okmodel 0.4.0 → 0.5.1

package/dist/runtime/validate/index.js

@@ -3,10 +3,10 @@ import {
 } from "../../shared/9m80mkac.js";
 import {
   addSchemaHook
-} from "../../shared/3p4b1fg0.js";
+} from "../../shared/5enne4ma.js";
 import {
   queryHandle
-} from "../../shared/kkzwp3d2.js";
+} from "../../shared/hf22e0wt.js";
 import {
   OkmError2
 } from "../../shared/52szzakm.js";
@@ -14,7 +14,7 @@ import {
 // src/runtime/validate/load.ts
 var engine;
 function loadEngine() {
-  engine ??= import("../../shared/c8aghh05.js");
+  engine ??= import("../../shared/8rsy3hxz.js");
   return engine;
 }
 

package/dist/shared/{radd3z4g.js → 0t22wwh1.js}

@@ -12,16 +12,14 @@ import {
   indexes,
   quote,
   isRecord,
+  effectivePredicate,
   registerFailFix,
   fail
-} from "./xrfnq5k8.js";
+} from "./gbtcc2d7.js";
 import {
   safetyInstalled,
   runSafety
 } from "./a5sxz52y.js";
-import {
-  isOperator
-} from "./cn0n68ft.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -362,11 +360,9 @@ function requireFilter(table, where, mods, op) {
     }
     return;
   }
-  if (isOperator(where))
-    return;
-  if (isRecord(where) && Object.keys(where).length > 0)
-    return;
-  fail("OKM1102", `${op} on ${table.model.name} needs a where. Pass a filter, or .all(reason).`);
+  if (!effectivePredicate(where)) {
+    fail("OKM1102", `${op} on ${table.model.name} needs a where. Pass a filter, or .all(reason).`);
+  }
 }
 function callOptions(input) {
   const signal = input.signal;

package/dist/shared/{ady1ms74.js → 2pqx26h8.js}

@@ -1,21 +1,23 @@
 import {
   open2
-} from "./wqem4jed.js";
-import"./8jb4ymh2.js";
+} from "./krxx77g0.js";
+import"./8bwbwy8h.js";
 import {
   createdOf,
   testing2
-} from "./ygem90rn.js";
+} from "./v36c5g6p.js";
 import"./n442h54c.js";
 import {
-  assertTargetPolicy,
-  assertDirectConnection,
-  selectTarget,
   loadConfig,
   loadSchema
-} from "./q6zsyh31.js";
-import"./n5y9zyj1.js";
-import"./41kv2xdm.js";
+} from "./qv2ydck9.js";
+import {
+  assertTargetPolicy,
+  assertDirectConnection,
+  assertStableBackend,
+  selectTarget
+} from "./ga3sfy93.js";
+import"./8xsbagad.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -34,9 +36,22 @@ async function seedProject(cwd, file, flags) {
       fix: { summary: "Pass okm seed <file> a module in this project." }
     });
   }
-  assertDirectConnection(target.url, flags.allowPooler || config.allowPooler === true);
+  const allowPooler = flags.allowPooler || config.allowPooler === true;
+  assertDirectConnection(target.url, allowPooler);
   const schema = await loadSchema(cwd, config.schema);
   const pool = open2({ url: target.url, max: 1 });
+  const held = await pool.reserve?.();
+  if (held !== undefined) {
+    try {
+      await assertStableBackend(async () => {
+        const result = await held.execute("select pg_backend_pid()::text");
+        const cell = result.rows[0]?.[0];
+        return cell === null || cell === undefined ? "" : String(cell);
+      }, allowPooler);
+    } finally {
+      await held.release();
+    }
+  }
   const harness = await testing2(schema, { driver: pool, migrate: false });
   try {
     const imported = await import(`${pathToFileURL(path).href}?okm=${Date.now()}`);

package/dist/shared/{kyxb62mc.js → 31vm914h.js}

@@ -75,7 +75,7 @@ function mapDriverError2(error, batchIndex) {
   if (error instanceof DriverError2) {
     return batchIndex === undefined ? error : error.at(batchIndex);
   }
-  const message = error instanceof Error ? error.message : "driver error";
+  const message = messageOf(error);
   return new DriverError2(message, driverFields({
     sqlstate: sqlstateOf(error),
     constraint: errorField2(error, "constraint_name") ?? errorField2(error, "constraint"),
@@ -86,6 +86,14 @@ function mapDriverError2(error, batchIndex) {
     batchIndex
   }));
 }
+function messageOf(error) {
+  if (!(error instanceof Error))
+    return "driver error";
+  if (error.message.length > 0)
+    return error.message;
+  const first = error.errors?.[0];
+  return first instanceof Error && first.message.length > 0 ? first.message : "driver error";
+}
 function driverFields(input) {
   const fields = {};
   if (input.sqlstate !== undefined)

package/dist/shared/{jns2wx4t.js → 32zqc1dw.js}

@@ -9,7 +9,7 @@ import {
   isRecord,
   registerFailFix,
   fail
-} from "./xrfnq5k8.js";
+} from "./gbtcc2d7.js";
 import {
   throwNamed2
 } from "./52szzakm.js";
@@ -18,7 +18,7 @@ import {
 registerFailFix("OKM1104", "Set on to the columns of a unique constraint or the primary key.");
 registerFailFix("OKM1190", "Remove the guarded field. Input cannot set it.");
 var NO_ALLOW = new Set;
-function readConflict(table, value, allow = NO_ALLOW) {
+function readConflict(table, value, allow = NO_ALLOW, tenantKey) {
   if (value === undefined || value === "error")
     return;
   if (value === "ignore")
@@ -34,13 +34,13 @@ function readConflict(table, value, allow = NO_ALLOW) {
   }
   if (ret === true) {
     rejectConflictKeys(keys, ["on", "return"]);
-    return { kind: "return", columns: uniqueColumns(table, value.on), update: [] };
+    return { kind: "return", columns: uniqueColumns(table, value.on, tenantKey), update: [] };
   }
   if (update !== undefined) {
     rejectConflictKeys(keys, ["on", "update"]);
     return {
       kind: "update",
-      columns: uniqueColumns(table, value.on),
+      columns: uniqueColumns(table, value.on, tenantKey),
       update: updateColumns(table, update, allow)
     };
   }
@@ -110,7 +110,7 @@ function samePrimary(table, columns) {
   }
   return true;
 }
-function uniqueColumns(table, on) {
+function uniqueColumns(table, on, tenantKey) {
   const names = conflictNames(on);
   for (const unique of table.model.uniques) {
     if (!same(unique, names))
@@ -125,8 +125,19 @@ function uniqueColumns(table, on) {
     }
     return columns;
   }
-  const accepted = table.model.uniques.map((fields) => fields.join(", "));
-  throwNamed2("OKM1104", names.join(", "), accepted, `onConflict on ${table.model.name} names ${names.join(", ")}, which is not a unique constraint. Accepted: ${list(accepted)}.`);
+  const accepted = acceptedConstraints(table.model, tenantKey);
+  const implicit = tenantKey === undefined ? "" : ` The tenant key ${tenantKey} is part of each one and is not named here.`;
+  throwNamed2("OKM1104", names.join(", "), accepted, `onConflict on ${table.model.name} names ${names.join(", ")}, which is not a unique constraint. Accepted: ${list(accepted)}.${implicit}`);
+}
+function acceptedConstraints(model, key) {
+  const shown = new Set;
+  for (const fields of model.uniques) {
+    const named = key === undefined ? fields : fields.filter((field) => field !== key);
+    if (named.length === 0)
+      continue;
+    shown.add(named.length > 1 ? `(${named.join(", ")})` : named.join(""));
+  }
+  return [...shown];
 }
 function updateColumns(table, value, allow) {
   if (!Array.isArray(value) || value.length === 0) {

package/dist/shared/{nxb42q7h.js → 47x8x9ze.js}

@@ -1,7 +1,7 @@
 import {
   withHttp,
   attachHttp
-} from "./kkzwp3d2.js";
+} from "./hf22e0wt.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -31,7 +31,7 @@ async function acceptServer(pool, schema, rows, http, requireMeta, options, sour
       }));
     }
   } else {
-    const { assertCompatible } = await import("./q795afwa.js");
+    const { assertCompatible } = await import("./z2rnngj4.js");
     try {
       await assertCompatible(pool, schema, recorded, source, options);
     } catch (error) {

package/dist/shared/{zvbjc949.js → 4az561fn.js}

@@ -4,7 +4,7 @@ import {
   nextTransactionDepth,
   EMPTY_NOTICES,
   resultFrom
-} from "./rrstp3kb.js";
+} from "./cgbamx3e.js";
 
 // src/adapters/pg/session.ts
 function quoteIdent2(name) {

package/dist/shared/{s6gqfn5j.js → 51mvgj8w.js}

@@ -1,7 +1,7 @@
 import {
   isConnectionSqlstate,
   isConnectionFailure
-} from "./tbszx8mz.js";
+} from "./pf0d8f77.js";
 import {
   OkmError2,
   stripRowValues,
@@ -16,12 +16,14 @@ function mapPostgresError(error, options) {
     return OkmError2.from(error);
   const kind = kindOf(error);
   const columns = columnsOf(error);
-  const fieldReason = kind === "not_null" ? "not_null" : reasonOf(kind, error.table, error.constraint);
+  const hint = hintOf(error, kind);
+  const fieldReason = hint?.reason ?? (kind === "not_null" ? "not_null" : reasonOf(kind, error.table, error.constraint));
   const values = options?.includeValues === true ? valuesOf(error.detail, columns) : undefined;
   const code = kind === "outcome_unknown" ? "OKM1401" : kind;
   return new OkmError2(code, summaryOf(kind, error, columns, fieldReason), {
     kind,
     fieldReason,
+    ...hint !== undefined ? { fix: hint.fix } : {},
     ...error.table !== undefined ? { table: error.table } : {},
     ...columns.length > 0 ? { columns } : {},
     ...error.constraint !== undefined ? { constraint: error.constraint } : {},
@@ -32,6 +34,12 @@ function mapPostgresError(error, options) {
     ...options?.http !== undefined ? { http: options.http } : {}
   });
 }
+var TLS_CODE = /^(ERR_TLS_|ERR_POSTGRES_TLS_|SELF_SIGNED_CERT_|DEPTH_ZERO_SELF_SIGNED_CERT$|UNABLE_TO_VERIFY_LEAF_SIGNATURE$)/;
+function isTlsFailure(error) {
+  const cause = error.cause;
+  const code = typeof cause === "object" && cause !== null ? Reflect.get(cause, "code") : undefined;
+  return typeof code === "string" && TLS_CODE.test(code);
+}
 function isDriverError(error) {
   if (!(error instanceof Error) || error.name !== "DriverError")
     return false;
@@ -47,10 +55,26 @@ function kindOf(error) {
     if (mapped !== undefined)
       return mapped;
   }
-  if (isConnectionFailure(error))
+  if (isTlsFailure(error) || isConnectionFailure(error))
     return "unavailable";
   return "driver";
 }
+var MIGRATE_FIX = {
+  summary: "Run okm migrate apply so the object exists, then check okm migrate status. The reason names the missing object."
+};
+var TLS_FIX = {
+  summary: "Check sslmode in the connection URL against the server certificate: use require, verify-ca, or verify-full with the CA the certificate chains to. For node-postgres, add uselibpqcompat=true so sslmode follows libpq."
+};
+function hintOf(error, kind) {
+  if (error.sqlstate === "42P01")
+    return { reason: "undefined_table", fix: MIGRATE_FIX };
+  if (error.sqlstate === "42703")
+    return { reason: "undefined_column", fix: MIGRATE_FIX };
+  if (kind === "unavailable" && error.sqlstate === undefined && isTlsFailure(error)) {
+    return { reason: "tls", fix: TLS_FIX };
+  }
+  return;
+}
 function kindFromSqlstate(sqlstate) {
   switch (sqlstate) {
     case "23505":

package/dist/shared/{k3ted12y.js → 54tqkxja.js}

@@ -1,4 +1,22 @@
 // src/adapters/pg/watch.ts
+var callers = new WeakMap;
+function listenOn(signal, onAbort) {
+  let set = callers.get(signal);
+  if (set === undefined) {
+    const created = new Set;
+    callers.set(signal, created);
+    signal.addEventListener("abort", () => {
+      for (const each of created)
+        each();
+    }, { once: true });
+    set = created;
+  }
+  const registered = set;
+  registered.add(onAbort);
+  return () => {
+    registered.delete(onAbort);
+  };
+}
 function openWatch(options) {
   let kind;
   const controller = new AbortController;
@@ -7,7 +25,7 @@ function openWatch(options) {
       kind = "cancelled";
     controller.abort();
   };
-  options.signal?.addEventListener("abort", onAbort, { once: true });
+  const release = options.signal === undefined ? undefined : listenOn(options.signal, onAbort);
   let timer;
   if (options.timeout !== undefined) {
     timer = setTimeout(() => {
@@ -21,7 +39,7 @@ function openWatch(options) {
     finish() {
       if (timer !== undefined)
         clearTimeout(timer);
-      options.signal?.removeEventListener("abort", onAbort);
+      release?.();
     },
     reason() {
       return kind;

package/dist/shared/{3p4b1fg0.js → 5enne4ma.js}

@@ -7,7 +7,7 @@ import {
   snakeCase,
   emittedTypeName,
   rejectLater
-} from "./jsd07prz.js";
+} from "./ntneex2a.js";
 import {
   withLocation
 } from "./k7dwkhvq.js";

package/dist/shared/{6693j9rs.js → 5fqx9yh4.js}

@@ -4,9 +4,11 @@ import {
   renameTable2,
   serializeCatalog2,
   catalogHash2,
+  startupCatalog2,
+  startupHash2,
   loadTrustedCatalog2,
   parseCatalog2
-} from "./8jb4ymh2.js";
+} from "./8bwbwy8h.js";
 export {
   catalogHash2 as catalogHash,
   creationOrder2 as creationOrder,
@@ -14,5 +16,7 @@ export {
   parseCatalog2 as parseCatalog,
   renameColumn2 as renameColumn,
   renameTable2 as renameTable,
-  serializeCatalog2 as serializeCatalog
+  serializeCatalog2 as serializeCatalog,
+  startupCatalog2 as startupCatalog,
+  startupHash2 as startupHash
 };

package/dist/shared/{c5g81ngb.js → 6mnp99hx.js}

@@ -1,7 +1,7 @@
 import {
   open2
-} from "./wqem4jed.js";
-import"./8jb4ymh2.js";
+} from "./krxx77g0.js";
+import"./8bwbwy8h.js";
 import"./n442h54c.js";
 import {
   CURRENT,
@@ -15,14 +15,17 @@ import {
   loadMigrations,
   expandProvisioned,
   provisionHistoryIsKnown
-} from "./7nk68fj8.js";
+} from "./gde73es6.js";
+import"./szm0cksa.js";
+import"./fancm5pt.js";
 import {
-  assertTargetPolicy,
-  listTargets,
   loadConfig
-} from "./q6zsyh31.js";
-import"./n5y9zyj1.js";
-import"./41kv2xdm.js";
+} from "./qv2ydck9.js";
+import {
+  assertTargetPolicy,
+  listTargets
+} from "./ga3sfy93.js";
+import"./8xsbagad.js";
 import {
   OkmError2
 } from "./52szzakm.js";

package/dist/shared/{hqjsxnz7.js → 6qd27mx0.js}

@@ -2,10 +2,11 @@ import {
   assertAuthorDrift2,
   catalogQuery2,
   managedRoleOptions2
-} from "./xghkt7a9.js";
-import"./n5y9zyj1.js";
-import"./41kv2xdm.js";
-import"./8jb4ymh2.js";
+} from "./sycnx8gt.js";
+import"./fancm5pt.js";
+import"./ga3sfy93.js";
+import"./8xsbagad.js";
+import"./8bwbwy8h.js";
 export {
   assertAuthorDrift2 as assertAuthorDrift,
   catalogQuery2 as catalogQuery,

package/dist/shared/{v7tpnhnz.js → 6rk2gen5.js}

@@ -3,7 +3,7 @@ import {
   readHandle,
   readCall,
   attachHttp
-} from "./kkzwp3d2.js";
+} from "./hf22e0wt.js";
 import {
   selectedColumns,
   parseOrder,
@@ -15,7 +15,7 @@ import {
   isRecord,
   registerFailFix,
   fail
-} from "./xrfnq5k8.js";
+} from "./gbtcc2d7.js";
 import {
   OkmError2,
   throwNamed2
@@ -30,6 +30,7 @@ var OPTIONS = [
   "limit",
   "include",
   "after",
+  "route",
   "signal",
   "timeout"
 ];
@@ -69,7 +70,8 @@ function plan(session, table, options, mods, view) {
       limit: size + 1,
       include: record.include,
       signal: record.signal,
-      timeout: record.timeout
+      timeout: record.timeout,
+      route: record.route
     }, undefined, session.scope, session.schema.model[table], session.schema, view),
     ...after !== undefined ? { after } : {}
   };

package/dist/shared/{2321avmn.js → 7zwwyh0v.js}

@@ -1,40 +1,45 @@
 import {
   parseCatalog2
-} from "./8jb4ymh2.js";
-import"./wqem4jed.js";
+} from "./8bwbwy8h.js";
+import"./krxx77g0.js";
 import"./n442h54c.js";
 import {
   applyTarget2,
   backfillTiming2
-} from "./s4mb6a4b.js";
+} from "./cctw17hj.js";
 import {
-  introspectSchema,
   sealViews,
   catalogQuery2,
   managedRoleOptions2
-} from "./xghkt7a9.js";
+} from "./sycnx8gt.js";
 import {
   loadMigrations,
   catalogsEqual,
   snapshotDifference
-} from "./7nk68fj8.js";
+} from "./gde73es6.js";
+import"./szm0cksa.js";
+import {
+  introspectSchema
+} from "./fancm5pt.js";
 import {
   lintMigrationDirectory,
   hasError,
   lintRefusal,
-  selectTarget,
   openProject
-} from "./q6zsyh31.js";
+} from "./qv2ydck9.js";
 import {
   canonicalTypeName,
   classOf,
   strictestClass,
   planMigration,
-  parsePlan
-} from "./n5y9zyj1.js";
+  parsePlan,
+  assertDirectConnection,
+  assertStableBackend,
+  selectTarget
+} from "./ga3sfy93.js";
 import {
   quoteIdent
-} from "./41kv2xdm.js";
+} from "./8xsbagad.js";
 import {
   catalog,
   isDomain
@@ -61,6 +66,8 @@ var STALE_FIX = "Run okm generate.";
 async function checkMigrations(cwd, flags, options) {
   const opened = await openProject(cwd);
   const target = selectTarget(opened.config, flags.target);
+  const allowPooler = flags.allowPooler || opened.config.allowPooler === true;
+  assertDirectConnection(target.url, allowPooler);
   if (target.protected) {
     throw new OkmError2("OKM1850", `okm migrate check writes a scratch schema and refuses protected target ${target.name}. Point it at a throwaway Postgres.`, {
       kind: "forbidden",
@@ -177,6 +184,7 @@ async function proveSnapshot(config, url, target, flags, history) {
     idle_timeout: 1,
     onnotice: () => {}
   });
+  const allowPooler = flags.allowPooler || config.allowPooler === true;
   const provided = `${CHECK_SCHEMA_PREFIX}p${crypto.randomUUID().replaceAll("-", "")}`;
   const replayed = `${CHECK_SCHEMA_PREFIX}r${crypto.randomUUID().replaceAll("-", "")}`;
   const timing = {
@@ -185,6 +193,10 @@ async function proveSnapshot(config, url, target, flags, history) {
     ...backfillTiming2(config.backfill)
   };
   try {
+    await assertStableBackend(async () => {
+      const rows = await sql`select pg_backend_pid()::text as pid`;
+      return rows[0]?.pid ?? "";
+    }, allowPooler);
     await sql.unsafe(`create schema ${quoteIdent(provided)}`);
     await sql.unsafe(`create schema ${quoteIdent(replayed)}`);
     const role = config.roles === undefined ? {} : { migrationRole: config.roles.migration, schema: provided };
@@ -225,9 +237,8 @@ async function proveSnapshot(config, url, target, flags, history) {
       })),
       ...config.roles !== undefined ? { migrationRole: config.roles.migration, schema: replayed } : {}
     });
-    const runner = catalogQuery2(sql);
-    const liveProvided = await introspectSchema(runner, provided, "public", managedRoleOptions2(config.roles));
-    const liveReplayed = await introspectSchema(runner, replayed, "public", managedRoleOptions2(config.roles));
+    const liveProvided = await introspectScratch(sql, provided, config);
+    const liveReplayed = await introspectScratch(sql, replayed, config);
     const difference = snapshotDifference(liveProvided, liveReplayed);
     if (difference === undefined)
       return;
@@ -256,9 +267,14 @@ async function replayHistory(config, url, target, flags, history) {
     idle_timeout: 1,
     onnotice: () => {}
   });
+  const allowPooler = flags.allowPooler || config.allowPooler === true;
   const scratch = `${CHECK_SCHEMA_PREFIX}${crypto.randomUUID().replaceAll("-", "")}`;
   const failures = [];
   try {
+    await assertStableBackend(async () => {
+      const rows = await sql`select pg_backend_pid()::text as pid`;
+      return rows[0]?.pid ?? "";
+    }, allowPooler);
     await sql.unsafe(`create schema ${quoteIdent(scratch)}`);
     const runner = catalogQuery2(sql);
     for (let index = 0;index < history.length; index += 1) {
@@ -284,7 +300,7 @@ async function replayHistory(config, url, target, flags, history) {
         ],
         ...config.roles !== undefined ? { migrationRole: config.roles.migration, schema: scratch } : {}
       });
-      const live = await introspectSchema(runner, scratch, "public", managedRoleOptions2(config.roles));
+      const live = await introspectScratch(sql, scratch, config);
       const sealed = await sealViews(runner, migration.catalog);
       const back = planMigration({ before: live, after: sealed, name: migration.id });
       if (back.steps.length === 0)
@@ -300,6 +316,18 @@ async function replayHistory(config, url, target, flags, history) {
   }
   return failures;
 }
+async function introspectScratch(sql, schema, config) {
+  const previous = await sql`select current_setting('search_path') as path`;
+  const saved = previous[0]?.path ?? "public";
+  try {
+    await sql.unsafe(`set search_path to ${quoteIdent(schema)}`);
+    return await introspectSchema(catalogQuery2(sql), schema, "public", managedRoleOptions2(config.roles));
+  } finally {
+    await sql`select set_config('search_path', ${saved}, false)`.catch(() => {
+      return;
+    });
+  }
+}
 function historyFailure(history, index, back) {
   const migration = history[index];
   const id = migration?.id ?? "migration";
@@ -349,9 +377,11 @@ function sameSql(planned, file) {
 function retargetSteps(steps, schema) {
   const from = `${quoteIdent("public")}.`;
   const to = `${quoteIdent(schema)}.`;
+  const fromDefaults = `in schema ${quoteIdent("public")} `;
+  const toDefaults = `in schema ${quoteIdent(schema)} `;
   return steps.map((step) => ({
     ...step,
-    sql: step.sql.replaceAll(from, to),
+    sql: step.sql.replaceAll(from, to).replaceAll(fromDefaults, toDefaults),
     ...step.backfill === undefined ? {} : { backfill: { ...step.backfill, table: step.backfill.table.replaceAll(from, to) } }
   }));
 }

package/dist/shared/{fa9vt245.js → 87jvvhnt.js}

@@ -9,7 +9,7 @@ import {
   runCall,
   EMPTY_NOTICES,
   resultFrom
-} from "./rrstp3kb.js";
+} from "./cgbamx3e.js";
 
 // src/adapters/pg/pglite.ts
 import { PGlite } from "@electric-sql/pglite";
@@ -48,7 +48,7 @@ async function open3(config = {}) {
     return {
       execute: (text, params, options) => runCall(closed, options, (watch) => session.query(text, params, watch)),
       batch: (statements, options) => runCall(closed, options, async (watch) => {
-        const { runAtomicBatch } = await import("./b066g80h.js");
+        const { runAtomicBatch } = await import("./efmy2gcg.js");
         return runAtomicBatch(session, statements, watch);
       }),
       async release() {

package/dist/shared/{8jb4ymh2.js → 8bwbwy8h.js}

@@ -229,6 +229,17 @@ function catalogHash2(source) {
   serializedHash.set(source, hash);
   return hash;
 }
+function startupCatalog2(source) {
+  if (!source.objects.some(isPrivilege))
+    return source;
+  return { version: source.version, objects: source.objects.filter((item) => !isPrivilege(item)) };
+}
+function startupHash2(source) {
+  return catalogHash2(startupCatalog2(source));
+}
+function isPrivilege(object) {
+  return object.kind === "role" || object.kind === "grant" || object.kind === "defaultPrivilege";
+}
 function loadTrustedCatalog2(text, hash) {
   if (sha2562(text) !== hash) {
     catalogError2("OKM1027", "Catalog hash does not match the build artifact.");
@@ -1444,4 +1455,4 @@ function assertNeverKind(value) {
   return catalogError2("OKM1020", `Unexpected kind ${JSON.stringify(value)}.`);
 }
 
-export { roleObject, grantObject, defaultPrivilegeObject, creationOrder2, renameColumn2, renameTable2, serializeCatalog2, catalogHash2, loadTrustedCatalog2, parseCatalog2 };
+export { roleObject, grantObject, defaultPrivilegeObject, creationOrder2, renameColumn2, renameTable2, serializeCatalog2, catalogHash2, startupCatalog2, startupHash2, loadTrustedCatalog2, parseCatalog2 };

package/dist/shared/{c8aghh05.js → 8rsy3hxz.js}

@@ -422,6 +422,12 @@ function isRecord(value) {
 function failShape(message) {
   throw new OkmError2("OKM1121", message, { kind: "invalid" });
 }
+function failedMessage(first) {
+  if (first === undefined)
+    return "Validation failed.";
+  const field = first.path.length === 0 ? "$row" : first.path.join(".");
+  return `Validation failed: ${field} ${first.message}`;
+}
 function throwIssues(issues) {
   const columns = [];
   for (const issue of issues) {
@@ -429,7 +435,7 @@ function throwIssues(issues) {
     if (typeof field === "string" && !columns.includes(field))
       columns.push(field);
   }
-  throw new OkmError2("OKM1200", "Validation failed.", {
+  throw new OkmError2("OKM1200", failedMessage(issues[0]), {
     kind: "invalid",
     ...columns.length > 0 ? { columns } : {},
     issues,