okmodel 0.2.1 → 0.3.0

package/dist/shared/{qa5dsc7z.js → 6bazvqwm.js}

@@ -1,17 +1,17 @@
 import {
   send,
   connectClient
-} from "./38crxbgn.js";
+} from "./bqha5cg6.js";
 import {
   isConnectionLost
 } from "./tbszx8mz.js";
 import {
   WireSession
-} from "./cstgkzdx.js";
+} from "./0jc3ffzf.js";
 import {
   rejectClosed,
   runCall
-} from "./9k6vetvf.js";
+} from "./rrstp3kb.js";
 
 // src/adapters/pg/nodepostgres-extra.ts
 var RESET_ALL = "RESET ALL";

package/dist/shared/{x9v1qgeb.js → 6w5j844a.js}

@@ -5,7 +5,7 @@ import {
 import {
   definition,
   unavailable
-} from "./xatfg0gn.js";
+} from "./tmbdywx0.js";
 import {
   OkmError2,
   throwNamed2

package/dist/shared/{0qkxbm1f.js → 75xkjv0t.js}

@@ -9,7 +9,7 @@ import {
   runCall,
   EMPTY_NOTICES,
   resultFrom
-} from "./9k6vetvf.js";
+} from "./rrstp3kb.js";
 
 // src/adapters/pg/pglite.ts
 import { PGlite } from "@electric-sql/pglite";

package/dist/shared/7fvtrkwr.js

@@ -0,0 +1,84 @@
+import {
+  extensionObject
+} from "./th14ygv2.js";
+import {
+  OkmError2
+} from "./52szzakm.js";
+
+// src/dialects/pg/ext/index.ts
+function extension2(name, options = {}) {
+  const schema = options.schema ?? "public";
+  const relocatable = options.relocatable ?? true;
+  const version = options.version;
+  const record = extensionObject({
+    name,
+    schema,
+    relocatable,
+    ...version !== undefined ? { version } : {},
+    provenance: { origin: "extension", name }
+  });
+  return {
+    name,
+    schema,
+    relocatable,
+    ...version !== undefined ? { version } : {},
+    contribute(peers, built) {
+      const names = peerNames(peers);
+      assertDeclared(names, built);
+      return [record];
+    }
+  };
+}
+function peerNames(peers) {
+  if (!Array.isArray(peers)) {
+    extensionError("OKM1810", "schema({ extensions }) must be a list of extensions.");
+  }
+  const counts = new Map;
+  for (const peer of peers) {
+    if (!isPeer(peer)) {
+      extensionError("OKM1810", "schema({ extensions }) must be a list of extensions.");
+    }
+    counts.set(peer.name, (counts.get(peer.name) ?? 0) + 1);
+  }
+  for (const [name, count] of counts) {
+    if (count > 1)
+      extensionError("OKM1813", `Extension ${name} is defined twice.`);
+  }
+  return counts;
+}
+function assertDeclared(names, built) {
+  if (!Array.isArray(built))
+    return;
+  for (const object of built) {
+    if (typeof object !== "object" || object === null || !("dependencies" in object))
+      continue;
+    const dependencies = object.dependencies;
+    if (!Array.isArray(dependencies))
+      continue;
+    for (const edge of dependencies) {
+      if (typeof edge !== "object" || edge === null || !("target" in edge))
+        continue;
+      const target = edge.target;
+      if (typeof target !== "object" || target === null)
+        continue;
+      if (!("kind" in target) || !("name" in target))
+        continue;
+      if (target.kind === "extension" && typeof target.name === "string" && !names.has(target.name)) {
+        extensionError("OKM1810", `Extension ${target.name} is used but not declared.`);
+      }
+    }
+  }
+}
+function isPeer(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  if (!("name" in value) || !("contribute" in value))
+    return false;
+  return typeof value.name === "string" && value.name.length > 0 && typeof value.contribute === "function";
+}
+function extensionError(code, message) {
+  const summary = code === "OKM1813" ? "Keep one definition. A second copy fails at build." : "Declare the extension next to the schema that uses it.";
+  throw new OkmError2(code, message, { fix: { summary } });
+}
+
+export { extension2 };

package/dist/shared/94ez8kzh.js

@@ -0,0 +1,19 @@
+// src/dialects/pg/quote.ts
+function quoteLiteral(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+function arrayElement(encoded, raw) {
+  if (raw && (encoded === "true" || encoded === "false" || isBareNumber(encoded))) {
+    return encoded;
+  }
+  return `"${encoded.replaceAll("\\", "\\\\").replaceAll('"', "\\\"")}"`;
+}
+function isBareNumber(encoded) {
+  let pattern = bareNumber;
+  pattern ??= /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$/;
+  bareNumber = pattern;
+  return pattern.test(encoded);
+}
+var bareNumber;
+
+export { quoteLiteral, arrayElement };

package/dist/shared/{1dp5knt7.js → 999ade2q.js}

@@ -1,6 +1,6 @@
 import {
   PgSession
-} from "./ecdzej21.js";
+} from "./xw1d69vd.js";
 import {
   isConnectionLost
 } from "./tbszx8mz.js";
@@ -11,7 +11,7 @@ import {
   runCall,
   rowsFrom,
   resultFrom
-} from "./9k6vetvf.js";
+} from "./rrstp3kb.js";
 
 // src/adapters/pg/postgres-extra.ts
 var RESET_ALL = "RESET ALL";

package/dist/shared/{3a5ne750.js → 9m80mkac.js}

@@ -1,9 +1,9 @@
 import {
   ColumnBuilder2
-} from "./dd4f8mnx.js";
+} from "./c9z5g0fm.js";
 import {
   definition
-} from "./xatfg0gn.js";
+} from "./tmbdywx0.js";
 import {
   OkmError2
 } from "./52szzakm.js";

package/dist/shared/9x25fxhc.js

@@ -0,0 +1,150 @@
+import {
+  staticNamespace2,
+  assertNamespace2,
+  normaliseEdges,
+  assertProvenance
+} from "./t4tbsy9h.js";
+import {
+  assertIdentifier2
+} from "./nfzc5z0w.js";
+import {
+  catalogError2
+} from "./52szzakm.js";
+
+// src/contracts/catalog/routine.ts
+var VOLATILITY = new Set(["volatile", "stable", "immutable"]);
+var SECURITY = new Set(["invoker", "definer"]);
+var TIMING = new Set(["before", "after", "instead"]);
+var LEVEL = new Set(["row", "statement"]);
+var EVENT_ORDER = ["insert", "update", "delete", "truncate"];
+var TYPE_TEXT = /^[A-Za-z][A-Za-z0-9_ ]*(\(\d+(,\s*\d+)?\))?(\[\])*$/;
+function functionObject(input) {
+  assertIdentifier2(input.name, "function");
+  const namespace = input.namespace ?? staticNamespace2("public");
+  assertNamespace2(namespace);
+  assertProvenance(input.provenance);
+  if (input.language !== "sql" && input.language !== "plpgsql") {
+    catalogError2("OKM1020", `Function ${input.name} language must be sql or plpgsql.`);
+  }
+  const volatility = input.volatility ?? "volatile";
+  if (!VOLATILITY.has(volatility)) {
+    catalogError2("OKM1020", `Function ${input.name} volatility ${volatility} is not supported.`);
+  }
+  const security = input.security ?? "invoker";
+  if (!SECURITY.has(security)) {
+    catalogError2("OKM1020", `Function ${input.name} security ${security} is not supported.`);
+  }
+  assertTypeName(input.returns, `function ${input.name} return type`);
+  const args = (input.arguments ?? []).map((argument) => readArgument(input.name, argument));
+  if (input.body.length === 0) {
+    catalogError2("OKM1020", `Function ${input.name} needs a body.`);
+  }
+  const atomic = input.atomic === true;
+  if (atomic && input.language !== "sql") {
+    catalogError2("OKM1020", `Function ${input.name} BEGIN ATOMIC needs language sql.`);
+  }
+  if (input.searchPath !== undefined && input.searchPath.trim().length === 0) {
+    catalogError2("OKM1020", `Function ${input.name} search_path is empty.`);
+  }
+  const definition = {
+    arguments: args,
+    returns: input.returns,
+    language: input.language,
+    volatility,
+    security,
+    body: input.body,
+    ...input.searchPath !== undefined ? { searchPath: input.searchPath } : {},
+    ...atomic ? { atomic: true } : {}
+  };
+  return {
+    kind: "function",
+    identity: {
+      kind: "function",
+      namespace,
+      name: input.name,
+      argTypes: args.map((arg) => arg.type)
+    },
+    owner: input.owner ?? "managed",
+    definition,
+    dependencies: normaliseEdges(input.dependencies ?? []),
+    provenance: input.provenance
+  };
+}
+function triggerObject(input) {
+  assertIdentifier2(input.name, "trigger");
+  assertNamespace2(input.parent.namespace);
+  assertIdentifier2(input.parent.name, "trigger table");
+  assertProvenance(input.provenance);
+  if (!TIMING.has(input.timing)) {
+    catalogError2("OKM1020", `Trigger ${input.name} timing ${input.timing} is not supported.`);
+  }
+  if (!LEVEL.has(input.level)) {
+    catalogError2("OKM1020", `Trigger ${input.name} level ${input.level} is not supported.`);
+  }
+  const events = EVENT_ORDER.filter((event) => input.events.includes(event));
+  if (events.length === 0) {
+    catalogError2("OKM1020", `Trigger ${input.name} needs an event.`);
+  }
+  const updateOf = input.updateOf === undefined ? undefined : [...input.updateOf];
+  if (updateOf !== undefined) {
+    if (!events.includes("update")) {
+      catalogError2("OKM1020", `Trigger ${input.name} lists UPDATE OF columns without an update event.`);
+    }
+    if (input.level !== "row") {
+      catalogError2("OKM1020", `Trigger ${input.name} UPDATE OF columns need level row.`);
+    }
+    for (const column of updateOf)
+      assertIdentifier2(column, "trigger column");
+  }
+  assertIdentifier2(input.calls.name, "trigger function");
+  assertNamespace2(input.calls.namespace);
+  for (const typeName of input.calls.argTypes)
+    assertTypeName(typeName, `trigger ${input.name}`);
+  const edges = [
+    { kind: "table", namespace: input.parent.namespace, name: input.parent.name },
+    {
+      kind: "function",
+      namespace: input.calls.namespace,
+      name: input.calls.name,
+      argTypes: input.calls.argTypes
+    },
+    ...(updateOf ?? []).map((column) => ({
+      kind: "column",
+      parent: input.parent,
+      name: column
+    })),
+    ...input.dependencies ?? []
+  ];
+  const definition = {
+    timing: input.timing,
+    events,
+    level: input.level,
+    calls: {
+      namespace: input.calls.namespace,
+      name: input.calls.name,
+      argTypes: [...input.calls.argTypes]
+    },
+    ...updateOf !== undefined && updateOf.length > 0 ? { updateOf } : {},
+    ...input.when !== undefined && input.when.length > 0 ? { when: input.when } : {}
+  };
+  return {
+    kind: "trigger",
+    identity: { kind: "trigger", parent: input.parent, name: input.name },
+    owner: input.owner ?? "managed",
+    definition,
+    dependencies: normaliseEdges(edges),
+    provenance: input.provenance
+  };
+}
+function readArgument(fn, argument) {
+  assertIdentifier2(argument.name, `function ${fn} argument`);
+  assertTypeName(argument.type, `function ${fn} argument ${argument.name}`);
+  return { name: argument.name, type: argument.type };
+}
+function assertTypeName(typeName, role) {
+  if (!TYPE_TEXT.test(typeName)) {
+    catalogError2("OKM1020", `${role} ${typeName} is not a type name.`);
+  }
+}
+
+export { functionObject, triggerObject };

package/dist/shared/{4b9da9d7.js → axhk06q1.js}

@@ -5,9 +5,10 @@ import {
   assertBoundText,
   assertRegconfig,
   textArray
-} from "./zt8y0wzb.js";
+} from "./n7mcc1gk.js";
 import {
   installOperatorSql,
+  quote,
   isRecord,
   fail
 } from "./xrfnq5k8.js";
@@ -35,6 +36,10 @@ function emitStructured(column, ref, name, value, sink) {
     emitMatches(column, ref, value, sink);
     return;
   }
+  if (name === "similar" || name === "wordSimilar") {
+    emitTrigram(column, ref, name, value, sink);
+    return;
+  }
   assertOperatorFits(column, name);
   fail("OKM1121", `${name} is not a value operator on ${column.field}. Use has, none, or every on a relation.`);
 }
@@ -135,4 +140,17 @@ function emitMatches(column, ref, value, sink) {
   sink.param(value.query);
   sink.text(")");
 }
+function emitTrigram(column, ref, name, value, sink) {
+  if (!isRecord(value) || typeof value.query !== "string" || typeof value.schema !== "string") {
+    fail("OKM1121", `${name} on ${column.field} needs query text.`);
+  }
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value.schema)) {
+    fail("OKM1121", `${name} on ${column.field} needs an extension schema name.`);
+  }
+  sink.text(ref);
+  sink.text(" operator(");
+  sink.text(quote(value.schema));
+  sink.text(name === "similar" ? ".%) " : ".<%) ");
+  sink.param(value.query);
+}
 installOperatorSql(emitStructured);

package/dist/shared/{38crxbgn.js → bqha5cg6.js}

@@ -3,14 +3,14 @@ import {
   noticeBuffer,
   WireSession,
   cursorStream
-} from "./cstgkzdx.js";
+} from "./0jc3ffzf.js";
 import {
   NODE_POSTGRES_CAPABILITIES,
   driverErrors,
   rejectClosed,
   mapFailure,
   runCall
-} from "./9k6vetvf.js";
+} from "./rrstp3kb.js";
 
 // src/adapters/pg/nodepostgres.ts
 import net from "node:net";
@@ -53,7 +53,7 @@ function open4(config) {
     counters.busy = Math.max(0, counters.busy - 1);
   }, inflight);
   const held = { pool, acquireMs, counters, notices, named, isClosed };
-  const checkout = () => closed ? rejectClosed() : import("./qa5dsc7z.js").then((mod) => mod.checkout(held));
+  const checkout = () => closed ? rejectClosed() : import("./6bazvqwm.js").then((mod) => mod.checkout(held));
   return {
     capabilities: NODE_POSTGRES_CAPABILITIES,
     execute(text, params, options) {

package/dist/shared/{zd93g3rq.js → bryqk9k9.js}

@@ -1,6 +1,6 @@
 import {
   withHttp
-} from "./mxmcdsh5.js";
+} from "./k34e0xf2.js";
 import {
   decodeResult
 } from "./xrfnq5k8.js";

package/dist/shared/{n47rd821.js → c8aghh05.js}

@@ -1,6 +1,6 @@
 import {
   validationGate
-} from "./3a5ne750.js";
+} from "./9m80mkac.js";
 import {
   isOperator
 } from "./cn0n68ft.js";

package/dist/shared/{dd4f8mnx.js → c9z5g0fm.js}

@@ -1,10 +1,12 @@
 import {
   definition,
   rejected,
-  quoteLiteral,
   writeArray,
   readArray
-} from "./xatfg0gn.js";
+} from "./tmbdywx0.js";
+import {
+  quoteLiteral
+} from "./94ez8kzh.js";
 import {
   REFERENTIAL_ACTIONS,
   referentialAction

package/dist/shared/{eqmtn1bj.js → dbjej1tw.js}

@@ -1,22 +1,34 @@
 import {
   open2
-} from "./ecdzej21.js";
+} from "./xw1d69vd.js";
 import {
   catalogHash2
-} from "./d2whjz4k.js";
+} from "./t616ynfn.js";
 import"./n442h54c.js";
 import {
   loadMigrations
-} from "./rtnaqre0.js";
+} from "./g4f5kcx9.js";
+import {
+  assertCreateRole,
+  currentUser,
+  roleExists
+} from "./hcmdtwgh.js";
 import {
-  quoteIdent,
-  planMigration,
   assertTargetPolicy,
   assertDirectConnection,
   selectTarget,
   projectHead,
   loadConfig
-} from "./5z4q2zda.js";
+} from "./5nmdenb6.js";
+import {
+  createdRoleName,
+  changesRole,
+  assertExtensionsAvailable,
+  planMigration
+} from "./2ssqrv66.js";
+import {
+  quoteIdent
+} from "./wekze34d.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -151,6 +163,9 @@ async function applyTarget(request) {
     await lockTarget(connection, request.target);
     locked = true;
     request.onLocked?.();
+    const session = {};
+    await prepareMigrationRole(connection, request, session);
+    await assertExtensionsAvailable(connection, request.migrations);
     await assertUuidV7Available(connection, request.migrations);
     await connection.execute(META);
     await connection.execute(HISTORY);
@@ -162,13 +177,17 @@ async function applyTarget(request) {
         continue;
       for (const unit of units) {
         assertUnitPolicy(request, unit);
-        await runUnit(connection, unit, request);
+        await runUnit(connection, unit, request, session);
         for (const item of unit.steps)
           done.add(`${unit.migrationId}:${String(item.index)}`);
       }
       applied.push(migration.id);
     }
-    return { target: request.target, applied };
+    return {
+      target: request.target,
+      applied,
+      ...session.setRole !== undefined ? { setRole: session.setRole } : {}
+    };
   } finally {
     if (locked)
       await connection.execute("select pg_advisory_unlock(hashtext($1))", [
@@ -194,7 +213,8 @@ nothing to apply
     allowPooler: flags.allowPooler || config.allowPooler === true,
     ...flags.lockTimeoutMs !== undefined ? { lockTimeoutMs: flags.lockTimeoutMs } : config.timeouts?.lock !== undefined ? { lockTimeoutMs: config.timeouts.lock } : {},
     ...flags.statementTimeoutMs !== undefined ? { statementTimeoutMs: flags.statementTimeoutMs } : config.timeouts?.statement !== undefined ? { statementTimeoutMs: config.timeouts.statement } : {},
-    migrations
+    migrations,
+    ...config.roles !== undefined ? { migrationRole: config.roles.migration } : {}
   });
   return formatReport(report);
 }
@@ -225,17 +245,20 @@ no changes
         catalogHash: catalogHash2(head.catalog),
         steps: plan.steps
       }
-    ]
+    ],
+    ...config.roles !== undefined ? { migrationRole: config.roles.migration } : {}
   });
   return formatReport(report);
 }
 function formatReport(report) {
+  const role = report.setRole !== undefined ? `set role ${report.setRole}
+` : "";
   if (report.applied.length === 0)
     return `target ${report.target}
-nothing to apply
+${role}nothing to apply
 `;
   return `target ${report.target}
-${report.applied.map((id) => `applied ${id}`).join(`
+${role}${report.applied.map((id) => `applied ${id}`).join(`
 `)}
 `;
 }
@@ -289,7 +312,31 @@ async function readDone(connection) {
   }
   return done;
 }
-async function runUnit(connection, unit, request) {
+async function prepareMigrationRole(connection, request, session) {
+  const role = request.migrationRole;
+  const changes = request.migrations.some((migration) => migration.steps.some((step) => changesRole(step.sql)));
+  if (role === undefined) {
+    if (changes)
+      await assertCreateRole(connection, await currentUser(connection));
+    return;
+  }
+  const current = await currentUser(connection);
+  const exists = await roleExists(connection, role);
+  if (changes)
+    await assertCreateRole(connection, exists && current !== role ? role : current);
+  if (exists && current !== role)
+    await assumeRole(connection, role, session);
+}
+async function grantSchema(connection, schema, role) {
+  await connection.execute(`grant usage, create on schema ${quoteIdent(schema)} to ${quoteIdent(role)}`);
+}
+async function assumeRole(connection, role, session) {
+  if (session.setRole === role)
+    return;
+  await connection.execute(`set role ${quoteIdent(role)}`);
+  session.setRole = role;
+}
+async function runUnit(connection, unit, request, session) {
   const retries = request.retries ?? DEFAULT_RETRIES;
   for (let attempt = 0;attempt <= retries; attempt += 1) {
     let began = false;
@@ -302,7 +349,17 @@ async function runUnit(connection, unit, request) {
       for (const item of unit.steps) {
         current = item.index;
         await rebuildInvalidIndex(connection, item.step.sql);
-        await connection.execute(item.step.sql);
+        const created = createdRoleName(item.step.sql);
+        const existed = created !== undefined && await roleExists(connection, created);
+        if (created === undefined || !existed)
+          await connection.execute(item.step.sql);
+        if (created !== undefined && created === request.migrationRole) {
+          if (!existed) {
+            await grantSchema(connection, request.schema ?? "public", created);
+            await connection.execute(`grant select, insert, update on okm_meta, okm_history to ${quoteIdent(created)}`);
+          }
+          await assumeRole(connection, created, session);
+        }
         if (!unit.transactional) {
           await connection.execute("begin");
           began = true;

package/dist/shared/{ps43134h.js → dyj86cmj.js}

@@ -1,15 +1,15 @@
 import {
   encodeText,
   decodeText
-} from "./sacqha1y.js";
+} from "./4m9fn52z.js";
 import {
   required,
   openColumn
-} from "./dd4f8mnx.js";
+} from "./c9z5g0fm.js";
 import {
   definition,
   rejected
-} from "./xatfg0gn.js";
+} from "./tmbdywx0.js";
 import {
   readClientGenerator
 } from "./rwmrejjz.js";
@@ -66,4 +66,4 @@ function uuidText() {
 }
 var uuidPattern;
 
-export { id2, uuid2 };
+export { id2, uuid2, encodeUuid, decodeUuid };

package/dist/shared/{sfh4pk75.js → fptpmvxp.js}

@@ -8,12 +8,12 @@ async function assertCompatible(pool, schema, recordedHash, source, options) {
   if (code.hash === recordedHash)
     return;
   if (code.artifact !== undefined) {
-    const { loadTrustedCatalog } = await import("./a1gdp7j9.js");
+    const { loadTrustedCatalog } = await import("./qybh48nd.js");
     loadTrustedCatalog(code.artifact.text, code.artifact.hash);
   } else {
     const artifact = await readCatalogFile(source.catalogDir);
     if (artifact !== undefined) {
-      const { loadTrustedCatalog } = await import("./a1gdp7j9.js");
+      const { loadTrustedCatalog } = await import("./qybh48nd.js");
       loadTrustedCatalog(artifact.text, artifact.hash);
     }
   }
@@ -26,7 +26,7 @@ async function codeHash(schema, source) {
   const listed = await readHashFile(source.catalogDir);
   if (listed !== undefined)
     return { hash: listed };
-  const { catalogHash } = await import("./a1gdp7j9.js");
+  const { catalogHash } = await import("./qybh48nd.js");
   return { hash: catalogHash(schemaCatalog(schema)) };
 }
 function schemaCatalog(schema) {

package/dist/shared/{97g2jnrw.js → fs0ex00p.js}

@@ -2,17 +2,17 @@ import {
   send2,
   reserve,
   park
-} from "./ytg3xf9p.js";
+} from "./01yr20s5.js";
 import {
   isConnectionLost
 } from "./tbszx8mz.js";
 import {
   WireSession
-} from "./cstgkzdx.js";
+} from "./0jc3ffzf.js";
 import {
   rejectClosed,
   runCall
-} from "./9k6vetvf.js";
+} from "./rrstp3kb.js";
 
 // src/adapters/pg/bunsql-extra.ts
 async function checkout(held) {

package/dist/shared/{rtnaqre0.js → g4f5kcx9.js}

@@ -1,10 +1,10 @@
 import {
   catalogHash2,
   parseCatalog2
-} from "./d2whjz4k.js";
+} from "./t616ynfn.js";
 import {
   parsePlan
-} from "./5z4q2zda.js";
+} from "./2ssqrv66.js";
 import {
   OkmError2
 } from "./52szzakm.js";

package/dist/shared/{yw5c610b.js → gjthds9j.js}

@@ -1,9 +1,9 @@
 import {
   required
-} from "./dd4f8mnx.js";
+} from "./c9z5g0fm.js";
 import {
   rejected
-} from "./xatfg0gn.js";
+} from "./tmbdywx0.js";
 
 // src/dialects/pg/json.ts
 function jsonReplacer2(_key, value) {