okmodel 0.5.0 → 0.6.0

package/dist/shared/{4ef7mmqf.js → j3rkk835.js}

@@ -1,18 +1,24 @@
+import {
+  DriverError2
+} from "./31vm914h.js";
+import {
+  noTimeout2
+} from "./8dqhth8c.js";
 import {
   send2,
   reserve,
   park
-} from "./sf8m6tfy.js";
+} from "./32cnm7kn.js";
 import {
   isConnectionLost
-} from "./tbszx8mz.js";
+} from "./gwn6v667.js";
 import {
   WireSession
-} from "./zvbjc949.js";
+} from "./4az561fn.js";
 import {
   rejectClosed,
   runCall
-} from "./rrstp3kb.js";
+} from "./cgbamx3e.js";
 
 // src/adapters/pg/bunsql-extra.ts
 async function checkout(held) {
@@ -27,18 +33,28 @@ async function checkout(held) {
     counters.reservedBusy = Math.max(0, counters.reservedBusy - 1);
   });
   let lost = false;
-  const guard = (run) => lost ? rejectClosed("The connection was lost.") : run().catch((error) => {
+  const guard = (run) => lost ? rejectClosed("CONNECTION_CLOSED") : run().catch((error) => {
     if (isConnectionLost(error))
       lost = true;
+    if (error instanceof Error && bunClosed(error.message)) {
+      lost = true;
+      throw new DriverError2("CONNECTION_CLOSED", { cause: error });
+    }
     throw error;
   });
   let released = false;
   return {
-    execute: (text, params, options) => guard(() => runCall(isClosed(), options, (watch) => session.query(text, params, watch))),
-    batch: (statements, options) => guard(() => runCall(isClosed(), options, async (watch) => {
-      const { runAtomicBatch } = await import("./b066g80h.js");
-      return runAtomicBatch(session, statements, watch);
-    })),
+    execute: (text, params, options) => {
+      noTimeout2(options);
+      return guard(() => runCall(isClosed(), options, (watch) => session.query(text, params, watch)));
+    },
+    batch: (statements, options) => {
+      noTimeout2(options);
+      return guard(() => runCall(isClosed(), options, async (watch) => {
+        const { runAtomicBatch } = await import("./ag4c7516.js");
+        return runAtomicBatch(session, statements, watch);
+      }));
+    },
     async release() {
       if (released)
         return;
@@ -48,12 +64,19 @@ async function checkout(held) {
           await reset(session, reserved);
       } finally {
         counters.reserved = Math.max(0, counters.reserved - 1);
-        if (!lost)
+        if (lost)
+          await held.sql.unsafe("select 1").catch(() => {
+            return;
+          });
+        else
           await park(held.parked, reserved);
       }
     }
   };
 }
+function bunClosed(message) {
+  return message === "Connection closed" || message === "connection must be a PostgresSQLConnection";
+}
 async function reset(session, sql) {
   const run = (text) => sql.unsafe(text);
   if (session.depth() > 0)

package/dist/shared/{bt9sfq0z.js → j60w0dvr.js}

@@ -7,7 +7,7 @@ import {
   decodeResult,
   logicalIntent,
   appliedRules
-} from "./qgvt8nx1.js";
+} from "./2z7wv5tj.js";
 import {
   OkmError2,
   safe2,
@@ -22,10 +22,22 @@ var SINGLE_ENDPOINT = {
   reason: "single-endpoint"
 };
 function createClient(schema, pool, options) {
-  const connected = checkServer(pool, schema, options.http, options.requireMeta === true, callOptions(options), {
+  const closing = {
+    current: undefined,
+    early: false
+  };
+  const checked = checkServer(pool, schema, options.http, options.requireMeta === true, callOptions(options), {
     ...options.catalog !== undefined ? { catalog: options.catalog } : {},
     ...options.catalogDir !== undefined ? { catalogDir: options.catalogDir } : {}
   });
+  const connected = checked.catch((error) => {
+    if (!closing.early)
+      throw error;
+    throw new OkmError2("unavailable", "The client was closed before it connected. Await connected before close(), or do not close it before use.", { kind: "unavailable", fix: { summary: "Await client.connected before calling close()." } });
+  });
+  connected.catch(() => {
+    return;
+  });
   const session = {
     schema,
     pool,
@@ -38,7 +50,7 @@ function createClient(schema, pool, options) {
     generators: options.generators,
     timeouts: options.timeouts,
     hookm: options.hookm,
-    closing: { current: undefined }
+    closing
   };
   return openClient(session);
 }
@@ -50,6 +62,7 @@ function openClient(session) {
   const close = () => {
     if (!session.ownsPool)
       return Promise.resolve();
+    session.closing.early = true;
     session.closing.current ??= session.pool.close();
     return session.closing.current;
   };
@@ -72,7 +85,7 @@ function openClient(session) {
     },
     close,
     connected: session.connected,
-    tx: (...args) => import("./k7cc9nzk.js").then((mod) => mod.tx(session, args)),
+    tx: (...args) => import("./5d8t84hg.js").then((mod) => mod.tx(session, args)),
     batch: (ops, options) => batchHandle(session, ops, options),
     ...session.tx?.extras
   };
@@ -107,7 +120,7 @@ function tableApi(session, table, view, uses) {
   const api = {
     find(options = {}) {
       if ("lock" in options) {
-        return lazyRead(session, () => import("./dxjp14rk.js"), table, options, base, view);
+        return lazyRead(session, () => import("./r11n8grd.js"), table, options, base, view);
       }
       return start(session, "find", table, options, base, view);
     },
@@ -121,10 +134,10 @@ function tableApi(session, table, view, uses) {
       return start(session, "exists", table, options, base, view);
     },
     page(options) {
-      return lazyRead(session, () => import("./h4nqvjkp.js"), table, options, base, view);
+      return lazyRead(session, () => import("./pjr6xrm5.js"), table, options, base, view);
     },
     aggregate(options = {}) {
-      return lazyRead(session, () => import("./r6pj4fq2.js"), table, options, base, view);
+      return lazyRead(session, () => import("./venqrjna.js"), table, options, base, view);
     },
     insert(data, options = {}) {
       return writeHandle(session, "insert", table, data, options, mods);
@@ -154,13 +167,13 @@ function tableApi(session, table, view, uses) {
   return api;
 }
 function batchHandle(session, ops, options, replica) {
-  return queryHandle(() => import("./xsq7v6wp.js").then((mod) => mod.batch(session, ops, options, replica)), {
+  return queryHandle(() => import("./sbdme3vy.js").then((mod) => mod.batch(session, ops, options, replica)), {
     replica: () => batchHandle(session, ops, options, true)
   });
 }
 var writers;
 function loadWrite() {
-  writers ??= import("./p7pfx624.js");
+  writers ??= import("./2cg3wnxc.js");
   return writers;
 }
 function queryHandle(run, extra) {
@@ -215,9 +228,30 @@ async function runWrite(session, op, table, input, options, mods, plan) {
     throw logged(session, await mapError(session, error));
   }
 }
+function rejectedRead(error) {
+  const fail = () => Promise.reject(error);
+  return queryHandle(fail, {
+    all: () => rejectedRead(error),
+    required: () => rejectedRead(error),
+    inspect: fail,
+    sql: fail,
+    stream() {
+      return {
+        [Symbol.asyncIterator]() {
+          return { next: fail };
+        }
+      };
+    }
+  });
+}
 function start(session, op, table, options, mods, view) {
   const model = session.schema.model[table];
-  const call = readCall(op, table, options, mods.all, session.scope, model, session.schema, view);
+  let call;
+  try {
+    call = readCall(op, table, options, mods.all, session.scope, model, session.schema, view);
+  } catch (error) {
+    return rejectedRead(error instanceof OkmError2 ? attachHttp(session.http, error) : error);
+  }
   return readHandle(session, table, call, mods, async (plan, rows) => {
     const value = await decodeRows(plan, rows, table);
     if (mods.required === true && value === null) {
@@ -245,7 +279,7 @@ function lazyRead(session, load, table, options, mods, view) {
   });
 }
 async function decodeRows(plan, rows, table) {
-  return plan.outputs.includes.length === 0 ? decodeResult(plan, rows, table) : (await import("./h8ne16fq.js")).decodeIncluded(plan, rows, table);
+  return plan.outputs.includes.length === 0 ? decodeResult(plan, rows, table) : (await import("./ys0xzyaj.js")).decodeIncluded(plan, rows, table);
 }
 function readHandle(session, table, call, mods, decode, extra) {
   let prepared;
@@ -320,7 +354,7 @@ function readHandle(session, table, call, mods, decode, extra) {
 }
 function streamLazy(session, call, prepare) {
   return async function* () {
-    const { streamRows } = await import("./922qbgnw.js");
+    const { streamRows } = await import("./3qnhc7w5.js");
     yield* streamRows(session, call, prepare, (error) => logged(session, error));
   }();
 }
@@ -357,14 +391,14 @@ function readCall(op, table, options, all, scope, model, schema, view) {
   };
 }
 async function checkServer(pool, schema, http, requireMeta, options, source) {
-  const server = await import("./47xzb9fc.js");
+  const server = await import("./y2t3jktd.js");
   let rows;
   try {
     const result = await pool.execute(server.versionQuery, undefined, options);
     rows = result.rows;
   } catch (error) {
-    const { mapPostgresError } = await import("./s6gqfn5j.js");
-    throw mapPostgresError(error, mapOptions(http, false));
+    const { mapPostgresError } = await import("./d5azex6s.js");
+    throw mapPostgresError(error, mapOptions(http, false, schema));
   }
   await server.acceptServer(pool, schema, rows, http, requireMeta, options, source);
 }
@@ -372,8 +406,8 @@ async function mapError(session, error) {
   if (error instanceof OkmError2) {
     return session.http === undefined ? error : new OkmError2(error.code, error.message, { ...errorFields(error), http: session.http });
   }
-  const { mapPostgresError } = await import("./s6gqfn5j.js");
-  return mapPostgresError(error, mapOptions(session.http, session.includeValues));
+  const { mapPostgresError } = await import("./d5azex6s.js");
+  return mapPostgresError(error, mapOptions(session.http, session.includeValues, session.schema));
 }
 function errorFields(error) {
   return {
@@ -386,7 +420,7 @@ function errorFields(error) {
 var includeHooks;
 var operatorSql;
 function loadOperatorSql() {
-  operatorSql ??= import("./tq9afp8d.js").then(() => {
+  operatorSql ??= import("./n076ydsc.js").then(() => {
     return;
   });
   return operatorSql;
@@ -394,7 +428,7 @@ function loadOperatorSql() {
 function hooksFor(call) {
   if (call.include === undefined)
     return Promise.resolve(undefined);
-  includeHooks ??= import("./h8ne16fq.js").then((mod) => mod.includeHooks);
+  includeHooks ??= import("./ys0xzyaj.js").then((mod) => mod.includeHooks);
   return includeHooks;
 }
 function bindNow(schema, call) {
@@ -435,10 +469,11 @@ function callOptions(input, statement) {
     ...route !== undefined ? { route } : {}
   };
 }
-function mapOptions(http, includeValues) {
+function mapOptions(http, includeValues, schema) {
   return {
     ...http !== undefined ? { http } : {},
-    ...includeValues ? { includeValues: true } : {}
+    ...includeValues ? { includeValues: true } : {},
+    schema
   };
 }
 async function settleCall(session, error) {

package/dist/shared/{ycatkxmq.js → jgqj11w4.js}

@@ -1,6 +1,6 @@
 import {
   extensionObject
-} from "./8ktwd3rh.js";
+} from "./r3j8s5y0.js";
 import {
   OkmError2
 } from "./52szzakm.js";

package/dist/shared/k68eedmy.js

@@ -0,0 +1,85 @@
+import {
+  catalogError2,
+  throwNamed2
+} from "./52szzakm.js";
+
+// src/dialects/pg/through.ts
+var emit = (planner, schema, relation, child, sink, parent, alias, depth) => {
+  const through = relation.through;
+  const join = through === undefined ? undefined : planner.indexes(schema).get(through.table);
+  if (through === undefined || join === undefined) {
+    return catalogError2("OKM1020", `Relation ${relation.name} names a join table that is not in the schema.`);
+  }
+  const { quote } = planner;
+  const joinAlias = `j${alias}`;
+  sink.mark(`via:${through.table}`);
+  sink.text(`${quote(join.model.sql)} ${joinAlias} join ${quote(child.model.sql)} ${alias} on `);
+  for (let index = 0;index < through.local.length; index += 1) {
+    const local = through.local[index];
+    const remote = through.remote[index];
+    if (local === undefined || remote === undefined)
+      continue;
+    if (index > 0)
+      sink.text(" and ");
+    sink.text(`${alias}.${quote(remote)} = ${joinAlias}.${quote(local)}`);
+  }
+  sink.text(" where ");
+  planner.join(sink, parent, joinAlias, relation);
+  planner.where(schema, join, undefined, sink, joinAlias, depth + 1, true);
+};
+function resolveThrough(scope, table, through, from, to) {
+  for (const name of [table, through]) {
+    if (!scope.tables.includes(name)) {
+      throwNamed2("OKM1020", name, scope.tables, `Relation ${scope.owner}.${scope.name} names ${name}, which is not in the schema. Accepted names: ${scope.tables.join(", ")}.`);
+    }
+  }
+  const toOwner = pick(scope, through, scope.owner, from, `${scope.owner}.${scope.name}`, "from");
+  const toTable = pick(scope, through, table, to, `${scope.owner}.${scope.name}`, "to");
+  if (toOwner === toTable) {
+    catalogError2("OKM1021", `Relation ${scope.owner}.${scope.name} uses ${toOwner.fromField} on ${through} for both ends. Pass from and to.`);
+  }
+  return {
+    name: scope.name,
+    kind: "many",
+    table,
+    local: toOwner.remote,
+    remote: toOwner.local,
+    through: { table: through, local: toTable.local, remote: toTable.remote, emit }
+  };
+}
+function pick(scope, through, target, field, label, end) {
+  const matches = scope.edges.filter((edge) => edge.fromTable === through && edge.toTable === target && (field === undefined || edge.fromField === field));
+  const [only] = matches;
+  if (matches.length === 1 && only !== undefined)
+    return only;
+  const fields = matches.map((edge) => edge.fromField).sort();
+  catalogError2("OKM1021", `Relation ${label} through ${through} is ambiguous at ${end}. Accepted columns: ${fields.length === 0 ? "(none)" : fields.join(", ")}.`);
+}
+
+// src/dialects/pg/relations.ts
+function one2(table, field) {
+  return { kind: "one", table, field };
+}
+function many2(table, field) {
+  return { kind: "many", table, field };
+}
+function isRelationCall(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  if (!("kind" in value) || !("table" in value))
+    return false;
+  const kind = value.kind;
+  return (kind === "one" || kind === "many") && typeof value.table === "string";
+}
+function manyThrough2(table, options) {
+  const { through, from, to } = options;
+  return {
+    kind: "many",
+    table,
+    field: undefined,
+    through,
+    resolve: (scope) => resolveThrough(scope, table, through, from, to)
+  };
+}
+
+export { one2, many2, isRelationCall, manyThrough2 };

package/dist/shared/{szm0cksa.js → knmes2kh.js}

@@ -1,6 +1,6 @@
 import {
   FUNCTION_ARG_TYPES
-} from "./fancm5pt.js";
+} from "./vjpnzwjz.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -9,6 +9,8 @@ import {
 async function assertRoleHealth(runner, roles, objects) {
   const managed = new Set((roles.managed ?? []).map((role) => role.name));
   const named = [roles.migration, roles.app];
+  if (roles.reporting !== undefined)
+    named.push(roles.reporting);
   for (const name of named) {
     if (managed.has(name))
       continue;
@@ -22,15 +24,16 @@ async function assertRoleHealth(runner, roles, objects) {
   if (managed.size > 0)
     await assertCreateRole(runner, await currentUser(runner));
   for (const object of objects) {
-    if (object.kind !== "grant" || object.identity.role !== roles.app)
+    if (object.kind !== "grant")
       continue;
+    if (managed.has(object.identity.role) && !await roleExists(runner, object.identity.role)) {
+      continue;
+    }
     await assertGrant(runner, object);
   }
 }
 async function assertCreateRole(runner, role) {
-  const result = await runner.execute("select rolcreaterole from pg_roles where rolname = $1", [
-    role
-  ]);
+  const result = await runner.execute("select rolsuper or rolcreaterole from pg_roles where rolname = $1", [role]);
   if (!truthy(result.rows[0]?.[0])) {
     throw new OkmError2("forbidden", `Role ${role} lacks CREATEROLE. Nothing was changed.`, {
       kind: "forbidden",
@@ -62,11 +65,36 @@ async function assertGrant(runner, object) {
       missing(object, `${schema}.${fn}`);
     return;
   }
-  if (target.kind === "namespace")
+  if (target.kind === "namespace") {
+    const allowed = await runner.execute(`select exists (
+         select 1 from pg_namespace n
+         cross join lateral aclexplode(n.nspacl) as a
+         where n.nspname = $2
+           and a.privilege_type = $3
+           and (
+             a.grantee = 0
+             or a.grantee = (select oid from pg_roles where rolname = $1)
+           )
+       )`, [object.identity.role, schema, privilege]);
+    if (!truthy(allowed.rows[0]?.[0]))
+      missing(object, `schema ${schema}`);
     return;
+  }
   const relkinds = target.kind === "sequence" ? "'S'" : target.kind === "view" ? "'v'" : target.kind === "materializedView" ? "'m'" : "'r', 'p'";
   if (!await relationExists(runner, schema, target.name, relkinds))
     return;
+  const column = /^(SELECT|UPDATE)\(([^)]*)\)$/.exec(privilege);
+  const listed = column?.[2];
+  const base = column?.[1];
+  if (listed !== undefined && base !== undefined) {
+    const names = listed.split(",").filter((name) => name.length > 0);
+    for (const name of names) {
+      const allowed = await runner.execute("select has_column_privilege($1, format('%I.%I', $2::text, $3::text), $4, $5)", [object.identity.role, schema, target.name, name, base]);
+      if (!truthy(allowed.rows[0]?.[0]))
+        missing(object, `${schema}.${target.name}.${name}`);
+    }
+    return;
+  }
   const probe = target.kind === "sequence" ? "select has_sequence_privilege($1, format('%I.%I', $2::text, $3::text), $4)" : "select has_table_privilege($1, format('%I.%I', $2::text, $3::text), $4)";
   const allowed = await runner.execute(probe, [
     object.identity.role,

package/dist/shared/{ckjbyrt9.js → mb2ycs1p.js}

@@ -1,3 +1,6 @@
+import {
+  effectivePredicate
+} from "./b3awxn7h.js";
 import {
   stack
 } from "./672t5vym.js";
@@ -14,14 +17,11 @@ import {
   isRecord,
   registerFailFix,
   fail
-} from "./qgvt8nx1.js";
+} from "./2z7wv5tj.js";
 import {
   safetyInstalled,
   runSafety
 } from "./a5sxz52y.js";
-import {
-  isOperator
-} from "./cn0n68ft.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -362,11 +362,9 @@ function requireFilter(table, where, mods, op) {
     }
     return;
   }
-  if (isOperator(where))
-    return;
-  if (isRecord(where) && Object.keys(where).length > 0)
-    return;
-  fail("OKM1102", `${op} on ${table.model.name} needs a where. Pass a filter, or .all(reason).`);
+  if (!effectivePredicate(where)) {
+    fail("OKM1102", `${op} on ${table.model.name} needs a where. Pass a filter, or .all(reason).`);
+  }
 }
 function callOptions(input) {
   const signal = input.signal;

package/dist/shared/{tq9afp8d.js → n076ydsc.js}

@@ -11,7 +11,7 @@ import {
   quote,
   isRecord,
   fail
-} from "./qgvt8nx1.js";
+} from "./2z7wv5tj.js";
 import {
   isOperator,
   operatorName,

package/dist/shared/{xhh1srw3.js → nx9hh281.js}

@@ -1,50 +1,51 @@
 import {
   open2
-} from "./wqem4jed.js";
+} from "./wkme6tep.js";
 import {
   startupHash2
-} from "./8bwbwy8h.js";
+} from "./qq3899ht.js";
 import {
   runTarget,
   assumeRole,
+  grantAppMeta,
   statementOutsideTransaction,
-  loadMigrations,
-  loadHeadSnapshot,
   readReference,
   referenceInserts,
   provisionMark,
   expandProvisioned,
   installSnapshot
-} from "./kdkxh3kb.js";
+} from "./p248q79y.js";
 import {
   assertCreateRole,
   currentUser,
   roleExists
-} from "./szm0cksa.js";
+} from "./knmes2kh.js";
 import {
+  projectPath,
+  loadMigrations,
+  loadHeadSnapshot,
   lintMigrationDirectory,
   hasError,
   lintRefusal,
-  assertTargetPolicy,
-  assertDirectConnection,
-  selectTarget,
   projectHead,
   loadBuiltSchema,
   loadConfig
-} from "./xdpj5kkm.js";
+} from "./t3g0k88x.js";
 import {
   changesRole,
   batchSizeField,
   assertExtensionsAvailable,
-  planMigration
-} from "./ayz64vzj.js";
+  planMigration,
+  finishQuiet,
+  assertTargetPolicy,
+  assertDirectConnection,
+  assertStableBackend,
+  selectTarget
+} from "./ttmg09vd.js";
 import {
   OkmError2
 } from "./52szzakm.js";
 
-// src/tooling/migrate/apply.ts
-import { join } from "node:path";
-
 // src/tooling/migrate/engine.ts
 var IDENT = String.raw`"(?:[^"]|"")+"|[A-Za-z_][\w$]*`;
 var DEFAULT_UUIDV7 = /\bdefault\s+uuidv7\s*\(\s*\)/i;
@@ -120,6 +121,11 @@ var BACKFILL = `create table if not exists okm_backfill (
   updated_at timestamptz not null default now(),
   primary key (migration_id, step_index)
 )`;
+async function ensureMigrationTables2(execute) {
+  await execute(META);
+  await execute(HISTORY);
+  await execute(BACKFILL);
+}
 function applyUnits(migration, done) {
   const pending = [];
   for (let index = 0;index < migration.steps.length; index += 1) {
@@ -174,9 +180,12 @@ async function applyTarget2(request) {
       fix: { summary: "Apply needs a driver with interactive transactions." }
     });
   }
-  const connection = await pool.reserve();
+  const reserved = await pool.reserve();
+  const connection = reserved;
   let locked = false;
   try {
+    await assertStableBackend(() => backendPid(connection), request.allowPooler === true);
+    await assertStandardStrings(connection);
     await setTimeouts(connection, request);
     await lockTarget(connection, request.target);
     locked = true;
@@ -199,9 +208,7 @@ async function applyTarget2(request) {
         throw notEmpty(request.target, state.kind === "occupied" ? state.object : "okm_meta");
       }
     }
-    await connection.execute(META);
-    await connection.execute(HISTORY);
-    await connection.execute(BACKFILL);
+    await ensureMigrationTables2((sql) => connection.execute(sql));
     const restamped = await restampLegacy(connection, request);
     const history = await readHistory(connection);
     const done = expandProvisioned(request.migrations, history.done, history.ids);
@@ -222,14 +229,14 @@ async function applyTarget2(request) {
     if (request.snapshot !== undefined) {
       await insertReference(connection, request);
     }
+    await grantAppMeta(connection, request.appRole, session);
     return restamped.length === 0 ? report : { ...report, restamped };
   } finally {
-    if (locked)
-      await connection.execute("select pg_advisory_unlock(hashtext($1))", [
-        lockKey(request.target)
-      ]);
-    await connection.release();
-    await pool.close();
+    if (locked) {
+      await finishQuiet(() => connection.execute("select pg_advisory_unlock(hashtext($1))", [lockKey(request.target)]));
+    }
+    await finishQuiet(() => connection.release());
+    await finishQuiet(() => pool.close());
   }
 }
 async function applyProject2(cwd, flags, write) {
@@ -264,7 +271,7 @@ nothing to apply
       catalogHash: head.catalogHash,
       reference: built === undefined ? [] : readReference(built.tables, built.casing, head.catalog)
     },
-    ...config.roles !== undefined ? { migrationRole: config.roles.migration } : {},
+    ...config.roles !== undefined ? { migrationRole: config.roles.migration, appRole: config.roles.app } : {},
     lintDirectory: directory,
     onProgress: (line) => {
       if (write !== undefined)
@@ -311,7 +318,7 @@ no changes
         steps: plan.steps
       }
     ],
-    ...config.roles !== undefined ? { migrationRole: config.roles.migration } : {}
+    ...config.roles !== undefined ? { migrationRole: config.roles.migration, appRole: config.roles.app } : {}
   });
   return formatReport(report);
 }
@@ -377,7 +384,19 @@ var RESTAMP = `with pairs as (
 )
 select distinct id from history order by id`;
 function joinMigrations(cwd, migrations) {
-  return join(cwd, migrations ?? "migrations");
+  return projectPath(cwd, migrations ?? "migrations");
+}
+async function backendPid(connection) {
+  const result = await connection.execute("select pg_backend_pid()::text");
+  const cell = result.rows[0]?.[0];
+  return cell === null || cell === undefined ? "" : String(cell);
+}
+async function assertStandardStrings(connection) {
+  const result = await connection.execute("show standard_conforming_strings");
+  const value = result.rows[0]?.[0];
+  if (value === "on")
+    return;
+  throw new OkmError2("invalid", `standard_conforming_strings is ${value === null || value === undefined ? "off" : String(value)}. Apply refuses to run.`, { fix: { summary: "Turn standard_conforming_strings on for this database." } });
 }
 async function setTimeouts(connection, request) {
   const lock = request.lockTimeoutMs ?? DEFAULT_LOCK_MS;
@@ -449,10 +468,9 @@ async function provisionEmpty(connection, request, session) {
     assertTargetPolicy({ name: request.target, protected: request.protected }, "reference", request.allowProtected === true);
   }
   const schema = concreteSchema(request);
-  await connection.execute(META);
-  await connection.execute(HISTORY);
-  await connection.execute(BACKFILL);
+  await ensureMigrationTables2((sql) => connection.execute(sql));
   await installSnapshot(connection, snapshot.catalog, schema, snapshot.reference, session, request.migrationRole);
+  await grantAppMeta(connection, request.appRole, session);
   const mark = provisionMark(snapshot.migrationId);
   await connection.execute("begin");
   try {
@@ -586,4 +604,4 @@ function wireTrue(value) {
   return value === "t" || value === "true";
 }
 
-export { applyTarget2, applyProject2, pushProject2, backfillTiming2 };
+export { ensureMigrationTables2, applyTarget2, applyProject2, pushProject2, backfillTiming2 };