okmodel 0.1.1 → 0.3.0

package/dist/shared/e6wg00wd.js

@@ -0,0 +1,164 @@
+import {
+  safetyInstalled,
+  runSafety
+} from "./a5sxz52y.js";
+import {
+  isOperator,
+  operatorValue
+} from "./cn0n68ft.js";
+import {
+  OkmError2
+} from "./52szzakm.js";
+
+// src/runtime/exposure.ts
+var REDACTED = "[redacted]";
+var namesOf = new WeakMap;
+function redactView(schema, view, call) {
+  const names = concealedNames(schema);
+  const secrets = new Set;
+  harvest(schema, call.where, names, undefined, secrets);
+  harvest(schema, call.include, names, undefined, secrets);
+  const model = schema.model[call.table];
+  const rules = model === undefined ? view.rules : [...view.rules, ...exposureRules(model, call)];
+  if (safetyInstalled())
+    runSafety(rules, undefined);
+  return {
+    ...view,
+    intent: {
+      ...view.intent,
+      where: walk(view.intent.where, names),
+      include: walk(view.intent.include, names)
+    },
+    rules,
+    sql: {
+      ...view.sql,
+      params: view.sql.params.map((value) => value !== null && secrets.has(value) ? REDACTED : value)
+    }
+  };
+}
+function scrubCall(error, schema, call) {
+  const names = concealedNames(schema);
+  const secrets = new Set;
+  harvest(schema, call.where, names, undefined, secrets);
+  harvest(schema, call.include, names, undefined, secrets);
+  let message = error.message;
+  for (const secret of secrets) {
+    if (secret.length < 4 || !message.includes(secret))
+      continue;
+    message = message.replaceAll(secret, REDACTED);
+  }
+  if (message === error.message)
+    return error;
+  return new OkmError2(error.code, message, {
+    kind: error.kind,
+    ...error.table !== undefined ? { table: error.table } : {},
+    ...error.columns.length > 0 ? { columns: error.columns } : {},
+    fix: error.fix
+  });
+}
+function concealedNames(schema) {
+  const cached = namesOf.get(schema);
+  if (cached !== undefined)
+    return cached;
+  const names = new Set;
+  for (const model of Object.values(schema.model)) {
+    if (model.conceal !== true)
+      continue;
+    for (const column of model.columns) {
+      if (column.hidden || column.sensitive)
+        names.add(column.field);
+    }
+  }
+  namesOf.set(schema, names);
+  return names;
+}
+function exposureRules(model, call) {
+  const named = namedSelect(call.select);
+  const source = model.source;
+  const rules = [];
+  for (const column of model.columns) {
+    if (column.hidden && (named === undefined || !named.has(column.field))) {
+      rules.push({
+        rule: "hidden",
+        contribution: `hidden ${model.name}.${column.field} excluded`,
+        provenance: "catalog",
+        ...source !== undefined ? { source } : {}
+      });
+    }
+    if (column.sensitive) {
+      rules.push({
+        rule: "sensitive",
+        contribution: `sensitive ${model.name}.${column.field} redacted`,
+        provenance: "catalog",
+        ...source !== undefined ? { source } : {}
+      });
+    }
+  }
+  return rules;
+}
+function namedSelect(select) {
+  if (!Array.isArray(select))
+    return;
+  const names = new Set;
+  for (const name of select) {
+    if (typeof name === "string")
+      names.add(name);
+  }
+  return names;
+}
+function harvest(schema, value, names, key, into) {
+  if (Array.isArray(value)) {
+    for (const item of value)
+      harvest(schema, item, names, key, into);
+    return;
+  }
+  if (isOperator(value)) {
+    harvest(schema, operatorValue(value), names, key, into);
+    return;
+  }
+  if (typeof value === "object" && value !== null) {
+    const record = value;
+    for (const child of Object.keys(record))
+      harvest(schema, record[child], names, child, into);
+    return;
+  }
+  if (key === undefined || !names.has(key))
+    return;
+  const encode = encodeOf(schema, key);
+  if (encode === undefined)
+    return;
+  try {
+    into.add(encode(value));
+  } catch {}
+}
+function encodeOf(schema, field) {
+  for (const model of Object.values(schema.model)) {
+    for (const column of model.columns) {
+      if (column.field === field && (column.hidden || column.sensitive)) {
+        return column.encode;
+      }
+    }
+  }
+  return;
+}
+function walk(value, names, key) {
+  if (Array.isArray(value))
+    return value.map((item) => walk(item, names, key));
+  if (typeof value === "object" && value !== null) {
+    const record = value;
+    if (typeof record.op === "string" && "value" in record) {
+      return { op: record.op, value: walk(record.value, names, key) };
+    }
+    const out = {};
+    for (const child of Object.keys(record))
+      out[child] = walk(record[child], names, child);
+    return out;
+  }
+  if (key !== undefined && names.has(key))
+    return REDACTED;
+  return value;
+}
+export {
+  redactView,
+  scrubCall
+};

package/dist/shared/{hadrfb9h.js → edwqqryd.js}

@@ -1,4 +1,5 @@
 import {
+  emitRelationFrom,
   decodeResult,
   emitJoin,
   emitWhere,
@@ -14,13 +15,15 @@ import {
   quote,
   list,
   isRecord,
+  registerFailFix,
   fail
-} from "./rgs0st28.js";
+} from "./xrfnq5k8.js";
 import {
   throwNamed2
-} from "./ycwz42az.js";
+} from "./52szzakm.js";
 
 // src/runtime/include.ts
+registerFailFix("OKM1105", "Pass limit on the include, or call .all(reason).");
 var INCLUDE_OPTIONS = ["all", "include", "limit", "orderBy", "select", "where"];
 function emitIncludeSelect(include, alias, sink, outputs, column) {
   const selected = include.columns;
@@ -130,11 +133,7 @@ function emitIncludeJoin(schema, include, sink, parentAlias, alias, depth) {
       emitNestedAggregate(schema, nested, sink, childAlias, depth + 1);
     }
     sink.text(") as item from ");
-    sink.text(quote(child.model.sql));
-    sink.text(" ");
-    sink.text(childAlias);
-    sink.text(" where ");
-    emitJoin(sink, parentAlias, childAlias, include.relation);
+    emitRelationFrom(schema, include.relation, child, sink, parentAlias, childAlias, depth + 1);
     emitWhere(schema, child, include.where, sink, childAlias, depth + 1, true);
     emitOrder(child, include.orderBy, sink, childAlias);
     if (include.orderBy === undefined && child.model.primary.length > 0) {
@@ -225,11 +224,7 @@ function emitNestedAggregate(schema, include, sink, alias, depth) {
   if (include.columns.length === 0)
     sink.text("1");
   sink.text(") as item from ");
-  sink.text(quote(child.model.sql));
-  sink.text(" ");
-  sink.text(childAlias);
-  sink.text(" where ");
-  emitJoin(sink, alias, childAlias, include.relation);
+  emitRelationFrom(schema, include.relation, child, sink, alias, childAlias, depth);
   emitWhere(schema, child, include.where, sink, childAlias, depth, true);
   emitOrder(child, include.orderBy, sink, childAlias);
   if (include.orderBy === undefined && child.model.primary.length > 0) {
@@ -242,6 +237,14 @@ function emitNestedAggregate(schema, include, sink, alias, depth) {
   }
   sink.text(") limited) ordered)");
 }
+function omitHidden(columns) {
+  for (const column of columns) {
+    if (!column.hidden)
+      continue;
+    return columns.filter((item) => !item.hidden);
+  }
+  return columns;
+}
 function readIncludes(schema, table, include, all) {
   if (include === undefined)
     return [];
@@ -264,7 +267,7 @@ function parseInclude(schema, name, relation, value, all) {
       fail("OKM1105", `Include ${name} is to-many and has no limit. Pass limit, or call .all(reason).`);
     }
     const child = childIndex(schema, relation);
-    const columns = selectedColumns(child, undefined);
+    const columns = omitHidden(selectedColumns(child, undefined));
     return {
       name,
       relation,
@@ -288,7 +291,7 @@ function parseInclude(schema, name, relation, value, all) {
     fail("OKM1105", `Include ${name} is to-many and has no limit. Pass limit, or call .all(reason).`);
   }
   const child = childIndex(schema, relation);
-  const columns = selectedColumns(child, value.select);
+  const columns = omitHidden(selectedColumns(child, value.select));
   const nestedValue = value.include;
   const nested = nestedValue === undefined ? [] : readIncludes(schema, child, nestedValue, reason);
   return {

package/dist/shared/{qk3hxfja.js → fptpmvxp.js}

@@ -1,6 +1,6 @@
 import {
   OkmError2
-} from "./ycwz42az.js";
+} from "./52szzakm.js";
 
 // src/runtime/drift.ts
 async function assertCompatible(pool, schema, recordedHash, source, options) {
@@ -8,16 +8,16 @@ async function assertCompatible(pool, schema, recordedHash, source, options) {
   if (code.hash === recordedHash)
     return;
   if (code.artifact !== undefined) {
-    const { loadTrustedCatalog } = await import("./w8samvk1.js");
+    const { loadTrustedCatalog } = await import("./qybh48nd.js");
     loadTrustedCatalog(code.artifact.text, code.artifact.hash);
   } else {
     const artifact = await readCatalogFile(source.catalogDir);
     if (artifact !== undefined) {
-      const { loadTrustedCatalog } = await import("./w8samvk1.js");
+      const { loadTrustedCatalog } = await import("./qybh48nd.js");
       loadTrustedCatalog(artifact.text, artifact.hash);
     }
   }
-  const { assertDrift } = await import("./p0cbr3g2.js");
+  const { assertDrift } = await import("./zwmqxb0g.js");
   await assertDrift(pool, code.hash, recordedHash, options);
 }
 async function codeHash(schema, source) {
@@ -26,7 +26,7 @@ async function codeHash(schema, source) {
   const listed = await readHashFile(source.catalogDir);
   if (listed !== undefined)
     return { hash: listed };
-  const { catalogHash } = await import("./w8samvk1.js");
+  const { catalogHash } = await import("./qybh48nd.js");
   return { hash: catalogHash(schemaCatalog(schema)) };
 }
 function schemaCatalog(schema) {

package/dist/shared/fs0ex00p.js

@@ -0,0 +1,76 @@
+import {
+  send2,
+  reserve,
+  park
+} from "./01yr20s5.js";
+import {
+  isConnectionLost
+} from "./tbszx8mz.js";
+import {
+  WireSession
+} from "./0jc3ffzf.js";
+import {
+  rejectClosed,
+  runCall
+} from "./rrstp3kb.js";
+
+// src/adapters/pg/bunsql-extra.ts
+async function checkout(held) {
+  const { counters, isClosed } = held;
+  if (isClosed())
+    return rejectClosed();
+  const reserved = held.parked.pop() ?? await reserve(held.sql, held.acquireMs, counters);
+  counters.reserved += 1;
+  const session = new WireSession((text, params) => send2(reserved, text, params), held.notices, isClosed, false, () => {
+    counters.reservedBusy += 1;
+  }, () => {
+    counters.reservedBusy = Math.max(0, counters.reservedBusy - 1);
+  });
+  let lost = false;
+  const guard = (run) => lost ? rejectClosed("The connection was lost.") : run().catch((error) => {
+    if (isConnectionLost(error))
+      lost = true;
+    throw error;
+  });
+  let released = false;
+  return {
+    execute: (text, params, options) => guard(() => runCall(isClosed(), options, (watch) => session.query(text, params, watch))),
+    batch: (statements, options) => guard(() => runCall(isClosed(), options, async (watch) => {
+      const { runAtomicBatch } = await import("./b066g80h.js");
+      return runAtomicBatch(session, statements, watch);
+    })),
+    async release() {
+      if (released)
+        return;
+      released = true;
+      try {
+        if (!lost)
+          await reset(session, reserved);
+      } finally {
+        counters.reserved = Math.max(0, counters.reserved - 1);
+        if (!lost)
+          await park(held.parked, reserved);
+      }
+    }
+  };
+}
+async function reset(session, sql) {
+  const run = (text) => sql.unsafe(text);
+  if (session.depth() > 0)
+    await run("ROLLBACK").catch(() => {
+      return;
+    });
+  try {
+    await run("RESET ALL");
+    await run("SELECT pg_advisory_unlock_all()");
+  } catch {
+    await run("ROLLBACK").catch(() => {
+      return;
+    });
+    await run("RESET ALL");
+    await run("SELECT pg_advisory_unlock_all()");
+  }
+}
+export {
+  checkout
+};

package/dist/shared/{jjb7yht9.js → g4f5kcx9.js}

@@ -1,13 +1,13 @@
 import {
   catalogHash2,
   parseCatalog2
-} from "./y9m15dfv.js";
+} from "./t616ynfn.js";
 import {
   parsePlan
-} from "./05w44d8g.js";
+} from "./2ssqrv66.js";
 import {
   OkmError2
-} from "./ycwz42az.js";
+} from "./52szzakm.js";
 
 // src/tooling/migrate/files.ts
 import { existsSync, readdirSync, readFileSync } from "node:fs";

package/dist/shared/gjthds9j.js

@@ -0,0 +1,48 @@
+import {
+  required
+} from "./c9z5g0fm.js";
+import {
+  rejected
+} from "./tmbdywx0.js";
+
+// src/dialects/pg/json.ts
+function jsonReplacer2(_key, value) {
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  return value;
+}
+function json2() {
+  return required({
+    baseType: "json",
+    encode: encodeJson,
+    decode: decodeJson,
+    accepts: ["Array", "Object"],
+    sqlForm: "json"
+  });
+}
+function jsonb2() {
+  return required({
+    baseType: "jsonb",
+    encode: encodeJson,
+    decode: decodeJson,
+    accepts: ["Array", "Object"],
+    sqlForm: "jsonb"
+  });
+}
+function encodeJson(value) {
+  const text = JSON.stringify(value, jsonReplacer2);
+  if (text === undefined) {
+    rejected("json value must be JSON data. undefined and functions are not accepted. bigint is written as a decimal string.");
+  }
+  return text;
+}
+function decodeJson(wire) {
+  try {
+    return JSON.parse(wire);
+  } catch {
+    rejected("json text must be JSON, for example null, a string, a number, true, {}, or [].");
+  }
+}
+
+export { jsonReplacer2, json2, jsonb2, encodeJson };

package/dist/shared/hcmdtwgh.js

@@ -0,0 +1,102 @@
+import {
+  OkmError2
+} from "./52szzakm.js";
+
+// src/dialects/pg/role/check.ts
+async function assertRoleHealth(runner, roles, objects) {
+  const managed = new Set((roles.managed ?? []).map((role) => role.name));
+  const named = [roles.migration, roles.app];
+  for (const name of named) {
+    if (managed.has(name))
+      continue;
+    if (!await roleExists(runner, name)) {
+      throw new OkmError2("not_found", `Role ${name} is named in roles and does not exist.`, {
+        kind: "not_found",
+        fix: { summary: "Create the role, or list it in roles.managed so the plan creates it." }
+      });
+    }
+  }
+  if (managed.size > 0)
+    await assertCreateRole(runner, await currentUser(runner));
+  for (const object of objects) {
+    if (object.kind !== "grant" || object.identity.role !== roles.app)
+      continue;
+    await assertGrant(runner, object);
+  }
+}
+async function assertCreateRole(runner, role) {
+  const result = await runner.execute("select rolcreaterole from pg_roles where rolname = $1", [
+    role
+  ]);
+  if (!truthy(result.rows[0]?.[0])) {
+    throw new OkmError2("forbidden", `Role ${role} lacks CREATEROLE. Nothing was changed.`, {
+      kind: "forbidden",
+      fix: { summary: "Grant CREATEROLE to the role that applies migrations." }
+    });
+  }
+}
+async function currentUser(runner) {
+  const result = await runner.execute("select current_user");
+  const name = result.rows[0]?.[0];
+  return typeof name === "string" ? name : "";
+}
+async function roleExists(runner, name) {
+  const result = await runner.execute("select 1 from pg_roles where rolname = $1", [name]);
+  return result.rows.length > 0;
+}
+async function assertGrant(runner, object) {
+  const target = object.identity.object;
+  const schema = target.namespace.form === "static" ? target.namespace.name : "public";
+  const privilege = object.identity.privilege;
+  if (target.kind === "function") {
+    const open = target.name.lastIndexOf("(");
+    const fn = open < 0 ? target.name : target.name.slice(0, open);
+    const args = open < 0 ? "" : target.name.slice(open + 1, -1);
+    if (!await functionExists(runner, schema, fn, args))
+      return;
+    const allowed = await runner.execute("select has_function_privilege($1, format('%I.%I(%s)', $2::text, $3::text, $4::text), $5)", [object.identity.role, schema, fn, args, privilege]);
+    if (!truthy(allowed.rows[0]?.[0]))
+      missing(object, `${schema}.${fn}`);
+    return;
+  }
+  if (target.kind === "namespace")
+    return;
+  const relkinds = target.kind === "sequence" ? "'S'" : target.kind === "view" ? "'v'" : target.kind === "materializedView" ? "'m'" : "'r', 'p'";
+  if (!await relationExists(runner, schema, target.name, relkinds))
+    return;
+  const probe = target.kind === "sequence" ? "select has_sequence_privilege($1, format('%I.%I', $2::text, $3::text), $4)" : "select has_table_privilege($1, format('%I.%I', $2::text, $3::text), $4)";
+  const allowed = await runner.execute(probe, [
+    object.identity.role,
+    schema,
+    target.name,
+    privilege
+  ]);
+  if (!truthy(allowed.rows[0]?.[0]))
+    missing(object, `${schema}.${target.name}`);
+}
+function missing(object, name) {
+  throw new OkmError2("OKM1825", `Role ${object.identity.role} lacks ${object.identity.privilege} on ${name}.`, {
+    kind: "forbidden",
+    fix: {
+      summary: "Grant the privilege, or change the role. okm doctor reports the object and the privilege."
+    }
+  });
+}
+async function relationExists(runner, schema, name, relkinds) {
+  const result = await runner.execute(`select 1 from pg_class c
+     join pg_namespace n on n.oid = c.relnamespace
+     where n.nspname = $1 and c.relname = $2 and c.relkind in (${relkinds})`, [schema, name]);
+  return result.rows.length > 0;
+}
+async function functionExists(runner, schema, name, args) {
+  const result = await runner.execute(`select 1 from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+     where n.nspname = $1 and p.proname = $2
+       and replace(pg_get_function_identity_arguments(p.oid), ' ', '') = $3`, [schema, name, args]);
+  return result.rows.length > 0;
+}
+function truthy(value) {
+  return value === true || value === "t" || value === "true";
+}
+
+export { assertRoleHealth, assertCreateRole, currentUser, roleExists };

package/dist/shared/{g5fhqmwe.js → jkc6ws1p.js}

@@ -1,19 +1,14 @@
 import {
-  CATALOG_VERSION2,
-  assertNamespace2,
   identityKey2,
   identityLabel2,
-  normaliseEdges,
-  compareText,
-  assertProvenance
-} from "./j5cn2963.js";
+  compareText
+} from "./t4tbsy9h.js";
 import {
-  assertIdentifier2,
-  assertStoredText
-} from "./mkjmqjv4.js";
+  CATALOG_VERSION2
+} from "./4e4c6vq2.js";
 import {
   catalogError2
-} from "./ycwz42az.js";
+} from "./52szzakm.js";
 
 // src/contracts/catalog/order.ts
 function indexObjects(objects) {
@@ -140,49 +135,4 @@ function assertForeignKeys(objects, keys) {
   }
 }
 
-// src/contracts/catalog/enum.ts
-function enumType(input) {
-  assertNamespace2(input.namespace);
-  assertIdentifier2(input.name, "type");
-  assertProvenance(input.provenance);
-  if (input.labels.length === 0) {
-    catalogError2("OKM1020", `Enum ${input.name} must list at least one label.`);
-  }
-  const labels = [];
-  const seen = new Set;
-  for (const label of input.labels) {
-    assertStoredText(label, "enum label");
-    if (label.length === 0) {
-      catalogError2("OKM1020", `Enum ${input.name} has an empty label.`);
-    }
-    if (seen.has(label)) {
-      catalogError2("OKM1020", `Enum ${input.name} repeats label ${label}.`);
-    }
-    seen.add(label);
-    labels.push(label);
-  }
-  const identity = {
-    kind: "type",
-    namespace: input.namespace,
-    name: input.name
-  };
-  return {
-    kind: "type",
-    identity,
-    owner: input.owner ?? "managed",
-    definition: { labels },
-    dependencies: normaliseEdges(input.dependencies ?? []),
-    provenance: input.provenance
-  };
-}
-function sameEnumLabels(left, right) {
-  if (left.length !== right.length)
-    return false;
-  for (let index = 0;index < left.length; index += 1) {
-    if (left[index] !== right[index])
-      return false;
-  }
-  return true;
-}
-
-export { dependencyOrder, catalog, enumType, sameEnumLabels };
+export { dependencyOrder, catalog };