okmodel 0.2.1 → 0.4.0

package/dist/shared/{qxa0yb9j.js → g7ez901n.js}

@@ -177,6 +177,35 @@ function enumType(input) {
     provenance: input.provenance
   };
 }
+function domainType(input) {
+  assertNamespace2(input.namespace);
+  assertIdentifier2(input.name, "type");
+  assertProvenance(input.provenance);
+  if (input.base.length === 0) {
+    catalogError2("OKM1020", `Domain ${input.name} needs a base type.`);
+  }
+  assertStoredText(input.check, "domain check");
+  if (input.check.length === 0) {
+    catalogError2("OKM1020", `Domain ${input.name} needs a check.`);
+  }
+  const identity = {
+    kind: "type",
+    namespace: input.namespace,
+    name: input.name
+  };
+  const definition = { base: input.base, check: input.check };
+  return {
+    kind: "type",
+    identity,
+    owner: input.owner ?? "managed",
+    definition,
+    dependencies: normaliseEdges(input.dependencies ?? []),
+    provenance: input.provenance
+  };
+}
+function isDomain(definition) {
+  return "base" in definition;
+}
 function sameEnumLabels(left, right) {
   if (left.length !== right.length)
     return false;
@@ -187,4 +216,4 @@ function sameEnumLabels(left, right) {
   return true;
 }
 
-export { dependencyOrder, catalog, enumType, sameEnumLabels };
+export { dependencyOrder, catalog, enumType, domainType, isDomain, sameEnumLabels };

package/dist/shared/{py3nh7jy.js → gdh9mrtp.js}

@@ -1,11 +1,11 @@
 import {
   open3
-} from "./0qkxbm1f.js";
+} from "./fa9vt245.js";
 import {
   PGLITE_CAPABILITIES,
   readCapability2,
   hasCapability2
-} from "./9k6vetvf.js";
+} from "./rrstp3kb.js";
 export {
   PGLITE_CAPABILITIES as capabilities,
   hasCapability2 as hasCapability,

package/dist/shared/{yw5c610b.js → gjthds9j.js}

@@ -1,9 +1,9 @@
 import {
   required
-} from "./dd4f8mnx.js";
+} from "./c9z5g0fm.js";
 import {
   rejected
-} from "./xatfg0gn.js";
+} from "./tmbdywx0.js";
 
 // src/dialects/pg/json.ts
 function jsonReplacer2(_key, value) {

package/dist/shared/hcmdtwgh.js

@@ -0,0 +1,102 @@
+import {
+  OkmError2
+} from "./52szzakm.js";
+
+// src/dialects/pg/role/check.ts
+async function assertRoleHealth(runner, roles, objects) {
+  const managed = new Set((roles.managed ?? []).map((role) => role.name));
+  const named = [roles.migration, roles.app];
+  for (const name of named) {
+    if (managed.has(name))
+      continue;
+    if (!await roleExists(runner, name)) {
+      throw new OkmError2("not_found", `Role ${name} is named in roles and does not exist.`, {
+        kind: "not_found",
+        fix: { summary: "Create the role, or list it in roles.managed so the plan creates it." }
+      });
+    }
+  }
+  if (managed.size > 0)
+    await assertCreateRole(runner, await currentUser(runner));
+  for (const object of objects) {
+    if (object.kind !== "grant" || object.identity.role !== roles.app)
+      continue;
+    await assertGrant(runner, object);
+  }
+}
+async function assertCreateRole(runner, role) {
+  const result = await runner.execute("select rolcreaterole from pg_roles where rolname = $1", [
+    role
+  ]);
+  if (!truthy(result.rows[0]?.[0])) {
+    throw new OkmError2("forbidden", `Role ${role} lacks CREATEROLE. Nothing was changed.`, {
+      kind: "forbidden",
+      fix: { summary: "Grant CREATEROLE to the role that applies migrations." }
+    });
+  }
+}
+async function currentUser(runner) {
+  const result = await runner.execute("select current_user");
+  const name = result.rows[0]?.[0];
+  return typeof name === "string" ? name : "";
+}
+async function roleExists(runner, name) {
+  const result = await runner.execute("select 1 from pg_roles where rolname = $1", [name]);
+  return result.rows.length > 0;
+}
+async function assertGrant(runner, object) {
+  const target = object.identity.object;
+  const schema = target.namespace.form === "static" ? target.namespace.name : "public";
+  const privilege = object.identity.privilege;
+  if (target.kind === "function") {
+    const open = target.name.lastIndexOf("(");
+    const fn = open < 0 ? target.name : target.name.slice(0, open);
+    const args = open < 0 ? "" : target.name.slice(open + 1, -1);
+    if (!await functionExists(runner, schema, fn, args))
+      return;
+    const allowed = await runner.execute("select has_function_privilege($1, format('%I.%I(%s)', $2::text, $3::text, $4::text), $5)", [object.identity.role, schema, fn, args, privilege]);
+    if (!truthy(allowed.rows[0]?.[0]))
+      missing(object, `${schema}.${fn}`);
+    return;
+  }
+  if (target.kind === "namespace")
+    return;
+  const relkinds = target.kind === "sequence" ? "'S'" : target.kind === "view" ? "'v'" : target.kind === "materializedView" ? "'m'" : "'r', 'p'";
+  if (!await relationExists(runner, schema, target.name, relkinds))
+    return;
+  const probe = target.kind === "sequence" ? "select has_sequence_privilege($1, format('%I.%I', $2::text, $3::text), $4)" : "select has_table_privilege($1, format('%I.%I', $2::text, $3::text), $4)";
+  const allowed = await runner.execute(probe, [
+    object.identity.role,
+    schema,
+    target.name,
+    privilege
+  ]);
+  if (!truthy(allowed.rows[0]?.[0]))
+    missing(object, `${schema}.${target.name}`);
+}
+function missing(object, name) {
+  throw new OkmError2("OKM1825", `Role ${object.identity.role} lacks ${object.identity.privilege} on ${name}.`, {
+    kind: "forbidden",
+    fix: {
+      summary: "Grant the privilege, or change the role. okm doctor reports the object and the privilege."
+    }
+  });
+}
+async function relationExists(runner, schema, name, relkinds) {
+  const result = await runner.execute(`select 1 from pg_class c
+     join pg_namespace n on n.oid = c.relnamespace
+     where n.nspname = $1 and c.relname = $2 and c.relkind in (${relkinds})`, [schema, name]);
+  return result.rows.length > 0;
+}
+async function functionExists(runner, schema, name, args) {
+  const result = await runner.execute(`select 1 from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+     where n.nspname = $1 and p.proname = $2
+       and replace(pg_get_function_identity_arguments(p.oid), ' ', '') = $3`, [schema, name, args]);
+  return result.rows.length > 0;
+}
+function truthy(value) {
+  return value === true || value === "t" || value === "true";
+}
+
+export { assertRoleHealth, assertCreateRole, currentUser, roleExists };

package/dist/shared/hqjsxnz7.js

@@ -0,0 +1,13 @@
+import {
+  assertAuthorDrift2,
+  catalogQuery2,
+  managedRoleOptions2
+} from "./xghkt7a9.js";
+import"./n5y9zyj1.js";
+import"./41kv2xdm.js";
+import"./8jb4ymh2.js";
+export {
+  assertAuthorDrift2 as assertAuthorDrift,
+  catalogQuery2 as catalogQuery,
+  managedRoleOptions2 as managedRoleOptions
+};

package/dist/shared/htnaj77v.js

@@ -0,0 +1,17 @@
+// src/runtime/catalog-cache.ts
+var inflight = new Map;
+function loadOnce(key, load) {
+  const found = inflight.get(key);
+  if (found !== undefined)
+    return found;
+  const pending = Promise.resolve().then(load);
+  inflight.set(key, pending);
+  pending.catch(() => {
+    if (inflight.get(key) === pending)
+      inflight.delete(key);
+  });
+  return pending;
+}
+export {
+  loadOnce
+};

package/dist/shared/{v18jva5b.js → jgxzjzcz.js}

@@ -4,7 +4,7 @@ import {
 import {
   withHttp,
   settleCall
-} from "./mxmcdsh5.js";
+} from "./kkzwp3d2.js";
 import {
   rejectKeys,
   isRecord,

package/dist/shared/{x9v1qgeb.js → jsd07prz.js}

@@ -5,7 +5,7 @@ import {
 import {
   definition,
   unavailable
-} from "./xatfg0gn.js";
+} from "./tmbdywx0.js";
 import {
   OkmError2,
   throwNamed2
@@ -60,6 +60,7 @@ var TABLE_KNOWN = new Set([
   "omitDefaults",
   "presets",
   "primaryKey",
+  "reference",
   "relations",
   "renamedFrom",
   "sqlName",
@@ -71,8 +72,7 @@ var TABLE_KNOWN = new Set([
 ]);
 var TABLE_LATER = {
   computed: "later",
-  policies: "later",
-  reference: "0.4"
+  policies: "later"
 };
 function table2(name, columns, options) {
   const source = callerLocation(1);

package/dist/shared/{g9f0zqce.js → kafaa5zv.js}

@@ -5,7 +5,7 @@ import {
   openClient,
   withHttp,
   settleCall
-} from "./mxmcdsh5.js";
+} from "./kkzwp3d2.js";
 import {
   rejectKeys,
   isRecord,

package/dist/shared/kj680nxv.js

@@ -0,0 +1,19 @@
+import {
+  applyTarget2,
+  applyProject2,
+  pushProject2,
+  backfillTiming2
+} from "./s4mb6a4b.js";
+import"./7nk68fj8.js";
+import"./q6zsyh31.js";
+import"./n5y9zyj1.js";
+import"./n442h54c.js";
+import"./41kv2xdm.js";
+import"./8jb4ymh2.js";
+import"./wqem4jed.js";
+export {
+  applyProject2 as applyProject,
+  applyTarget2 as applyTarget,
+  backfillTiming2 as backfillTiming,
+  pushProject2 as pushProject
+};

package/dist/shared/{mxmcdsh5.js → kkzwp3d2.js}

@@ -72,7 +72,7 @@ function openClient(session) {
     },
     close,
     connected: session.connected,
-    tx: (...args) => import("./g9f0zqce.js").then((mod) => mod.tx(session, args)),
+    tx: (...args) => import("./kafaa5zv.js").then((mod) => mod.tx(session, args)),
     batch: (ops, options) => batchHandle(session, ops, options),
     ...session.tx?.extras
   };
@@ -107,7 +107,7 @@ function tableApi(session, table, view, uses) {
   const api = {
     find(options = {}) {
       if ("lock" in options) {
-        return lazyRead(session, () => import("./mrq77sgw.js"), table, options, base, view);
+        return lazyRead(session, () => import("./zg24x0hm.js"), table, options, base, view);
       }
       return start(session, "find", table, options, base, view);
     },
@@ -121,10 +121,10 @@ function tableApi(session, table, view, uses) {
       return start(session, "exists", table, options, base, view);
     },
     page(options) {
-      return lazyRead(session, () => import("./e7a268fy.js"), table, options, base, view);
+      return lazyRead(session, () => import("./v7tpnhnz.js"), table, options, base, view);
     },
     aggregate(options = {}) {
-      return lazyRead(session, () => import("./10tjenmd.js"), table, options, base, view);
+      return lazyRead(session, () => import("./qn0srwwq.js"), table, options, base, view);
     },
     insert(data, options = {}) {
       return writeHandle(session, "insert", table, data, options, mods);
@@ -154,13 +154,13 @@ function tableApi(session, table, view, uses) {
   return api;
 }
 function batchHandle(session, ops, options, replica) {
-  return queryHandle(() => import("./v18jva5b.js").then((mod) => mod.batch(session, ops, options, replica)), {
+  return queryHandle(() => import("./jgxzjzcz.js").then((mod) => mod.batch(session, ops, options, replica)), {
     replica: () => batchHandle(session, ops, options, true)
   });
 }
 var writers;
 function loadWrite() {
-  writers ??= import("./4jzzghr6.js");
+  writers ??= import("./awrsqrn7.js");
   return writers;
 }
 function queryHandle(run, extra) {
@@ -320,7 +320,7 @@ function readHandle(session, table, call, mods, decode, extra) {
 }
 function streamLazy(session, call, prepare) {
   return async function* () {
-    const { streamRows } = await import("./zd93g3rq.js");
+    const { streamRows } = await import("./sr5ms7b3.js");
     yield* streamRows(session, call, prepare, (error) => logged(session, error));
   }();
 }
@@ -357,7 +357,7 @@ function readCall(op, table, options, all, scope, model, schema, view) {
   };
 }
 async function checkServer(pool, schema, http, requireMeta, options, source) {
-  const server = await import("./ge03bfca.js");
+  const server = await import("./nxb42q7h.js");
   let rows;
   try {
     const result = await pool.execute(server.versionQuery, undefined, options);
@@ -386,7 +386,7 @@ function errorFields(error) {
 var includeHooks;
 var operatorSql;
 function loadOperatorSql() {
-  operatorSql ??= import("./4b9da9d7.js").then(() => {
+  operatorSql ??= import("./axhk06q1.js").then(() => {
     return;
   });
   return operatorSql;

package/dist/shared/{g1b5zzj9.js → n0dgs0pb.js}

@@ -1,7 +1,7 @@
 import {
   definition,
   unavailable
-} from "./xatfg0gn.js";
+} from "./tmbdywx0.js";
 
 // src/dialects/pg/trait.ts
 var TRAIT_KEYS = new Set(["fields", "name", "presets", "sealed", "touch"]);