okmodel 0.5.0 → 0.6.0

package/dist/shared/{ayz64vzj.js → ttmg09vd.js}

@@ -2,29 +2,35 @@ import {
   creationOrder2,
   renameColumn2,
   renameTable2
-} from "./8bwbwy8h.js";
+} from "./qq3899ht.js";
+import {
+  isConnectionLost
+} from "./gwn6v667.js";
 import {
   quoteIdent,
+  uniqueBeforeForeignKey,
   ownedByView,
   dropObjectSql,
   createObjectSql,
   functionSql,
   viewSql,
+  policyCreatePlan,
+  policyDropPlan,
   refreshMaterializedViewSql,
   alterColumnSql,
   identitySequence,
   createTableSql,
   qualify
-} from "./8xsbagad.js";
+} from "./9s0ypp87.js";
 import {
   isExactVersion,
   compareExtensionVersions,
   sameExtensionDefinition
-} from "./8ktwd3rh.js";
+} from "./r3j8s5y0.js";
 import {
   isDomain,
   sameEnumLabels
-} from "./g7ez901n.js";
+} from "./ywspezzx.js";
 import {
   quoteLiteral
 } from "./94ez8kzh.js";
@@ -33,7 +39,7 @@ import {
   identityKey2,
   identityLabel2,
   compareText
-} from "./t4tbsy9h.js";
+} from "./358zsv4r.js";
 import {
   fitIdentifier2
 } from "./nfzc5z0w.js";
@@ -41,6 +47,332 @@ import {
   OkmError2
 } from "./52szzakm.js";
 
+// src/tooling/migrate/sql-lex.ts
+function sqlStatements(sql) {
+  return scan(sql).statements;
+}
+function sqlQuoteOpen(sql) {
+  return scan(sql).open;
+}
+function scan(sql) {
+  const statements = [];
+  const parts = [];
+  let index = 0;
+  let open = false;
+  let atomic = 0;
+  const flush = () => {
+    const text = parts.join("").trim();
+    parts.length = 0;
+    if (text.length > 0)
+      statements.push(text);
+  };
+  while (index < sql.length) {
+    if (sql.startsWith("--", index)) {
+      parts.push(" ");
+      index = lineCommentEnd(sql, index + 2);
+      continue;
+    }
+    if (sql.startsWith("/*", index)) {
+      parts.push(" ");
+      const block = blockComment(sql, index + 2);
+      index = block.index;
+      if (block.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    const dollar = dollarAt(sql, index);
+    if (dollar !== undefined) {
+      const closed = takeDollar(sql, dollar);
+      parts.push(sql.slice(index, closed.index));
+      index = closed.index;
+      if (closed.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    if (isEscapeString(sql, index)) {
+      const quote = takeQuoted(sql, index + 2, true);
+      parts.push(sql.slice(index, quote.index));
+      index = quote.index;
+      if (quote.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    const char = sql[index];
+    if (char === "'") {
+      const quote = takeQuoted(sql, index + 1, false);
+      parts.push(sql.slice(index, quote.index));
+      index = quote.index;
+      if (quote.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    if (char === '"') {
+      const quote = takeIdent(sql, index + 1);
+      parts.push(sql.slice(index, quote.index));
+      index = quote.index;
+      if (quote.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    if (char === ";") {
+      if (atomic === 0)
+        flush();
+      else
+        parts.push(";");
+      index += 1;
+      continue;
+    }
+    if (isIdentStart(sql.charCodeAt(index))) {
+      const word = readWord(sql, index);
+      const lower = word.toLowerCase();
+      if (atomic > 0 && lower === "case")
+        atomic += 1;
+      else if (atomic > 0 && lower === "end")
+        atomic -= 1;
+      else if (lower === "begin" && nextWordIs(sql, index + word.length, "atomic")) {
+        if (atomic > 0 || isRoutineHead(parts.join("")))
+          atomic += 1;
+      }
+      parts.push(word);
+      index += word.length;
+      continue;
+    }
+    parts.push(char ?? "");
+    index += 1;
+  }
+  flush();
+  return { statements, open: open || atomic > 0 };
+}
+function transactionControl(sql) {
+  for (const statement of sqlStatements(sql)) {
+    const top = controlWord(statement, false);
+    if (top !== undefined)
+      return top;
+    if (!isDo(statement))
+      continue;
+    for (const body of dollarBodies(statement)) {
+      for (const inner of sqlStatements(body)) {
+        const hit = controlWord(inner, true);
+        if (hit !== undefined)
+          return hit;
+      }
+    }
+  }
+  return;
+}
+function isDo(statement) {
+  return /^do(?:\s|$)/i.test(statement.trim());
+}
+function controlWord(statement, insideBody) {
+  let text = statement.trim().replace(/\s+/g, " ").toLowerCase();
+  if (insideBody && /^begin(?:\s|$)/.test(text) && !/^begin\s+(?:work|transaction)\b/.test(text)) {
+    text = text.replace(/^begin\s+/, "").trim();
+    if (text.length === 0)
+      return;
+  }
+  if (/^commit(?:\s+(?:work|transaction|prepared\b.*))?$/.test(text))
+    return "commit";
+  if (text === "abort")
+    return "abort";
+  if (/^rollback(?:\s+(?:work|transaction|prepared\b.*))?$/.test(text))
+    return "rollback";
+  if (/^prepare\s+transaction\b/.test(text))
+    return "prepare transaction";
+  if (/^start\s+transaction\b/.test(text))
+    return "start transaction";
+  if (/^begin(?:\s+(?:work|transaction)\b.*)?$/.test(text) || /^begin\s+\S/.test(text)) {
+    if (insideBody && !/^begin\s+(?:work|transaction)\b/.test(text))
+      return;
+    return "begin";
+  }
+  if (/^end(?:\s+(?:work|transaction))?$/.test(text)) {
+    if (insideBody && text === "end")
+      return;
+    return "end";
+  }
+  return;
+}
+function dollarBodies(sql) {
+  const bodies = [];
+  let index = 0;
+  while (index < sql.length) {
+    if (sql.startsWith("--", index)) {
+      index = lineCommentEnd(sql, index + 2);
+      continue;
+    }
+    if (sql.startsWith("/*", index)) {
+      index = blockComment(sql, index + 2).index;
+      continue;
+    }
+    if (isEscapeString(sql, index)) {
+      index = takeQuoted(sql, index + 2, true).index;
+      continue;
+    }
+    if (sql[index] === "'") {
+      index = takeQuoted(sql, index + 1, false).index;
+      continue;
+    }
+    if (sql[index] === '"') {
+      index = takeIdent(sql, index + 1).index;
+      continue;
+    }
+    const dollar = dollarAt(sql, index);
+    if (dollar !== undefined) {
+      const closed = takeDollar(sql, dollar);
+      if (!closed.open) {
+        const closer = `$${dollar.tag}$`.length;
+        bodies.push(sql.slice(dollar.end, closed.index - closer));
+      }
+      index = closed.index;
+      continue;
+    }
+    index += 1;
+  }
+  return bodies;
+}
+function readWord(sql, index) {
+  let cursor = index + 1;
+  while (isIdentCont(sql.charCodeAt(cursor)))
+    cursor += 1;
+  return sql.slice(index, cursor);
+}
+function nextWordIs(sql, index, expected) {
+  const at = skipTrivia(sql, index);
+  if (!isIdentStart(sql.charCodeAt(at)))
+    return false;
+  return readWord(sql, at).toLowerCase() === expected;
+}
+function skipTrivia(sql, index) {
+  while (index < sql.length) {
+    const code = sql.charCodeAt(index);
+    if (code === 32 || code === 9 || code === 10 || code === 13) {
+      index += 1;
+      continue;
+    }
+    if (sql.startsWith("--", index)) {
+      index = lineCommentEnd(sql, index + 2);
+      continue;
+    }
+    if (sql.startsWith("/*", index)) {
+      const block = blockComment(sql, index + 2);
+      if (block.open)
+        return sql.length;
+      index = block.index;
+      continue;
+    }
+    return index;
+  }
+  return index;
+}
+function isRoutineHead(text) {
+  return /^create(?:\s+or\s+replace)?\s+(?:function|procedure)\b/i.test(text.replace(/\s+/g, " ").trim());
+}
+function lineCommentEnd(sql, index) {
+  while (index < sql.length && sql.charCodeAt(index) !== 10)
+    index += 1;
+  return index;
+}
+function blockComment(sql, index) {
+  let depth = 1;
+  while (index < sql.length) {
+    if (sql.startsWith("/*", index)) {
+      depth += 1;
+      index += 2;
+      continue;
+    }
+    if (sql.startsWith("*/", index)) {
+      depth -= 1;
+      index += 2;
+      if (depth === 0)
+        return { index, open: false };
+      continue;
+    }
+    index += 1;
+  }
+  return { index, open: true };
+}
+function dollarAt(sql, index) {
+  if (sql.charCodeAt(index) !== 36)
+    return;
+  const next = index + 1;
+  if (sql.charCodeAt(next) === 36)
+    return { tag: "", end: next + 1 };
+  if (!isIdentStart(sql.charCodeAt(next)))
+    return;
+  let cursor = next + 1;
+  while (isIdentCont(sql.charCodeAt(cursor)))
+    cursor += 1;
+  if (sql.charCodeAt(cursor) !== 36)
+    return;
+  return { tag: sql.slice(next, cursor), end: cursor + 1 };
+}
+function takeDollar(sql, dollar) {
+  const closer = `$${dollar.tag}$`;
+  const found = sql.indexOf(closer, dollar.end);
+  if (found === -1)
+    return { index: sql.length, open: true };
+  return { index: found + closer.length, open: false };
+}
+function takeQuoted(sql, index, escape) {
+  while (index < sql.length) {
+    const char = sql[index];
+    if (escape && char === "\\") {
+      if (index + 1 >= sql.length)
+        return { index: sql.length, open: true };
+      index += 2;
+      continue;
+    }
+    if (char === "'") {
+      if (sql[index + 1] === "'") {
+        index += 2;
+        continue;
+      }
+      return { index: index + 1, open: false };
+    }
+    index += 1;
+  }
+  return { index, open: true };
+}
+function takeIdent(sql, index) {
+  while (index < sql.length) {
+    if (sql[index] === '"') {
+      if (sql[index + 1] === '"') {
+        index += 2;
+        continue;
+      }
+      return { index: index + 1, open: false };
+    }
+    index += 1;
+  }
+  return { index, open: true };
+}
+function isEscapeString(sql, index) {
+  const code = sql.charCodeAt(index);
+  if (code !== 69 && code !== 101)
+    return false;
+  if (sql.charCodeAt(index + 1) !== 39)
+    return false;
+  if (index > 0 && isIdentCont(sql.charCodeAt(index - 1)))
+    return false;
+  return true;
+}
+function isIdentStart(code) {
+  return code >= 65 && code <= 90 || code >= 97 && code <= 122 || code === 95;
+}
+function isIdentCont(code) {
+  return isIdentStart(code) || code >= 48 && code <= 57;
+}
+
 // src/tooling/migrate/type-name.ts
 function canonicalTypeName(typeName) {
   const suffix = arraySuffix(typeName);
@@ -108,6 +440,10 @@ function canonicalTime(name, precision) {
 
 // src/dialects/pg/role/sql.ts
 var PRIVILEGE = /^(select|insert|update|delete|execute|usage)$/;
+var COLUMN_PRIVILEGE = /^(select|update)\(([^)]*)\)$/i;
+function columnPrivilege(name, columns) {
+  return `${name.toUpperCase()}(${[...columns].sort().join(",")})`;
+}
 function privilegeSql(before, after, schema, recreated = new Set) {
   const beforeBy = index(before);
   const afterBy = index(after);
@@ -145,7 +481,13 @@ function privilegeSql(before, after, schema, recreated = new Set) {
       const target = grantTargetKey(object.identity.object);
       if (previous !== undefined && (target === undefined || !recreated.has(target)))
         continue;
+      const tighten = tightenColumnSelect(object, after, schema);
+      if (tighten !== undefined)
+        grant.push(tighten);
       grant.push({ sql: grantStatement(object, schema, false), kind: "grant" });
+      const writes = revokeMatviewWrites(object, after, schema);
+      if (writes !== undefined)
+        grant.push(writes);
       continue;
     }
     if (previous !== undefined)
@@ -191,12 +533,48 @@ function login(object) {
 function inherit(object) {
   return object.definition.inherit ? "inherit" : "noinherit";
 }
+function tightenColumnSelect(object, after, schema) {
+  if (!/^select\([^)]*\)$/.test(object.identity.privilege.toLowerCase()))
+    return;
+  const target = object.identity.object;
+  const covered = after.some((item) => item.kind === "grant" && item.identity.role === object.identity.role && item.identity.privilege.toUpperCase() === "SELECT" && item.identity.object.kind === target.kind && item.identity.object.name === target.name);
+  if (covered)
+    return;
+  return {
+    sql: `revoke select on ${grantTarget(target, schema)} from ${quoteIdent(object.identity.role)}`,
+    kind: "revoke"
+  };
+}
+function revokeMatviewWrites(object, after, schema) {
+  if (object.identity.privilege.toUpperCase() !== "SELECT")
+    return;
+  const target = object.identity.object;
+  if (target.kind !== "materializedView")
+    return;
+  const inheritsWrites = after.some((item) => item.kind === "defaultPrivilege" && item.identity.grantee === object.identity.role && item.identity.objectKind === "table" && (item.identity.privilege === "INSERT" || item.identity.privilege === "UPDATE" || item.identity.privilege === "DELETE"));
+  if (!inheritsWrites)
+    return;
+  return {
+    sql: `revoke insert, update, delete on ${grantTarget(target, schema)} from ${quoteIdent(object.identity.role)}`,
+    kind: "revoke"
+  };
+}
 function grantStatement(object, schema, revoke) {
-  const privilege = object.identity.privilege.toLowerCase();
-  assertPrivilege(privilege);
+  const privilege = object.identity.privilege;
+  const column = COLUMN_PRIVILEGE.exec(privilege);
   const verb = revoke ? "revoke" : "grant";
   const direction = revoke ? "from" : "to";
-  return `${verb} ${privilege} on ${grantTarget(object.identity.object, schema)} ${direction} ${quoteIdent(object.identity.role)}`;
+  const target = grantTarget(object.identity.object, schema);
+  const role = quoteIdent(object.identity.role);
+  const listed = column?.[2];
+  const base = column?.[1];
+  if (listed !== undefined && base !== undefined) {
+    const names = listed.split(",").filter((name) => name.length > 0).map((name) => quoteIdent(name)).join(", ");
+    return `${verb} ${base.toLowerCase()} (${names}) on ${target} ${direction} ${role}`;
+  }
+  const keyword = privilege.toLowerCase();
+  assertPrivilege(keyword);
+  return `${verb} ${keyword} on ${target} ${direction} ${role}`;
 }
 function defaultStatement(object, schema, revoke) {
   const privilege = object.identity.privilege.toLowerCase();
@@ -229,7 +607,7 @@ function grantTarget(object, schema) {
   if (object.kind === "function")
     return functionTarget(object.name, schema);
   if (object.kind === "namespace")
-    return `schema ${quoteIdent(object.name)}`;
+    return `schema ${quoteIdent(schema)}`;
   return `table ${qualify(schema, object.name)}`;
 }
 function functionTarget(name, schema) {
@@ -481,6 +859,10 @@ var STEP_CLASS = {
   "rename-sequence": "contract",
   "backfill-expand": "expand",
   "backfill-contract": "contract",
+  "enable-rls": "expand",
+  "create-policy": "expand",
+  "drop-policy": "contract",
+  "disable-rls": "contract",
   "raw-sql": "unclassified"
 };
 var STEP_KINDS = Object.keys(STEP_CLASS);
@@ -690,6 +1072,43 @@ function managedSequence(name) {
   return name === "okm_meta" || name === "okm_history" || name === "okm_backfill" || name.startsWith("okm_meta_") || name.startsWith("okm_history_") || name.startsWith("okm_backfill_");
 }
 
+// src/tooling/migrate/text.ts
+var FIX = {
+  "no-steps": "Add -- no steps when the migration is intentionally empty. Otherwise the file needs a statement okm can read.",
+  utf16: "Save the file as UTF-8. okm does not read UTF-16."
+};
+
+class MigrationTextError extends OkmError2 {
+  reason;
+  constructor(reason, message) {
+    super("invalid", message, {
+      kind: "invalid",
+      fieldReason: reason,
+      fix: { summary: FIX[reason] }
+    });
+    this.name = "OkmError";
+    this.reason = reason;
+  }
+}
+function prepareMigrationText(text, label = "Migration SQL") {
+  if (text.includes("\x00")) {
+    throw new MigrationTextError("utf16", `${label} is UTF-16. Save the file as UTF-8.`);
+  }
+  const withoutBom = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+  return withoutBom.replaceAll(`\r
+`, `
+`).replaceAll("\r", `
+`);
+}
+function assertMigrationSteps(text, stepCount, label) {
+  if (stepCount > 0 || text.trim().length === 0)
+    return;
+  if (text.split(`
+`).includes("-- no steps"))
+    return;
+  throw new MigrationTextError("no-steps", `${label} has text but no steps. okm did not apply it.`);
+}
+
 // src/tooling/migrate/safe.ts
 var ACCESS = "ACCESS EXCLUSIVE";
 var SHARE_UPDATE = "SHARE UPDATE EXCLUSIVE";
@@ -1047,17 +1466,24 @@ function planMigration(input) {
     if (!afterBy.has(item.key)) {
       if (item.object.kind === "role")
         continue;
+      if (handsOff(item.object) || childOfHandsOff(item.object, afterBy))
+        continue;
       dropKeys.add(item.key);
     }
   }
   for (const item of afterList) {
-    if (!beforeBy.has(item.key))
+    if (!beforeBy.has(item.key)) {
+      if (handsOff(item.object) || childOfHandsOff(item.object, afterBy))
+        continue;
       createKeys.add(item.key);
+    }
   }
   for (const item of afterList) {
     const previous = beforeBy.get(item.key);
     if (previous === undefined || sameDefinition(previous, item.object))
       continue;
+    if (handsOff(item.object) || childOfHandsOff(item.object, afterBy))
+      continue;
     if (previous.kind === "extension" && item.object.kind === "extension")
       continue;
     if (previous.kind === "role" && item.object.kind === "role")
@@ -1093,6 +1519,8 @@ function planMigration(input) {
   refuseRoutineDrops(beforeBy, afterBy, dropKeys);
   omitOwnedSequences(createKeys, afterBy, request.after);
   omitOwnedSequences(dropKeys, beforeBy, renamed);
+  releaseHandsOff(dropKeys, beforeBy, afterBy);
+  releaseHandsOff(createKeys, afterBy, afterBy);
   const recreated = new Set;
   for (const key of createKeys) {
     if (dropKeys.has(key))
@@ -1111,7 +1539,7 @@ function planMigration(input) {
   const deferred = new Set(picklists.map((change) => identityKey2(change.before.identity)));
   const typeDrops = [];
   const extensionDrops = [];
-  const reverse = [...creationOrder2(renamed)].reverse();
+  const reverse = [...uniqueBeforeForeignKey(creationOrder2(renamed))].reverse();
   const emitDrop = (object) => {
     const key = identityKey2(object.identity);
     if (!dropKeys.has(key) || deferred.has(key) || covered(object, droppedTables))
@@ -1145,7 +1573,17 @@ function planMigration(input) {
       emitDrop(object);
   }
   for (const object of reverse) {
-    if (object.kind === "trigger" || object.kind === "function" || object.kind === "view" || object.kind === "materializedView" || ownedByView(object)) {
+    if (object.kind !== "policy")
+      continue;
+    const key = identityKey2(object.identity);
+    if (!dropKeys.has(key) || deferred.has(key))
+      continue;
+    for (const item of policyDropPlan(object, schema)) {
+      steps.push(step(item.sql, item.kind, "ddl", ACCESS2, true, [object.identity.parent.name]));
+    }
+  }
+  for (const object of reverse) {
+    if (object.kind === "trigger" || object.kind === "function" || object.kind === "view" || object.kind === "materializedView" || object.kind === "policy" || ownedByView(object)) {
       continue;
     }
     const key = identityKey2(object.identity);
@@ -1217,8 +1655,8 @@ function planMigration(input) {
       continue;
     steps.push(step(sql, kind, "ddl", ACCESS2));
   }
-  for (const object of creationOrder2(request.after)) {
-    if (object.kind === "type" || object.kind === "extension" || object.kind === "function" || object.kind === "trigger" || object.kind === "view" || object.kind === "materializedView" || ownedByView(object)) {
+  for (const object of uniqueBeforeForeignKey(creationOrder2(request.after))) {
+    if (object.kind === "type" || object.kind === "extension" || object.kind === "function" || object.kind === "trigger" || object.kind === "view" || object.kind === "materializedView" || object.kind === "policy" || ownedByView(object)) {
       continue;
     }
     const key = identityKey2(object.identity);
@@ -1249,6 +1687,17 @@ function planMigration(input) {
     }
     steps.push(step(sql, kind, "ddl", object.kind === "index" ? SHARE : ACCESS2));
   }
+  for (const object of creationOrder2(request.after)) {
+    if (object.kind !== "policy")
+      continue;
+    const key = identityKey2(object.identity);
+    if (!createKeys.has(key) || emitted.has(key))
+      continue;
+    emitted.add(key);
+    for (const item of policyCreatePlan(object, schema)) {
+      steps.push(step(item.sql, item.kind, "ddl", ACCESS2, true, [object.identity.parent.name]));
+    }
+  }
   for (const change of replaces) {
     if (sameDefinition(change.before, change.after))
       continue;
@@ -1345,7 +1794,7 @@ function formatPlan(plan, lockText) {
 `);
 }
 function parsePlan(text) {
-  const lines = text.split(`
+  const lines = prepareMigrationText(text).split(`
 `);
   let name = "migration";
   let planClass = "expand";
@@ -1377,9 +1826,16 @@ function parsePlan(text) {
     let behavior;
     const allows = [];
     const sql = [];
-    while (index < lines.length && (lines[index] ?? "") !== "") {
+    let quoteOpen = false;
+    while (index < lines.length && (quoteOpen || (lines[index] ?? "") !== "")) {
       const line = lines[index] ?? "";
       index += 1;
+      if (quoteOpen) {
+        sql.push(line);
+        quoteOpen = sqlQuoteOpen(sql.join(`
+`));
+        continue;
+      }
       if (line.startsWith("-- class: ")) {
         stepClass = readClass(line.slice("-- class: ".length));
         sawClass = true;
@@ -1401,8 +1857,11 @@ function parsePlan(text) {
         behavior = "change";
       else if (line.startsWith("-- okm-allow"))
         allows.push(readAllow(line));
-      else if (!line.startsWith("--"))
+      else if (!line.startsWith("--")) {
         sql.push(line);
+        quoteOpen = sqlQuoteOpen(sql.join(`
+`));
+      }
     }
     const statement = sql.join(`
 `).replace(/;\s*$/, "");
@@ -1559,7 +2018,7 @@ function withoutNameKey(value) {
 }
 function renameShapeStep(pair, schema) {
   if (pair.from.kind === "index" && pair.to.kind === "index") {
-    return step(`alter index ${qualify(schema, pair.from.identity.name)} rename to ${quoteIdent(pair.to.identity.name)}`, "rename-index", "ddl", ACCESS2);
+    return step(`alter index ${qualify(schema, pair.from.identity.name)} rename to ${quoteIdent(pair.to.identity.name)}`, "rename-index", "ddl", SHARE_UPDATE2);
   }
   if (pair.from.kind !== "constraint" || pair.to.kind !== "constraint") {
     throw new OkmError2("invalid", "A same-shape rename is an index or a constraint.", {
@@ -2132,6 +2591,25 @@ function reprintedDefaultBase(typeName) {
     return `${time[1] ?? ""} ${time[2] ?? ""}`;
   return;
 }
+function handsOff(object) {
+  return object.owner === "external" || object.owner === "ignored";
+}
+function childOfHandsOff(object, catalog) {
+  if (object.kind !== "column" && object.kind !== "index" && object.kind !== "constraint" && object.kind !== "trigger" && object.kind !== "policy") {
+    return false;
+  }
+  const parent = object.identity.parent;
+  const table = catalog.get(identityKey2({ kind: "table", namespace: parent.namespace, name: parent.name }));
+  return table !== undefined && handsOff(table);
+}
+function releaseHandsOff(keys, objects, parents) {
+  for (const key of keys) {
+    const object = objects.get(key);
+    if (object !== undefined && (handsOff(object) || childOfHandsOff(object, parents))) {
+      keys.delete(key);
+    }
+  }
+}
 function sameDefinition(left, right) {
   if (left.kind === "materializedView" && right.kind === "materializedView") {
     return stable(canonicalColumns(left.definition.columns)) === stable(canonicalColumns(right.definition.columns)) && left.definition.query === right.definition.query;
@@ -2171,6 +2649,9 @@ function forComparison(object) {
       if (!isDomain(object.definition))
         return object.definition;
       return { ...object.definition, base: canonicalTypeName(object.definition.base) };
+    case "constraint":
+    case "index":
+      return withoutNameKey(object.definition);
     default:
       return object.definition;
   }
@@ -2429,4 +2910,212 @@ function order(value) {
   return value;
 }
 
-export { canonicalTypeName, createdRoleName, createRoleOnce, changesRole, DEFAULT_BACKFILL_PAUSE_MS, DEFAULT_BACKFILL_STATEMENT_TIMEOUT_MS, batchSizeField, aboutBatchCount, boundaryQuery, checkedCast, classOf, strictestClass, assertExtensionsAvailable, omitManagedObjects, parseReplace, planMigration, formatPlan, parsePlan, staleRenames };
+// src/tooling/migrate/lost.ts
+var UNAVAILABLE_FIX = {
+  summary: "The connection to Postgres closed. Run the command again when the database is reachable."
+};
+function sessionFailure(error) {
+  if (error instanceof OkmError2) {
+    if (error.kind === "outcome_unknown" || error.kind === "unavailable")
+      return error;
+    const cause = error.cause;
+    if (cause === undefined || cause === error || error.kind !== "invalid")
+      return;
+    const inner = sessionFailure(cause);
+    if (inner === undefined)
+      return;
+    return new OkmError2(inner.code, error.message, {
+      kind: inner.kind,
+      cause: error,
+      fix: inner.fix
+    });
+  }
+  if (isOutcomeUnknown(error)) {
+    return new OkmError2("OKM1401", "The commit outcome is unknown. The result never arrived.", {
+      kind: "outcome_unknown",
+      cause: error,
+      fix: {
+        summary: "Check whether the write landed before retrying. This error is never retried automatically."
+      }
+    });
+  }
+  if (!isConnectionLost(error))
+    return;
+  const message = error instanceof Error && error.message.length > 0 ? error.message : "The database is unavailable.";
+  return new OkmError2("unavailable", message, {
+    kind: "unavailable",
+    cause: error,
+    fix: UNAVAILABLE_FIX
+  });
+}
+async function finishQuiet(run) {
+  await run().catch(() => {
+    return;
+  });
+}
+function isOutcomeUnknown(error) {
+  return typeof error === "object" && error !== null && Reflect.get(error, "kind") === "outcome_unknown";
+}
+
+// src/tooling/migrate/policy.ts
+var READ = new Set([
+  "plan",
+  "status",
+  "check",
+  "drift",
+  "verify",
+  "pull",
+  "catalog-export",
+  "inspect"
+]);
+var ALLOWED = new Set(["expand", "reference", "provision"]);
+var FORWARD_ONLY = new Set(["drop", "rollback"]);
+function assertTargetPolicy(target, operation, allowProtected = false) {
+  if (FORWARD_ONLY.has(operation)) {
+    throw new OkmError2("invalid", "There is no down migration.", {
+      fix: { summary: "Recovery is a new forward migration." }
+    });
+  }
+  if (!target.protected || allowProtected)
+    return;
+  if (READ.has(operation) || ALLOWED.has(operation))
+    return;
+  throw new OkmError2("OKM1850", `${operation} is blocked on protected target ${target.name}.`, {
+    kind: "forbidden",
+    fix: {
+      summary: "Run a read-only command or an expand migration, or pass --allow-protected for this invocation."
+    }
+  });
+}
+function assertTargetAlias(targets) {
+  const groups = new Map;
+  for (const target of targets) {
+    const key = `${target.host}
+${target.port}
+${target.database}`;
+    const group = groups.get(key);
+    if (group === undefined)
+      groups.set(key, [target]);
+    else
+      group.push(target);
+  }
+  for (const group of groups.values()) {
+    const protectedTarget = group.find((target) => target.protected);
+    const open = group.find((target) => !target.protected);
+    if (protectedTarget !== undefined && open !== undefined) {
+      throw new OkmError2("OKM1852", `${open.name} and ${protectedTarget.name} resolve to the same database and disagree about protection.`, {
+        fix: {
+          summary: "Give those targets the same protection flag. okm check and okm doctor both report this."
+        }
+      });
+    }
+  }
+}
+function assertDirectConnection(url, allowPooler) {
+  if (allowPooler)
+    return;
+  const endpoint = endpointOf(url);
+  const parsed = new URL(url);
+  const host = endpoint.host;
+  if (host.includes("pooler") || host.includes("pgbouncer") || host.includes("-pooler") || endpoint.port === "6543" || endpoint.port === "6432" || parsed.searchParams.get("pgbouncer") === "true") {
+    throw new OkmError2("invalid", `Refusing pooler host ${host}. Apply needs a direct connection.`, { fix: { summary: "Use a direct connection, or pass --allow-pooler." } });
+  }
+}
+async function assertStableBackend(readPid, allowPooler) {
+  if (allowPooler)
+    return;
+  const first = await readPid();
+  const second = await readPid();
+  if (first === second)
+    return;
+  throw new OkmError2("OKM1854", `The backend pid changed from ${first} to ${second}. A pooler is handing out a new session between statements.`, { fix: { summary: "Use a direct connection, or pass --allow-pooler." } });
+}
+function listTargets(config) {
+  if (config.database !== undefined && config.targets !== undefined) {
+    throw new OkmError2("invalid", "Set database or targets, not both.", {
+      fix: { summary: "database is the one target named default. Use targets for more than one." }
+    });
+  }
+  const entries = [];
+  if (config.database !== undefined)
+    entries.push(["default", config.database]);
+  if (config.targets !== undefined) {
+    for (const name of Object.keys(config.targets).sort()) {
+      const input = config.targets[name];
+      if (input !== undefined)
+        entries.push([name, input]);
+    }
+  }
+  return entries.map(([name, input]) => resolveTarget(name, input));
+}
+function selectTarget(config, name) {
+  const targets = listTargets(config);
+  if (targets.length === 0) {
+    throw new OkmError2("OKM1845", "No target is configured.", {
+      fix: { summary: "Set database or targets in okmodel.config.ts." }
+    });
+  }
+  if (name === undefined) {
+    if (targets.length === 1) {
+      const only = targets[0];
+      if (only !== undefined)
+        return only;
+    }
+    throw new OkmError2("OKM1853", "Several targets are configured and --target was not passed.", {
+      fix: { summary: "Pass --target <name>. The command does not guess." }
+    });
+  }
+  const found = targets.find((target) => target.name === name);
+  if (found === undefined) {
+    throw new OkmError2("OKM1845", `Target ${name} is not configured.`, {
+      fix: { summary: "Pass a name from targets, or database for the target named default." }
+    });
+  }
+  return found;
+}
+function resolveTarget(name, input) {
+  if (typeof input !== "string" && isReplicaTarget(input)) {
+    throw new OkmError2("OKM1845", `Target ${name} is a replica. Migrations run on the primary only.`, {
+      fix: {
+        summary: "Set database or targets to the primary URL. A replica is not a migration target."
+      }
+    });
+  }
+  const url = typeof input === "string" ? input : input.url;
+  const protectedTarget = typeof input === "string" ? false : input.protected === true;
+  if (url === undefined || url.length === 0) {
+    throw new OkmError2("OKM1845", `Target ${name} has no url.`, {
+      fix: { summary: "Set the target url. A target is not inferred from the environment." }
+    });
+  }
+  const endpoint = endpointOf(url);
+  return {
+    name,
+    url,
+    protected: protectedTarget,
+    host: endpoint.host,
+    port: endpoint.port,
+    database: endpoint.database
+  };
+}
+function isReplicaTarget(input) {
+  return "primary" in input || "replicas" in input || "weight" in input || "pool" in input;
+}
+function endpointOf(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new OkmError2("OKM1845", "The target URL is not a Postgres URL.", {
+      fix: { summary: "Pass a postgres:// URL for the target." }
+    });
+  }
+  const database = decodeURIComponent(parsed.pathname.replace(/^\//, ""));
+  return {
+    host: parsed.hostname.toLowerCase(),
+    port: parsed.port.length > 0 ? parsed.port : "5432",
+    database
+  };
+}
+
+export { sqlStatements, transactionControl, canonicalTypeName, prepareMigrationText, assertMigrationSteps, columnPrivilege, createdRoleName, createRoleOnce, changesRole, DEFAULT_BACKFILL_PAUSE_MS, DEFAULT_BACKFILL_STATEMENT_TIMEOUT_MS, batchSizeField, aboutBatchCount, boundaryQuery, checkedCast, classOf, strictestClass, assertExtensionsAvailable, omitManagedObjects, parseReplace, planMigration, formatPlan, parsePlan, staleRenames, sessionFailure, finishQuiet, assertTargetPolicy, assertTargetAlias, assertDirectConnection, assertStableBackend, listTargets, selectTarget };