okmodel 0.4.0 → 0.5.1

package/dist/shared/{n5y9zyj1.js → ga3sfy93.js}

@@ -2,7 +2,7 @@ import {
   creationOrder2,
   renameColumn2,
   renameTable2
-} from "./8jb4ymh2.js";
+} from "./8bwbwy8h.js";
 import {
   quoteIdent,
   ownedByView,
@@ -15,7 +15,7 @@ import {
   identitySequence,
   createTableSql,
   qualify
-} from "./41kv2xdm.js";
+} from "./8xsbagad.js";
 import {
   isExactVersion,
   compareExtensionVersions,
@@ -122,7 +122,7 @@ function privilegeSql(before, after, schema, recreated = new Set) {
       revoke.push({ sql: grantStatement(object, schema, true), kind: "revoke" });
     }
     if (object.kind === "defaultPrivilege") {
-      revoke.push({ sql: defaultStatement(object, true), kind: "revoke-default" });
+      revoke.push({ sql: defaultStatement(object, schema, true), kind: "revoke-default" });
     }
   }
   for (const [key, object] of afterBy) {
@@ -151,7 +151,7 @@ function privilegeSql(before, after, schema, recreated = new Set) {
     if (previous !== undefined)
       continue;
     if (object.kind === "defaultPrivilege") {
-      defaults.push({ sql: defaultStatement(object, false), kind: "grant-default" });
+      defaults.push({ sql: defaultStatement(object, schema, false), kind: "grant-default" });
     }
   }
   return { revoke, prepare: [...roles, ...defaults], grant };
@@ -163,6 +163,9 @@ function createdRoleName(sql) {
     return quoted.replaceAll('""', '"');
   return match?.[2];
 }
+function createRoleOnce(sql) {
+  return `do $okm$ begin ${sql}; exception when duplicate_object or unique_violation then null; end $okm$`;
+}
 function changesRole(sql) {
   return /^\s*(create|alter)\s+role\b/i.test(sql);
 }
@@ -195,13 +198,12 @@ function grantStatement(object, schema, revoke) {
   const direction = revoke ? "from" : "to";
   return `${verb} ${privilege} on ${grantTarget(object.identity.object, schema)} ${direction} ${quoteIdent(object.identity.role)}`;
 }
-function defaultStatement(object, revoke) {
+function defaultStatement(object, schema, revoke) {
   const privilege = object.identity.privilege.toLowerCase();
   assertPrivilege(privilege);
   const verb = revoke ? "revoke" : "grant";
   const direction = revoke ? "from" : "to";
-  const namespace = object.identity.namespace.form === "static" ? object.identity.namespace.name : "public";
-  return `alter default privileges for role ${quoteIdent(object.identity.forRole)} in schema ${quoteIdent(namespace)} ${verb} ${privilege} on ${objectKindSql(object.identity.objectKind)} ${direction} ${quoteIdent(object.identity.grantee)}`;
+  return `alter default privileges for role ${quoteIdent(object.identity.forRole)} in schema ${quoteIdent(schema)} ${verb} ${privilege} on ${objectKindSql(object.identity.objectKind)} ${direction} ${quoteIdent(object.identity.grantee)}`;
 }
 function grantTargetKey(object) {
   if (object.kind === "table" || object.kind === "view" || object.kind === "materializedView" || object.kind === "sequence") {
@@ -222,14 +224,13 @@ function grantTargetKey(object) {
   });
 }
 function grantTarget(object, schema) {
-  const name = object.namespace.form === "static" ? object.namespace.name : schema;
   if (object.kind === "sequence")
-    return `sequence ${qualify(name, object.name)}`;
+    return `sequence ${qualify(schema, object.name)}`;
   if (object.kind === "function")
-    return functionTarget(object.name, name);
+    return functionTarget(object.name, schema);
   if (object.kind === "namespace")
     return `schema ${quoteIdent(object.name)}`;
-  return `table ${qualify(name, object.name)}`;
+  return `table ${qualify(schema, object.name)}`;
 }
 function functionTarget(name, schema) {
   const open = name.lastIndexOf("(");
@@ -975,6 +976,189 @@ function functionCalls(expression) {
   return names;
 }
 
+// src/tooling/migrate/sql-lex.ts
+function sqlStatements(sql) {
+  return scan(sql).statements;
+}
+function sqlQuoteOpen(sql) {
+  return scan(sql).open;
+}
+function scan(sql) {
+  const statements = [];
+  const parts = [];
+  let index = 0;
+  let open = false;
+  const flush = () => {
+    const text = parts.join("").trim();
+    parts.length = 0;
+    if (text.length > 0)
+      statements.push(text);
+  };
+  while (index < sql.length) {
+    if (sql.startsWith("--", index)) {
+      parts.push(" ");
+      index = lineCommentEnd(sql, index + 2);
+      continue;
+    }
+    if (sql.startsWith("/*", index)) {
+      parts.push(" ");
+      const block = blockComment(sql, index + 2);
+      index = block.index;
+      if (block.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    const dollar = dollarAt(sql, index);
+    if (dollar !== undefined) {
+      const closed = takeDollar(sql, dollar);
+      parts.push(sql.slice(index, closed.index));
+      index = closed.index;
+      if (closed.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    if (isEscapeString(sql, index)) {
+      const quote = takeQuoted(sql, index + 2, true);
+      parts.push(sql.slice(index, quote.index));
+      index = quote.index;
+      if (quote.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    const char = sql[index];
+    if (char === "'") {
+      const quote = takeQuoted(sql, index + 1, false);
+      parts.push(sql.slice(index, quote.index));
+      index = quote.index;
+      if (quote.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    if (char === '"') {
+      const quote = takeIdent(sql, index + 1);
+      parts.push(sql.slice(index, quote.index));
+      index = quote.index;
+      if (quote.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    if (char === ";") {
+      flush();
+      index += 1;
+      continue;
+    }
+    parts.push(char ?? "");
+    index += 1;
+  }
+  flush();
+  return { statements, open };
+}
+function lineCommentEnd(sql, index) {
+  while (index < sql.length && sql.charCodeAt(index) !== 10)
+    index += 1;
+  return index;
+}
+function blockComment(sql, index) {
+  let depth = 1;
+  while (index < sql.length) {
+    if (sql.startsWith("/*", index)) {
+      depth += 1;
+      index += 2;
+      continue;
+    }
+    if (sql.startsWith("*/", index)) {
+      depth -= 1;
+      index += 2;
+      if (depth === 0)
+        return { index, open: false };
+      continue;
+    }
+    index += 1;
+  }
+  return { index, open: true };
+}
+function dollarAt(sql, index) {
+  if (sql.charCodeAt(index) !== 36)
+    return;
+  const next = index + 1;
+  if (sql.charCodeAt(next) === 36)
+    return { tag: "", end: next + 1 };
+  if (!isIdentStart(sql.charCodeAt(next)))
+    return;
+  let cursor = next + 1;
+  while (isIdentCont(sql.charCodeAt(cursor)))
+    cursor += 1;
+  if (sql.charCodeAt(cursor) !== 36)
+    return;
+  return { tag: sql.slice(next, cursor), end: cursor + 1 };
+}
+function takeDollar(sql, dollar) {
+  const closer = `$${dollar.tag}$`;
+  const found = sql.indexOf(closer, dollar.end);
+  if (found === -1)
+    return { index: sql.length, open: true };
+  return { index: found + closer.length, open: false };
+}
+function takeQuoted(sql, index, escape) {
+  while (index < sql.length) {
+    const char = sql[index];
+    if (escape && char === "\\") {
+      if (index + 1 >= sql.length)
+        return { index: sql.length, open: true };
+      index += 2;
+      continue;
+    }
+    if (char === "'") {
+      if (sql[index + 1] === "'") {
+        index += 2;
+        continue;
+      }
+      return { index: index + 1, open: false };
+    }
+    index += 1;
+  }
+  return { index, open: true };
+}
+function takeIdent(sql, index) {
+  while (index < sql.length) {
+    if (sql[index] === '"') {
+      if (sql[index + 1] === '"') {
+        index += 2;
+        continue;
+      }
+      return { index: index + 1, open: false };
+    }
+    index += 1;
+  }
+  return { index, open: true };
+}
+function isEscapeString(sql, index) {
+  const code = sql.charCodeAt(index);
+  if (code !== 69 && code !== 101)
+    return false;
+  if (sql.charCodeAt(index + 1) !== 39)
+    return false;
+  if (index > 0 && isIdentCont(sql.charCodeAt(index - 1)))
+    return false;
+  return true;
+}
+function isIdentStart(code) {
+  return code >= 65 && code <= 90 || code >= 97 && code <= 122 || code === 95;
+}
+function isIdentCont(code) {
+  return isIdentStart(code) || code >= 48 && code <= 57;
+}
+
 // src/tooling/migrate/values.ts
 function parseReplace(flag) {
   const eq = flag.indexOf("=");
@@ -1376,9 +1560,16 @@ function parsePlan(text) {
     let behavior;
     const allows = [];
     const sql = [];
-    while (index < lines.length && (lines[index] ?? "") !== "") {
+    let quoteOpen = false;
+    while (index < lines.length && (quoteOpen || (lines[index] ?? "") !== "")) {
       const line = lines[index] ?? "";
       index += 1;
+      if (quoteOpen) {
+        sql.push(line);
+        quoteOpen = sqlQuoteOpen(sql.join(`
+`));
+        continue;
+      }
       if (line.startsWith("-- class: ")) {
         stepClass = readClass(line.slice("-- class: ".length));
         sawClass = true;
@@ -1400,8 +1591,11 @@ function parsePlan(text) {
         behavior = "change";
       else if (line.startsWith("-- okm-allow"))
         allows.push(readAllow(line));
-      else if (!line.startsWith("--"))
+      else if (!line.startsWith("--")) {
         sql.push(line);
+        quoteOpen = sqlQuoteOpen(sql.join(`
+`));
+      }
     }
     const statement = sql.join(`
 `).replace(/;\s*$/, "");
@@ -2428,4 +2622,165 @@ function order(value) {
   return value;
 }
 
-export { canonicalTypeName, createdRoleName, changesRole, DEFAULT_BACKFILL_PAUSE_MS, DEFAULT_BACKFILL_STATEMENT_TIMEOUT_MS, batchSizeField, aboutBatchCount, boundaryQuery, checkedCast, classOf, strictestClass, assertExtensionsAvailable, omitManagedObjects, parseReplace, planMigration, formatPlan, parsePlan, staleRenames };
+// src/tooling/migrate/policy.ts
+var READ = new Set([
+  "plan",
+  "status",
+  "check",
+  "drift",
+  "verify",
+  "pull",
+  "catalog-export",
+  "inspect"
+]);
+var ALLOWED = new Set(["expand", "reference", "provision"]);
+var FORWARD_ONLY = new Set(["drop", "rollback"]);
+function assertTargetPolicy(target, operation, allowProtected = false) {
+  if (FORWARD_ONLY.has(operation)) {
+    throw new OkmError2("invalid", "There is no down migration.", {
+      fix: { summary: "Recovery is a new forward migration." }
+    });
+  }
+  if (!target.protected || allowProtected)
+    return;
+  if (READ.has(operation) || ALLOWED.has(operation))
+    return;
+  throw new OkmError2("OKM1850", `${operation} is blocked on protected target ${target.name}.`, {
+    kind: "forbidden",
+    fix: {
+      summary: "Run a read-only command or an expand migration, or pass --allow-protected for this invocation."
+    }
+  });
+}
+function assertTargetAlias(targets) {
+  const groups = new Map;
+  for (const target of targets) {
+    const key = `${target.host}
+${target.port}
+${target.database}`;
+    const group = groups.get(key);
+    if (group === undefined)
+      groups.set(key, [target]);
+    else
+      group.push(target);
+  }
+  for (const group of groups.values()) {
+    const protectedTarget = group.find((target) => target.protected);
+    const open = group.find((target) => !target.protected);
+    if (protectedTarget !== undefined && open !== undefined) {
+      throw new OkmError2("OKM1852", `${open.name} and ${protectedTarget.name} resolve to the same database and disagree about protection.`, {
+        fix: {
+          summary: "Give those targets the same protection flag. okm check and okm doctor both report this."
+        }
+      });
+    }
+  }
+}
+function assertDirectConnection(url, allowPooler) {
+  if (allowPooler)
+    return;
+  const endpoint = endpointOf(url);
+  const parsed = new URL(url);
+  const host = endpoint.host;
+  if (host.includes("pooler") || host.includes("pgbouncer") || host.includes("-pooler") || endpoint.port === "6543" || endpoint.port === "6432" || parsed.searchParams.get("pgbouncer") === "true") {
+    throw new OkmError2("invalid", `Refusing pooler host ${host}. Apply needs a direct connection.`, { fix: { summary: "Use a direct connection, or pass --allow-pooler." } });
+  }
+}
+async function assertStableBackend(readPid, allowPooler) {
+  if (allowPooler)
+    return;
+  const first = await readPid();
+  const second = await readPid();
+  if (first === second)
+    return;
+  throw new OkmError2("OKM1854", `The backend pid changed from ${first} to ${second}. A pooler is handing out a new session between statements.`, { fix: { summary: "Use a direct connection, or pass --allow-pooler." } });
+}
+function listTargets(config) {
+  if (config.database !== undefined && config.targets !== undefined) {
+    throw new OkmError2("invalid", "Set database or targets, not both.", {
+      fix: { summary: "database is the one target named default. Use targets for more than one." }
+    });
+  }
+  const entries = [];
+  if (config.database !== undefined)
+    entries.push(["default", config.database]);
+  if (config.targets !== undefined) {
+    for (const name of Object.keys(config.targets).sort()) {
+      const input = config.targets[name];
+      if (input !== undefined)
+        entries.push([name, input]);
+    }
+  }
+  return entries.map(([name, input]) => resolveTarget(name, input));
+}
+function selectTarget(config, name) {
+  const targets = listTargets(config);
+  if (targets.length === 0) {
+    throw new OkmError2("OKM1845", "No target is configured.", {
+      fix: { summary: "Set database or targets in okmodel.config.ts." }
+    });
+  }
+  if (name === undefined) {
+    if (targets.length === 1) {
+      const only = targets[0];
+      if (only !== undefined)
+        return only;
+    }
+    throw new OkmError2("OKM1853", "Several targets are configured and --target was not passed.", {
+      fix: { summary: "Pass --target <name>. The command does not guess." }
+    });
+  }
+  const found = targets.find((target) => target.name === name);
+  if (found === undefined) {
+    throw new OkmError2("OKM1845", `Target ${name} is not configured.`, {
+      fix: { summary: "Pass a name from targets, or database for the target named default." }
+    });
+  }
+  return found;
+}
+function resolveTarget(name, input) {
+  if (typeof input !== "string" && isReplicaTarget(input)) {
+    throw new OkmError2("OKM1845", `Target ${name} is a replica. Migrations run on the primary only.`, {
+      fix: {
+        summary: "Set database or targets to the primary URL. A replica is not a migration target."
+      }
+    });
+  }
+  const url = typeof input === "string" ? input : input.url;
+  const protectedTarget = typeof input === "string" ? false : input.protected === true;
+  if (url === undefined || url.length === 0) {
+    throw new OkmError2("OKM1845", `Target ${name} has no url.`, {
+      fix: { summary: "Set the target url. A target is not inferred from the environment." }
+    });
+  }
+  const endpoint = endpointOf(url);
+  return {
+    name,
+    url,
+    protected: protectedTarget,
+    host: endpoint.host,
+    port: endpoint.port,
+    database: endpoint.database
+  };
+}
+function isReplicaTarget(input) {
+  return "primary" in input || "replicas" in input || "weight" in input || "pool" in input;
+}
+function endpointOf(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new OkmError2("OKM1845", "The target URL is not a Postgres URL.", {
+      fix: { summary: "Pass a postgres:// URL for the target." }
+    });
+  }
+  const database = decodeURIComponent(parsed.pathname.replace(/^\//, ""));
+  return {
+    host: parsed.hostname.toLowerCase(),
+    port: parsed.port.length > 0 ? parsed.port : "5432",
+    database
+  };
+}
+
+export { canonicalTypeName, createdRoleName, createRoleOnce, changesRole, DEFAULT_BACKFILL_PAUSE_MS, DEFAULT_BACKFILL_STATEMENT_TIMEOUT_MS, batchSizeField, aboutBatchCount, boundaryQuery, checkedCast, classOf, strictestClass, assertExtensionsAvailable, omitManagedObjects, sqlStatements, parseReplace, planMigration, formatPlan, parsePlan, staleRenames, assertTargetPolicy, assertTargetAlias, assertDirectConnection, assertStableBackend, listTargets, selectTarget };

package/dist/shared/{xrfnq5k8.js → gbtcc2d7.js}

@@ -42,12 +42,21 @@ var FIND_OPTIONS = [
   "limit",
   "orderBy",
   "select",
+  "route",
   "signal",
   "timeout",
   "where"
 ];
-var ONE_OPTIONS = ["include", "orderBy", "select", "signal", "timeout", "where"];
-var FILTER_OPTIONS = ["signal", "timeout", "where"];
+var ONE_OPTIONS = [
+  "include",
+  "orderBy",
+  "route",
+  "select",
+  "signal",
+  "timeout",
+  "where"
+];
+var FILTER_OPTIONS = ["route", "signal", "timeout", "where"];
 function readOptionNames(op) {
   if (op === "find")
     return FIND_OPTIONS;
@@ -524,7 +533,9 @@ function emitIn(column, ref, name, value, sink) {
   sink.text(")");
 }
 function emitOr(schema, table, value, sink, alias, depth) {
-  if (!Array.isArray(value) || value.length === 0) {
+  if (!Array.isArray(value))
+    orFail(false);
+  if (value.length === 0) {
     sink.text("false");
     sink.mark(":0");
     return;
@@ -550,7 +561,7 @@ function emitOr(schema, table, value, sink, alias, depth) {
       emitPredicate(schema, table, key, item, sink, alias, depth);
     }
     if (!wrote)
-      sink.text("true");
+      orFail(true);
     sink.text(")");
   }
   sink.text(")");
@@ -835,6 +846,45 @@ function list(names) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) && !isOperator(value);
 }
+function effectivePredicate(where) {
+  if (where === undefined)
+    return false;
+  if (isOperator(where)) {
+    const name = operatorName(where);
+    const value = operatorValue(where);
+    if (name === "or") {
+      if (!Array.isArray(value))
+        orFail(false);
+      if (value.length === 0)
+        return true;
+      for (const branch of value) {
+        if (!effectivePredicate(branch))
+          orFail(true);
+      }
+      return true;
+    }
+    if (name === "and") {
+      return Array.isArray(value) && value.some((part) => effectivePredicate(part));
+    }
+    if (name === "not")
+      return effectivePredicate(value);
+    return true;
+  }
+  if (!isRecord(where))
+    return true;
+  for (const key of Object.keys(where)) {
+    if (where[key] !== undefined)
+      return true;
+  }
+  return false;
+}
+function orFail(empty) {
+  throw new OkmError2("OKM1121", empty ? "or() branch is empty." : "Pass an array: or([a, b]).", {
+    fix: {
+      summary: empty ? "Give every or() branch a predicate. An empty branch matches every row." : "Pass an array: or([a, b])."
+    }
+  });
+}
 var FAIL_FIX = {
   OKM1121: "Use eq for an object value, or has, none, or every for a relation.",
   OKM1101: "Pass limit, or call .all(reason)."
@@ -866,4 +916,4 @@ function hasMany(include) {
   return Object.keys(include).length > 0;
 }
 
-export { withRowFilters, installArchiveInspect, archiveRules, readOptionNames, installOperatorSql, readNeedsOperatorSql, emitRelationFrom, bindCall, compileCall, decodeResult, logicalIntent, appliedRules, emitJoin, emitWhere, emitOrder, emitPrimaryOrder, selectedColumns, parseOrder, rejectKeys, readLimit, takeObject, projectExpr, jsonExpr, decodeRow, cell, indexes, quote, list, isRecord, registerFailFix, fail };
+export { withRowFilters, installArchiveInspect, archiveRules, readOptionNames, installOperatorSql, readNeedsOperatorSql, emitRelationFrom, bindCall, compileCall, decodeResult, logicalIntent, appliedRules, emitJoin, emitWhere, emitOrder, emitPrimaryOrder, selectedColumns, parseOrder, rejectKeys, readLimit, takeObject, projectExpr, jsonExpr, decodeRow, cell, indexes, quote, list, isRecord, effectivePredicate, registerFailFix, fail };

package/dist/shared/{7nk68fj8.js → gde73es6.js}

@@ -1,29 +1,29 @@
 import {
   serializeCatalog2,
   catalogHash2,
+  startupCatalog2,
   parseCatalog2
-} from "./8jb4ymh2.js";
+} from "./8bwbwy8h.js";
 import {
   roleExists
-} from "./hcmdtwgh.js";
-import {
-  assertTargetPolicy
-} from "./q6zsyh31.js";
+} from "./szm0cksa.js";
 import {
   canonicalTypeName,
   createdRoleName,
+  createRoleOnce,
   DEFAULT_BACKFILL_PAUSE_MS,
   DEFAULT_BACKFILL_STATEMENT_TIMEOUT_MS,
   boundaryQuery,
   checkedCast,
   omitManagedObjects,
   planMigration,
-  parsePlan
-} from "./n5y9zyj1.js";
+  parsePlan,
+  assertTargetPolicy
+} from "./ga3sfy93.js";
 import {
   quoteIdent,
   qualify
-} from "./41kv2xdm.js";
+} from "./8xsbagad.js";
 import {
   alignExtensionVersions
 } from "./8ktwd3rh.js";
@@ -33,7 +33,7 @@ import {
 } from "./g7ez901n.js";
 import {
   snakeCase
-} from "./jsd07prz.js";
+} from "./ntneex2a.js";
 import {
   quoteLiteral
 } from "./94ez8kzh.js";
@@ -98,8 +98,10 @@ async function runUnit(connection, unit, run, session) {
         await rebuildInvalidIndex(connection, item.step.sql);
         const created = createdRoleName(item.step.sql);
         const existed = created !== undefined && await roleExists(connection, created);
-        if (created === undefined || !existed)
+        if (created === undefined)
           await connection.execute(item.step.sql);
+        else if (!existed)
+          await connection.execute(createRoleOnce(item.step.sql));
         if (created !== undefined && created === run.migrationRole) {
           if (!existed) {
             await grantSchema(connection, run.schema ?? "public", created);
@@ -305,7 +307,7 @@ function failStep(unit, index, error) {
   if (error instanceof OkmError2)
     return error;
   const message = error instanceof Error ? error.message : "The step failed.";
-  return new OkmError2("invalid", `Migration ${unit.migrationId} failed at step ${String(index)}: ${message}`, {
+  return new OkmError2("invalid", `Migration ${unit.migrationId} failed at step ${String(index + 1)}: ${message}`, {
     cause: error,
     fix: { summary: "Fix the step and run apply again. Finished steps are not repeated." }
   });
@@ -377,8 +379,10 @@ function loadMigrations(directory) {
       });
     }
     const plan = parsePlan(readFileSync(join(directory, file), "utf8"));
-    const hash = catalogHash2(parseCatalog2(readFileSync(catalogPath, "utf8")));
-    migrations.push({ id, catalogHash: hash, steps: plan.steps });
+    const stored = parseCatalog2(readFileSync(catalogPath, "utf8"));
+    const startup = startupCatalog2(stored);
+    const hash = catalogHash2(startup);
+    migrations.push(startup === stored ? { id, catalogHash: hash, steps: plan.steps } : { id, catalogHash: hash, legacyHash: catalogHash2(stored), steps: plan.steps });
   }
   return migrations;
 }
@@ -601,11 +605,12 @@ async function installSnapshot(connection, head, schema, reference, session, mig
           await assumeRole(connection, created, session);
         continue;
       }
+      const sql = created === undefined ? step.sql : createRoleOnce(step.sql);
       if (step.transactional && !statementOutsideTransaction(step.sql)) {
-        batch.push(step.sql);
+        batch.push(sql);
       } else {
         await flush();
-        await connection.execute(step.sql);
+        await connection.execute(sql);
       }
       if (created !== undefined && created === migrationRole) {
         await flush();