: "TEXT" | "INTEGER" | "REAL" | "BLOB";
+  /** Unparameterized Postgres DDL type for auto-DDL (`CREATE TABLE`). */
+  readonly sqlType:
+    | "TEXT"
+    | "INTEGER"
+    | "BIGINT"
+    | "REAL"
+    | "DOUBLE PRECISION"
+    | "NUMERIC"
+    | "BOOLEAN"
+    | "JSONB"
+    | "BYTEA"
+    | "POINT"
+    | "LINE"
+    | "TIMESTAMP"
+    | "DATE"
+    | "BLOB";
   /** Optional `$defaultFn` from Drizzle. */
   readonly defaultFn?: () => unknown;
 }
@@ -119,6 +134,57 @@ export function isDrizzleTable(t: Record<string, unknown>): boolean {
   return ("$" in t || "_" in t) && !("columns" in t);
 }
 
+/**
+ * Unparameterized Postgres DDL type for an abstract {@link FieldSqlType}.
+ *
+ * Mirrors each type's drizzle `getSQLType()` output minus parameters — the
+ * memory driver's `CREATE TABLE` parser comma-splits column defs, so
+ * `numeric(p, s)` parens are never emitted here. Precision/length remain
+ * migration-time concerns via drizzle-kit reading the emitted schema.
+ *
+ * @param sqlType - Declared SQL type primitive
+ */
+export function ddlTypeOf(sqlType: string): ResolvedColumn["sqlType"] {
+  switch (sqlType) {
+    case "smallint":
+    case "smallserial":
+      return "INTEGER";
+    case "integer":
+    case "bigint":
+    case "serial":
+    case "bigserial":
+      // Abstract integer (ms clocks) and int8 family widen to BIGINT.
+      return "BIGINT";
+    case "real":
+      return "REAL";
+    case "doublePrecision":
+      return "DOUBLE PRECISION";
+    case "numeric":
+      return "NUMERIC";
+    case "boolean":
+      return "BOOLEAN";
+    case "json":
+    case "jsonb":
+      // jsonb chosen for indexability; auto-DDL is a dev-only convenience.
+      return "JSONB";
+    case "bytea":
+      return "BYTEA";
+    case "point":
+      return "POINT";
+    case "line":
+      return "LINE";
+    case "timestamp":
+      return "TIMESTAMP";
+    case "date":
+      return "DATE";
+    case "BLOB":
+      return "BLOB";
+    default:
+      // text · varchar · char · uuid · time · interval · inet/cidr/mac* — text-shaped.
+      return "TEXT";
+  }
+}
+
 /**
  * Introspect columns from a TableHandle or Drizzle table.
  *
@@ -144,19 +210,11 @@ export function resolveColumns(table: unknown): ResolvedColumn[] {
           typeof col.primaryKey === "boolean"
             ? col.primaryKey
             : col.name === "id" || key === "id" || sqlName === "id";
-        const sqlType =
-          col.sqlType === "integer" || col.sqlType === "INTEGER"
-            ? ("INTEGER" as const)
-            : col.sqlType === "real" || col.sqlType === "REAL"
-              ? ("REAL" as const)
-              : col.sqlType === "blob" || col.sqlType === "BLOB"
-                ? ("BLOB" as const)
-                : ("TEXT" as const);
         return {
           key,
           sqlName,
           primary,
-          sqlType,
+          sqlType: ddlTypeOf(col.sqlType ?? ""),
           ...(typeof col.defaultFn === "function" ? { defaultFn: col.defaultFn } : {}),
         };
       });
@@ -219,13 +277,19 @@ function drizzleSqlType(
 ): ResolvedColumn["sqlType"] {
   const ct = (columnType ?? "").toLowerCase();
   const dt = (dataType ?? "").toLowerCase();
-  if (ct.includes("int") || dt.includes("int") || dt.includes("number")) {
-    return "INTEGER";
-  }
-  if (ct.includes("real") || ct.includes("numeric") || dt.includes("float")) {
-    return "REAL";
-  }
-  if (ct.includes("blob") || dt.includes("buffer")) return "BLOB";
+  if (ct.includes("bigint") || dt.includes("bigint")) return "BIGINT";
+  if (ct.includes("smallint")) return "INTEGER";
+  if (ct.includes("int") || dt.includes("int") || dt.includes("number")) return "INTEGER";
+  if (dt.includes("boolean") || ct.includes("bool")) return "BOOLEAN";
+  if (ct.includes("jsonb")) return "JSONB";
+  if (ct.includes("json")) return "JSONB";
+  if (ct.includes("bytea") || dt.includes("buffer")) return "BYTEA";
+  if (ct.includes("double precision")) return "DOUBLE PRECISION";
+  if (ct.includes("real") || dt.includes("float")) return "REAL";
+  if (ct.includes("numeric")) return "NUMERIC";
+  if (ct.includes("timestamp")) return "TIMESTAMP";
+  if (ct.startsWith("date")) return "DATE";
+  if (ct.includes("blob")) return "BLOB";
   return "TEXT";
 }
 
@@ -330,15 +394,32 @@ export function classificationsFromTable(table: TableHandle): Record<string, Col
 }
 
 /**
- * Generate a unique id (UUID). Suitable for `$defaultFn(id)` in schemas.
+ * Generate a unique id (21-char OKID, 126-bit entropy). Suitable for
+ * `$defaultFn(id)` in schemas.
  */
 export function id(): string {
-  return crypto.randomUUID();
+  return okid();
 }
 
 /**
- * Current epoch-ms. Suitable for `$defaultFn(now)` in schemas.
+ * Current epoch-ms. Suitable for `$defaultFn(now)` in schemas (number columns).
  */
 export function now(): number {
   return Date.now();
 }
+
+/**
+ * Current instant as an ISO-8601 string. The resolved default for `.now()` on
+ * string-typed temporal columns (`timestamp` / `date` in string mode).
+ */
+export function nowIso(): string {
+  return new Date().toISOString();
+}
+
+/**
+ * Current instant as a `Date`. The resolved default for `.now()` on temporal
+ * columns declared with `{ mode: "date" }`.
+ */
+export function nowDate(): Date {
+  return new Date();
+}