okmodel 0.5.1 → 0.6.0

package/dist/shared/{8xsbagad.js → 9s0ypp87.js}

@@ -1,15 +1,15 @@
 import {
   creationOrder2
-} from "./8bwbwy8h.js";
+} from "./qq3899ht.js";
 import {
   isDomain
-} from "./g7ez901n.js";
+} from "./ywspezzx.js";
 import {
   quoteLiteral
 } from "./94ez8kzh.js";
 import {
   identityKey2
-} from "./t4tbsy9h.js";
+} from "./358zsv4r.js";
 import {
   fitIdentifier2
 } from "./nfzc5z0w.js";
@@ -22,6 +22,7 @@ function renderCatalog(source, schema) {
   const folded = foldedKeys(source);
   const statements = [];
   const ordered = creationOrder2(source);
+  const created = uniqueBeforeForeignKey(ordered);
   for (const object of ordered) {
     if (object.kind !== "type" || object.owner === "ignored")
       continue;
@@ -29,8 +30,8 @@ function renderCatalog(source, schema) {
     if (sql !== undefined)
       statements.push(sql);
   }
-  for (const object of ordered) {
-    if (object.kind === "type" || object.kind === "function" || object.kind === "trigger" || object.kind === "view" || object.kind === "materializedView" || ownedByView(object)) {
+  for (const object of created) {
+    if (object.kind === "type" || object.kind === "function" || object.kind === "trigger" || object.kind === "view" || object.kind === "materializedView" || object.kind === "policy" || ownedByView(object)) {
       continue;
     }
     if (object.owner === "ignored")
@@ -46,6 +47,12 @@ function renderCatalog(source, schema) {
     if (sql !== undefined)
       statements.push(sql);
   }
+  for (const object of created) {
+    if (object.kind !== "policy" || object.owner === "ignored")
+      continue;
+    for (const step of policyCreatePlan(object, schema))
+      statements.push(step.sql);
+  }
   for (const kind of ["function", "trigger"]) {
     for (const object of ordered) {
       if (object.kind !== kind || object.owner === "ignored")
@@ -73,6 +80,48 @@ function renderCatalog(source, schema) {
   }
   return statements;
 }
+function uniqueBeforeForeignKey(objects) {
+  const uniques = objects.filter((object) => object.kind === "constraint" && object.definition.constraintKind === "unique");
+  if (uniques.length === 0)
+    return objects;
+  const emitted = new Set;
+  const result = [];
+  for (const object of objects) {
+    if (emitted.has(object))
+      continue;
+    if (object.kind === "constraint" && object.definition.constraintKind === "foreignKey") {
+      const target = object.definition.references;
+      if (target !== undefined && !coveredByPrimary(objects, target.parent, target.columns)) {
+        const columns = target.columns.join("\x00");
+        for (const unique of uniques) {
+          if (emitted.has(unique))
+            continue;
+          if (!sameRef(unique.identity.parent, target.parent))
+            continue;
+          if (unique.definition.columns.join("\x00") !== columns)
+            continue;
+          result.push(unique);
+          emitted.add(unique);
+        }
+      }
+    }
+    result.push(object);
+    emitted.add(object);
+  }
+  return result;
+}
+function coveredByPrimary(objects, parent, columns) {
+  const key = columns.join("\x00");
+  return objects.some((object) => object.kind === "constraint" && object.definition.constraintKind === "primaryKey" && sameRef(object.identity.parent, parent) && object.definition.columns.join("\x00") === key);
+}
+function sameRef(left, right) {
+  if (left.name !== right.name || left.namespace.form !== right.namespace.form)
+    return false;
+  if (left.namespace.form === "static" && right.namespace.form === "static") {
+    return left.namespace.name === right.namespace.name;
+  }
+  return left.namespace.form === "template" && right.namespace.form === "template" ? left.namespace.pattern === right.namespace.pattern : false;
+}
 function ownedByView(object) {
   if (object.kind !== "index")
     return false;
@@ -149,7 +198,39 @@ function functionSql(object, schema, replace) {
 }
 function viewSql(object, schema, replace) {
   const verb = replace ? "create or replace view" : "create view";
-  return `${verb} ${qualify(schema, object.identity.name)} as ${object.definition.query}`;
+  const invoker = object.definition.securityInvoker === true ? " with (security_invoker = true)" : "";
+  return `${verb} ${qualify(schema, object.identity.name)}${invoker} as ${object.definition.query}`;
+}
+function policyCreatePlan(object, schema) {
+  const table = qualify(schema, object.identity.parent.name);
+  const name = quoteIdent(object.identity.name);
+  const command = object.definition.command === "all" ? "all" : "select";
+  const check = object.definition.command === "all" ? ` with check ${object.definition.expression}` : "";
+  const create = {
+    sql: `create policy ${name} on ${table} as permissive for ${command} using ${object.definition.expression}${check}`,
+    kind: "create-policy"
+  };
+  if (object.definition.command !== "all")
+    return [create];
+  return [
+    { sql: `alter table ${table} enable row level security`, kind: "enable-rls" },
+    { sql: `alter table ${table} force row level security`, kind: "enable-rls" },
+    create
+  ];
+}
+function policyDropPlan(object, schema) {
+  const table = qualify(schema, object.identity.parent.name);
+  const drop = {
+    sql: `drop policy ${quoteIdent(object.identity.name)} on ${table}`,
+    kind: "drop-policy"
+  };
+  if (object.definition.command !== "all")
+    return [drop];
+  return [
+    drop,
+    { sql: `alter table ${table} no force row level security`, kind: "disable-rls" },
+    { sql: `alter table ${table} disable row level security`, kind: "disable-rls" }
+  ];
 }
 function materializedViewSql(object, schema) {
   return `create materialized view ${qualify(schema, object.identity.name)} as ${object.definition.query} with no data`;
@@ -315,4 +396,4 @@ function qualify(schema, name) {
   return `${quoteIdent(schema)}.${quoteIdent(name)}`;
 }
 
-export { quoteIdent, renderCatalog, ownedByView, dropObjectSql, createObjectSql, functionSql, viewSql, refreshMaterializedViewSql, alterColumnSql, identitySequence, createTableSql, qualify };
+export { quoteIdent, renderCatalog, uniqueBeforeForeignKey, ownedByView, dropObjectSql, createObjectSql, functionSql, viewSql, policyCreatePlan, policyDropPlan, refreshMaterializedViewSql, alterColumnSql, identitySequence, createTableSql, qualify };

package/dist/shared/{efmy2gcg.js → ag4c7516.js}

@@ -5,7 +5,7 @@ import {
 } from "./31vm914h.js";
 import {
   isConnectionLost
-} from "./pf0d8f77.js";
+} from "./gwn6v667.js";
 
 // src/adapters/pg/batch.ts
 var savepointIds = 0;

package/dist/shared/b3awxn7h.js

@@ -0,0 +1,45 @@
+import {
+  isRecord,
+  orFail
+} from "./2z7wv5tj.js";
+import {
+  isOperator,
+  operatorName,
+  operatorValue
+} from "./cn0n68ft.js";
+
+// src/runtime/predicate.ts
+function effectivePredicate(where) {
+  if (where === undefined)
+    return false;
+  if (isOperator(where)) {
+    const name = operatorName(where);
+    const value = operatorValue(where);
+    if (name === "or") {
+      if (!Array.isArray(value))
+        orFail(false);
+      if (value.length === 0)
+        return true;
+      for (const branch of value) {
+        if (!effectivePredicate(branch))
+          orFail(true);
+      }
+      return true;
+    }
+    if (name === "and") {
+      return Array.isArray(value) && value.some((part) => effectivePredicate(part));
+    }
+    if (name === "not")
+      return effectivePredicate(value);
+    return true;
+  }
+  if (!isRecord(where))
+    return true;
+  for (const key of Object.keys(where)) {
+    if (where[key] !== undefined)
+      return true;
+  }
+  return false;
+}
+
+export { effectivePredicate };

package/dist/shared/b4v57v3x.js

@@ -0,0 +1,9 @@
+// src/runtime/inflight.ts
+async function refuseUncancellableTimeout(pool, timeout) {
+  if (pool.capabilities.cancel === true || timeout === undefined || !(timeout > 0))
+    return;
+  const { noTimeout } = await import("./wxr8cwns.js");
+  noTimeout({ timeout });
+}
+
+export { refuseUncancellableTimeout };

package/dist/shared/bdk4sty6.js

@@ -0,0 +1,58 @@
+import {
+  assertNamespace2,
+  normaliseEdges,
+  assertProvenance
+} from "./358zsv4r.js";
+import {
+  isReservedIdentifier2,
+  assertIdentifier2,
+  fitIdentifier2,
+  assertStoredText
+} from "./nfzc5z0w.js";
+import {
+  catalogError2
+} from "./52szzakm.js";
+
+// src/contracts/catalog/policy.ts
+var BARE_IDENT = /^[a-z_][a-z0-9_$]*$/;
+function policyIdent(name) {
+  if (BARE_IDENT.test(name) && !isReservedIdentifier2(name))
+    return name;
+  return `"${name.replaceAll('"', '""')}"`;
+}
+function tenantPolicyExpression(column, dataType) {
+  return `(${policyIdent(column)} = (NULLIF(current_setting('app.tenant'::text, true), ''::text))::${dataType})`;
+}
+function unscopedPolicyExpression() {
+  return `(current_setting('app.unscoped'::text, true) = 'on'::text)`;
+}
+function policyObject(input) {
+  assertNamespace2(input.parent.namespace);
+  assertIdentifier2(input.parent.name, "policy parent");
+  assertIdentifier2(input.name, "policy");
+  assertStoredText(input.expression, "policy expression");
+  if (input.command !== "all" && input.command !== "select") {
+    catalogError2("OKM1020", `Policy ${input.name} command is not supported.`);
+  }
+  assertProvenance(input.provenance);
+  const parent = {
+    kind: "table",
+    namespace: input.parent.namespace,
+    name: input.parent.name
+  };
+  const definition = {
+    command: input.command,
+    expression: input.expression,
+    force: input.force
+  };
+  return {
+    kind: "policy",
+    identity: { kind: "policy", parent: input.parent, name: fitIdentifier2(input.name) },
+    owner: input.owner ?? "managed",
+    definition,
+    dependencies: normaliseEdges([parent, ...input.dependencies ?? []]),
+    provenance: input.provenance
+  };
+}
+
+export { tenantPolicyExpression, unscopedPolicyExpression, policyObject };

package/dist/shared/{51mvgj8w.js → c58secgj.js}

@@ -1,7 +1,7 @@
 import {
   isConnectionSqlstate,
   isConnectionFailure
-} from "./pf0d8f77.js";
+} from "./gwn6v667.js";
 import {
   OkmError2,
   stripRowValues,
@@ -9,7 +9,7 @@ import {
 } from "./52szzakm.js";
 
 // src/dialects/pg/errors.ts
-function mapPostgresError(error, options) {
+function mapPostgresError2(error, options) {
   if (error instanceof OkmError2)
     return error;
   if (!isDriverError(error))
@@ -17,7 +17,7 @@ function mapPostgresError(error, options) {
   const kind = kindOf(error);
   const columns = columnsOf(error);
   const hint = hintOf(error, kind);
-  const fieldReason = hint?.reason ?? (kind === "not_null" ? "not_null" : reasonOf(kind, error.table, error.constraint));
+  const fieldReason = hint?.reason ?? (kind === "not_null" ? "not_null" : reasonOf(kind, error.table, error.constraint, columns, options?.schema));
   const values = options?.includeValues === true ? valuesOf(error.detail, columns) : undefined;
   const code = kind === "outcome_unknown" ? "OKM1401" : kind;
   return new OkmError2(code, summaryOf(kind, error, columns, fieldReason), {
@@ -70,11 +70,39 @@ function hintOf(error, kind) {
     return { reason: "undefined_table", fix: MIGRATE_FIX };
   if (error.sqlstate === "42703")
     return { reason: "undefined_column", fix: MIGRATE_FIX };
+  const refresh = refreshHint(error);
+  if (refresh !== undefined)
+    return refresh;
   if (kind === "unavailable" && error.sqlstate === undefined && isTlsFailure(error)) {
     return { reason: "tls", fix: TLS_FIX };
   }
   return;
 }
+function refreshHint(error) {
+  if (error.sqlstate === "0A000" && error.message.includes("materialized view is not populated")) {
+    return {
+      reason: "not_populated",
+      fix: { summary: "Refresh once without CONCURRENTLY so the view is populated." }
+    };
+  }
+  if (error.sqlstate === "55000" && error.message.includes("cannot refresh materialized view") && error.message.includes("concurrently")) {
+    return {
+      reason: "no_unique_index",
+      fix: {
+        summary: "Add a unique index with no WHERE clause, or refresh without CONCURRENTLY."
+      }
+    };
+  }
+  if (error.sqlstate === "42501" && error.message.includes("materialized view")) {
+    return {
+      reason: "not_owner",
+      fix: {
+        summary: "Refresh runs as the owner, the migration role. Connect as that role and call refresh(), or run REFRESH MATERIALIZED VIEW as that role. The application role is not the owner."
+      }
+    };
+  }
+  return;
+}
 function kindFromSqlstate(sqlstate) {
   switch (sqlstate) {
     case "23505":
@@ -112,7 +140,15 @@ function kindFromSqlstate(sqlstate) {
       return;
   }
 }
-function reasonOf(kind, table, constraint) {
+function reasonOf(kind, table, constraint, columns, schema) {
+  if (schema !== undefined && schema.catalog !== undefined && table !== undefined) {
+    const matched = matchObject(schema.catalog, table, constraint, columns);
+    if (matched !== undefined)
+      return reasonFromObject(schema, table, matched, columns);
+  }
+  return reasonFromName(kind, table, constraint);
+}
+function reasonFromName(kind, table, constraint) {
   if (constraint === undefined || constraint.length === 0)
     return kind;
   if (table !== undefined) {
@@ -128,6 +164,61 @@ function reasonOf(kind, table, constraint) {
   }
   return constraint;
 }
+function matchObject(catalog, table, constraint, columns) {
+  const rows = [];
+  for (const object of catalog.objects) {
+    if (object.kind !== "constraint" && object.kind !== "index")
+      continue;
+    if (object.identity.parent.name !== table)
+      continue;
+    rows.push(object);
+  }
+  if (columns.length > 0) {
+    const key = columns.join(",");
+    const hits = rows.filter((object) => object.definition.columns.join(",") === key);
+    if (constraint !== undefined) {
+      const named = hits.find((object) => object.identity.name === constraint);
+      if (named !== undefined)
+        return named;
+    }
+    const only = hits.length === 1 ? hits[0] : undefined;
+    if (only !== undefined)
+      return only;
+  }
+  if (constraint === undefined)
+    return;
+  return rows.find((object) => object.identity.name === constraint);
+}
+function reasonFromObject(schema, table, object, columns) {
+  if (object.kind === "index")
+    return object.identity.name;
+  const nameKey = object.definition.nameKey;
+  if (columns.length === 0)
+    return nameKey;
+  const sqlKey = object.definition.columns.join("_");
+  if (nameKey !== sqlKey || object.definition.columns.length < 2)
+    return nameKey;
+  return fieldKey(schema, table, object.definition.columns) ?? nameKey;
+}
+function fieldKey(schema, table, columns) {
+  let model;
+  for (const item of Object.values(schema.model)) {
+    if (item.sql === table) {
+      model = item;
+      break;
+    }
+  }
+  if (model === undefined)
+    return;
+  const fields = [];
+  for (const column of columns) {
+    const found = model.columns.find((item) => item.sql === column);
+    if (found === undefined)
+      return;
+    fields.push(found.field);
+  }
+  return fields.join("_");
+}
 function nameKeyOf(rest) {
   const tags = ["_fkey", "_check", "_key"];
   for (const tag of tags) {
@@ -212,6 +303,9 @@ function unquote(name) {
 }
 function summaryOf(kind, error, columns, fieldReason) {
   const label = labelOf(kind);
+  if (kind === "driver" && fieldReason === "not_owner") {
+    return "The application role cannot refresh a materialized view. Refresh runs as the owner, the migration role.";
+  }
   if (kind === "driver")
     return stripRowValues(error.message);
   const where = place(error.table, columns);
@@ -276,6 +370,5 @@ function labelOf(kind) {
       return "Driver error";
   }
 }
-export {
-  mapPostgresError
-};
+
+export { mapPostgresError2 };

package/dist/shared/d5azex6s.js

@@ -0,0 +1,6 @@
+import {
+  mapPostgresError2
+} from "./c58secgj.js";
+export {
+  mapPostgresError2 as mapPostgresError
+};

package/dist/shared/{5fqx9yh4.js → dk8v79p3.js}

@@ -7,9 +7,11 @@ import {
   startupCatalog2,
   startupHash2,
   loadTrustedCatalog2,
+  catalogFileText2,
   parseCatalog2
-} from "./8bwbwy8h.js";
+} from "./qq3899ht.js";
 export {
+  catalogFileText2 as catalogFileText,
   catalogHash2 as catalogHash,
   creationOrder2 as creationOrder,
   loadTrustedCatalog2 as loadTrustedCatalog,

package/dist/shared/{4m9fn52z.js → ed0b8k4s.js}

@@ -1,6 +1,6 @@
 import {
   required
-} from "./c9z5g0fm.js";
+} from "./ywr8hmey.js";
 import {
   definition,
   rejected

package/dist/shared/{z2rnngj4.js → ek2wt2dz.js}

@@ -1,3 +1,6 @@
+import {
+  catalogFileText2
+} from "./qq3899ht.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -11,7 +14,7 @@ async function assertCompatible(pool, schema, recordedHash, source, options) {
   if (code.artifact !== undefined) {
     const artifact = code.artifact;
     await loadOnce(`text\x00${artifact.hash}`, async () => {
-      const { loadTrustedCatalog } = await import("./5fqx9yh4.js");
+      const { loadTrustedCatalog } = await import("./dk8v79p3.js");
       loadTrustedCatalog(artifact.text, artifact.hash);
     });
   } else if (code.fromFile) {
@@ -25,7 +28,7 @@ async function assertCompatible(pool, schema, recordedHash, source, options) {
           }
         });
       }
-      const { loadTrustedCatalog } = await import("./5fqx9yh4.js");
+      const { loadTrustedCatalog } = await import("./dk8v79p3.js");
       loadTrustedCatalog(text, code.hash);
     });
   }
@@ -39,7 +42,7 @@ async function codeHash(schema, source) {
   const listed = await readHashFile(source.catalogDir);
   if (listed !== undefined)
     return { hash: listed, fromFile: true };
-  const { catalogHash } = await import("./5fqx9yh4.js");
+  const { catalogHash } = await import("./dk8v79p3.js");
   return { hash: catalogHash(schemaCatalog(schema)), fromFile: false };
 }
 function schemaCatalog(schema) {
@@ -57,12 +60,12 @@ async function readHashFile(catalogDir) {
   const text = await readText(`${artifactDir(catalogDir)}/catalog.hash`);
   if (text === undefined)
     return;
-  const hash = text.trim();
+  const hash = catalogFileText2(text, "catalog.hash").trim();
   return hash.length === 0 ? undefined : hash;
 }
 function artifactDir(catalogDir) {
   if (catalogDir !== undefined)
-    return catalogDir.replace(/\/$/, "");
+    return catalogDir.replace(/[/\\]+$/, "");
   const cwd = globalThis.process?.cwd?.() ?? ".";
   return `${cwd}/.okm`;
 }

package/dist/shared/{sycnx8gt.js → f0f1n281.js}

@@ -4,24 +4,26 @@ import {
   viewDependencyEdges,
   PUBLIC,
   introspectSchema
-} from "./fancm5pt.js";
+} from "./vjpnzwjz.js";
 import {
   planMigration,
+  sessionFailure,
+  finishQuiet,
   assertDirectConnection,
   assertStableBackend
-} from "./ga3sfy93.js";
+} from "./ttmg09vd.js";
 import {
   quoteIdent,
   createObjectSql
-} from "./8xsbagad.js";
+} from "./9s0ypp87.js";
 import {
   normaliseViewQuery,
   viewObject,
   materializedViewObject
-} from "./y005b761.js";
+} from "./zy8r7qvz.js";
 import {
   catalog
-} from "./g7ez901n.js";
+} from "./ywspezzx.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -88,7 +90,8 @@ async function sealViews(runner, source) {
           query,
           owner: object.owner,
           provenance: object.provenance,
-          dependencies
+          dependencies,
+          ...object.definition.securityInvoker === true ? { securityInvoker: true } : {}
         });
       }
       return materializedViewObject({
@@ -256,8 +259,10 @@ ${plan.steps.map((step) => step.sql).join(`
         summary: "Change the schema or the database so okm check reports no difference."
       }
     });
+  } catch (error) {
+    throw sessionFailure(error) ?? error;
   } finally {
-    await sql.end({ timeout: 5 });
+    await finishQuiet(() => sql.end({ timeout: 5 }));
   }
 }
 function catalogQuery2(sql) {
@@ -275,12 +280,17 @@ function catalogQuery2(sql) {
 }
 function managedRoleOptions2(roles) {
   const names = managedRoleNames(roles);
-  return names === undefined ? undefined : { managedRoles: names };
+  return names === undefined ? undefined : {
+    managedRoles: names,
+    ...roles?.reporting !== undefined ? { reportingRole: roles.reporting } : {}
+  };
 }
 function managedRoleNames(roles) {
   if (roles === undefined)
     return;
   const names = new Set([roles.migration, roles.app]);
+  if (roles.reporting !== undefined)
+    names.add(roles.reporting);
   for (const role of roles.managed ?? [])
     names.add(role.name);
   return [...names];

package/dist/shared/{f5cw5q5r.js → g90m9b0g.js}

@@ -1,6 +1,7 @@
 import {
   open3
-} from "./87jvvhnt.js";
+} from "./5j36z8dn.js";
+import"./8dqhth8c.js";
 import {
   PGLITE_CAPABILITIES,
   readCapability2,

package/dist/shared/{pf0d8f77.js → gwn6v667.js}

@@ -28,7 +28,7 @@ function isConnectionFailure(error) {
   if (!(error instanceof Error))
     return false;
   const message = error.message;
-  return message.includes("ECONNREFUSED") || message.includes("ECONNRESET") || message.includes("CONNECTION_CLOSED") || message.includes("terminating connection") || message.includes("The pool is closed");
+  return message.includes("ECONNREFUSED") || message.includes("ECONNRESET") || message.includes("CONNECT") || message.includes("terminating connection") || message.includes("The pool is closed");
 }
 function isConnectionLost(error) {
   if (isConnectionFailure(error))

package/dist/shared/{8rsy3hxz.js → h15jx9bc.js}

@@ -1,6 +1,6 @@
 import {
   validationGate
-} from "./9m80mkac.js";
+} from "./ze4hxsmy.js";
 import {
   isOperator
 } from "./cn0n68ft.js";