okmodel 0.5.0 → 0.6.0

package/dist/shared/{xdpj5kkm.js → t3g0k88x.js}

@@ -9,46 +9,71 @@ import {
   serializeCatalog2,
   catalogHash2,
   startupCatalog2,
+  catalogFileText2,
   parseCatalog2
-} from "./8bwbwy8h.js";
+} from "./qq3899ht.js";
 import {
   open2
-} from "./wqem4jed.js";
+} from "./wkme6tep.js";
 import {
+  sqlStatements,
+  transactionControl,
   canonicalTypeName,
+  prepareMigrationText,
+  assertMigrationSteps,
+  columnPrivilege,
   batchSizeField,
   aboutBatchCount,
   parseReplace,
   planMigration,
   formatPlan,
   parsePlan,
-  staleRenames
-} from "./ayz64vzj.js";
+  staleRenames,
+  sessionFailure,
+  finishQuiet,
+  assertTargetPolicy,
+  assertTargetAlias,
+  listTargets,
+  selectTarget
+} from "./ttmg09vd.js";
 import {
   contributedFields
 } from "./n0dgs0pb.js";
 import {
   assertValidation,
   writeWouldValidate
-} from "./9m80mkac.js";
+} from "./ze4hxsmy.js";
+import {
+  tableOwner,
+  stampOwnership
+} from "./xqve9598.js";
 import {
   catalog,
   isDomain
-} from "./g7ez901n.js";
+} from "./ywspezzx.js";
 import {
   snakeCase,
   emittedTypeName
-} from "./jsd07prz.js";
+} from "./rpycarcr.js";
 import {
   ColumnBuilder2
-} from "./c9z5g0fm.js";
+} from "./ywr8hmey.js";
 import {
   staticNamespace2
-} from "./t4tbsy9h.js";
+} from "./358zsv4r.js";
+import {
+  sha2562
+} from "./nfzc5z0w.js";
 import {
   OkmError2
 } from "./52szzakm.js";
 
+// src/tooling/migrate/paths.ts
+import { resolve } from "node:path";
+function projectPath(cwd, ...parts) {
+  return resolve(cwd, ...parts);
+}
+
 // src/tooling/errors/registry.ts
 var ERROR_DOCS = [
   {
@@ -150,8 +175,8 @@ var ERROR_DOCS = [
   {
     code: "OKM1102",
     title: "Unfiltered write",
-    summary: "update or delete would run with an empty where.",
-    fix: "Pass a filter. undefined in a write filter does not mean every row."
+    summary: "A write with no effective predicate, including undefined values, is OKM1102.",
+    fix: "Pass a predicate, or .all(reason). An undefined-only where is the same as {}."
   },
   {
     code: "OKM1104",
@@ -180,14 +205,14 @@ var ERROR_DOCS = [
   {
     code: "OKM1120",
     title: "Unknown field",
-    summary: "A field name in where, select, orderBy, or include is not on the table.",
-    fix: "Use a field from the catalog. The error includes a nearest-name hint when one is close."
+    summary: "The name is not a field or an option. timeout and signal go in the second argument of update. Options go first: tx(options, fn).",
+    fix: "Use a field from the catalog, or move the option. The error includes a nearest-name hint when one is close."
   },
   {
     code: "OKM1121",
     title: "Object as value",
-    summary: "A plain object was passed where a value is required. JSON cannot create an operator.",
-    fix: "Wrap the value with eq. eq is the equality form for json and jsonb."
+    summary: "An empty or() branch is OKM1121. or() takes one array: or([a, b]). A plain object was passed where a value is required.",
+    fix: "Give every or() branch a predicate. Pass an array: or([a, b]). Wrap a json value with eq."
   },
   {
     code: "OKM1122",
@@ -252,8 +277,8 @@ var ERROR_DOCS = [
   {
     code: "OKM1510",
     title: "Unsafe migration",
-    summary: "A migration has an unresolved lint error, or an override with an empty reason or a code the statement did not trigger.",
-    fix: "Put `-- okm-allow OKM15xx: reason` on the line above the statement. The code must be one that statement triggered, and the reason must not be empty."
+    summary: "A migration has an unresolved lint error, or an override with an empty reason or a code no statement in the step triggered.",
+    fix: "Put `-- okm-allow OKM15xx: reason` on the step. The code must be one a statement in that step triggered, and the reason must not be empty. The line silences that code on every statement of the step."
   },
   {
     code: "OKM1511",
@@ -444,8 +469,8 @@ var ERROR_DOCS = [
   {
     code: "OKM1542",
     title: "Data statement",
-    summary: "A migration contains a data statement outside backfill().",
-    fix: "Move the statement into backfill(). Data changes are batched and resumable there."
+    summary: "A migration contains a data statement outside backfill(), or a DO or CALL whose body is not analysed.",
+    fix: "Move insert, update, delete, merge, and truncate into backfill(). DO and CALL are refused because the body is not analysed. Allow OKM1542 with a reason to keep one."
   },
   {
     code: "OKM1543",
@@ -489,6 +514,18 @@ var ERROR_DOCS = [
     summary: "The last migration's catalog does not match the schema.",
     fix: "Run okm generate."
   },
+  {
+    code: "OKM1550",
+    title: "Row-level security weakened",
+    summary: "A statement disables row-level security, drops or widens a policy, grants BYPASSRLS, or changes the owner of a tenant table.",
+    fix: "Remove the statement, or allow OKM1550 with a reason when the change is reviewed."
+  },
+  {
+    code: "OKM1551",
+    title: "Transaction control in a step",
+    summary: "A step contains COMMIT, ROLLBACK, or other transaction control, including inside a DO body. A function or procedure body is not this.",
+    fix: "Remove the transaction control. okm migrate check replays one transaction and rolls it back. Apply accepts the step only with -- okm-allow OKM1551: reason."
+  },
   {
     code: "OKM1601",
     title: "Stale typed SQL",
@@ -528,8 +565,14 @@ var ERROR_DOCS = [
   {
     code: "OKM1707",
     title: "RLS role",
-    summary: "connect() was given a role that owns the tables or is a superuser, under the rls strategy.",
-    fix: "Connect as a role that is neither the owner nor a superuser."
+    summary: "A scoped call under rls ran as a role that owns the tenant tables, is a superuser, or has BYPASSRLS. The reason field says which. The message names the endpoint.",
+    fix: "Connect as a role that is not the table owner, a superuser, or BYPASSRLS. okm seed under rlsTenancy runs as the application role. The owner gets this error."
+  },
+  {
+    code: "OKM1708",
+    title: "RLS policy",
+    summary: "A scoped call under rls found a tenant table whose row-level security is missing, not forced, or whose policies are not the ones okm generate emits. The message names the table and the endpoint.",
+    fix: "Restore the policies okm generate emits for this rls schema."
   },
   {
     code: "OKM1801",
@@ -612,7 +655,7 @@ var ERROR_DOCS = [
   {
     code: "OKM1825",
     title: "Missing privilege",
-    summary: "The application role lacks a privilege on a managed object.",
+    summary: "A role lacks a privilege on a managed object.",
     fix: "Grant the privilege, or change the role. okm doctor reports the object and the privilege."
   },
   {
@@ -686,6 +729,12 @@ var ERROR_DOCS = [
     title: "Target not named",
     summary: "Several targets are configured and the command was not given --target.",
     fix: "Pass --target <name>. The command does not guess."
+  },
+  {
+    code: "OKM1854",
+    title: "Pooler session",
+    summary: "Two statements on the same connection saw different backend pids. A transaction-mode pooler is in the way.",
+    fix: "Use a direct connection, or pass --allow-pooler."
   }
 ];
 var byCode;
@@ -701,9 +750,53 @@ function indexDocs() {
   return index;
 }
 
-// src/tooling/migrate/lint.ts
+// src/tooling/migrate/files.ts
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+function loadMigrations(directory) {
+  if (!existsSync(directory))
+    return [];
+  const names = readdirSync(directory).filter((file) => file.endsWith(".sql")).sort();
+  const migrations = [];
+  for (const file of names) {
+    const id = file.slice(0, -".sql".length);
+    const catalogPath = join(directory, `${id}.catalog.json`);
+    if (!existsSync(catalogPath)) {
+      throw new OkmError2("invalid", `Migration ${id} is missing its catalog snapshot.`, {
+        fix: {
+          summary: "Generate the migration again so the SQL and the catalog are written together."
+        }
+      });
+    }
+    const plan = readMigrationPlan(join(directory, file));
+    const stored = parseCatalog2(readFileSync(catalogPath, "utf8"));
+    const startup = startupCatalog2(stored);
+    const hash = catalogHash2(startup);
+    migrations.push(startup === stored ? { id, catalogHash: hash, steps: plan.steps } : { id, catalogHash: hash, legacyHash: catalogHash2(stored), steps: plan.steps });
+  }
+  return migrations;
+}
+function readMigrationPlan(path) {
+  const text = prepareMigrationText(readFileSync(path, "utf8"), path);
+  const plan = parsePlan(text);
+  assertMigrationSteps(text, plan.steps.length, path);
+  return plan;
+}
+function loadHeadSnapshot(directory) {
+  const migrations = loadMigrations(directory);
+  const last = migrations.at(-1);
+  if (last === undefined)
+    return;
+  return {
+    id: last.id,
+    catalogHash: last.catalogHash,
+    catalog: parseCatalog2(readFileSync(join(directory, `${last.id}.catalog.json`), "utf8"))
+  };
+}
+
+// src/tooling/migrate/lint.ts
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
 
 // src/tooling/migrate/lint-rules.ts
 var INTEGER_WIDTH = {
@@ -740,7 +833,12 @@ var STEP_RULES = [
   rule("OKM1536", "locking", "error", "Adding a foreign key without NOT VALID locks the table while it scans.", (input) => hit(foreignKeyWithoutNotValid(input), "adds a foreign key without NOT VALID")),
   rule("OKM1537", "locking", "error", "SET NOT NULL locks the table while it scans for nulls.", (input) => hit(unsafeSetNotNull(input), "sets NOT NULL")),
   rule("OKM1538", "locking", "warning", "A type change that rewrites the table locks it for the rewrite.", (input) => typeChange(input, "rewrite")),
-  rule("OKM1542", "data-dependent", "error", "A data statement outside backfill() is not a migration step.", (input) => hit(dataStatement(input.step), "changes rows outside backfill()"))
+  rule("OKM1542", "data-dependent", "error", "A data statement outside backfill(), or DO or CALL, is not a migration step.", (input) => dataStatement(input.step)),
+  rule("OKM1550", "destructive", "error", "Disabling row-level security, dropping a policy, creating or altering one that is not the emitted tenant predicate, granting BYPASSRLS, or changing the owner of a tenant table removes the rlsTenancy backstop.", (input) => weakensRls(input)),
+  rule("OKM1551", "destructive", "error", "Transaction control inside a step commits or leaves the migration transaction.", (input) => {
+    const word = transactionControl(input.step.sql);
+    return word === undefined ? [] : [`contains ${word}`];
+  })
 ];
 var COLUMN_RULES = [
   {
@@ -799,13 +897,159 @@ function normalized(sql) {
   }
   return out;
 }
-function dataStatement(step) {
-  if (step.backfill !== undefined)
+function weakensRls(input) {
+  const text = normalized(input.step.sql);
+  if (/\bdisable row level security\b/.test(text))
+    return ["disables row level security"];
+  if (/\bno force row level security\b/.test(text))
+    return ["stops forcing row level security"];
+  if (/^drop policy\b/.test(text))
+    return ["drops a policy"];
+  const drifted = policyDrift(input, text);
+  if (drifted !== undefined)
+    return [drifted];
+  if (/^(?:alter|create) (?:role|user)\b/.test(text) && /(?<!no)bypassrls\b/.test(text)) {
+    return ["grants BYPASSRLS"];
+  }
+  if (changesTenantOwner(input, text))
+    return ["changes the owner of a tenant table"];
+  return [];
+}
+function policyDrift(input, text) {
+  const header = /^(create|alter) policy\s+(\S+)\s+on\s+(\S+)/.exec(text);
+  const kind = header?.[1];
+  const table = lastName(header?.[3]);
+  if (kind === undefined || table === undefined)
+    return;
+  if (!hasPolicy(input.before, table) && !hasPolicy(input.after, table))
+    return;
+  const name = lastName(header?.[2]) ?? "";
+  const using = clause(text, "using");
+  const check = clause(text, "with check");
+  if (isTrue(using) || isTrue(check)) {
+    return kind === "alter" ? "widens a policy to match every row" : "creates a policy that matches every row";
+  }
+  if (kind === "alter" && using === undefined && check === undefined)
+    return;
+  const tenant = policyExpression(input, table, `${table}_tenant`);
+  const unscoped = policyExpression(input, table, `${table}_unscoped_select`);
+  const emitted = !/\bas restrictive\b/.test(text) && (matchesEmitted(name, `${table}_tenant`, using, check, tenant) || matchesEmitted(name, `${table}_unscoped_select`, using, check, unscoped));
+  if (emitted)
+    return;
+  return kind === "alter" ? "widens a policy away from the tenant predicate" : "creates a policy that is not the tenant predicate";
+}
+function matchesEmitted(name, expectedName, using, check, expression) {
+  if (name !== expectedName || expression === undefined || using === undefined)
     return false;
+  if (!sameExpression(using, expression))
+    return false;
+  return check === undefined || sameExpression(check, expression);
+}
+function sameExpression(found, expected) {
+  return found === expected || unwrap(found) === unwrap(expected);
+}
+function unwrap(expression) {
+  const body = expression.trim();
+  if (!body.startsWith("(") || !body.endsWith(")"))
+    return body;
+  let depth = 0;
+  for (let index = 0;index < body.length; index += 1) {
+    const char = body[index];
+    if (char === "(")
+      depth += 1;
+    else if (char === ")") {
+      depth -= 1;
+      if (depth === 0)
+        return index === body.length - 1 ? body.slice(1, -1).trim() : body;
+    }
+  }
+  return body;
+}
+function isTrue(expression) {
+  return expression !== undefined && expression.replaceAll(" ", "") === "(true)";
+}
+function clause(text, keyword) {
+  const needle = keyword === "using" ? /\busing\s*\(/g : /\bwith check\s*\(/g;
+  const found = needle.exec(text);
+  if (found === null)
+    return;
+  return parenthesized(text, found.index + found[0].length - 1);
+}
+function parenthesized(text, open) {
+  let depth = 0;
+  let quoted = false;
+  let single = false;
+  for (let index = open;index < text.length; index += 1) {
+    const char = text[index];
+    if (single) {
+      if (char === "'" && text[index + 1] === "'") {
+        index += 1;
+        continue;
+      }
+      if (char === "'")
+        single = false;
+      continue;
+    }
+    if (quoted) {
+      if (char === '"')
+        quoted = false;
+      continue;
+    }
+    if (char === "'") {
+      single = true;
+      continue;
+    }
+    if (char === '"') {
+      quoted = true;
+      continue;
+    }
+    if (char === "(")
+      depth += 1;
+    else if (char === ")") {
+      depth -= 1;
+      if (depth === 0)
+        return text.slice(open, index + 1);
+    }
+  }
+  return;
+}
+function policyExpression(input, table, name) {
+  const expression = expressionOf(input.after, table, name) ?? expressionOf(input.before, table, name);
+  return expression === undefined ? undefined : normalized(expression);
+}
+function expressionOf(source, table, name) {
+  for (const object of source.objects) {
+    if (object.kind !== "policy")
+      continue;
+    if (object.identity.parent.name !== table || object.identity.name !== name)
+      continue;
+    return object.definition.expression;
+  }
+  return;
+}
+function changesTenantOwner(input, text) {
+  const match = /^alter table\s+(\S+)\s+owner to\b/.exec(text);
+  const table = lastName(match?.[1]);
+  if (table === undefined)
+    return false;
+  return hasPolicy(input.before, table) || hasPolicy(input.after, table);
+}
+function hasPolicy(source, table) {
+  return source.objects.some((object) => object.kind === "policy" && object.identity.parent.name === table);
+}
+function dataStatement(step) {
   const text = normalized(step.sql);
-  if (/^(?:insert|update|delete|merge|truncate)\b/.test(text))
-    return true;
-  return /^with\b/.test(text) && /\b(?:insert|update|delete|merge)\b/.test(text);
+  if (/^(?:do|call)\b/.test(text))
+    return ["the body is not analysed"];
+  if (step.backfill !== undefined)
+    return [];
+  if (/^(?:insert|update|delete|merge|truncate)\b/.test(text)) {
+    return ["changes rows outside backfill()"];
+  }
+  if (/^with\b/.test(text) && /\b(?:insert|update|delete|merge)\b/.test(text)) {
+    return ["changes rows outside backfill()"];
+  }
+  return [];
 }
 function matches(step, kind, pattern) {
   return pattern.test(normalized(step.sql)) || step.kind === kind;
@@ -980,9 +1224,10 @@ function validates(input, kind) {
     return true;
   return false;
 }
+var TYPE_CHANGE = /^alter table\s+(\S+)\s+alter column\s+(\S+)\s+(?:set data type|type)\b/;
 function typeChange(input, mode) {
   const text = normalized(input.step.sql);
-  const changing = /^alter table\s+\S+\s+alter column\s+\S+\s+set data type\b/.test(text) || input.step.kind === "set-column-type";
+  const changing = TYPE_CHANGE.test(text) || input.step.kind === "set-column-type";
   if (!changing)
     return [];
   const compared = columnTypes(input);
@@ -1009,7 +1254,7 @@ function typeChange(input, mode) {
 }
 function columnTypes(input) {
   const text = normalized(input.step.sql);
-  const match = /^alter table\s+(\S+)\s+alter column\s+(\S+)\s+set data type\b/.exec(text);
+  const match = TYPE_CHANGE.exec(text);
   const table = lastName(match?.[1]);
   const column = lastName(match?.[2]);
   if (table === undefined || column === undefined)
@@ -1143,15 +1388,15 @@ function lintCatalog(source) {
   return findings;
 }
 function lintMigrationDirectory(directory, pending) {
-  if (!existsSync(directory))
+  if (!existsSync2(directory))
     return [];
-  const names = readdirSync(directory).filter((file) => file.endsWith(".sql")).sort();
+  const names = readdirSync2(directory).filter((file) => file.endsWith(".sql")).sort();
   let before = catalog([]);
   const findings = [];
   for (const file of names) {
     const id = file.slice(0, -".sql".length);
-    const plan = parsePlan(readFileSync(join(directory, file), "utf8"));
-    const after = parseCatalog2(readFileSync(join(directory, `${id}.catalog.json`), "utf8"));
+    const plan = readMigrationPlan(join2(directory, file));
+    const after = parseCatalog2(readFileSync2(join2(directory, `${id}.catalog.json`), "utf8"));
     if (pending === undefined || pending.has(id)) {
       for (const item of lintPlan(plan, before, after)) {
         findings.push({ ...item, place: `${id} ${item.place}` });
@@ -1178,34 +1423,76 @@ function lintRefusal(findings) {
   });
 }
 function lintStep(step, number, before, after, existingTables, earlier, later) {
-  const hits = [];
-  for (const rule of STEP_RULES) {
-    for (const reason of rule.check({ step, before, after, existingTables, earlier, later })) {
-      hits.push({ code: rule.code, severity: rule.severity, reason });
+  const texts = statementTexts(step);
+  const multi = texts.length > 1;
+  const earlierStatements = earlier.flatMap(contextSteps);
+  const laterStatements = later.flatMap(contextSteps);
+  const perStatement = [];
+  const triggered = new Set;
+  texts.forEach((sql, index) => {
+    const statement = multi ? withoutKind(step, sql) : withSql(step, sql);
+    const hits = [];
+    for (const rule of STEP_RULES) {
+      for (const reason of rule.check({
+        step: statement,
+        before,
+        after,
+        existingTables,
+        earlier: earlierStatements,
+        later: laterStatements
+      })) {
+        const hit = { code: rule.code, severity: rule.severity, reason };
+        hits.push(hit);
+        triggered.add(hit.code);
+      }
     }
-  }
-  const triggered = new Set(hits.map((item) => item.code));
+    const place = multi ? `step ${String(number)} statement ${String(index + 1)}` : `step ${String(number)}`;
+    perStatement.push({ place, hits });
+  });
   const silenced = new Set;
   const findings = [];
-  const place = `step ${String(number)}`;
+  const stepPlace = `step ${String(number)}`;
   for (const allow of step.allows ?? []) {
     if (allow.reason.trim().length === 0 || allow.code.length === 0) {
-      findings.push(finding("error", "OKM1510", place, "override needs a reason"));
+      findings.push(finding("error", "OKM1510", stepPlace, "override needs a reason"));
       continue;
     }
     if (!triggered.has(allow.code)) {
-      findings.push(finding("error", "OKM1510", place, `override ${allow.code} does not match this statement`));
+      findings.push(finding("error", "OKM1510", stepPlace, `override ${allow.code} does not match this statement`));
       continue;
     }
     silenced.add(allow.code);
   }
-  for (const hit of hits) {
-    if (silenced.has(hit.code))
-      continue;
-    findings.push(finding(hit.severity, hit.code, place, hit.reason));
+  for (const item of perStatement) {
+    for (const hit of item.hits) {
+      if (silenced.has(hit.code))
+        continue;
+      findings.push(finding(hit.severity, hit.code, item.place, hit.reason));
+    }
   }
   return findings;
 }
+function statementTexts(step) {
+  const statements = sqlStatements(step.sql);
+  return statements.length === 0 ? [step.sql] : statements;
+}
+function contextSteps(step) {
+  const statements = sqlStatements(step.sql);
+  if (statements.length === 0)
+    return [step];
+  if (statements.length === 1 && statements[0] === step.sql)
+    return [step];
+  return statements.map((sql) => withSql(step, sql));
+}
+function withSql(step, sql) {
+  if (sql === step.sql)
+    return step;
+  return { ...step, sql };
+}
+function withoutKind(step, sql) {
+  const { kind: _kind, ...rest } = step;
+  return { ...rest, sql };
+}
 function finding(severity, code, place, reason) {
   const doc = errorDoc(code);
   if (doc === undefined)
@@ -1227,161 +1514,9 @@ function columnPlace(column) {
   return `${column.identity.parent.name}.${column.identity.name}`;
 }
 
-// src/tooling/migrate/policy.ts
-var READ = new Set([
-  "plan",
-  "status",
-  "check",
-  "drift",
-  "verify",
-  "pull",
-  "catalog-export",
-  "inspect"
-]);
-var ALLOWED = new Set(["expand", "reference", "provision"]);
-var FORWARD_ONLY = new Set(["drop", "rollback"]);
-function assertTargetPolicy(target, operation, allowProtected = false) {
-  if (FORWARD_ONLY.has(operation)) {
-    throw new OkmError2("invalid", "There is no down migration.", {
-      fix: { summary: "Recovery is a new forward migration." }
-    });
-  }
-  if (!target.protected || allowProtected)
-    return;
-  if (READ.has(operation) || ALLOWED.has(operation))
-    return;
-  throw new OkmError2("OKM1850", `${operation} is blocked on protected target ${target.name}.`, {
-    kind: "forbidden",
-    fix: {
-      summary: "Run a read-only command or an expand migration, or pass --allow-protected for this invocation."
-    }
-  });
-}
-function assertTargetAlias(targets) {
-  const groups = new Map;
-  for (const target of targets) {
-    const key = `${target.host}
-${target.port}
-${target.database}`;
-    const group = groups.get(key);
-    if (group === undefined)
-      groups.set(key, [target]);
-    else
-      group.push(target);
-  }
-  for (const group of groups.values()) {
-    const protectedTarget = group.find((target) => target.protected);
-    const open = group.find((target) => !target.protected);
-    if (protectedTarget !== undefined && open !== undefined) {
-      throw new OkmError2("OKM1852", `${open.name} and ${protectedTarget.name} resolve to the same database and disagree about protection.`, {
-        fix: {
-          summary: "Give those targets the same protection flag. okm check and okm doctor both report this."
-        }
-      });
-    }
-  }
-}
-function assertDirectConnection(url, allowPooler) {
-  if (allowPooler)
-    return;
-  const endpoint = endpointOf(url);
-  const parsed = new URL(url);
-  const host = endpoint.host;
-  if (host.includes("pooler") || host.includes("pgbouncer") || host.includes("-pooler") || endpoint.port === "6543" || parsed.searchParams.get("pgbouncer") === "true") {
-    throw new OkmError2("invalid", `Refusing pooler host ${host}. Apply needs a direct connection.`, { fix: { summary: "Use a direct connection, or pass --allow-pooler." } });
-  }
-}
-function listTargets(config) {
-  if (config.database !== undefined && config.targets !== undefined) {
-    throw new OkmError2("invalid", "Set database or targets, not both.", {
-      fix: { summary: "database is the one target named default. Use targets for more than one." }
-    });
-  }
-  const entries = [];
-  if (config.database !== undefined)
-    entries.push(["default", config.database]);
-  if (config.targets !== undefined) {
-    for (const name of Object.keys(config.targets).sort()) {
-      const input = config.targets[name];
-      if (input !== undefined)
-        entries.push([name, input]);
-    }
-  }
-  return entries.map(([name, input]) => resolveTarget(name, input));
-}
-function selectTarget(config, name) {
-  const targets = listTargets(config);
-  if (targets.length === 0) {
-    throw new OkmError2("OKM1845", "No target is configured.", {
-      fix: { summary: "Set database or targets in okmodel.config.ts." }
-    });
-  }
-  if (name === undefined) {
-    if (targets.length === 1) {
-      const only = targets[0];
-      if (only !== undefined)
-        return only;
-    }
-    throw new OkmError2("OKM1853", "Several targets are configured and --target was not passed.", {
-      fix: { summary: "Pass --target <name>. The command does not guess." }
-    });
-  }
-  const found = targets.find((target) => target.name === name);
-  if (found === undefined) {
-    throw new OkmError2("OKM1845", `Target ${name} is not configured.`, {
-      fix: { summary: "Pass a name from targets, or database for the target named default." }
-    });
-  }
-  return found;
-}
-function resolveTarget(name, input) {
-  if (typeof input !== "string" && isReplicaTarget(input)) {
-    throw new OkmError2("OKM1845", `Target ${name} is a replica. Migrations run on the primary only.`, {
-      fix: {
-        summary: "Set database or targets to the primary URL. A replica is not a migration target."
-      }
-    });
-  }
-  const url = typeof input === "string" ? input : input.url;
-  const protectedTarget = typeof input === "string" ? false : input.protected === true;
-  if (url === undefined || url.length === 0) {
-    throw new OkmError2("OKM1845", `Target ${name} has no url.`, {
-      fix: { summary: "Set the target url. A target is not inferred from the environment." }
-    });
-  }
-  const endpoint = endpointOf(url);
-  return {
-    name,
-    url,
-    protected: protectedTarget,
-    host: endpoint.host,
-    port: endpoint.port,
-    database: endpoint.database
-  };
-}
-function isReplicaTarget(input) {
-  return "primary" in input || "replicas" in input || "weight" in input || "pool" in input;
-}
-function endpointOf(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new OkmError2("OKM1845", "The target URL is not a Postgres URL.", {
-      fix: { summary: "Pass a postgres:// URL for the target." }
-    });
-  }
-  const database = decodeURIComponent(parsed.pathname.replace(/^\//, ""));
-  return {
-    host: parsed.hostname.toLowerCase(),
-    port: parsed.port.length > 0 ? parsed.port : "5432",
-    database
-  };
-}
-
 // src/tooling/migrate/project.ts
-import { existsSync as existsSync2, mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync2, writeFileSync } from "node:fs";
-import { basename, join as join2 } from "node:path";
+import { existsSync as existsSync3, mkdirSync, readdirSync as readdirSync3, readFileSync as readFileSync3, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, join as join3 } from "node:path";
 import { pathToFileURL } from "node:url";
 
 // src/dialects/pg/declarations.ts
@@ -1423,7 +1558,7 @@ function sqlIdentifier(name, casing) {
 }
 
 // src/dialects/pg/emit.ts
-function emitRowTypes(source) {
+function emitRowTypes(source, jsonTypes) {
   const lines = [
     "/**",
     " * Row types emitted from the schema.",
@@ -1441,13 +1576,13 @@ function emitRowTypes(source) {
     inserts.push(`  readonly ${key}: ${name}Insert;`);
     updates.push(`  readonly ${key}: ${name}Update;`);
     lines.push(`export interface ${name} {`);
-    lines.push(fields(item, "row", source));
+    lines.push(fields(item, "row", source, jsonTypes));
     lines.push("}", "");
     lines.push(`export interface ${name}Insert {`);
-    lines.push(fields(item, "insert", source));
+    lines.push(fields(item, "insert", source, jsonTypes));
     lines.push("}", "");
     lines.push(`export interface ${name}Update {`);
-    lines.push(fields(item, "update", source));
+    lines.push(fields(item, "update", source, jsonTypes));
     lines.push("}", "");
   }
   lines.push("export interface Rows {");
@@ -1462,14 +1597,92 @@ function emitRowTypes(source) {
   lines.push(updates.join(`
 `));
   lines.push("}");
-  return `${lines.join(`
+  const body = `${lines.join(`
 `)}
 `;
+  const aliases = [];
+  if (body.includes("jsonb<"))
+    aliases.push("export type jsonb<T> = T;");
+  if (body.includes("json<"))
+    aliases.push("export type json<T> = T;");
+  if (aliases.length === 0)
+    return body;
+  return `${aliases.join(`
+`)}
+
+${body}`;
 }
 function propertyName(name) {
   return /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ? name : JSON.stringify(name);
 }
-function fields(item, kind, source) {
+function jsonColumnTypes(source) {
+  const text = source.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/\/\/[^\n]*/g, " ");
+  const found = new Map;
+  const pattern = /(?:\bt\s*\.\s*)?(jsonb|json)\s*</g;
+  for (const match of text.matchAll(pattern)) {
+    const open = (match.index ?? 0) + match[0].length - 1;
+    const argument = readGeneric(text, open);
+    const field = propertyBefore(text, match.index ?? 0);
+    const table = tableBefore(text, match.index ?? 0);
+    if (argument === undefined || field === undefined || table === undefined)
+      continue;
+    found.set(`${table}.${field}`, argument);
+  }
+  return found;
+}
+function readGeneric(source, open) {
+  if (source[open] !== "<")
+    return;
+  let depth = 0;
+  let quote;
+  for (let index = open;index < source.length; index += 1) {
+    const char = source[index];
+    if (char === undefined)
+      return;
+    if (quote !== undefined) {
+      if (char === "\\") {
+        index += 1;
+        continue;
+      }
+      if (char === quote)
+        quote = undefined;
+      continue;
+    }
+    if (char === "'" || char === '"' || char === "`") {
+      quote = char;
+      continue;
+    }
+    if (char === "<")
+      depth += 1;
+    else if (char === ">") {
+      depth -= 1;
+      if (depth === 0)
+        return source.slice(open + 1, index).trim().replace(/\s+/g, " ");
+    }
+  }
+  return;
+}
+function propertyBefore(source, index) {
+  let cursor = index;
+  while (cursor > 0 && /\s/.test(source[cursor - 1] ?? ""))
+    cursor -= 1;
+  if (source[cursor - 1] !== ":")
+    return;
+  cursor -= 1;
+  while (cursor > 0 && /\s/.test(source[cursor - 1] ?? ""))
+    cursor -= 1;
+  const end = cursor;
+  while (cursor > 0 && /[\w$]/.test(source[cursor - 1] ?? ""))
+    cursor -= 1;
+  const name = source.slice(cursor, end);
+  return /^[$A-Za-z_][\w$]*$/.test(name) ? name : undefined;
+}
+function tableBefore(source, index) {
+  const head = source.slice(0, index);
+  const tables = [...head.matchAll(/table\(\s*["']([^"']+)["']/g)];
+  return tables.at(-1)?.[1];
+}
+function fields(item, kind, source, jsonTypes) {
   const printed = [];
   const options = item.options;
   const entries = Object.entries(item.columns);
@@ -1487,7 +1700,7 @@ function fields(item, kind, source) {
     const state = builder.state;
     if (kind === "row") {
       if (!state.hidden) {
-        printed.push(`  readonly ${field}: ${valueType(state, "required")};`);
+        printed.push(`  readonly ${field}: ${valueType(state, jsonTypes?.get(`${item.name}.${field}`))};`);
       }
       continue;
     }
@@ -1496,7 +1709,8 @@ function fields(item, kind, source) {
       continue;
     }
     const mode = kind === "update" ? "optional" : written;
-    printed.push(`  readonly ${field}: ${valueType(state, mode)};`);
+    const label = valueType(state, jsonTypes?.get(`${item.name}.${field}`));
+    printed.push(mode === "optional" ? `  readonly ${field}?: ${label};` : `  readonly ${field}: ${label};`);
   }
   return printed.join(`
 `);
@@ -1515,8 +1729,8 @@ function updateMode(state) {
     return "omit";
   return "optional";
 }
-function valueType(state, mode) {
-  let label = scalarLabel(state);
+function valueType(state, jsonArg) {
+  let label = scalarLabel(state, jsonArg);
   if (state.dims > 0) {
     for (let rank = 0;rank < state.dims; rank += 1) {
       label = `readonly (${label})[]`;
@@ -1525,12 +1739,9 @@ function valueType(state, mode) {
   if (state.nullable) {
     label += " | null";
   }
-  if (mode === "optional") {
-    label += " | undefined";
-  }
   return label;
 }
-function scalarLabel(state) {
+function scalarLabel(state, jsonArg) {
   if (state.picklist !== undefined) {
     return state.picklist.values.map((value) => JSON.stringify(value)).join(" | ");
   }
@@ -1563,8 +1774,9 @@ function scalarLabel(state) {
     case "bytea":
       return "Uint8Array";
     case "json":
+      return `json<${jsonArg ?? "unknown"}>`;
     case "jsonb":
-      return "unknown";
+      return `jsonb<${jsonArg ?? "unknown"}>`;
     case "timestamptz":
       return "Temporal.Instant";
     case "timestamp":
@@ -1608,17 +1820,34 @@ function baseName(dataType) {
 }
 
 // src/dialects/pg/role/index.ts
+class RoleDeclarationError extends OkmError2 {
+  reason;
+  constructor(reason, message) {
+    super("invalid", message, {
+      kind: "invalid",
+      fix: {
+        summary: reason === "reporting_write" ? "Grant select, or use the application role for writes." : "Give the reporting role its own name."
+      }
+    });
+    this.name = "OkmError";
+    this.reason = reason;
+  }
+}
 var PROVENANCE = { origin: "file", name: "roles" };
 var RELATION = ["SELECT", "INSERT", "UPDATE", "DELETE"];
-var READ2 = ["SELECT"];
+var READ = ["SELECT"];
 var ROUTINE = ["EXECUTE"];
 var SEQUENCE = ["USAGE", "SELECT"];
-function attachRoles(source, input) {
-  return catalog([...source.objects, ...contributeRoles(input, source.objects)]);
+function attachRoles(source, input, exposure) {
+  return catalog([...source.objects, ...contributeRoles(input, source.objects, exposure)]);
 }
-function contributeRoles(input, built) {
+function contributeRoles(input, built, exposure) {
   const migration = requireName(input.migration, "migration");
   const app = requireName(input.app, "app");
+  const reporting = input.reporting === undefined ? undefined : requireName(input.reporting, "reporting");
+  if (reporting !== undefined && (reporting === app || reporting === migration)) {
+    throw new RoleDeclarationError("reporting_distinct", `Role ${reporting} cannot be the reporting role and also migration or app.`);
+  }
   const managed = new Map;
   for (const role of input.managed ?? []) {
     const name = requireName(role.name, "managed role");
@@ -1626,6 +1855,10 @@ function contributeRoles(input, built) {
   }
   const objects = [];
   const names = new Set([migration, app, ...managed.keys()]);
+  if (reporting !== undefined)
+    names.add(reporting);
+  for (const grant of input.columns ?? [])
+    names.add(requireName(grant.role, "column grant role"));
   for (const name of [...names].sort()) {
     const declaration = managed.get(name);
     objects.push(roleObject({
@@ -1640,8 +1873,10 @@ function contributeRoles(input, built) {
   }
   const roleIdentity = (name) => ({ kind: "role", name });
   const namespaces = new Set;
+  const exposed = indexExposure(exposure);
+  const columnGrants = new Map;
   for (const object of built) {
-    if (object.owner === "ignored")
+    if (object.owner === "ignored" || object.owner === "external")
       continue;
     const ref = grantRef(object);
     if (ref === undefined)
@@ -1659,6 +1894,7 @@ function contributeRoles(input, built) {
       }));
     }
   }
+  const relations = built.filter((object) => object.owner !== "ignored" && object.owner !== "external" && (object.kind === "table" || object.kind === "view" || object.kind === "materializedView"));
   const schemas = namespaces.size === 0 ? ["public"] : [...namespaces].sort();
   for (const name of schemas) {
     const namespace = staticNamespace2(name);
@@ -1679,6 +1915,45 @@ function contributeRoles(input, built) {
         }));
       }
     }
+    if (reporting !== undefined) {
+      objects.push(grantObject({
+        role: reporting,
+        object: { kind: "namespace", namespace, name },
+        privilege: "USAGE",
+        provenance: PROVENANCE,
+        dependencies: [roleIdentity(reporting)]
+      }));
+      objects.push(defaultPrivilegeObject({
+        forRole: migration,
+        namespace,
+        objectKind: "table",
+        grantee: reporting,
+        privilege: "SELECT",
+        provenance: PROVENANCE,
+        dependencies: [roleIdentity(migration), roleIdentity(reporting)]
+      }));
+    }
+  }
+  for (const grant of input.columns ?? []) {
+    noteColumnGrant(columnGrants, grant, built, exposed, reporting);
+  }
+  if (reporting !== undefined) {
+    for (const object of relations) {
+      const ref = grantRef(object);
+      if (ref === undefined)
+        continue;
+      noteReportingSelect(columnGrants, objects, reporting, object, ref, exposed, built);
+    }
+  }
+  for (const pending of [...columnGrants.values()].sort((left, right) => left.key < right.key ? -1 : left.key > right.key ? 1 : 0)) {
+    const target = pending.target;
+    objects.push(grantObject({
+      role: pending.role,
+      object: pending.object,
+      privilege: columnPrivilege(pending.privilege, [...pending.columns].sort()),
+      provenance: PROVENANCE,
+      dependencies: [roleIdentity(pending.role), target.identity]
+    }));
   }
   return objects;
 }
@@ -1712,7 +1987,7 @@ function privilegesFor(kind) {
   if (kind === "sequence")
     return SEQUENCE;
   if (kind === "materializedView")
-    return READ2;
+    return READ;
   if (kind === "namespace")
     return [];
   return RELATION;
@@ -1720,6 +1995,137 @@ function privilegesFor(kind) {
 function objectIdentity(object) {
   return object.identity;
 }
+function indexExposure(exposure) {
+  const indexed = new Map;
+  for (const table of exposure ?? [])
+    indexed.set(table.table, table);
+  return indexed;
+}
+function noteReportingSelect(pending, objects, role, target, ref, exposed, built) {
+  const key = columnKey(role, ref, "SELECT");
+  const declared = pending.get(key);
+  if (ref.kind === "view" || ref.kind === "materializedView") {
+    if (declared !== undefined)
+      return;
+    objects.push(selectGrant(role, ref, target));
+    return;
+  }
+  const visible = visibleColumns(ref.name, exposed, built);
+  const hidden = hiddenColumns(ref.name, exposed);
+  if (hidden.size === 0) {
+    pending.delete(key);
+    objects.push(selectGrant(role, ref, target));
+    return;
+  }
+  const columns = new Set(visible);
+  for (const name of declared?.columns ?? [])
+    columns.add(name);
+  if (columns.size === 0) {
+    pending.delete(key);
+    return;
+  }
+  const next = declared ?? openColumnGrant(role, ref, "SELECT", target);
+  next.columns.clear();
+  for (const name of columns)
+    next.columns.add(name);
+  pending.set(key, next);
+}
+function selectGrant(role, ref, target) {
+  return grantObject({
+    role,
+    object: ref,
+    privilege: "SELECT",
+    provenance: PROVENANCE,
+    dependencies: [{ kind: "role", name: role }, target.identity]
+  });
+}
+function noteColumnGrant(pending, grant, built, exposed, reporting) {
+  const role = requireName(grant.role, "column grant role");
+  const target = findRelation(built, grant.on);
+  if (target.owner === "ignored") {
+    throw new OkmError2("invalid", `Column grant on ${grant.on} targets an ignored table.`, {
+      fix: { summary: "Remove the grant, or mark the table external." }
+    });
+  }
+  const ref = grantRef(target);
+  if (ref === undefined) {
+    throw new OkmError2("OKM1020", `Column grant on ${grant.on} is not a table or a view.`, {
+      fix: { summary: "Name a table, view, or materialized view in the schema." }
+    });
+  }
+  for (const privilege of ["select", "update"]) {
+    const names = grant[privilege];
+    if (names === undefined || names.length === 0)
+      continue;
+    if (role === reporting && privilege === "update") {
+      throw new RoleDeclarationError("reporting_write", `Role ${role} is the reporting role and cannot be granted update.`);
+    }
+    const upper = privilege === "select" ? "SELECT" : "UPDATE";
+    const resolved = names.map((name) => resolveColumn(target, built, ref.name, name, exposed));
+    const current = pending.get(columnKey(role, ref, upper)) ?? openColumnGrant(role, ref, upper, target);
+    for (const name of resolved)
+      current.columns.add(name);
+    pending.set(current.key, current);
+  }
+}
+function openColumnGrant(role, object, privilege, target) {
+  return {
+    key: columnKey(role, object, privilege),
+    role,
+    privilege,
+    object,
+    target,
+    columns: new Set
+  };
+}
+function columnKey(role, object, privilege) {
+  const namespace = object.namespace.form === "static" ? object.namespace.name : object.namespace.pattern;
+  return `${role}\x00${object.kind}\x00${namespace}\x00${object.name}\x00${privilege}`;
+}
+function findRelation(built, name) {
+  const found = built.filter((object) => (object.kind === "table" || object.kind === "view" || object.kind === "materializedView") && object.identity.name === name);
+  const target = found[0];
+  if (target === undefined) {
+    throw new OkmError2("OKM1020", `Column grant names ${name}, which is not in the schema.`, {
+      fix: { summary: "Use the SQL name of a table, view, or materialized view." }
+    });
+  }
+  if (found.length > 1) {
+    throw new OkmError2("OKM1020", `Column grant on ${name} matches more than one object.`, {
+      fix: { summary: "Rename one of the objects so the grant names one." }
+    });
+  }
+  return target;
+}
+function resolveColumn(target, built, table, name, exposed) {
+  const known = exposed.get(table);
+  const fromField = known?.columns.find((column) => column.field === name || column.sql === name);
+  if (fromField !== undefined)
+    return fromField.sql;
+  const sqlNames = columnNames(target, built, table);
+  if (sqlNames.includes(name))
+    return name;
+  throw new OkmError2("OKM1020", `Column ${table}.${name} is not in the schema.`, {
+    fix: { summary: "Name a column of that table or view." }
+  });
+}
+function visibleColumns(table, exposed, built) {
+  const known = exposed.get(table);
+  if (known !== undefined) {
+    return known.columns.filter((column) => !column.hidden).map((column) => column.sql);
+  }
+  return built.flatMap((object) => object.kind === "column" && object.identity.parent.name === table ? [object.identity.name] : []);
+}
+function hiddenColumns(table, exposed) {
+  const known = exposed.get(table);
+  return new Set((known?.columns ?? []).filter((column) => column.hidden).map((column) => column.sql));
+}
+function columnNames(target, built, table) {
+  if (target.kind === "view" || target.kind === "materializedView") {
+    return target.definition.columns.map((column) => column.name);
+  }
+  return built.flatMap((object) => object.kind === "column" && object.identity.parent.name === table ? [object.identity.name] : []);
+}
 
 // src/tooling/migrate/estimate.ts
 var LARGE_TABLE_ROWS = 1e6;
@@ -1759,31 +2165,49 @@ async function readRowEstimates(url, schema, tables) {
       return map;
     } catch (error) {
       if (began)
-        await connection.execute("rollback").catch(() => {
-          return;
-        });
-      throw error;
+        await finishQuiet(() => connection.execute("rollback"));
+      throw sessionFailure(error) ?? error;
     } finally {
-      await connection.release();
+      await finishQuiet(() => connection.release());
     }
   } finally {
-    await pool.close();
+    await finishQuiet(() => pool.close());
   }
 }
-function annotateLock(step, estimates) {
+function annotateLock(step, estimates, aliases = new Map) {
   const pieces = lockPieces(step);
   const text = withBatches(step, pieces.map((piece) => {
     if (piece.table === undefined)
       return piece.mode;
-    return `${piece.mode} on ${piece.table}, ${estimatePhrase(estimates.get(piece.table))}`;
-  }).join("; "), estimates);
+    return `${piece.mode} on ${piece.table}, ${estimatePhrase(lookupEstimate(piece.table, estimates, aliases))}`;
+  }).join("; "), estimates, aliases);
   if (step.safeRewrite === true)
     return `${text}; safe rewrite applied`;
-  if (exclusiveOverLarge(pieces, estimates)) {
+  if (exclusiveOverLarge(pieces, estimates, aliases)) {
     return `${text}; note: more than ${String(LARGE_TABLE_ROWS)} estimated rows`;
   }
   return text;
 }
+function renameAliases(steps) {
+  const map = new Map;
+  for (const step of steps) {
+    if (step.kind !== "rename-table")
+      continue;
+    const match = /^alter table "(?:(?:[^"]|"")*)"\."((?:[^"]|"")*)" rename to "((?:[^"]|"")*)"/.exec(step.sql);
+    const from = match?.[1]?.replaceAll('""', '"');
+    const to = match?.[2]?.replaceAll('""', '"');
+    if (from !== undefined && to !== undefined)
+      map.set(to, from);
+  }
+  return map;
+}
+function lookupEstimate(table, estimates, aliases) {
+  const direct = estimates.get(table);
+  if (direct !== undefined)
+    return direct;
+  const previous = aliases.get(table);
+  return previous === undefined ? undefined : estimates.get(previous);
+}
 function aboutRows(count) {
   const rounded = Math.max(0, Math.round(count));
   if (rounded < 1000)
@@ -1803,12 +2227,12 @@ function aboutRows(count) {
   }
   return `about ${String(rounded)} rows`;
 }
-function withBatches(step, text, estimates) {
+function withBatches(step, text, estimates, aliases = new Map) {
   const batch = step.backfill?.batch;
   if (batch === undefined)
     return text;
   const name = step.tables?.[0];
-  const estimate = name === undefined ? undefined : estimates.get(name);
+  const estimate = name === undefined ? undefined : lookupEstimate(name, estimates, aliases);
   if (estimate === undefined || estimate.kind !== "rows")
     return text;
   return `${text}, about ${String(aboutBatchCount(estimate.reltuples, batch))} batches`;
@@ -1870,11 +2294,11 @@ function lockPieces(step) {
   }
   return pieces;
 }
-function exclusiveOverLarge(pieces, estimates) {
+function exclusiveOverLarge(pieces, estimates, aliases = new Map) {
   for (const piece of pieces) {
     if (piece.mode !== "ACCESS EXCLUSIVE" || piece.table === undefined)
       continue;
-    const estimate = estimates.get(piece.table);
+    const estimate = lookupEstimate(piece.table, estimates, aliases);
     if (estimate === undefined || estimate.kind !== "rows")
       continue;
     if (estimate.reltuples > LARGE_TABLE_ROWS)
@@ -1904,15 +2328,17 @@ async function buildProject(cwd) {
 }
 async function generateProject(cwd, name, flags) {
   const prepared = await prepare(cwd, name, flags);
+  if (name === "init")
+    writeGitAttributes(cwd);
   writeArtifact(cwd, prepared.config, prepared.built);
   if (prepared.plan.steps.length === 0)
     return;
-  const directory = join2(cwd, prepared.config.migrations ?? "migrations");
+  const directory = projectPath(cwd, prepared.config.migrations ?? "migrations");
   mkdirSync(directory, { recursive: true });
   const base = `${nextNumber(directory)}_${safeName(name)}`;
-  const sqlPath = join2(directory, `${base}.sql`);
+  const sqlPath = join3(directory, `${base}.sql`);
   writeFileSync(sqlPath, formatPlan(prepared.plan));
-  writeFileSync(join2(directory, `${base}.catalog.json`), serializeCatalog2(prepared.built.catalog));
+  writeFileSync(join3(directory, `${base}.catalog.json`), serializeCatalog2(prepared.built.catalog));
   return { path: sqlPath, findings: lintPrepared(prepared) };
 }
 async function planProject(cwd, name, flags, invoke) {
@@ -1935,9 +2361,9 @@ async function checkProject(cwd, flags) {
   const targets = listTargets(opened.config);
   assertTargetAlias(targets);
   if (opened.config.tables !== undefined) {
-    const directory = join2(cwd, opened.config.tables);
-    const files = existsSync2(directory) ? readdirSync2(directory) : [];
-    const source = readFileSync2(join2(cwd, opened.config.schema), "utf8");
+    const directory = projectPath(cwd, opened.config.tables);
+    const files = existsSync3(directory) ? readdirSync3(directory) : [];
+    const source = readFileSync3(projectPath(cwd, opened.config.schema), "utf8");
     const missing = unlistedTableFiles(source, files);
     if (missing.length > 0) {
       throw new OkmError2("OKM1024", `Table file not in schema: ${missing.join(", ")}.`, {
@@ -1956,8 +2382,9 @@ async function checkProject(cwd, flags) {
   const target = selectTarget(opened.config, named);
   assertTargetPolicy(target, "check", flags?.allowProtected ?? false);
   assertTargetPolicy(target, "drift", flags?.allowProtected ?? false);
-  const { assertAuthorDrift } = await import("./ykv7wh5b.js");
-  await assertAuthorDrift(target.url, opened.built.catalog, opened.config.roles);
+  const { assertAuthorDrift } = await import("./1f0xa3cb.js");
+  const allowPooler = flags?.allowPooler === true || opened.config.allowPooler === true;
+  await assertAuthorDrift(target.url, opened.built.catalog, opened.config.roles, allowPooler);
   return findings;
 }
 function unlistedTableFiles(schemaSource, fileNames) {
@@ -2016,7 +2443,8 @@ async function displayPlan(config, plan, invoke) {
   } catch {
     return offline;
   }
-  return formatPlan(plan, (step) => annotateLock(step, estimates));
+  const aliases = renameAliases(plan.steps);
+  return formatPlan(plan, (step) => annotateLock(step, estimates, aliases));
 }
 function lintOpened(opened) {
   const plan = planMigration({
@@ -2035,7 +2463,7 @@ async function openProject(cwd) {
   const config = await loadConfig(cwd);
   const built = withRoles(await loadSchema(cwd, config.schema), config);
   const declarations = schemaDeclarations(built);
-  const previous = readPrevious(join2(cwd, config.migrations ?? "migrations"));
+  const previous = readPrevious(projectPath(cwd, config.migrations ?? "migrations"));
   const stale = staleRenames(previous?.catalog, declarations.renames);
   if (stale.length > 0) {
     throw new OkmError2("OKM1020", stale.join(" "), {
@@ -2050,25 +2478,108 @@ async function openProject(cwd) {
   };
 }
 function withRoles(built, config) {
-  if (config.roles === undefined)
+  const marks = ownershipMarks(built);
+  const stamped = marks.size === 0 ? built.catalog : stampOwnership(built.catalog, marks);
+  const roles = config.roles;
+  const catalog = roles === undefined ? stamped : attachRoles(stamped, roles, exposureFor(built, roles));
+  if (catalog === built.catalog)
     return built;
-  return { ...built, catalog: attachRoles(built.catalog, config.roles) };
+  return { ...built, catalog };
+}
+function ownershipMarks(built) {
+  const marks = new Map;
+  const models = built.model;
+  for (const table of built.tables) {
+    const owner = tableOwner(table);
+    if (owner === undefined)
+      continue;
+    const model = models[table.name];
+    if (model === undefined)
+      continue;
+    marks.set(model.sql, owner);
+  }
+  return marks;
+}
+function exposureFor(built, roles) {
+  if (roles.reporting === undefined && (roles.columns === undefined || roles.columns.length === 0)) {
+    return;
+  }
+  return Object.values(built.model).map((model) => ({
+    table: model.sql,
+    columns: model.columns.map((column) => ({
+      field: column.field,
+      sql: column.sql,
+      hidden: column.hidden === true || column.hidden === "filter"
+    }))
+  }));
+}
+var GIT_ATTRIBUTES = [
+  "migrations/*.sql text eol=lf",
+  "*.catalog.json text eol=lf",
+  ".okm/** text eol=lf",
+  ""
+].join(`
+`);
+function writeGitAttributes(cwd) {
+  const path = projectPath(cwd, ".gitattributes");
+  if (existsSync3(path))
+    return;
+  writeFileSync(path, GIT_ATTRIBUTES);
+}
+function typesText(cwd, spec, built) {
+  return `${emitRowTypes(built, jsonColumnTypes(readSchemaSource(cwd, spec)))}${referenceAugmentation(built)}`;
+}
+function readSchemaSource(cwd, spec) {
+  const parts = [];
+  const seen = new Set;
+  const visit = (file) => {
+    if (seen.has(file) || !existsSync3(file))
+      return;
+    let stat;
+    try {
+      stat = statSync(file);
+    } catch {
+      return;
+    }
+    if (!stat.isFile())
+      return;
+    seen.add(file);
+    const text = readFileSync3(file, "utf8");
+    parts.push(text);
+    for (const match of text.matchAll(/from\s+["'](\.[^"']+)["']/g)) {
+      const rel = match[1];
+      if (rel === undefined)
+        continue;
+      const base = join3(dirname(file), rel);
+      const candidates = [base, `${base}.ts`, `${base}.tsx`, `${base}.mts`, join3(base, "index.ts")];
+      for (const candidate of candidates) {
+        if (existsSync3(candidate)) {
+          visit(candidate);
+          break;
+        }
+      }
+    }
+  };
+  visit(projectPath(cwd, spec));
+  return parts.join(`
+`);
 }
 function writeArtifact(cwd, config, built) {
-  const directory = join2(cwd, config.out ?? ".okm");
+  const directory = projectPath(cwd, config.out ?? ".okm");
   mkdirSync(directory, { recursive: true });
   const startup = startupCatalog2(built.catalog);
-  writeFileSync(join2(directory, "catalog.json"), serializeCatalog2(startup));
-  writeFileSync(join2(directory, "catalog.hash"), `${catalogHash2(startup)}
+  const text = catalogFileText2(serializeCatalog2(startup));
+  writeFileSync(join3(directory, "catalog.json"), text);
+  writeFileSync(join3(directory, "catalog.hash"), `${sha2562(text)}
 `);
-  writeFileSync(join2(directory, "types.d.ts"), `${emitRowTypes(built)}${referenceAugmentation(built)}`);
+  writeFileSync(join3(directory, "types.d.ts"), typesText(cwd, config.schema, built));
   return directory;
 }
 async function loadBuiltSchema(cwd, config) {
   return withRoles(await loadSchema(cwd, config.schema), config);
 }
 async function loadConfig(cwd) {
-  const path = join2(cwd, "okmodel.config.ts");
+  const path = projectPath(cwd, "okmodel.config.ts");
   const imported = await import(`${pathToFileURL(path).href}?okm=${Date.now()}`);
   const record = isRecord(imported) ? imported : {};
   const config = record.default ?? record.config;
@@ -2078,7 +2589,7 @@ async function loadConfig(cwd) {
   return config;
 }
 async function loadSchema(cwd, spec) {
-  const path = join2(cwd, spec);
+  const path = projectPath(cwd, spec);
   const imported = await import(`${pathToFileURL(path).href}?okm=${Date.now()}`);
   const record = isRecord(imported) ? imported : {};
   for (const value of Object.values(record)) {
@@ -2090,13 +2601,13 @@ async function loadSchema(cwd, spec) {
   throw new OkmError2("invalid", `${spec} must export a schema().`);
 }
 function readPrevious(directory) {
-  if (!existsSync2(directory))
+  if (!existsSync3(directory))
     return;
-  const catalogs = readdirSync2(directory).filter((file) => file.endsWith(".catalog.json")).sort();
+  const catalogs = readdirSync3(directory).filter((file) => file.endsWith(".catalog.json")).sort();
   const latest = catalogs.at(-1);
   if (latest === undefined)
     return;
-  const text = readFileSync2(join2(directory, latest), "utf8");
+  const text = readFileSync3(join3(directory, latest), "utf8");
   return { catalog: parseCatalog2(text) };
 }
 function referenceAugmentation(source) {
@@ -2121,8 +2632,8 @@ function referenceAugmentation(source) {
 }
 function nextNumber(directory) {
   let max = 0;
-  if (existsSync2(directory)) {
-    for (const file of readdirSync2(directory)) {
+  if (existsSync3(directory)) {
+    for (const file of readdirSync3(directory)) {
       const match = /^(\d+)_/.exec(file);
       const value = match?.[1];
       if (value !== undefined)
@@ -2163,14 +2674,14 @@ function projectImportsValidate(cwd) {
 function directoryImportsValidate(dir) {
   let entries;
   try {
-    entries = readdirSync2(dir, { withFileTypes: true });
+    entries = readdirSync3(dir, { withFileTypes: true });
   } catch {
     return false;
   }
   for (const entry of entries) {
     if (entry.name.startsWith(".") || SKIP_SCAN.has(entry.name))
       continue;
-    const path = join2(dir, entry.name);
+    const path = join3(dir, entry.name);
     if (entry.isDirectory()) {
       if (directoryImportsValidate(path))
         return true;
@@ -2178,7 +2689,7 @@ function directoryImportsValidate(dir) {
     }
     if (!/\.(?:ts|tsx|mts|cts)$/.test(entry.name))
       continue;
-    if (runtimeImportsValidate(readFileSync2(path, "utf8")))
+    if (runtimeImportsValidate(readFileSync3(path, "utf8")))
       return true;
   }
   return false;
@@ -2200,4 +2711,4 @@ function runtimeImportsValidate(source) {
   return false;
 }
 
-export { errorDoc, lintMigrationDirectory, formatFindings, hasError, lintRefusal, assertTargetPolicy, assertDirectConnection, listTargets, selectTarget, buildProject, generateProject, planProject, checkProject, projectHead, openProject, loadBuiltSchema, loadConfig, loadSchema };
+export { projectPath, errorDoc, loadMigrations, readMigrationPlan, loadHeadSnapshot, lintMigrationDirectory, formatFindings, hasError, lintRefusal, buildProject, generateProject, planProject, checkProject, projectHead, openProject, loadBuiltSchema, loadConfig, loadSchema };