okmodel 0.1.1 → 0.3.0

package/dist/shared/{05w44d8g.js → 2ssqrv66.js}

@@ -1,170 +1,419 @@
 import {
   creationOrder2,
   renameColumn2,
-  renameTable2,
-  serializeCatalog2,
-  catalogHash2,
-  parseCatalog2
-} from "./y9m15dfv.js";
+  renameTable2
+} from "./t616ynfn.js";
 import {
-  quoteLiteral,
-  ColumnBuilder2,
-  snakeCase,
-  emittedTypeName
-} from "./gk7cs7sp.js";
+  quoteIdent,
+  ownedByView,
+  dropObjectSql,
+  createObjectSql,
+  functionSql,
+  viewSql,
+  refreshMaterializedViewSql,
+  alterColumnSql,
+  identitySequence,
+  createTableSql,
+  qualify
+} from "./wekze34d.js";
 import {
-  catalog,
+  isExactVersion,
+  compareExtensionVersions,
+  sameExtensionDefinition
+} from "./th14ygv2.js";
+import {
+  isDomain,
   sameEnumLabels
-} from "./g5fhqmwe.js";
+} from "./qbxzvwwc.js";
+import {
+  quoteLiteral
+} from "./94ez8kzh.js";
 import {
   staticNamespace2,
   identityKey2,
+  identityLabel2,
   compareText
-} from "./j5cn2963.js";
+} from "./t4tbsy9h.js";
+import {
+  fitIdentifier2
+} from "./nfzc5z0w.js";
 import {
   OkmError2
-} from "./ycwz42az.js";
+} from "./52szzakm.js";
 
-// src/dialects/pg/ddl.ts
-function quoteIdent(name) {
-  return `"${name.replaceAll('"', '""')}"`;
+// src/dialects/pg/role/sql.ts
+var PRIVILEGE = /^(select|insert|update|delete|execute|usage)$/;
+function privilegeSql(before, after, schema) {
+  const beforeBy = index(before);
+  const afterBy = index(after);
+  const revoke = [];
+  const roles = [];
+  const defaults = [];
+  const grant = [];
+  for (const [key, object] of beforeBy) {
+    if (afterBy.has(key))
+      continue;
+    if (object.kind === "grant")
+      revoke.push(grantStatement(object, schema, true));
+    if (object.kind === "defaultPrivilege")
+      revoke.push(defaultStatement(object, true));
+  }
+  for (const [key, object] of afterBy) {
+    const previous = beforeBy.get(key);
+    if (object.kind === "role") {
+      if (object.owner !== "managed")
+        continue;
+      if (previous === undefined) {
+        roles.push(createRoleSql(object));
+        continue;
+      }
+      if (previous.kind !== "role" || previous.owner !== "managed")
+        continue;
+      if (previous.definition.login !== object.definition.login || previous.definition.inherit !== object.definition.inherit) {
+        roles.push(alterRoleSql(object));
+      }
+      continue;
+    }
+    if (previous !== undefined)
+      continue;
+    if (object.kind === "defaultPrivilege")
+      defaults.push(defaultStatement(object, false));
+    if (object.kind === "grant")
+      grant.push(grantStatement(object, schema, false));
+  }
+  return { revoke, prepare: [...roles, ...defaults], grant };
+}
+function createdRoleName(sql) {
+  const match = /^\s*create\s+role\s+(?:"([^"]+)"|([A-Za-z_][\w$]*))/i.exec(sql);
+  const quoted = match?.[1];
+  if (quoted !== undefined)
+    return quoted.replaceAll('""', '"');
+  return match?.[2];
+}
+function changesRole(sql) {
+  return /^\s*(create|alter)\s+role\b/i.test(sql);
+}
+function index(objects) {
+  const by = new Map;
+  for (const object of objects) {
+    if (object.kind !== "role" && object.kind !== "grant" && object.kind !== "defaultPrivilege") {
+      continue;
+    }
+    by.set(identityKey2(object.identity), object);
+  }
+  return by;
+}
+function createRoleSql(object) {
+  return `create role ${quoteIdent(object.identity.name)} with nosuperuser nocreatedb nocreaterole ${inherit(object)} ${login(object)}`;
+}
+function alterRoleSql(object) {
+  return `alter role ${quoteIdent(object.identity.name)} with ${inherit(object)} ${login(object)}`;
+}
+function login(object) {
+  return object.definition.login ? "login" : "nologin";
+}
+function inherit(object) {
+  return object.definition.inherit ? "inherit" : "noinherit";
+}
+function grantStatement(object, schema, revoke) {
+  const privilege = object.identity.privilege.toLowerCase();
+  assertPrivilege(privilege);
+  const verb = revoke ? "revoke" : "grant";
+  const direction = revoke ? "from" : "to";
+  return `${verb} ${privilege} on ${grantTarget(object.identity.object, schema)} ${direction} ${quoteIdent(object.identity.role)}`;
+}
+function defaultStatement(object, revoke) {
+  const privilege = object.identity.privilege.toLowerCase();
+  assertPrivilege(privilege);
+  const verb = revoke ? "revoke" : "grant";
+  const direction = revoke ? "from" : "to";
+  const namespace = object.identity.namespace.form === "static" ? object.identity.namespace.name : "public";
+  return `alter default privileges for role ${quoteIdent(object.identity.forRole)} in schema ${quoteIdent(namespace)} ${verb} ${privilege} on ${objectKindSql(object.identity.objectKind)} ${direction} ${quoteIdent(object.identity.grantee)}`;
+}
+function grantTarget(object, schema) {
+  const name = object.namespace.form === "static" ? object.namespace.name : schema;
+  if (object.kind === "sequence")
+    return `sequence ${qualify(name, object.name)}`;
+  if (object.kind === "function")
+    return functionTarget(object.name, name);
+  if (object.kind === "namespace")
+    return `schema ${quoteIdent(object.name)}`;
+  return `table ${qualify(name, object.name)}`;
+}
+function functionTarget(name, schema) {
+  const open = name.lastIndexOf("(");
+  if (open < 0 || !name.endsWith(")"))
+    return `function ${qualify(schema, name)}()`;
+  const fn = name.slice(0, open);
+  const args = name.slice(open + 1, -1);
+  return `function ${qualify(schema, fn)}(${args})`;
+}
+function objectKindSql(kind) {
+  if (kind === "function")
+    return "functions";
+  if (kind === "sequence")
+    return "sequences";
+  return "tables";
+}
+function assertPrivilege(privilege) {
+  if (!PRIVILEGE.test(privilege)) {
+    throw new OkmError2("invalid", `Privilege ${privilege} is not emitted.`, {
+      fix: {
+        summary: "Grants in this version are select, insert, update, delete, execute, and usage."
+      }
+    });
+  }
 }
-function dropObjectSql(object, schema) {
-  if (object.owner === "ignored")
+
+// src/tooling/migrate/extensions.ts
+var CREATE_EXTENSION = /^\s*create\s+extension\s+(?:"([^"]+)"|([A-Za-z_][\w$]*))/i;
+var UPDATE_EXTENSION = /^\s*alter\s+extension\s+(?:"([^"]+)"|([A-Za-z_][\w$]*))\s+update\s+to\s+'([^']*)'/i;
+function extensionAlterSteps(beforeBy, afterBy, dropKeys) {
+  refuseDrops(beforeBy, afterBy, dropKeys);
+  const steps = [];
+  for (const after of afterBy.values()) {
+    if (after.kind !== "extension")
+      continue;
+    const before = beforeBy.get(identityKey2(after.identity));
+    if (before === undefined || before.kind !== "extension")
+      continue;
+    if (sameExtensionDefinition(before, after))
+      continue;
+    steps.push(...alterExtension(before, after));
+  }
+  return steps;
+}
+async function assertExtensionsAvailable(connection, migrations) {
+  const creates = new Set;
+  const updates = [];
+  for (const migration of migrations) {
+    for (const step of migration.steps) {
+      const created = CREATE_EXTENSION.exec(step.sql);
+      const name = created?.[1] ?? created?.[2];
+      if (name !== undefined)
+        creates.add(name.replaceAll('""', '"'));
+      const updated = UPDATE_EXTENSION.exec(step.sql);
+      const updateName = updated?.[1] ?? updated?.[2];
+      const version = updated?.[3];
+      if (updateName !== undefined && version !== undefined) {
+        updates.push({ name: updateName.replaceAll('""', '"'), version });
+      }
+    }
+  }
+  if (creates.size === 0 && updates.length === 0)
     return;
-  switch (object.kind) {
-    case "table":
-      return `drop table ${qualify(schema, object.identity.name)}`;
-    case "column":
-      return `alter table ${qualify(schema, object.identity.parent.name)} drop column ${quoteIdent(object.identity.name)}`;
-    case "index":
-      return `drop index ${qualify(schema, object.identity.name)}`;
-    case "constraint":
-      return `alter table ${qualify(schema, object.identity.parent.name)} drop constraint ${quoteIdent(object.identity.name)}`;
-    case "sequence":
-      return `drop sequence ${qualify(schema, object.identity.name)}`;
-    case "type":
-      return `drop type ${qualify(schema, object.identity.name)}`;
-    default:
-      return;
+  const names = [...creates, ...updates.map((item) => item.name)];
+  const available = await availableExtensions(connection, names);
+  for (const name of creates) {
+    if (!available.has(name)) {
+      throw new OkmError2("OKM1811", `Extension ${name} is not available on the server. Nothing was changed.`, { fix: { summary: "Install the extension, or remove the declaration." } });
+    }
+  }
+  for (const update of updates) {
+    if (!available.has(update.name)) {
+      throw new OkmError2("OKM1811", `Extension ${update.name} is not available on the server. Nothing was changed.`, { fix: { summary: "Install the extension, or remove the declaration." } });
+    }
+    const installed = await installedVersion(connection, update.name);
+    if (installed === undefined) {
+      throw new OkmError2("OKM1811", `Extension ${update.name} is not installed, so it cannot be updated. Nothing was changed.`, { fix: { summary: "Create the extension before updating it." } });
+    }
+    const path = await updatePath(connection, update.name, installed, update.version);
+    if (!path) {
+      throw new OkmError2("OKM1814", `Extension ${update.name} has no update path from ${installed} to ${update.version}. Nothing was changed.`, {
+        fix: {
+          summary: "Drop or move the dependents first. Postgres cannot lower an extension version."
+        }
+      });
+    }
   }
 }
-function createObjectSql(object, schema) {
-  switch (object.kind) {
-    case "column":
-      return `alter table ${qualify(schema, object.identity.parent.name)} add column ${columnSql(object)}`;
-    case "index":
-      return createIndexSql(object, schema);
-    case "constraint":
-      return `alter table ${qualify(schema, object.identity.parent.name)} add constraint ${quoteIdent(object.identity.name)} ${constraintBody(object, schema)}`;
-    case "sequence":
-      return createSequenceSql(object, schema);
-    case "type":
-      return createEnumSql(object, schema);
-    case "table":
-      return;
-    default:
-      return;
+function refuseDrops(beforeBy, afterBy, dropKeys) {
+  for (const key of dropKeys) {
+    const object = beforeBy.get(key);
+    if (object?.kind !== "extension")
+      continue;
+    for (const after of afterBy.values()) {
+      const used = after.dependencies.some((edge) => edge.target.kind === "extension" && edge.target.name === object.identity.name);
+      if (!used)
+        continue;
+      throw new OkmError2("OKM1814", `Extension ${object.identity.name} still has dependents. Nothing was dropped.`, {
+        fix: {
+          summary: "Drop or move the dependents first. Postgres cannot lower an extension version."
+        }
+      });
+    }
   }
 }
-function alterColumnSql(before, after, schema) {
-  const statements = [];
-  const table = qualify(schema, after.identity.parent.name);
+function alterExtension(before, after) {
+  const steps = [];
   const name = quoteIdent(after.identity.name);
-  if (before.definition.dataType !== after.definition.dataType) {
-    statements.push(`alter table ${table} alter column ${name} set data type ${after.definition.dataType} using ${name}::${after.definition.dataType}`);
+  if (before.definition.schema !== after.definition.schema) {
+    if (!after.definition.relocatable) {
+      throw new OkmError2("OKM1814", `Extension ${after.identity.name} is not relocatable, so it cannot move to ${after.definition.schema}.`, {
+        fix: {
+          summary: "Drop or move the dependents first. Postgres cannot lower an extension version."
+        }
+      });
+    }
+    steps.push({
+      sql: `alter extension ${name} set schema ${quoteIdent(after.definition.schema)}`,
+      class: "contract",
+      action: "ddl",
+      lock: "ACCESS EXCLUSIVE",
+      transactional: true
+    });
   }
-  if (before.definition.nullable !== after.definition.nullable) {
-    statements.push(`alter table ${table} alter column ${name} ${after.definition.nullable ? "drop not null" : "set not null"}`);
+  const previous = before.definition.version;
+  const next = after.definition.version;
+  if (!isExactVersion(previous) || !isExactVersion(next) || previous === next)
+    return steps;
+  if (compareExtensionVersions(next, previous) < 0) {
+    throw new OkmError2("OKM1814", `Extension ${after.identity.name} cannot move from ${previous} to ${next}. Postgres cannot lower an extension version.`, {
+      fix: {
+        summary: "Drop or move the dependents first. Postgres cannot lower an extension version."
+      }
+    });
   }
-  if (before.definition.defaultExpression !== after.definition.defaultExpression) {
-    statements.push(after.definition.defaultExpression === undefined ? `alter table ${table} alter column ${name} drop default` : `alter table ${table} alter column ${name} set default ${after.definition.defaultExpression}`);
+  steps.push({
+    sql: `alter extension ${name} update to ${quoteLiteral(next)}`,
+    class: "expand",
+    action: "ddl",
+    lock: "ACCESS EXCLUSIVE",
+    transactional: true,
+    path: "unverified"
+  });
+  return steps;
+}
+async function availableExtensions(connection, names) {
+  const listed = await connection.execute(`select name from pg_available_extensions where name in (${names.map((_, index) => `$${String(index + 1)}`).join(", ")})`, names);
+  const found = new Set;
+  for (const row of listed.rows) {
+    const name = row[0];
+    if (typeof name === "string")
+      found.add(name);
   }
-  return statements;
+  return found;
 }
-function identitySequence(sequence, source) {
-  const key = identityKey2(sequence.identity);
-  return source.objects.some((object) => {
-    if (object.kind !== "column" || object.definition.identity === undefined)
-      return false;
-    return object.dependencies.some((edge) => identityKey2(edge.target) === key);
-  });
+async function installedVersion(connection, name) {
+  const result = await connection.execute("select extversion from pg_extension where extname = $1", [name]);
+  const version = result.rows[0]?.[0];
+  return typeof version === "string" ? version : undefined;
+}
+async function updatePath(connection, name, source, target) {
+  const result = await connection.execute("select path from pg_extension_update_paths($1) where source = $2 and target = $3", [name, source, target]);
+  const path = result.rows[0]?.[0];
+  return typeof path === "string" && path.length > 0;
 }
-function createTableSql(tableObject, source, schema) {
-  const parent = tableObject.identity.name;
-  const columns = source.objects.filter((object) => object.kind === "column" && object.identity.parent.name === parent);
-  const primary = source.objects.find((object) => object.kind === "constraint" && object.definition.constraintKind === "primaryKey" && object.identity.parent.name === parent);
-  const lines = columns.map((column) => columnSql(column));
-  if (primary !== undefined) {
-    const cols = primary.definition.columns.map((name) => quoteIdent(name)).join(", ");
-    lines.push(`primary key (${cols})`);
-  }
-  const partition = tableObject.definition.partition;
-  const tail = partition === undefined ? "" : ` partition by ${partition.method} (${partition.columns.map((name) => quoteIdent(name)).join(", ")})`;
-  return `create table ${qualify(schema, parent)} (
-  ${lines.join(`,
-  `)}
-)${tail}`;
-}
-function createEnumSql(object, schema) {
-  const labels = object.definition.labels.map((label) => quoteLiteral(label)).join(", ");
-  return `create type ${qualify(schema, object.identity.name)} as enum (${labels})`;
-}
-function columnSql(column) {
-  const definition = column.definition;
-  let sql = `${quoteIdent(column.identity.name)} ${definition.dataType}`;
-  if (definition.identity !== undefined) {
-    sql += definition.identity.always ? " generated always as identity" : " generated by default as identity";
-  } else if (definition.generated !== undefined) {
-    sql += ` generated always as (${definition.generated.expression}) stored`;
-  }
-  if (!definition.nullable)
-    sql += " not null";
-  if (definition.defaultExpression !== undefined)
-    sql += ` default ${definition.defaultExpression}`;
-  return sql;
-}
-function createIndexSql(object, schema) {
-  const unique = object.definition.unique ? "unique " : "";
-  const target = object.definition.expression !== undefined ? `(${object.definition.expression})` : object.definition.columns.map((name) => quoteIdent(name)).join(", ");
-  const where = object.definition.predicate === undefined ? "" : ` where ${object.definition.predicate}`;
-  return `create ${unique}index ${quoteIdent(object.identity.name)} on ${qualify(schema, object.identity.parent.name)} (${target})${where}`;
-}
-function createSequenceSql(object, schema) {
-  const definition = object.definition;
-  const cycle = definition.cycle ? " cycle" : "";
-  return `create sequence ${qualify(schema, object.identity.name)} as ${definition.dataType} start ${definition.start} increment ${definition.increment}${cycle}`;
-}
-function constraintBody(object, schema) {
-  const definition = object.definition;
-  const columns = definition.columns.map((name) => quoteIdent(name)).join(", ");
-  switch (definition.constraintKind) {
-    case "primaryKey":
-      return `primary key (${columns})`;
-    case "unique": {
-      const nulls = definition.nullsNotDistinct ? " nulls not distinct" : "";
-      return `unique${nulls} (${columns})${deferClause(definition)}`;
+
+// src/tooling/migrate/managed.ts
+var MANAGED_TABLES = new Set(["okm_meta", "okm_history"]);
+function omitManagedObjects(source) {
+  let dropped = false;
+  const objects = [];
+  for (const object of source.objects) {
+    if (ownedByMigration(object)) {
+      dropped = true;
+      continue;
     }
-    case "check":
-      return `check (${definition.expression ?? "true"})${deferClause(definition)}`;
-    case "foreignKey": {
-      const references = definition.references;
-      const target = references === undefined ? "" : ` references ${qualify(schema, references.parent.name)} (${references.columns.map((name) => quoteIdent(name)).join(", ")})`;
-      const onDelete = references?.onDelete === undefined ? "" : ` on delete ${references.onDelete}`;
-      const onUpdate = references?.onUpdate === undefined ? "" : ` on update ${references.onUpdate}`;
-      return `foreign key (${columns})${target}${onDelete}${onUpdate}${deferClause(definition)}`;
+    objects.push(object);
+  }
+  if (!dropped)
+    return source;
+  return { version: source.version, objects };
+}
+function ownedByMigration(object) {
+  switch (object.kind) {
+    case "table":
+    case "view":
+    case "materializedView":
+      return MANAGED_TABLES.has(object.identity.name);
+    case "column":
+    case "index":
+    case "constraint":
+    case "trigger":
+      return MANAGED_TABLES.has(object.identity.parent.name);
+    case "sequence":
+      return managedSequence(object.identity.name);
+    case "grant": {
+      const target = object.identity.object;
+      if (target.kind === "namespace")
+        return false;
+      if (target.kind === "sequence" || target.kind === "function") {
+        return managedSequence(target.name);
+      }
+      return MANAGED_TABLES.has(target.name);
     }
     default:
-      return definition.constraintKind;
+      return false;
   }
 }
-function deferClause(definition) {
-  if (!definition.deferrable)
-    return "";
-  return ` deferrable initially ${definition.initially}`;
+function managedSequence(name) {
+  return name === "okm_meta" || name === "okm_history" || name.startsWith("okm_meta_") || name.startsWith("okm_history_");
+}
+
+// src/tooling/migrate/type-name.ts
+function canonicalTypeName(typeName) {
+  const suffix = arraySuffix(typeName);
+  const scalar = suffix.length === 0 ? typeName : typeName.slice(0, -suffix.length);
+  return canonicalScalar(scalar) + suffix;
+}
+function arraySuffix(typeName) {
+  let end = typeName.length;
+  let suffix = "";
+  while (end >= 2 && typeName.endsWith("[]", end)) {
+    suffix = `[]${suffix}`;
+    end -= 2;
+  }
+  return suffix;
+}
+function canonicalScalar(typeName) {
+  const varying = /^(?:varchar|character varying)(\(\d+\))$/.exec(typeName);
+  if (varying !== null)
+    return `character varying${varying[1] ?? ""}`;
+  const fixed = /^(?:char|character)(\(\d+\))$/.exec(typeName);
+  if (fixed !== null)
+    return `character${fixed[1] ?? ""}`;
+  const timed = /^(timestamp with time zone|timestamp without time zone|time with time zone|time without time zone|timestamptz|timestamp|timetz|time)(\(\d+\))?$/.exec(typeName);
+  if (timed !== null)
+    return canonicalTime(timed[1] ?? "", timed[2] ?? "");
+  const numeric = /^(?:decimal|numeric)(\(\d+(?:,\d+)?\))?$/.exec(typeName);
+  if (numeric !== null)
+    return `numeric${numeric[1] ?? ""}`;
+  switch (typeName) {
+    case "int":
+    case "int4":
+    case "integer":
+      return "integer";
+    case "int8":
+    case "bigint":
+      return "bigint";
+    case "int2":
+    case "smallint":
+      return "smallint";
+    case "bool":
+    case "boolean":
+      return "boolean";
+    case "float8":
+    case "double precision":
+      return "double precision";
+    case "float4":
+    case "real":
+      return "real";
+    default:
+      return typeName;
+  }
 }
-function qualify(schema, name) {
-  return `${quoteIdent(schema)}.${quoteIdent(name)}`;
+function canonicalTime(name, precision) {
+  if (name === "timestamptz" || name === "timestamp with time zone") {
+    return `timestamp${precision} with time zone`;
+  }
+  if (name === "timestamp" || name === "timestamp without time zone") {
+    return `timestamp${precision} without time zone`;
+  }
+  if (name === "timetz" || name === "time with time zone") {
+    return `time${precision} with time zone`;
+  }
+  return `time${precision} without time zone`;
 }
 
 // src/tooling/migrate/values.ts
@@ -213,23 +462,32 @@ var ACCESS = "ACCESS EXCLUSIVE";
 var SHARE = "SHARE";
 var SHARE_UPDATE = "SHARE UPDATE EXCLUSIVE";
 var ROW = "ROW EXCLUSIVE";
-function planMigration(request) {
+function planMigration(input) {
+  const request = {
+    ...input,
+    before: omitManagedObjects(input.before),
+    after: omitManagedObjects(input.after)
+  };
   const schema = request.schema ?? "public";
   const renames = request.renames ?? [];
   const replacements = request.replacements ?? [];
   assertNoChains(replacements);
   const renamed = applyRenames(request.before, renames);
-  const beforeList = index(renamed);
-  const afterList = index(request.after);
+  const beforeList = index2(renamed);
+  const afterList = index2(request.after);
   const beforeBy = new Map(beforeList.map((item) => [item.key, item.object]));
   const afterBy = new Map(afterList.map((item) => [item.key, item.object]));
   assertUnambiguous(beforeBy, afterBy);
   const dropKeys = new Set;
   const createKeys = new Set;
+  const replaces = [];
   const alters = [];
   for (const item of beforeList) {
-    if (!afterBy.has(item.key))
+    if (!afterBy.has(item.key)) {
+      if (item.object.kind === "role")
+        continue;
       dropKeys.add(item.key);
+    }
   }
   for (const item of afterList) {
     if (!beforeBy.has(item.key))
@@ -239,8 +497,24 @@ function planMigration(request) {
     const previous = beforeBy.get(item.key);
     if (previous === undefined || sameDefinition(previous, item.object))
       continue;
-    if (previous.kind === "type" && item.object.kind === "type")
+    if (previous.kind === "extension" && item.object.kind === "extension")
+      continue;
+    if (previous.kind === "role" && item.object.kind === "role")
+      continue;
+    if (previous.kind === "function" && item.object.kind === "function" && canonicalTypeName(previous.definition.returns) === canonicalTypeName(item.object.definition.returns)) {
+      replaces.push({ kind: "function", before: previous, after: item.object });
+      continue;
+    }
+    if (previous.kind === "view" && item.object.kind === "view") {
+      if (columnsAppended(previous.definition.columns, item.object.definition.columns)) {
+        replaces.push({ kind: "view", before: previous, after: item.object });
+        continue;
+      }
+    }
+    if (previous.kind === "type" && item.object.kind === "type") {
+      refuseDomainBaseChange(previous, item.object);
       continue;
+    }
     if (previous.kind === "column" && item.object.kind === "column" && columnAlterable(previous, item.object)) {
       alters.push({ before: previous, after: item.object });
       continue;
@@ -253,17 +527,51 @@ function planMigration(request) {
   const enums = enumEdits(beforeBy, afterBy, schema);
   requireReplacements(picklists, enums, replacements);
   recreateDependents(beforeList, afterList, alters, dropKeys, createKeys, picklists);
+  recreateRoutineDependents(afterList, dropKeys, createKeys);
+  recreateViewDependents(afterList, dropKeys, createKeys);
+  refuseRoutineDrops(beforeBy, afterBy, dropKeys);
   omitOwnedSequences(createKeys, afterBy, request.after);
   omitOwnedSequences(dropKeys, beforeBy, renamed);
+  const privileges = privilegeSql(renamed.objects, request.after.objects, schema);
   const steps = [];
   steps.push(...renameSteps(request.before, renames, schema));
+  for (const sql of privileges.revoke)
+    steps.push(step(sql, "contract", "ddl", ACCESS));
   steps.push(...keptNames.map((item) => renameShapeStep(item, schema)));
   steps.push(...enumAddSteps(enums));
+  steps.push(...domainCheckSteps(beforeBy, afterBy, schema));
   steps.push(...expandBackfills(picklists, enums, replacements, schema));
   const droppedTables = new Set([...dropKeys].map((key) => beforeBy.get(key)).filter((object) => object?.kind === "table").map((object) => object.identity.name));
   const deferred = new Set(picklists.map((change) => identityKey2(change.before.identity)));
   const typeDrops = [];
-  for (const object of [...creationOrder2(renamed)].reverse()) {
+  const extensionDrops = [];
+  const reverse = [...creationOrder2(renamed)].reverse();
+  const emitDrop = (object) => {
+    const key = identityKey2(object.identity);
+    if (!dropKeys.has(key) || deferred.has(key) || covered(object, droppedTables))
+      return;
+    const sql = dropObjectSql(object, schema);
+    if (sql === undefined)
+      return;
+    steps.push(step(sql, "contract", "ddl", ACCESS));
+  };
+  for (const object of reverse)
+    if (object.kind === "trigger")
+      emitDrop(object);
+  for (const object of reverse)
+    if (object.kind === "function")
+      emitDrop(object);
+  for (const object of reverse)
+    if (ownedByView(object))
+      emitDrop(object);
+  for (const object of reverse) {
+    if (object.kind === "view" || object.kind === "materializedView")
+      emitDrop(object);
+  }
+  for (const object of reverse) {
+    if (object.kind === "trigger" || object.kind === "function" || object.kind === "view" || object.kind === "materializedView" || ownedByView(object)) {
+      continue;
+    }
     const key = identityKey2(object.identity);
     if (!dropKeys.has(key) || deferred.has(key) || covered(object, droppedTables))
       continue;
@@ -271,19 +579,27 @@ function planMigration(request) {
       typeDrops.push(object);
       continue;
     }
+    if (object.kind === "extension") {
+      extensionDrops.push(object);
+      continue;
+    }
+    emitDrop(object);
+  }
+  for (const object of typeDrops) {
     const sql = dropObjectSql(object, schema);
     if (sql === undefined)
       continue;
     steps.push(step(sql, "contract", "ddl", ACCESS));
   }
-  for (const object of typeDrops) {
+  for (const object of extensionDrops) {
     const sql = dropObjectSql(object, schema);
     if (sql === undefined)
       continue;
     steps.push(step(sql, "contract", "ddl", ACCESS));
   }
+  steps.push(...extensionAlterSteps(beforeBy, afterBy, dropKeys));
   for (const change of alters) {
-    for (const sql of alterColumnSql(change.before, change.after, schema)) {
+    for (const sql of alterColumnSql(alignedColumnType(change.before, change.after), change.after, schema)) {
       steps.push(step(sql, alterClass(sql), "ddl", ACCESS));
     }
     const identitySql = identityChangeSql(change.before, change.after, schema);
@@ -292,6 +608,20 @@ function planMigration(request) {
   }
   const createdTables = new Set([...createKeys].map((key) => afterBy.get(key)).filter((object) => object?.kind === "table").map((object) => object.identity.name));
   const emitted = new Set;
+  for (const sql of privileges.prepare)
+    steps.push(step(sql, "expand", "ddl", ACCESS));
+  for (const object of creationOrder2(request.after)) {
+    if (object.kind !== "extension")
+      continue;
+    const key = identityKey2(object.identity);
+    if (!createKeys.has(key) || emitted.has(key))
+      continue;
+    emitted.add(key);
+    const sql = createObjectSql(object, schema);
+    if (sql === undefined)
+      continue;
+    steps.push(step(sql, "expand", "ddl", ACCESS));
+  }
   for (const object of creationOrder2(request.after)) {
     if (object.kind !== "type")
       continue;
@@ -305,8 +635,9 @@ function planMigration(request) {
     steps.push(step(sql, "expand", "ddl", ACCESS));
   }
   for (const object of creationOrder2(request.after)) {
-    if (object.kind === "type")
+    if (object.kind === "type" || object.kind === "extension" || object.kind === "function" || object.kind === "trigger" || object.kind === "view" || object.kind === "materializedView" || ownedByView(object)) {
       continue;
+    }
     const key = identityKey2(object.identity);
     if (deferred.has(key))
       continue;
@@ -327,6 +658,59 @@ function planMigration(request) {
       continue;
     steps.push(step(sql, "expand", "ddl", object.kind === "index" ? SHARE : ACCESS));
   }
+  for (const change of replaces) {
+    if (sameDefinition(change.before, change.after))
+      continue;
+    const key = identityKey2(change.after.identity);
+    if (dropKeys.has(key) && createKeys.has(key))
+      continue;
+    const sql = change.kind === "function" ? functionSql(change.after, schema, true) : viewSql(change.after, schema, true);
+    steps.push({
+      sql,
+      class: "expand",
+      action: "ddl",
+      lock: ACCESS,
+      transactional: true,
+      behavior: "change"
+    });
+  }
+  for (const kind of ["function", "trigger", "view", "materializedView"]) {
+    for (const object of creationOrder2(request.after)) {
+      if (object.kind !== kind)
+        continue;
+      const key = identityKey2(object.identity);
+      if (!createKeys.has(key) || emitted.has(key))
+        continue;
+      emitted.add(key);
+      const sql = createObjectSql(object, schema);
+      if (sql === undefined)
+        continue;
+      steps.push(step(sql, "expand", "ddl", ACCESS));
+    }
+  }
+  for (const object of creationOrder2(request.after)) {
+    if (!ownedByView(object))
+      continue;
+    const key = identityKey2(object.identity);
+    if (!createKeys.has(key) || emitted.has(key))
+      continue;
+    emitted.add(key);
+    const sql = createObjectSql(object, schema);
+    if (sql === undefined)
+      continue;
+    steps.push(step(sql, "expand", "ddl", SHARE));
+  }
+  for (const object of creationOrder2(request.after)) {
+    if (object.kind !== "materializedView")
+      continue;
+    const key = identityKey2(object.identity);
+    if (!createKeys.has(key))
+      continue;
+    assertConcurrentRefresh(object, request.after);
+    steps.push(step(refreshMaterializedViewSql(object, schema, false), "expand", "backfill", ACCESS));
+  }
+  for (const sql of privileges.grant)
+    steps.push(step(sql, "expand", "ddl", ACCESS));
   steps.push(...contractSwaps(picklists, enums, replacements, schema));
   return {
     name: request.name ?? "migration",
@@ -348,6 +732,10 @@ function formatPlan(plan) {
     lines.push(`-- lock: ${item.lock}`);
     if (!item.transactional)
       lines.push("-- transactional: false");
+    if (item.path !== undefined)
+      lines.push(`-- path: ${item.path}`);
+    if (item.behavior === "change")
+      lines.push("-- behavior: change");
     lines.push(`${item.sql};`);
     lines.push("");
   }
@@ -380,6 +768,8 @@ function parsePlan(text) {
     let action = "ddl";
     let lock = "";
     let transactional = true;
+    let path;
+    let behavior;
     const sql = [];
     while (index < lines.length && (lines[index] ?? "") !== "") {
       const line = lines[index] ?? "";
@@ -392,13 +782,25 @@ function parsePlan(text) {
         lock = line.slice("-- lock: ".length);
       else if (line === "-- transactional: false")
         transactional = false;
+      else if (line === "-- path: unverified")
+        path = "unverified";
+      else if (line === "-- behavior: change")
+        behavior = "change";
       else if (!line.startsWith("--"))
         sql.push(line);
     }
     const statement = sql.join(`
 `).replace(/;\s*$/, "");
     if (statement.length > 0) {
-      steps.push({ sql: statement, class: stepClass, action, lock, transactional });
+      steps.push({
+        sql: statement,
+        class: stepClass,
+        action,
+        lock,
+        transactional,
+        ...path !== undefined ? { path } : {},
+        ...behavior !== undefined ? { behavior } : {}
+      });
     }
   }
   return { name, class: steps.length === 0 ? planClass : overall(steps), steps };
@@ -454,7 +856,7 @@ function renameSteps(source, renames, schema) {
     if (rename.kind !== "table" || !hasTable(source, rename.from))
       continue;
     tables.set(rename.to, rename.from);
-    steps.push(step(`alter table ${qualify2(schema, rename.from)} rename to ${quoteIdent(rename.to)}`, "contract", "ddl", ACCESS));
+    steps.push(step(`alter table ${qualify(schema, rename.from)} rename to ${quoteIdent(rename.to)}`, "contract", "ddl", ACCESS));
   }
   for (const rename of renames) {
     if (rename.kind !== "column")
@@ -462,7 +864,7 @@ function renameSteps(source, renames, schema) {
     const previousTable = tables.get(rename.table) ?? rename.table;
     if (!hasColumn(source, previousTable, rename.from))
       continue;
-    steps.push(step(`alter table ${qualify2(schema, rename.table)} rename column ${quoteIdent(rename.from)} to ${quoteIdent(rename.to)}`, "contract", "ddl", ACCESS));
+    steps.push(step(`alter table ${qualify(schema, rename.table)} rename column ${quoteIdent(rename.from)} to ${quoteIdent(rename.to)}`, "contract", "ddl", ACCESS));
   }
   return steps;
 }
@@ -489,7 +891,7 @@ function pairSameShape(beforeBy, afterBy, dropKeys, createKeys) {
     used.add(rightKey);
     dropKeys.delete(identityKey2(left.identity));
     createKeys.delete(rightKey);
-    if (left.identity.name !== right.identity.name)
+    if (anchoredName(left) !== anchoredName(right))
       pairs.push({ from: left, to: right });
   }
   return pairs;
@@ -511,12 +913,12 @@ function withoutNameKey(value) {
 }
 function renameShapeStep(pair, schema) {
   if (pair.from.kind === "index" && pair.to.kind === "index") {
-    return step(`alter index ${qualify2(schema, pair.from.identity.name)} rename to ${quoteIdent(pair.to.identity.name)}`, "contract", "ddl", ACCESS);
+    return step(`alter index ${qualify(schema, pair.from.identity.name)} rename to ${quoteIdent(pair.to.identity.name)}`, "contract", "ddl", ACCESS);
   }
   if (pair.from.kind !== "constraint" || pair.to.kind !== "constraint") {
     return step("select 1", "unclassified", "ddl", ACCESS);
   }
-  return step(`alter table ${qualify2(schema, pair.from.identity.parent.name)} rename constraint ${quoteIdent(pair.from.identity.name)} to ${quoteIdent(pair.to.identity.name)}`, "contract", "ddl", ACCESS);
+  return step(`alter table ${qualify(schema, pair.from.identity.parent.name)} rename constraint ${quoteIdent(pair.from.identity.name)} to ${quoteIdent(pair.to.identity.name)}`, "contract", "ddl", ACCESS);
 }
 function assertUnambiguous(beforeBy, afterBy) {
   const dropped = new Map;
@@ -528,7 +930,10 @@ function assertUnambiguous(beforeBy, afterBy) {
     if (group === undefined)
       continue;
     const list = dropped.get(group) ?? [];
-    list.push(object.identity.name);
+    const name = anchoredName(object);
+    if (name === undefined)
+      continue;
+    list.push(name);
     dropped.set(group, list);
   }
   for (const [key, object] of afterBy) {
@@ -538,7 +943,10 @@ function assertUnambiguous(beforeBy, afterBy) {
     if (group === undefined)
       continue;
     const list = added.get(group) ?? [];
-    list.push(object.identity.name);
+    const name = anchoredName(object);
+    if (name === undefined)
+      continue;
+    list.push(name);
     added.set(group, list);
   }
   for (const [group, names] of added) {
@@ -553,6 +961,15 @@ function assertUnambiguous(beforeBy, afterBy) {
     });
   }
 }
+function anchoredName(object) {
+  switch (object.kind) {
+    case "grant":
+    case "defaultPrivilege":
+      return;
+    default:
+      return object.identity.name;
+  }
+}
 function groupOf(object) {
   if (object.kind === "table")
     return "table:public";
@@ -561,7 +978,7 @@ function groupOf(object) {
   return;
 }
 function recreateDependents(beforeList, afterList, alters, dropKeys, createKeys, picklists) {
-  const changed = new Set(alters.filter((item) => item.before.definition.dataType !== item.after.definition.dataType).map((item) => identityKey2(item.after.identity)));
+  const changed = new Set(alters.filter((item) => canonicalTypeName(item.before.definition.dataType) !== canonicalTypeName(item.after.definition.dataType)).map((item) => identityKey2(item.after.identity)));
   if (changed.size === 0)
     return;
   const deferred = new Set(picklists.map((change) => identityKey2(change.before.identity)));
@@ -576,11 +993,99 @@ function recreateDependents(beforeList, afterList, alters, dropKeys, createKeys,
     createKeys.add(key);
   }
 }
+function recreateRoutineDependents(afterList, dropKeys, createKeys) {
+  const recreated = new Set;
+  for (const item of afterList) {
+    if (!dropKeys.has(item.key) || !createKeys.has(item.key))
+      continue;
+    if (item.object.kind === "function" || item.object.kind === "column" || item.object.kind === "table") {
+      recreated.add(item.key);
+    }
+  }
+  if (recreated.size === 0)
+    return;
+  for (const item of afterList) {
+    if (item.object.kind !== "trigger" && item.object.kind !== "function")
+      continue;
+    const hit = item.object.dependencies.some((edge) => recreated.has(identityKey2(edge.target)));
+    if (!hit)
+      continue;
+    dropKeys.add(item.key);
+    createKeys.add(item.key);
+  }
+}
+function refuseRoutineDrops(beforeBy, afterBy, dropKeys) {
+  for (const after of afterBy.values()) {
+    const key = identityKey2(after.identity);
+    if (dropKeys.has(key))
+      continue;
+    if (after.kind !== "trigger" && after.kind !== "function" && after.kind !== "view" && after.kind !== "materializedView") {
+      continue;
+    }
+    for (const edge of after.dependencies) {
+      const targetKey = identityKey2(edge.target);
+      if (!dropKeys.has(targetKey))
+        continue;
+      const target = beforeBy.get(targetKey);
+      if (target === undefined)
+        continue;
+      if (target.kind !== "function" && target.kind !== "table" && target.kind !== "column" && target.kind !== "view" && target.kind !== "materializedView") {
+        continue;
+      }
+      throw new OkmError2("OKM1821", `${identityLabel2(after.identity)} depends on ${identityLabel2(target.identity)}, which this plan drops. CASCADE is never used.`, { fix: { summary: "Review the dependents the plan lists and recreate them explicitly." } });
+    }
+  }
+}
 function dependsOnChanged(object, columns) {
-  if (object.kind !== "index" && object.kind !== "constraint")
+  if (object.kind !== "index" && object.kind !== "constraint" && object.kind !== "view" && object.kind !== "materializedView") {
     return false;
+  }
   return object.dependencies.some((edge) => columns.has(identityKey2(edge.target)));
 }
+function recreateViewDependents(afterList, dropKeys, createKeys) {
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const item of afterList) {
+      if (dropKeys.has(item.key) && createKeys.has(item.key))
+        continue;
+      const kind = item.object.kind;
+      if (kind !== "view" && kind !== "materializedView" && kind !== "index")
+        continue;
+      const hit = item.object.dependencies.some((edge) => {
+        const key = identityKey2(edge.target);
+        return dropKeys.has(key) && createKeys.has(key);
+      });
+      if (!hit)
+        continue;
+      dropKeys.add(item.key);
+      createKeys.add(item.key);
+      changed = true;
+    }
+  }
+}
+function columnsAppended(before, after) {
+  if (after.length < before.length)
+    return false;
+  for (let index = 0;index < before.length; index += 1) {
+    const left = before[index];
+    const right = after[index];
+    if (left === undefined || right === undefined)
+      return false;
+    if (left.name !== right.name || canonicalTypeName(left.dataType) !== canonicalTypeName(right.dataType)) {
+      return false;
+    }
+  }
+  return true;
+}
+function assertConcurrentRefresh(object, source) {
+  if (object.definition.refresh !== "concurrently")
+    return;
+  const unique = source.objects.some((item) => item.kind === "index" && item.definition.unique && item.identity.parent.name === object.identity.name);
+  if (unique)
+    return;
+  throw new OkmError2("OKM1822", `Materialized view ${object.identity.name} refreshes concurrently and has no unique index.`, { fix: { summary: "Add a unique index, or refresh without CONCURRENTLY." } });
+}
 function enumAddSteps(enums) {
   const steps = [];
   for (const change of enums) {
@@ -599,7 +1104,7 @@ function contractSwaps(picklists, enums, replacements, schema) {
   const steps = [];
   steps.push(...dataSteps(picklists, enums, replacements, schema, "contract"));
   for (const change of picklists) {
-    const table = qualify2(schema, change.after.identity.parent.name);
+    const table = qualify(schema, change.after.identity.parent.name);
     const name = quoteIdent(change.after.identity.name);
     steps.push(step(`alter table ${table} drop constraint ${name}`, change.removed.length > 0 ? "contract" : "expand", "ddl", ACCESS));
     const expression = change.after.definition.expression ?? "true";
@@ -609,17 +1114,17 @@ function contractSwaps(picklists, enums, replacements, schema) {
   for (const change of enums) {
     if (change.kind !== "replace")
       continue;
-    const type = qualify2(schema, change.name);
+    const type = qualify(schema, change.name);
     const old = quoteIdent(`${change.name}_old`);
-    const labels = change.labels.map((label) => sqlString(label)).join(", ");
+    const labels = change.labels.map((label) => quoteLiteral(label)).join(", ");
     steps.push(step(`alter type ${type} rename to ${old}`, "contract", "ddl", ACCESS));
     steps.push(step(`create type ${type} as enum (${labels})`, "contract", "ddl", ACCESS));
     for (const column of change.columns) {
-      const table = qualify2(schema, column.table);
+      const table = qualify(schema, column.table);
       const name = quoteIdent(column.column);
       steps.push(step(`alter table ${table} alter column ${name} type ${type} using ${name}::text::${type}`, "contract", "ddl", ACCESS));
     }
-    steps.push(step(`drop type ${qualify2(schema, `${change.name}_old`)}`, "contract", "ddl", ACCESS));
+    steps.push(step(`drop type ${qualify(schema, `${change.name}_old`)}`, "contract", "ddl", ACCESS));
   }
   return steps;
 }
@@ -737,30 +1242,69 @@ function picklistChanges(beforeBy, afterBy, after) {
   }
   return changes;
 }
+function refuseDomainBaseChange(before, after) {
+  if (before.kind !== "type" || after.kind !== "type")
+    return;
+  if (!isDomain(before.definition) || !isDomain(after.definition))
+    return;
+  if (before.definition.base === after.definition.base)
+    return;
+  throw new OkmError2("OKM1020", `Domain ${after.identity.name} cannot change its base type from ${before.definition.base} to ${after.definition.base}. The base type of a domain stays as it was created.`, {
+    fix: {
+      summary: "Keep the base type. Add a new domain when the column needs another type."
+    }
+  });
+}
+function domainCheckSteps(beforeBy, afterBy, schema) {
+  const steps = [];
+  for (const [key, next] of afterBy) {
+    if (next.kind !== "type" || !isDomain(next.definition))
+      continue;
+    const previous = beforeBy.get(key);
+    if (previous === undefined || previous.kind !== "type" || !isDomain(previous.definition)) {
+      continue;
+    }
+    if (previous.definition.check === next.definition.check)
+      continue;
+    const name = next.identity.name;
+    const type = qualify(schema, name);
+    const current = quoteIdent(fitIdentifier2(`${name}_check`));
+    const upcoming = quoteIdent(fitIdentifier2(`${name}_check_next`));
+    const expression = next.definition.check;
+    steps.push(step(`alter domain ${type} add constraint ${upcoming} check (${expression}) not valid`, "expand", "ddl", ACCESS));
+    steps.push(step(`alter domain ${type} validate constraint ${upcoming}`, "expand", "ddl", ACCESS));
+    steps.push(step(`alter domain ${type} drop constraint ${current}`, "contract", "ddl", ACCESS));
+    steps.push(step(`alter domain ${type} rename constraint ${upcoming} to ${current}`, "expand", "ddl", ACCESS));
+  }
+  return steps;
+}
 function enumEdits(beforeBy, afterBy, schema) {
   const edits = [];
   for (const [key, next] of afterBy) {
-    if (next.kind !== "type")
+    if (next.kind !== "type" || isDomain(next.definition))
       continue;
     const previous = beforeBy.get(key);
-    if (previous === undefined || previous.kind !== "type")
+    if (previous === undefined || previous.kind !== "type" || isDomain(previous.definition)) {
       continue;
-    if (sameEnumLabels(previous.definition.labels, next.definition.labels))
+    }
+    const beforeLabels = previous.definition.labels;
+    const afterLabels = next.definition.labels;
+    if (sameEnumLabels(beforeLabels, afterLabels))
       continue;
-    const removed = previous.definition.labels.filter((label) => !next.definition.labels.includes(label));
+    const removed = beforeLabels.filter((label) => !afterLabels.includes(label));
     const columns = enumColumns(previous.identity.name, beforeBy, afterBy);
-    if (removed.length === 0 && labelSubsequence(previous.definition.labels, next.definition.labels)) {
+    if (removed.length === 0 && labelSubsequence(beforeLabels, afterLabels)) {
       edits.push({
         kind: "add",
         name: next.identity.name,
-        statements: addValueStatements(schema, next.identity.name, previous.definition.labels, next.definition.labels)
+        statements: addValueStatements(schema, next.identity.name, beforeLabels, afterLabels)
       });
       continue;
     }
     edits.push({
       kind: "replace",
       name: next.identity.name,
-      labels: next.definition.labels,
+      labels: afterLabels,
       removed,
       columns
     });
@@ -801,7 +1345,7 @@ function labelSubsequence(before, after) {
 function addValueStatements(schema, name, before, after) {
   const present = new Set(before);
   const statements = [];
-  const type = qualify2(schema, name);
+  const type = qualify(schema, name);
   for (let index = 0;index < after.length; index += 1) {
     const label = after[index];
     if (label === undefined || present.has(label))
@@ -814,9 +1358,9 @@ function addValueStatements(schema, name, before, after) {
         break;
       }
     }
-    let sql = `alter type ${type} add value ${sqlString(label)}`;
+    let sql = `alter type ${type} add value ${quoteLiteral(label)}`;
     if (beforeNeighbor !== undefined) {
-      sql += ` before ${sqlString(beforeNeighbor)}`;
+      sql += ` before ${quoteLiteral(beforeNeighbor)}`;
     } else {
       let afterNeighbor;
       for (let cursor = index - 1;cursor >= 0; cursor -= 1) {
@@ -827,7 +1371,7 @@ function addValueStatements(schema, name, before, after) {
         }
       }
       if (afterNeighbor !== undefined)
-        sql += ` after ${sqlString(afterNeighbor)}`;
+        sql += ` after ${quoteLiteral(afterNeighbor)}`;
     }
     statements.push(sql);
     present.add(label);
@@ -885,7 +1429,7 @@ function columnAlterable(before, after) {
 function identityChangeSql(before, after, schema) {
   if (stable(before.definition.identity) === stable(after.definition.identity))
     return;
-  const table = qualify2(schema, after.identity.parent.name);
+  const table = qualify(schema, after.identity.parent.name);
   const name = quoteIdent(after.identity.name);
   const next = after.definition.identity;
   const previous = before.definition.identity;
@@ -905,7 +1449,53 @@ function omitOwnedSequences(keys, by, source) {
   }
 }
 function sameDefinition(left, right) {
-  return stable(left.definition) === stable(right.definition);
+  if (left.kind === "materializedView" && right.kind === "materializedView") {
+    return stable(canonicalColumns(left.definition.columns)) === stable(canonicalColumns(right.definition.columns)) && left.definition.query === right.definition.query;
+  }
+  return stable(forComparison(left)) === stable(forComparison(right));
+}
+function forComparison(object) {
+  switch (object.kind) {
+    case "column":
+    case "sequence":
+      return { ...object.definition, dataType: canonicalTypeName(object.definition.dataType) };
+    case "view":
+      return { ...object.definition, columns: canonicalColumns(object.definition.columns) };
+    case "function":
+      return {
+        ...object.definition,
+        returns: canonicalTypeName(object.definition.returns),
+        arguments: object.definition.arguments.map((argument) => ({
+          ...argument,
+          type: canonicalTypeName(argument.type)
+        }))
+      };
+    case "trigger":
+      return {
+        ...object.definition,
+        calls: {
+          ...object.definition.calls,
+          argTypes: object.definition.calls.argTypes.map((typeName) => canonicalTypeName(typeName))
+        }
+      };
+    case "type":
+      if (!isDomain(object.definition))
+        return object.definition;
+      return { ...object.definition, base: canonicalTypeName(object.definition.base) };
+    default:
+      return object.definition;
+  }
+}
+function canonicalColumns(columns) {
+  return columns.map((column) => ({ ...column, dataType: canonicalTypeName(column.dataType) }));
+}
+function alignedColumnType(before, after) {
+  if (canonicalTypeName(before.definition.dataType) !== canonicalTypeName(after.definition.dataType)) {
+    return before;
+  }
+  if (before.definition.dataType === after.definition.dataType)
+    return before;
+  return { ...before, definition: { ...before.definition, dataType: after.definition.dataType } };
 }
 function covered(object, tables) {
   if (object.kind === "column" || object.kind === "index" || object.kind === "constraint") {
@@ -951,9 +1541,9 @@ function overall(steps) {
   return "expand";
 }
 function updateSql(schema, table, column, from, to, cast = false) {
-  const value = to === null ? "null" : sqlString(to);
+  const value = to === null ? "null" : quoteLiteral(to);
   const compare = cast ? `${quoteIdent(column)}::text` : quoteIdent(column);
-  return `update ${qualify2(schema, table)} set ${quoteIdent(column)} = ${value} where ${compare} = ${sqlString(from)}`;
+  return `update ${qualify(schema, table)} set ${quoteIdent(column)} = ${value} where ${compare} = ${quoteLiteral(from)}`;
 }
 function hasTable(source, name) {
   return source.objects.some((object) => object.kind === "table" && object.identity.name === name);
@@ -961,18 +1551,12 @@ function hasTable(source, name) {
 function hasColumn(source, table, name) {
   return source.objects.some((object) => object.kind === "column" && object.identity.parent.name === table && object.identity.name === name);
 }
-function index(source) {
+function index2(source) {
   return source.objects.map((object) => ({ key: identityKey2(object.identity), object }));
 }
 function step(sql, classification, action, lock, transactional = true) {
   return { sql, class: classification, action, lock, transactional };
 }
-function qualify2(schema, name) {
-  return `${quoteIdent(schema)}.${quoteIdent(name)}`;
-}
-function sqlString(value) {
-  return `'${value.replaceAll("'", "''")}'`;
-}
 function stable(value) {
   return JSON.stringify(order(value));
 }
@@ -989,536 +1573,4 @@ function order(value) {
   return value;
 }
 
-// src/tooling/migrate/policy.ts
-var READ = new Set([
-  "plan",
-  "status",
-  "check",
-  "drift",
-  "verify",
-  "pull",
-  "catalog-export",
-  "inspect"
-]);
-var ALLOWED = new Set(["expand", "reference", "provision"]);
-var FORWARD_ONLY = new Set(["drop", "rollback"]);
-function assertTargetPolicy(target, operation, allowProtected = false) {
-  if (FORWARD_ONLY.has(operation)) {
-    throw new OkmError2("invalid", "There is no down migration.", {
-      fix: { summary: "Recovery is a new forward migration." }
-    });
-  }
-  if (!target.protected || allowProtected)
-    return;
-  if (READ.has(operation) || ALLOWED.has(operation))
-    return;
-  throw new OkmError2("OKM1850", `${operation} is blocked on protected target ${target.name}.`, {
-    kind: "forbidden",
-    fix: {
-      summary: "Run a read-only command or an expand migration, or pass --allow-protected for this invocation."
-    }
-  });
-}
-function assertTargetAlias(targets) {
-  const groups = new Map;
-  for (const target of targets) {
-    const key = `${target.host}
-${target.port}
-${target.database}`;
-    const group = groups.get(key);
-    if (group === undefined)
-      groups.set(key, [target]);
-    else
-      group.push(target);
-  }
-  for (const group of groups.values()) {
-    const protectedTarget = group.find((target) => target.protected);
-    const open = group.find((target) => !target.protected);
-    if (protectedTarget !== undefined && open !== undefined) {
-      throw new OkmError2("OKM1852", `${open.name} and ${protectedTarget.name} resolve to the same database and disagree about protection.`, {
-        fix: {
-          summary: "Give those targets the same protection flag. okm check and okm doctor both report this."
-        }
-      });
-    }
-  }
-}
-function assertDirectConnection(url, allowPooler) {
-  if (allowPooler)
-    return;
-  const endpoint = endpointOf(url);
-  const parsed = new URL(url);
-  const host = endpoint.host;
-  if (host.includes("pooler") || host.includes("pgbouncer") || host.includes("-pooler") || endpoint.port === "6543" || parsed.searchParams.get("pgbouncer") === "true") {
-    throw new OkmError2("invalid", `Refusing pooler host ${host}. Apply needs a direct connection.`, { fix: { summary: "Use a direct connection, or pass --allow-pooler." } });
-  }
-}
-function listTargets(config) {
-  if (config.database !== undefined && config.targets !== undefined) {
-    throw new OkmError2("invalid", "Set database or targets, not both.", {
-      fix: { summary: "database is the one target named default. Use targets for more than one." }
-    });
-  }
-  const entries = [];
-  if (config.database !== undefined)
-    entries.push(["default", config.database]);
-  if (config.targets !== undefined) {
-    for (const name of Object.keys(config.targets).sort()) {
-      const input = config.targets[name];
-      if (input !== undefined)
-        entries.push([name, input]);
-    }
-  }
-  return entries.map(([name, input]) => resolveTarget(name, input));
-}
-function selectTarget(config, name) {
-  const targets = listTargets(config);
-  if (targets.length === 0) {
-    throw new OkmError2("OKM1845", "No target is configured.", {
-      fix: { summary: "Set database or targets in okmodel.config.ts." }
-    });
-  }
-  if (name === undefined) {
-    if (targets.length === 1) {
-      const only = targets[0];
-      if (only !== undefined)
-        return only;
-    }
-    throw new OkmError2("OKM1853", "Several targets are configured and --target was not passed.", {
-      fix: { summary: "Pass --target <name>. The command does not guess." }
-    });
-  }
-  const found = targets.find((target) => target.name === name);
-  if (found === undefined) {
-    throw new OkmError2("OKM1845", `Target ${name} is not configured.`, {
-      fix: { summary: "Pass a name from targets, or database for the target named default." }
-    });
-  }
-  return found;
-}
-function resolveTarget(name, input) {
-  const url = typeof input === "string" ? input : input.url;
-  const protectedTarget = typeof input === "string" ? false : input.protected === true;
-  if (url === undefined || url.length === 0) {
-    throw new OkmError2("OKM1845", `Target ${name} has no url.`, {
-      fix: { summary: "Set the target url. A target is not inferred from the environment." }
-    });
-  }
-  const endpoint = endpointOf(url);
-  return {
-    name,
-    url,
-    protected: protectedTarget,
-    host: endpoint.host,
-    port: endpoint.port,
-    database: endpoint.database
-  };
-}
-function endpointOf(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new OkmError2("OKM1845", "The target URL is not a Postgres URL.", {
-      fix: { summary: "Pass a postgres:// URL for the target." }
-    });
-  }
-  const database = decodeURIComponent(parsed.pathname.replace(/^\//, ""));
-  return {
-    host: parsed.hostname.toLowerCase(),
-    port: parsed.port.length > 0 ? parsed.port : "5432",
-    database
-  };
-}
-
-// src/tooling/migrate/project.ts
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, join } from "node:path";
-import { pathToFileURL } from "node:url";
-
-// src/dialects/pg/declarations.ts
-function schemaDeclarations(source) {
-  const renames = [];
-  for (const item of source.tables) {
-    const tableName = sqlTableName(item, source.casing);
-    const renamed = tableRenamedFrom(item);
-    if (renamed !== undefined) {
-      renames.push({ kind: "table", from: renamed, to: tableName });
-    }
-    for (const [field, value] of Object.entries(item.columns)) {
-      if (!(value instanceof ColumnBuilder2))
-        continue;
-      const state = value.state;
-      const columnName = state.sqlName ?? sqlIdentifier(field, source.casing);
-      if (state.renamedFrom !== undefined) {
-        renames.push({
-          kind: "column",
-          table: tableName,
-          from: state.renamedFrom,
-          to: columnName
-        });
-      }
-    }
-  }
-  return { renames };
-}
-function sqlTableName(item, casing) {
-  const options = item.options;
-  return options?.sqlName ?? sqlIdentifier(item.name, casing);
-}
-function tableRenamedFrom(item) {
-  const options = item.options;
-  return options?.renamedFrom;
-}
-function sqlIdentifier(name, casing) {
-  return casing === "snake" ? snakeCase(name) : name;
-}
-
-// src/dialects/pg/emit.ts
-function emitRowTypes(source) {
-  const lines = [
-    "/**",
-    " * Row types emitted from the schema.",
-    ` * Mode: ${source.types}.`,
-    " */",
-    ""
-  ];
-  const rows = [];
-  const inserts = [];
-  const updates = [];
-  for (const item of source.tables) {
-    const name = emittedTypeName(item.name);
-    const key = propertyName(item.name);
-    rows.push(`  readonly ${key}: ${name};`);
-    inserts.push(`  readonly ${key}: ${name}Insert;`);
-    updates.push(`  readonly ${key}: ${name}Update;`);
-    lines.push(`export interface ${name} {`);
-    lines.push(fields(item, "row"));
-    lines.push("}", "");
-    lines.push(`export interface ${name}Insert {`);
-    lines.push(fields(item, "insert"));
-    lines.push("}", "");
-    lines.push(`export interface ${name}Update {`);
-    lines.push(fields(item, "update"));
-    lines.push("}", "");
-  }
-  lines.push("export interface Rows {");
-  lines.push(rows.join(`
-`));
-  lines.push("}", "");
-  lines.push("export interface Inserts {");
-  lines.push(inserts.join(`
-`));
-  lines.push("}", "");
-  lines.push("export interface Updates {");
-  lines.push(updates.join(`
-`));
-  lines.push("}");
-  return `${lines.join(`
-`)}
-`;
-}
-function propertyName(name) {
-  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ? name : JSON.stringify(name);
-}
-function fields(item, kind) {
-  const printed = [];
-  for (const [field, builder] of Object.entries(item.columns)) {
-    if (!(builder instanceof ColumnBuilder2)) {
-      continue;
-    }
-    const state = builder.state;
-    const written = insertMode(state);
-    if (kind === "row") {
-      if (!state.hidden) {
-        printed.push(`  readonly ${field}: ${valueType(state, "required")};`);
-      }
-      continue;
-    }
-    if (written === "omit") {
-      continue;
-    }
-    const mode = kind === "update" ? "optional" : written;
-    printed.push(`  readonly ${field}: ${valueType(state, mode)};`);
-  }
-  return printed.join(`
-`);
-}
-function insertMode(state) {
-  if (state.omitWrite || state.generated !== undefined || state.guarded) {
-    return "omit";
-  }
-  if (state.hasDefault || state.nullable) {
-    return "optional";
-  }
-  return "required";
-}
-function valueType(state, mode) {
-  let label = scalarLabel(state);
-  if (state.dims > 0) {
-    for (let rank = 0;rank < state.dims; rank += 1) {
-      label = `readonly (${label})[]`;
-    }
-  }
-  if (state.nullable) {
-    label += " | null";
-  }
-  if (mode === "optional") {
-    label += " | undefined";
-  }
-  return label;
-}
-function scalarLabel(state) {
-  if (state.picklist !== undefined) {
-    return state.picklist.values.map((value) => JSON.stringify(value)).join(" | ");
-  }
-  if (state.typeLabel !== undefined) {
-    return state.typeLabel;
-  }
-  const base = baseName(state.baseType);
-  switch (base) {
-    case "smallint":
-    case "integer":
-    case "real":
-    case "double precision":
-      return "number";
-    case "bigint":
-    case "numeric":
-    case "text":
-    case "varchar":
-    case "char":
-    case "citext":
-    case "uuid":
-    case "inet":
-    case "cidr":
-    case "macaddr":
-    case "macaddr8":
-    case "tsvector":
-    case "ltree":
-      return "string";
-    case "boolean":
-      return "boolean";
-    case "bytea":
-      return "Uint8Array";
-    case "json":
-    case "jsonb":
-      return "unknown";
-    case "timestamptz":
-      return "Temporal.Instant";
-    case "timestamp":
-      return "Temporal.PlainDateTime";
-    case "date":
-      return "Temporal.PlainDate";
-    case "time":
-      return "Temporal.PlainTime";
-    case "timetz":
-      return "{ readonly time: Temporal.PlainTime; readonly offset: string }";
-    case "interval":
-      return "Temporal.Duration";
-    case "tstzrange":
-      return rangeLabel("Temporal.Instant");
-    case "daterange":
-      return rangeLabel("Temporal.PlainDate");
-    case "int4range":
-      return rangeLabel("number");
-    case "int8range":
-    case "numrange":
-      return rangeLabel("string");
-    case "point":
-      return "{ readonly x: number; readonly y: number }";
-    case "line":
-      return "{ readonly a: number; readonly b: number; readonly c: number }";
-    default:
-      return "unknown";
-  }
-}
-function rangeLabel(bound) {
-  return `{ readonly empty: true } | { readonly empty: false; readonly lower: ${bound} | null; readonly upper: ${bound} | null; readonly lowerInclusive: boolean; readonly upperInclusive: boolean }`;
-}
-function baseName(dataType) {
-  if (dataType.startsWith("double precision")) {
-    return "double precision";
-  }
-  const space = dataType.indexOf(" ");
-  const head = space === -1 ? dataType : dataType.slice(0, space);
-  const paren = head.indexOf("(");
-  return paren === -1 ? head : head.slice(0, paren);
-}
-
-// src/tooling/migrate/project.ts
-async function buildProject(cwd) {
-  const config = await loadConfig(cwd);
-  const built = await loadSchema(cwd, config.schema);
-  return writeArtifact(cwd, config, built);
-}
-async function generateProject(cwd, name, flags) {
-  const prepared = await prepare(cwd, name, flags);
-  writeArtifact(cwd, prepared.config, prepared.built);
-  if (prepared.plan.steps.length === 0)
-    return;
-  const directory = join(cwd, prepared.config.migrations ?? "migrations");
-  mkdirSync(directory, { recursive: true });
-  const base = `${nextNumber(directory)}_${safeName(name)}`;
-  const sqlPath = join(directory, `${base}.sql`);
-  writeFileSync(sqlPath, formatPlan(prepared.plan));
-  writeFileSync(join(directory, `${base}.catalog.json`), serializeCatalog2(prepared.built.catalog));
-  return sqlPath;
-}
-async function planProject(cwd, name, flags) {
-  const prepared = await prepare(cwd, name, flags);
-  return prepared.plan;
-}
-async function checkProject(cwd) {
-  const opened = await openProject(cwd);
-  assertTargetAlias(listTargets(opened.config));
-  if (opened.config.tables !== undefined) {
-    const directory = join(cwd, opened.config.tables);
-    const files = existsSync(directory) ? readdirSync(directory) : [];
-    const source = readFileSync(join(cwd, opened.config.schema), "utf8");
-    const missing = unlistedTableFiles(source, files);
-    if (missing.length > 0) {
-      throw new OkmError2("OKM1024", `Table file not in schema: ${missing.join(", ")}.`, {
-        fix: { summary: "Add the file's table to the schema() call that okm check reads." }
-      });
-    }
-  }
-}
-function unlistedTableFiles(schemaSource, fileNames) {
-  const missing = [];
-  for (const file of fileNames) {
-    if (!file.endsWith(".ts"))
-      continue;
-    const stem = basename(file, ".ts");
-    if (stem.length === 0 || stem.startsWith("."))
-      continue;
-    if (!schemaSource.includes(stem))
-      missing.push(file);
-  }
-  return missing;
-}
-async function projectHead(cwd) {
-  const opened = await openProject(cwd);
-  return { previous: opened.previous, catalog: opened.built.catalog, renames: opened.renames };
-}
-async function prepare(cwd, name, flags) {
-  const opened = await openProject(cwd);
-  const plan = planMigration({
-    before: opened.previous,
-    after: opened.built.catalog,
-    renames: opened.renames,
-    replacements: flags.map((flag) => parseReplace(flag)),
-    name
-  });
-  return { config: opened.config, built: opened.built, plan };
-}
-async function openProject(cwd) {
-  const config = await loadConfig(cwd);
-  const built = await loadSchema(cwd, config.schema);
-  const declarations = schemaDeclarations(built);
-  const previous = readPrevious(join(cwd, config.migrations ?? "migrations"));
-  const stale = staleRenames(previous?.catalog, declarations.renames);
-  if (stale.length > 0) {
-    throw new OkmError2("OKM1020", stale.join(" "), {
-      fix: { summary: "Remove renamedFrom once the migration that used it has been applied." }
-    });
-  }
-  return {
-    config,
-    built,
-    previous: previous?.catalog ?? catalog([]),
-    renames: declarations.renames
-  };
-}
-function writeArtifact(cwd, config, built) {
-  const directory = join(cwd, config.out ?? ".okm");
-  mkdirSync(directory, { recursive: true });
-  const text = serializeCatalog2(built.catalog);
-  writeFileSync(join(directory, "catalog.json"), text);
-  writeFileSync(join(directory, "catalog.hash"), `${catalogHash2(built.catalog)}
-`);
-  writeFileSync(join(directory, "types.d.ts"), `${emitRowTypes(built)}${referenceAugmentation(built)}`);
-  return directory;
-}
-async function loadConfig(cwd) {
-  const path = join(cwd, "okmodel.config.ts");
-  const imported = await import(`${pathToFileURL(path).href}?okm=${Date.now()}`);
-  const record = isRecord(imported) ? imported : {};
-  const config = record.default ?? record.config;
-  if (!isConfig(config)) {
-    throw new OkmError2("invalid", "okmodel.config.ts must default-export defineConfig(...).");
-  }
-  return config;
-}
-async function loadSchema(cwd, spec) {
-  const path = join(cwd, spec);
-  const imported = await import(`${pathToFileURL(path).href}?okm=${Date.now()}`);
-  const record = isRecord(imported) ? imported : {};
-  for (const value of Object.values(record)) {
-    if (!isBuilt(value))
-      continue;
-    value.catalog;
-    return value;
-  }
-  throw new OkmError2("invalid", `${spec} must export a schema().`);
-}
-function readPrevious(directory) {
-  if (!existsSync(directory))
-    return;
-  const catalogs = readdirSync(directory).filter((file) => file.endsWith(".catalog.json")).sort();
-  const latest = catalogs.at(-1);
-  if (latest === undefined)
-    return;
-  const text = readFileSync(join(directory, latest), "utf8");
-  return { catalog: parseCatalog2(text) };
-}
-function referenceAugmentation(source) {
-  const names = source.tables.map((item) => JSON.stringify(item.name));
-  const union = names.length === 0 ? "never" : names.join(" | ");
-  return [
-    'import type { ColumnFlags, ReferenceOptions } from "okmodel/pg";',
-    "",
-    'declare module "okmodel/pg" {',
-    "  interface ColumnBuilder<TValue, TFlags extends ColumnFlags> {",
-    "    references(",
-    `      table: ${union},`,
-    "      options?: ReferenceOptions,",
-    "    ): ColumnBuilder<TValue, TFlags>;",
-    "  }",
-    "}",
-    "",
-    `export type TableName = ${union};`,
-    ""
-  ].join(`
-`);
-}
-function nextNumber(directory) {
-  let max = 0;
-  if (existsSync(directory)) {
-    for (const file of readdirSync(directory)) {
-      const match = /^(\d+)_/.exec(file);
-      const value = match?.[1];
-      if (value !== undefined)
-        max = Math.max(max, Number(value));
-    }
-  }
-  return String(max + 1).padStart(4, "0");
-}
-function safeName(name) {
-  if (!/^[A-Za-z0-9_-]+$/.test(name)) {
-    throw new OkmError2("invalid", `Migration name ${name} must be letters, digits, _ or -.`);
-  }
-  return name;
-}
-function isBuilt(value) {
-  if (!isRecord(value) || !Array.isArray(value.tables))
-    return false;
-  return "catalog" in value;
-}
-function isConfig(value) {
-  return isRecord(value) && typeof value.schema === "string";
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-
-export { quoteIdent, planMigration, formatPlan, parsePlan, assertTargetPolicy, assertDirectConnection, listTargets, selectTarget, buildProject, generateProject, planProject, checkProject, projectHead, loadConfig };
+export { createdRoleName, changesRole, assertExtensionsAvailable, omitManagedObjects, parseReplace, planMigration, formatPlan, parsePlan, staleRenames };