okmodel 0.5.0 → 0.6.0

package/dist/shared/{nkc9sfqb.js → 929h19xp.js}

@@ -1,9 +1,10 @@
 import {
-  isConnectionFailure
-} from "./tbszx8mz.js";
+  isConnectionSqlstate,
+  isConnectionErrno
+} from "./gwn6v667.js";
 import {
   createClient
-} from "./bt9sfq0z.js";
+} from "./j60w0dvr.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -330,7 +331,8 @@ async function openEndpoint(open, url, max, defaults, name, role, weight, probeM
     timer: undefined,
     current: 0,
     inflight: 0,
-    latencyMs: null
+    latencyMs: null,
+    generation: 0
   };
 }
 async function detectPosition(endpoint) {
@@ -344,8 +346,11 @@ async function detectPosition(endpoint) {
 async function sample(handle, endpoint) {
   try {
     const sampled = await readPosition(handle, endpoint);
+    const reopened = endpoint.circuit === "open";
     endpoint.failures = 0;
     endpoint.circuit = "closed";
+    if (reopened)
+      endpoint.generation += 1;
     applySample(endpoint, sampled);
   } catch {
     endpoint.failures += 1;
@@ -514,6 +519,7 @@ function routePool(handle) {
         replicaRefused();
       const reason = options?.route === "primary" ? "constraint:primary" : "primary-required";
       tell(handle, { op: "write", endpoint: primary.name, reason });
+      await callGuard(primary);
       const result = await primary.pool.batch(statements, strip(options));
       await noteWrite(handle, primary.pool);
       return result;
@@ -554,6 +560,14 @@ function routePool(handle) {
         endpoint.pool.cancel?.();
     };
   }
+  const routed = pool;
+  routed.okmReadOnlyUnit = (text, params, prelude, options) => readOnlyUnit(handle, text, params, prelude, options);
+  routed.okmReadOnlyStream = (text, params, prelude, options) => readOnlyStream(handle, text, params, prelude, options);
+  routed.okmEndpoints = () => handle.endpoints.map((endpoint) => ({
+    name: endpoint.name,
+    generation: endpoint.generation,
+    pool: endpoint.pool
+  }));
   return pool;
 }
 function derive(schema, handle, router, shared, route) {
@@ -600,8 +614,82 @@ function force(handle, router, route) {
   }
   if (router.cancel !== undefined)
     pool.cancel = () => router.cancel();
+  const unit = router.okmReadOnlyUnit;
+  const stream = router.okmReadOnlyStream;
+  const forced = pool;
+  if (unit !== undefined) {
+    forced.okmReadOnlyUnit = (text, params, prelude, options) => unit(text, params, prelude, { ...options, route });
+  }
+  if (stream !== undefined) {
+    forced.okmReadOnlyStream = (text, params, prelude, options) => stream(text, params, prelude, { ...options, route });
+  }
   return pool;
 }
+async function readOnlyUnit(handle, text, params, prelude, options) {
+  if (handle.closed)
+    closed();
+  const choice = await choose(handle, text, options?.route);
+  return attempt(handle, choice, async (endpoint) => {
+    if (endpoint.pool.reserve === undefined)
+      replicaReserve();
+    const conn = await endpoint.pool.reserve();
+    try {
+      await conn.execute("begin read only");
+      try {
+        await conn.execute(prelude.text, prelude.params);
+        const result = await conn.execute(text, params, strip(options));
+        await conn.execute("commit");
+        return result;
+      } catch (error) {
+        await conn.execute("rollback").catch(() => {
+          return;
+        });
+        throw error;
+      }
+    } finally {
+      await conn.release();
+    }
+  });
+}
+function readOnlyStream(handle, text, params, prelude, options) {
+  return async function* () {
+    if (handle.closed)
+      closed();
+    const choice = await choose(handle, text, options?.route);
+    tell(handle, { op: choice.op, endpoint: choice.endpoint.name, reason: choice.reason });
+    await callGuard(choice.endpoint);
+    if (choice.endpoint.pool.reserve === undefined)
+      replicaReserve();
+    const conn = await choice.endpoint.pool.reserve();
+    try {
+      await conn.execute("begin read only");
+      try {
+        await conn.execute(prelude.text, prelude.params);
+        await conn.execute(`declare okm_rls no scroll cursor for ${text}`, params);
+        for (;; ) {
+          const chunk = await conn.execute("fetch 64 from okm_rls");
+          if (chunk.rows.length === 0)
+            break;
+          yield chunk.rows;
+        }
+        await conn.execute("close okm_rls");
+        await conn.execute("commit");
+      } catch (error) {
+        await conn.execute("rollback").catch(() => {
+          return;
+        });
+        throw error;
+      }
+    } finally {
+      await conn.release();
+    }
+  }();
+}
+function replicaReserve() {
+  throw new OkmError2("OKM1111", "Row-level security needs a driver that can reserve a connection.", {
+    fix: { summary: "Use a Postgres driver that supports interactive transactions." }
+  });
+}
 function classOf(text) {
   const head = text.trimStart().toLowerCase().replace(/\s+/g, " ");
   if (/^(begin|start transaction|commit|rollback|savepoint|release|set|reset)\b/.test(head)) {
@@ -611,7 +699,7 @@ function classOf(text) {
     return "lock";
   if (/\sfor (no key update|key share|update|share)\b/.test(head))
     return "lock";
-  if (/^(insert|update|delete|with|create|alter|drop|truncate|grant|revoke|comment|vacuum|analyze|reindex|copy)\b/.test(head)) {
+  if (/^(insert|update|delete|refresh|with|create|alter|drop|truncate|grant|revoke|comment|vacuum|analyze|reindex|copy)\b/.test(head)) {
     return "write";
   }
   return "read";
@@ -625,7 +713,7 @@ async function choose(handle, text, route) {
   if (primary === undefined)
     throw new OkmError2("OKM1120", "A topology needs one primary URL.");
   if (text.trimStart().toLowerCase().startsWith("select current_setting")) {
-    return { endpoint: primary, op: "read", reason: "primary-required" };
+    return { endpoint: primary, op: "read", reason: "primary-required", skipGuard: true };
   }
   if (route === "replica" && op !== "read")
     replicaRefused();
@@ -672,17 +760,67 @@ async function* readStream(handle, text, route, params, fallback) {
 async function attempt(handle, choice, run) {
   tell(handle, { op: choice.op, endpoint: choice.endpoint.name, reason: choice.reason });
   try {
+    if (choice.skipGuard !== true)
+      await callGuard(choice.endpoint);
     return await tracked(choice.endpoint, choice.op === "read", () => run(choice.endpoint));
   } catch (error) {
-    if (choice.op !== "read" || !isConnectionFailure(error))
+    if (choice.op !== "read" || !isUnreachable(error))
       throw error;
+    choice.endpoint.generation += 1;
     const next = await retryOf(handle, choice);
     if (next === undefined)
       throw error;
     tell(handle, { op: "read", endpoint: next.endpoint.name, reason: next.reason });
+    if (choice.skipGuard !== true)
+      await callGuard(next.endpoint);
     return tracked(next.endpoint, true, () => run(next.endpoint));
   }
 }
+function callGuard(endpoint) {
+  const guard = endpoint.pool.okmGuard;
+  if (guard === undefined)
+    return Promise.resolve();
+  return guard({
+    name: endpoint.name,
+    generation: endpoint.generation,
+    pool: endpoint.pool
+  });
+}
+var CHAIN_DEPTH = 8;
+function isUnreachable(error) {
+  const seen = new Set;
+  const visit = (value, depth) => {
+    if (typeof value !== "object" || value === null || depth > CHAIN_DEPTH)
+      return false;
+    if (seen.has(value))
+      return false;
+    seen.add(value);
+    if (unreachableNode(value))
+      return true;
+    if (visit(Reflect.get(value, "cause"), depth + 1))
+      return true;
+    const errors = Reflect.get(value, "errors");
+    return Array.isArray(errors) && errors.some((item) => visit(item, depth + 1));
+  };
+  return visit(error, 0);
+}
+function unreachableNode(node) {
+  for (const key of ["sqlstate", "code", "errno"]) {
+    const code = Reflect.get(node, key);
+    if (typeof code !== "string" || code.length === 0)
+      continue;
+    if (isConnectionSqlstate(code) || isConnectionErrno(code))
+      return true;
+    if (code.startsWith("ERR_POSTGRES_CONNECTION_"))
+      return true;
+    if (code === "ERR_POSTGRES_IDLE_TIMEOUT" || code === "ERR_POSTGRES_LIFETIME_TIMEOUT") {
+      return true;
+    }
+  }
+  if (!(node instanceof Error))
+    return false;
+  return node.message.includes("ECONNREFUSED") || node.message.includes("ECONNRESET") || node.message.includes("CONNECTION_CLOSED") || node.message.includes("terminating connection") || node.message.includes("The pool is closed");
+}
 async function tracked(endpoint, time, run) {
   const replica = endpoint.role === "replica";
   if (replica)

package/dist/shared/{gjthds9j.js → 9628a9xt.js}

@@ -1,6 +1,6 @@
 import {
   required
-} from "./c9z5g0fm.js";
+} from "./ywr8hmey.js";
 import {
   rejected
 } from "./tmbdywx0.js";

package/dist/shared/{8xsbagad.js → 9s0ypp87.js}

@@ -1,15 +1,15 @@
 import {
   creationOrder2
-} from "./8bwbwy8h.js";
+} from "./qq3899ht.js";
 import {
   isDomain
-} from "./g7ez901n.js";
+} from "./ywspezzx.js";
 import {
   quoteLiteral
 } from "./94ez8kzh.js";
 import {
   identityKey2
-} from "./t4tbsy9h.js";
+} from "./358zsv4r.js";
 import {
   fitIdentifier2
 } from "./nfzc5z0w.js";
@@ -22,6 +22,7 @@ function renderCatalog(source, schema) {
   const folded = foldedKeys(source);
   const statements = [];
   const ordered = creationOrder2(source);
+  const created = uniqueBeforeForeignKey(ordered);
   for (const object of ordered) {
     if (object.kind !== "type" || object.owner === "ignored")
       continue;
@@ -29,8 +30,8 @@ function renderCatalog(source, schema) {
     if (sql !== undefined)
       statements.push(sql);
   }
-  for (const object of ordered) {
-    if (object.kind === "type" || object.kind === "function" || object.kind === "trigger" || object.kind === "view" || object.kind === "materializedView" || ownedByView(object)) {
+  for (const object of created) {
+    if (object.kind === "type" || object.kind === "function" || object.kind === "trigger" || object.kind === "view" || object.kind === "materializedView" || object.kind === "policy" || ownedByView(object)) {
       continue;
     }
     if (object.owner === "ignored")
@@ -46,6 +47,12 @@ function renderCatalog(source, schema) {
     if (sql !== undefined)
       statements.push(sql);
   }
+  for (const object of created) {
+    if (object.kind !== "policy" || object.owner === "ignored")
+      continue;
+    for (const step of policyCreatePlan(object, schema))
+      statements.push(step.sql);
+  }
   for (const kind of ["function", "trigger"]) {
     for (const object of ordered) {
       if (object.kind !== kind || object.owner === "ignored")
@@ -73,6 +80,48 @@ function renderCatalog(source, schema) {
   }
   return statements;
 }
+function uniqueBeforeForeignKey(objects) {
+  const uniques = objects.filter((object) => object.kind === "constraint" && object.definition.constraintKind === "unique");
+  if (uniques.length === 0)
+    return objects;
+  const emitted = new Set;
+  const result = [];
+  for (const object of objects) {
+    if (emitted.has(object))
+      continue;
+    if (object.kind === "constraint" && object.definition.constraintKind === "foreignKey") {
+      const target = object.definition.references;
+      if (target !== undefined && !coveredByPrimary(objects, target.parent, target.columns)) {
+        const columns = target.columns.join("\x00");
+        for (const unique of uniques) {
+          if (emitted.has(unique))
+            continue;
+          if (!sameRef(unique.identity.parent, target.parent))
+            continue;
+          if (unique.definition.columns.join("\x00") !== columns)
+            continue;
+          result.push(unique);
+          emitted.add(unique);
+        }
+      }
+    }
+    result.push(object);
+    emitted.add(object);
+  }
+  return result;
+}
+function coveredByPrimary(objects, parent, columns) {
+  const key = columns.join("\x00");
+  return objects.some((object) => object.kind === "constraint" && object.definition.constraintKind === "primaryKey" && sameRef(object.identity.parent, parent) && object.definition.columns.join("\x00") === key);
+}
+function sameRef(left, right) {
+  if (left.name !== right.name || left.namespace.form !== right.namespace.form)
+    return false;
+  if (left.namespace.form === "static" && right.namespace.form === "static") {
+    return left.namespace.name === right.namespace.name;
+  }
+  return left.namespace.form === "template" && right.namespace.form === "template" ? left.namespace.pattern === right.namespace.pattern : false;
+}
 function ownedByView(object) {
   if (object.kind !== "index")
     return false;
@@ -149,7 +198,39 @@ function functionSql(object, schema, replace) {
 }
 function viewSql(object, schema, replace) {
   const verb = replace ? "create or replace view" : "create view";
-  return `${verb} ${qualify(schema, object.identity.name)} as ${object.definition.query}`;
+  const invoker = object.definition.securityInvoker === true ? " with (security_invoker = true)" : "";
+  return `${verb} ${qualify(schema, object.identity.name)}${invoker} as ${object.definition.query}`;
+}
+function policyCreatePlan(object, schema) {
+  const table = qualify(schema, object.identity.parent.name);
+  const name = quoteIdent(object.identity.name);
+  const command = object.definition.command === "all" ? "all" : "select";
+  const check = object.definition.command === "all" ? ` with check ${object.definition.expression}` : "";
+  const create = {
+    sql: `create policy ${name} on ${table} as permissive for ${command} using ${object.definition.expression}${check}`,
+    kind: "create-policy"
+  };
+  if (object.definition.command !== "all")
+    return [create];
+  return [
+    { sql: `alter table ${table} enable row level security`, kind: "enable-rls" },
+    { sql: `alter table ${table} force row level security`, kind: "enable-rls" },
+    create
+  ];
+}
+function policyDropPlan(object, schema) {
+  const table = qualify(schema, object.identity.parent.name);
+  const drop = {
+    sql: `drop policy ${quoteIdent(object.identity.name)} on ${table}`,
+    kind: "drop-policy"
+  };
+  if (object.definition.command !== "all")
+    return [drop];
+  return [
+    drop,
+    { sql: `alter table ${table} no force row level security`, kind: "disable-rls" },
+    { sql: `alter table ${table} disable row level security`, kind: "disable-rls" }
+  ];
 }
 function materializedViewSql(object, schema) {
   return `create materialized view ${qualify(schema, object.identity.name)} as ${object.definition.query} with no data`;
@@ -315,4 +396,4 @@ function qualify(schema, name) {
   return `${quoteIdent(schema)}.${quoteIdent(name)}`;
 }
 
-export { quoteIdent, renderCatalog, ownedByView, dropObjectSql, createObjectSql, functionSql, viewSql, refreshMaterializedViewSql, alterColumnSql, identitySequence, createTableSql, qualify };
+export { quoteIdent, renderCatalog, uniqueBeforeForeignKey, ownedByView, dropObjectSql, createObjectSql, functionSql, viewSql, policyCreatePlan, policyDropPlan, refreshMaterializedViewSql, alterColumnSql, identitySequence, createTableSql, qualify };

package/dist/shared/{b066g80h.js → ag4c7516.js}

@@ -2,10 +2,10 @@ import {
   DriverError2,
   outcomeUnknown2,
   mapDriverError2
-} from "./kyxb62mc.js";
+} from "./31vm914h.js";
 import {
   isConnectionLost
-} from "./tbszx8mz.js";
+} from "./gwn6v667.js";
 
 // src/adapters/pg/batch.ts
 var savepointIds = 0;

package/dist/shared/b3awxn7h.js

@@ -0,0 +1,45 @@
+import {
+  isRecord,
+  orFail
+} from "./2z7wv5tj.js";
+import {
+  isOperator,
+  operatorName,
+  operatorValue
+} from "./cn0n68ft.js";
+
+// src/runtime/predicate.ts
+function effectivePredicate(where) {
+  if (where === undefined)
+    return false;
+  if (isOperator(where)) {
+    const name = operatorName(where);
+    const value = operatorValue(where);
+    if (name === "or") {
+      if (!Array.isArray(value))
+        orFail(false);
+      if (value.length === 0)
+        return true;
+      for (const branch of value) {
+        if (!effectivePredicate(branch))
+          orFail(true);
+      }
+      return true;
+    }
+    if (name === "and") {
+      return Array.isArray(value) && value.some((part) => effectivePredicate(part));
+    }
+    if (name === "not")
+      return effectivePredicate(value);
+    return true;
+  }
+  if (!isRecord(where))
+    return true;
+  for (const key of Object.keys(where)) {
+    if (where[key] !== undefined)
+      return true;
+  }
+  return false;
+}
+
+export { effectivePredicate };

package/dist/shared/b4v57v3x.js

@@ -0,0 +1,9 @@
+// src/runtime/inflight.ts
+async function refuseUncancellableTimeout(pool, timeout) {
+  if (pool.capabilities.cancel === true || timeout === undefined || !(timeout > 0))
+    return;
+  const { noTimeout } = await import("./wxr8cwns.js");
+  noTimeout({ timeout });
+}
+
+export { refuseUncancellableTimeout };

package/dist/shared/bdk4sty6.js

@@ -0,0 +1,58 @@
+import {
+  assertNamespace2,
+  normaliseEdges,
+  assertProvenance
+} from "./358zsv4r.js";
+import {
+  isReservedIdentifier2,
+  assertIdentifier2,
+  fitIdentifier2,
+  assertStoredText
+} from "./nfzc5z0w.js";
+import {
+  catalogError2
+} from "./52szzakm.js";
+
+// src/contracts/catalog/policy.ts
+var BARE_IDENT = /^[a-z_][a-z0-9_$]*$/;
+function policyIdent(name) {
+  if (BARE_IDENT.test(name) && !isReservedIdentifier2(name))
+    return name;
+  return `"${name.replaceAll('"', '""')}"`;
+}
+function tenantPolicyExpression(column, dataType) {
+  return `(${policyIdent(column)} = (NULLIF(current_setting('app.tenant'::text, true), ''::text))::${dataType})`;
+}
+function unscopedPolicyExpression() {
+  return `(current_setting('app.unscoped'::text, true) = 'on'::text)`;
+}
+function policyObject(input) {
+  assertNamespace2(input.parent.namespace);
+  assertIdentifier2(input.parent.name, "policy parent");
+  assertIdentifier2(input.name, "policy");
+  assertStoredText(input.expression, "policy expression");
+  if (input.command !== "all" && input.command !== "select") {
+    catalogError2("OKM1020", `Policy ${input.name} command is not supported.`);
+  }
+  assertProvenance(input.provenance);
+  const parent = {
+    kind: "table",
+    namespace: input.parent.namespace,
+    name: input.parent.name
+  };
+  const definition = {
+    command: input.command,
+    expression: input.expression,
+    force: input.force
+  };
+  return {
+    kind: "policy",
+    identity: { kind: "policy", parent: input.parent, name: fitIdentifier2(input.name) },
+    owner: input.owner ?? "managed",
+    definition,
+    dependencies: normaliseEdges([parent, ...input.dependencies ?? []]),
+    provenance: input.provenance
+  };
+}
+
+export { tenantPolicyExpression, unscopedPolicyExpression, policyObject };