okmodel 0.2.1 → 0.3.0

package/dist/shared/hcmdtwgh.js

@@ -0,0 +1,102 @@
+import {
+  OkmError2
+} from "./52szzakm.js";
+
+// src/dialects/pg/role/check.ts
+async function assertRoleHealth(runner, roles, objects) {
+  const managed = new Set((roles.managed ?? []).map((role) => role.name));
+  const named = [roles.migration, roles.app];
+  for (const name of named) {
+    if (managed.has(name))
+      continue;
+    if (!await roleExists(runner, name)) {
+      throw new OkmError2("not_found", `Role ${name} is named in roles and does not exist.`, {
+        kind: "not_found",
+        fix: { summary: "Create the role, or list it in roles.managed so the plan creates it." }
+      });
+    }
+  }
+  if (managed.size > 0)
+    await assertCreateRole(runner, await currentUser(runner));
+  for (const object of objects) {
+    if (object.kind !== "grant" || object.identity.role !== roles.app)
+      continue;
+    await assertGrant(runner, object);
+  }
+}
+async function assertCreateRole(runner, role) {
+  const result = await runner.execute("select rolcreaterole from pg_roles where rolname = $1", [
+    role
+  ]);
+  if (!truthy(result.rows[0]?.[0])) {
+    throw new OkmError2("forbidden", `Role ${role} lacks CREATEROLE. Nothing was changed.`, {
+      kind: "forbidden",
+      fix: { summary: "Grant CREATEROLE to the role that applies migrations." }
+    });
+  }
+}
+async function currentUser(runner) {
+  const result = await runner.execute("select current_user");
+  const name = result.rows[0]?.[0];
+  return typeof name === "string" ? name : "";
+}
+async function roleExists(runner, name) {
+  const result = await runner.execute("select 1 from pg_roles where rolname = $1", [name]);
+  return result.rows.length > 0;
+}
+async function assertGrant(runner, object) {
+  const target = object.identity.object;
+  const schema = target.namespace.form === "static" ? target.namespace.name : "public";
+  const privilege = object.identity.privilege;
+  if (target.kind === "function") {
+    const open = target.name.lastIndexOf("(");
+    const fn = open < 0 ? target.name : target.name.slice(0, open);
+    const args = open < 0 ? "" : target.name.slice(open + 1, -1);
+    if (!await functionExists(runner, schema, fn, args))
+      return;
+    const allowed = await runner.execute("select has_function_privilege($1, format('%I.%I(%s)', $2::text, $3::text, $4::text), $5)", [object.identity.role, schema, fn, args, privilege]);
+    if (!truthy(allowed.rows[0]?.[0]))
+      missing(object, `${schema}.${fn}`);
+    return;
+  }
+  if (target.kind === "namespace")
+    return;
+  const relkinds = target.kind === "sequence" ? "'S'" : target.kind === "view" ? "'v'" : target.kind === "materializedView" ? "'m'" : "'r', 'p'";
+  if (!await relationExists(runner, schema, target.name, relkinds))
+    return;
+  const probe = target.kind === "sequence" ? "select has_sequence_privilege($1, format('%I.%I', $2::text, $3::text), $4)" : "select has_table_privilege($1, format('%I.%I', $2::text, $3::text), $4)";
+  const allowed = await runner.execute(probe, [
+    object.identity.role,
+    schema,
+    target.name,
+    privilege
+  ]);
+  if (!truthy(allowed.rows[0]?.[0]))
+    missing(object, `${schema}.${target.name}`);
+}
+function missing(object, name) {
+  throw new OkmError2("OKM1825", `Role ${object.identity.role} lacks ${object.identity.privilege} on ${name}.`, {
+    kind: "forbidden",
+    fix: {
+      summary: "Grant the privilege, or change the role. okm doctor reports the object and the privilege."
+    }
+  });
+}
+async function relationExists(runner, schema, name, relkinds) {
+  const result = await runner.execute(`select 1 from pg_class c
+     join pg_namespace n on n.oid = c.relnamespace
+     where n.nspname = $1 and c.relname = $2 and c.relkind in (${relkinds})`, [schema, name]);
+  return result.rows.length > 0;
+}
+async function functionExists(runner, schema, name, args) {
+  const result = await runner.execute(`select 1 from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+     where n.nspname = $1 and p.proname = $2
+       and replace(pg_get_function_identity_arguments(p.oid), ' ', '') = $3`, [schema, name, args]);
+  return result.rows.length > 0;
+}
+function truthy(value) {
+  return value === true || value === "t" || value === "true";
+}
+
+export { assertRoleHealth, assertCreateRole, currentUser, roleExists };

package/dist/shared/{qxa0yb9j.js → jkc6ws1p.js}

@@ -1,18 +1,11 @@
 import {
-  assertNamespace2,
   identityKey2,
   identityLabel2,
-  normaliseEdges,
-  compareText,
-  assertProvenance
+  compareText
 } from "./t4tbsy9h.js";
 import {
   CATALOG_VERSION2
 } from "./4e4c6vq2.js";
-import {
-  assertIdentifier2,
-  assertStoredText
-} from "./nfzc5z0w.js";
 import {
   catalogError2
 } from "./52szzakm.js";
@@ -142,49 +135,4 @@ function assertForeignKeys(objects, keys) {
   }
 }
 
-// src/contracts/catalog/enum.ts
-function enumType(input) {
-  assertNamespace2(input.namespace);
-  assertIdentifier2(input.name, "type");
-  assertProvenance(input.provenance);
-  if (input.labels.length === 0) {
-    catalogError2("OKM1020", `Enum ${input.name} must list at least one label.`);
-  }
-  const labels = [];
-  const seen = new Set;
-  for (const label of input.labels) {
-    assertStoredText(label, "enum label");
-    if (label.length === 0) {
-      catalogError2("OKM1020", `Enum ${input.name} has an empty label.`);
-    }
-    if (seen.has(label)) {
-      catalogError2("OKM1020", `Enum ${input.name} repeats label ${label}.`);
-    }
-    seen.add(label);
-    labels.push(label);
-  }
-  const identity = {
-    kind: "type",
-    namespace: input.namespace,
-    name: input.name
-  };
-  return {
-    kind: "type",
-    identity,
-    owner: input.owner ?? "managed",
-    definition: { labels },
-    dependencies: normaliseEdges(input.dependencies ?? []),
-    provenance: input.provenance
-  };
-}
-function sameEnumLabels(left, right) {
-  if (left.length !== right.length)
-    return false;
-  for (let index = 0;index < left.length; index += 1) {
-    if (left[index] !== right[index])
-      return false;
-  }
-  return true;
-}
-
-export { dependencyOrder, catalog, enumType, sameEnumLabels };
+export { dependencyOrder, catalog };

package/dist/shared/{mxmcdsh5.js → k34e0xf2.js}

@@ -72,7 +72,7 @@ function openClient(session) {
     },
     close,
     connected: session.connected,
-    tx: (...args) => import("./g9f0zqce.js").then((mod) => mod.tx(session, args)),
+    tx: (...args) => import("./m78s7898.js").then((mod) => mod.tx(session, args)),
     batch: (ops, options) => batchHandle(session, ops, options),
     ...session.tx?.extras
   };
@@ -107,7 +107,7 @@ function tableApi(session, table, view, uses) {
   const api = {
     find(options = {}) {
       if ("lock" in options) {
-        return lazyRead(session, () => import("./mrq77sgw.js"), table, options, base, view);
+        return lazyRead(session, () => import("./ydaz1sv3.js"), table, options, base, view);
       }
       return start(session, "find", table, options, base, view);
     },
@@ -121,10 +121,10 @@ function tableApi(session, table, view, uses) {
       return start(session, "exists", table, options, base, view);
     },
     page(options) {
-      return lazyRead(session, () => import("./e7a268fy.js"), table, options, base, view);
+      return lazyRead(session, () => import("./p24x2334.js"), table, options, base, view);
     },
     aggregate(options = {}) {
-      return lazyRead(session, () => import("./10tjenmd.js"), table, options, base, view);
+      return lazyRead(session, () => import("./3ekj9x92.js"), table, options, base, view);
     },
     insert(data, options = {}) {
       return writeHandle(session, "insert", table, data, options, mods);
@@ -154,13 +154,13 @@ function tableApi(session, table, view, uses) {
   return api;
 }
 function batchHandle(session, ops, options, replica) {
-  return queryHandle(() => import("./v18jva5b.js").then((mod) => mod.batch(session, ops, options, replica)), {
+  return queryHandle(() => import("./mt5wswjz.js").then((mod) => mod.batch(session, ops, options, replica)), {
     replica: () => batchHandle(session, ops, options, true)
   });
 }
 var writers;
 function loadWrite() {
-  writers ??= import("./4jzzghr6.js");
+  writers ??= import("./xva8v7qk.js");
   return writers;
 }
 function queryHandle(run, extra) {
@@ -320,7 +320,7 @@ function readHandle(session, table, call, mods, decode, extra) {
 }
 function streamLazy(session, call, prepare) {
   return async function* () {
-    const { streamRows } = await import("./zd93g3rq.js");
+    const { streamRows } = await import("./bryqk9k9.js");
     yield* streamRows(session, call, prepare, (error) => logged(session, error));
   }();
 }
@@ -357,7 +357,7 @@ function readCall(op, table, options, all, scope, model, schema, view) {
   };
 }
 async function checkServer(pool, schema, http, requireMeta, options, source) {
-  const server = await import("./ge03bfca.js");
+  const server = await import("./ty3v3hfk.js");
   let rows;
   try {
     const result = await pool.execute(server.versionQuery, undefined, options);
@@ -386,7 +386,7 @@ function errorFields(error) {
 var includeHooks;
 var operatorSql;
 function loadOperatorSql() {
-  operatorSql ??= import("./4b9da9d7.js").then(() => {
+  operatorSql ??= import("./axhk06q1.js").then(() => {
     return;
   });
   return operatorSql;

package/dist/shared/{py3nh7jy.js → kgnc8grt.js}

@@ -1,11 +1,11 @@
 import {
   open3
-} from "./0qkxbm1f.js";
+} from "./75xkjv0t.js";
 import {
   PGLITE_CAPABILITIES,
   readCapability2,
   hasCapability2
-} from "./9k6vetvf.js";
+} from "./rrstp3kb.js";
 export {
   PGLITE_CAPABILITIES as capabilities,
   hasCapability2 as hasCapability,

package/dist/shared/{g9f0zqce.js → m78s7898.js}

@@ -5,7 +5,7 @@ import {
   openClient,
   withHttp,
   settleCall
-} from "./mxmcdsh5.js";
+} from "./k34e0xf2.js";
 import {
   rejectKeys,
   isRecord,

package/dist/shared/meck53jv.js

@@ -0,0 +1,99 @@
+import {
+  open2
+} from "./xw1d69vd.js";
+import"./t616ynfn.js";
+import"./n442h54c.js";
+import {
+  assertTargetPolicy,
+  selectTarget,
+  openProject
+} from "./5nmdenb6.js";
+import"./2ssqrv66.js";
+import {
+  isExactVersion,
+  compareExtensionVersions
+} from "./th14ygv2.js";
+import {
+  OkmError2
+} from "./52szzakm.js";
+
+// src/tooling/migrate/ext.ts
+async function extProject(cwd, command, flags) {
+  const opened = await openProject(cwd);
+  const target = selectTarget(opened.config, flags.target);
+  assertTargetPolicy(target, "check", flags.allowProtected);
+  const pool = open2({ url: target.url, max: 1 });
+  try {
+    if (command === "list")
+      return formatList(await readExtensions(pool));
+    return formatCheck(opened.built.catalog.objects, await readExtensions(pool));
+  } finally {
+    await pool.close();
+  }
+}
+var LIST_SQL = `
+  select a.name, a.default_version, e.extversion, n.nspname
+  from pg_available_extensions a
+  left join pg_extension e on e.extname = a.name
+  left join pg_namespace n on n.oid = e.extnamespace
+  order by a.name
+`;
+async function readExtensions(pool) {
+  const result = await pool.execute(LIST_SQL);
+  return result.rows.map((row) => ({
+    name: cell(row[0]),
+    defaultVersion: cell(row[1]),
+    installedVersion: cell(row[2]),
+    schema: cell(row[3])
+  }));
+}
+function cell(value) {
+  return typeof value === "string" ? value : "";
+}
+function formatList(rows) {
+  const lines = ["name\tdefault\tinstalled\tschema"];
+  for (const row of rows) {
+    lines.push([row.name, row.defaultVersion, row.installedVersion, row.schema].join("\t"));
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+function formatCheck(objects, server) {
+  const declared = objects.filter((object) => object.kind === "extension");
+  if (declared.length === 0)
+    return `no extensions
+`;
+  const installed = new Map(server.map((row) => [row.name, row.installedVersion]));
+  const lines = ["name\tdeclared\tinstalled"];
+  for (const object of [...declared].sort((left, right) => left.identity.name < right.identity.name ? -1 : 1)) {
+    const name = object.identity.name;
+    const have = installed.get(name) ?? "";
+    if (have.length === 0) {
+      throw new OkmError2("OKM1811", `Extension ${name} is not installed on the server.`, {
+        fix: { summary: "Install the extension, or remove the declaration." }
+      });
+    }
+    const want = object.definition.version;
+    if (!versionAccepted(want, have)) {
+      throw new OkmError2("OKM1812", `Extension ${name} is ${have} on the server. The schema requires ${want ?? ""}.`, { fix: { summary: "Install a version the declaration accepts, or change the pin." } });
+    }
+    lines.push([name, want ?? "-", have].join("\t"));
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+function versionAccepted(declared, installed) {
+  if (declared === undefined)
+    return true;
+  const floor = /^>=(\d+(?:\.\d+)*)$/.exec(declared);
+  const minimum = floor?.[1];
+  if (minimum !== undefined) {
+    return isExactVersion(installed) && compareExtensionVersions(installed, minimum) >= 0;
+  }
+  return declared === installed;
+}
+export {
+  extProject
+};

package/dist/shared/{v18jva5b.js → mt5wswjz.js}

@@ -4,7 +4,7 @@ import {
 import {
   withHttp,
   settleCall
-} from "./mxmcdsh5.js";
+} from "./k34e0xf2.js";
 import {
   rejectKeys,
   isRecord,

package/dist/shared/{g1b5zzj9.js → n0dgs0pb.js}

@@ -1,7 +1,7 @@
 import {
   definition,
   unavailable
-} from "./xatfg0gn.js";
+} from "./tmbdywx0.js";
 
 // src/dialects/pg/trait.ts
 var TRAIT_KEYS = new Set(["fields", "name", "presets", "sealed", "touch"]);

package/dist/shared/{zt8y0wzb.js → n7mcc1gk.js}

@@ -1,6 +1,6 @@
 import {
   writeArray
-} from "./xatfg0gn.js";
+} from "./tmbdywx0.js";
 import {
   OkmError2
 } from "./52szzakm.js";

package/dist/shared/ne02ng5c.js

@@ -0,0 +1,68 @@
+import {
+  open2
+} from "./xw1d69vd.js";
+import"./n442h54c.js";
+import"./t616ynfn.js";
+import {
+  assertRoleHealth
+} from "./hcmdtwgh.js";
+import {
+  errorDoc,
+  selectTarget,
+  openProject
+} from "./5nmdenb6.js";
+import {
+  omitManagedObjects
+} from "./2ssqrv66.js";
+import {
+  OkmError2
+} from "./52szzakm.js";
+
+// src/tooling/migrate/doctor.ts
+async function doctorProject(cwd, code, flags) {
+  if (code !== undefined) {
+    const doc = errorDoc(code);
+    if (doc === undefined) {
+      throw new OkmError2("invalid", `Unknown code ${code}.`, {
+        fix: { summary: "Pass a code from the registry, or run okm doctor with no argument." }
+      });
+    }
+    return `${doc.code}: ${doc.title}
+${doc.summary}
+${doc.fix}
+`;
+  }
+  const opened = await openProject(cwd);
+  const objects = omitManagedObjects(opened.built.catalog).objects;
+  if (opened.config.roles !== undefined) {
+    const target = selectTarget(opened.config, flags?.target);
+    const pool = open2({ url: target.url, max: 1 });
+    try {
+      await assertRoleHealth(pool, opened.config.roles, objects);
+    } finally {
+      await pool.close();
+    }
+  }
+  return formatTriggers(objects);
+}
+function formatTriggers(objects) {
+  const tables = new Map;
+  for (const object of objects) {
+    if (object.kind !== "trigger")
+      continue;
+    const table = object.identity.parent.name;
+    const names = tables.get(table) ?? [];
+    names.push(object.identity.name);
+    tables.set(table, names);
+  }
+  if (tables.size === 0)
+    return `no triggers
+`;
+  const lines = [...tables.entries()].sort((left, right) => left[0] < right[0] ? -1 : left[0] > right[0] ? 1 : 0).map(([table, names]) => `${table}: ${[...names].sort().join(", ")}`);
+  return `${lines.join(`
+`)}
+`;
+}
+export {
+  doctorProject
+};

package/dist/shared/{e7a268fy.js → p24x2334.js}

@@ -3,7 +3,7 @@ import {
   readHandle,
   readCall,
   attachHttp
-} from "./mxmcdsh5.js";
+} from "./k34e0xf2.js";
 import {
   selectedColumns,
   parseOrder,

package/dist/shared/qbxzvwwc.js

@@ -0,0 +1,88 @@
+import {
+  assertNamespace2,
+  normaliseEdges,
+  assertProvenance
+} from "./t4tbsy9h.js";
+import {
+  assertIdentifier2,
+  assertStoredText
+} from "./nfzc5z0w.js";
+import {
+  catalogError2
+} from "./52szzakm.js";
+
+// src/contracts/catalog/enum.ts
+function enumType(input) {
+  assertNamespace2(input.namespace);
+  assertIdentifier2(input.name, "type");
+  assertProvenance(input.provenance);
+  if (input.labels.length === 0) {
+    catalogError2("OKM1020", `Enum ${input.name} must list at least one label.`);
+  }
+  const labels = [];
+  const seen = new Set;
+  for (const label of input.labels) {
+    assertStoredText(label, "enum label");
+    if (label.length === 0) {
+      catalogError2("OKM1020", `Enum ${input.name} has an empty label.`);
+    }
+    if (seen.has(label)) {
+      catalogError2("OKM1020", `Enum ${input.name} repeats label ${label}.`);
+    }
+    seen.add(label);
+    labels.push(label);
+  }
+  const identity = {
+    kind: "type",
+    namespace: input.namespace,
+    name: input.name
+  };
+  return {
+    kind: "type",
+    identity,
+    owner: input.owner ?? "managed",
+    definition: { labels },
+    dependencies: normaliseEdges(input.dependencies ?? []),
+    provenance: input.provenance
+  };
+}
+function domainType(input) {
+  assertNamespace2(input.namespace);
+  assertIdentifier2(input.name, "type");
+  assertProvenance(input.provenance);
+  if (input.base.length === 0) {
+    catalogError2("OKM1020", `Domain ${input.name} needs a base type.`);
+  }
+  assertStoredText(input.check, "domain check");
+  if (input.check.length === 0) {
+    catalogError2("OKM1020", `Domain ${input.name} needs a check.`);
+  }
+  const identity = {
+    kind: "type",
+    namespace: input.namespace,
+    name: input.name
+  };
+  const definition = { base: input.base, check: input.check };
+  return {
+    kind: "type",
+    identity,
+    owner: input.owner ?? "managed",
+    definition,
+    dependencies: normaliseEdges(input.dependencies ?? []),
+    provenance: input.provenance
+  };
+}
+function isDomain(definition) {
+  return "base" in definition;
+}
+function sameEnumLabels(left, right) {
+  if (left.length !== right.length)
+    return false;
+  for (let index = 0;index < left.length; index += 1) {
+    if (left[index] !== right[index])
+      return false;
+  }
+  return true;
+}
+
+export { enumType, domainType, isDomain, sameEnumLabels };

package/dist/shared/{a1gdp7j9.js → qybh48nd.js}

@@ -6,7 +6,7 @@ import {
   catalogHash2,
   loadTrustedCatalog2,
   parseCatalog2
-} from "./d2whjz4k.js";
+} from "./t616ynfn.js";
 export {
   catalogHash2 as catalogHash,
   creationOrder2 as creationOrder,

package/dist/shared/{d04j53v8.js → scwxrpx2.js}

@@ -1,16 +1,17 @@
 import {
   open2
-} from "./ecdzej21.js";
-import"./d2whjz4k.js";
+} from "./xw1d69vd.js";
+import"./t616ynfn.js";
 import"./n442h54c.js";
 import {
   loadMigrations
-} from "./rtnaqre0.js";
+} from "./g4f5kcx9.js";
 import {
   assertTargetPolicy,
   listTargets,
   loadConfig
-} from "./5z4q2zda.js";
+} from "./5nmdenb6.js";
+import"./2ssqrv66.js";
 import {
   OkmError2
 } from "./52szzakm.js";