okmodel 0.5.1 → 0.6.0

package/dist/shared/{qv2ydck9.js → t3g0k88x.js}

@@ -9,51 +9,71 @@ import {
   serializeCatalog2,
   catalogHash2,
   startupCatalog2,
+  catalogFileText2,
   parseCatalog2
-} from "./8bwbwy8h.js";
+} from "./qq3899ht.js";
 import {
   open2
-} from "./krxx77g0.js";
+} from "./wkme6tep.js";
 import {
+  sqlStatements,
+  transactionControl,
   canonicalTypeName,
+  prepareMigrationText,
+  assertMigrationSteps,
+  columnPrivilege,
   batchSizeField,
   aboutBatchCount,
-  sqlStatements,
   parseReplace,
   planMigration,
   formatPlan,
   parsePlan,
   staleRenames,
+  sessionFailure,
+  finishQuiet,
   assertTargetPolicy,
   assertTargetAlias,
   listTargets,
   selectTarget
-} from "./ga3sfy93.js";
+} from "./ttmg09vd.js";
 import {
   contributedFields
 } from "./n0dgs0pb.js";
 import {
   assertValidation,
   writeWouldValidate
-} from "./9m80mkac.js";
+} from "./ze4hxsmy.js";
+import {
+  tableOwner,
+  stampOwnership
+} from "./xqve9598.js";
 import {
   catalog,
   isDomain
-} from "./g7ez901n.js";
+} from "./ywspezzx.js";
 import {
   snakeCase,
   emittedTypeName
-} from "./ntneex2a.js";
+} from "./rpycarcr.js";
 import {
   ColumnBuilder2
-} from "./c9z5g0fm.js";
+} from "./ywr8hmey.js";
 import {
   staticNamespace2
-} from "./t4tbsy9h.js";
+} from "./358zsv4r.js";
+import {
+  sha2562
+} from "./nfzc5z0w.js";
 import {
   OkmError2
 } from "./52szzakm.js";
 
+// src/tooling/migrate/paths.ts
+import { resolve } from "node:path";
+function projectPath(cwd, ...parts) {
+  return resolve(cwd, ...parts);
+}
+
 // src/tooling/errors/registry.ts
 var ERROR_DOCS = [
   {
@@ -494,6 +514,18 @@ var ERROR_DOCS = [
     summary: "The last migration's catalog does not match the schema.",
     fix: "Run okm generate."
   },
+  {
+    code: "OKM1550",
+    title: "Row-level security weakened",
+    summary: "A statement disables row-level security, drops or widens a policy, grants BYPASSRLS, or changes the owner of a tenant table.",
+    fix: "Remove the statement, or allow OKM1550 with a reason when the change is reviewed."
+  },
+  {
+    code: "OKM1551",
+    title: "Transaction control in a step",
+    summary: "A step contains COMMIT, ROLLBACK, or other transaction control, including inside a DO body. A function or procedure body is not this.",
+    fix: "Remove the transaction control. okm migrate check replays one transaction and rolls it back. Apply accepts the step only with -- okm-allow OKM1551: reason."
+  },
   {
     code: "OKM1601",
     title: "Stale typed SQL",
@@ -533,8 +565,14 @@ var ERROR_DOCS = [
   {
     code: "OKM1707",
     title: "RLS role",
-    summary: "connect() was given a role that owns the tables or is a superuser, under the rls strategy.",
-    fix: "Connect as a role that is neither the owner nor a superuser."
+    summary: "A scoped call under rls ran as a role that owns the tenant tables, is a superuser, or has BYPASSRLS. The reason field says which. The message names the endpoint.",
+    fix: "Connect as a role that is not the table owner, a superuser, or BYPASSRLS. okm seed under rlsTenancy runs as the application role. The owner gets this error."
+  },
+  {
+    code: "OKM1708",
+    title: "RLS policy",
+    summary: "A scoped call under rls found a tenant table whose row-level security is missing, not forced, or whose policies are not the ones okm generate emits. The message names the table and the endpoint.",
+    fix: "Restore the policies okm generate emits for this rls schema."
   },
   {
     code: "OKM1801",
@@ -617,7 +655,7 @@ var ERROR_DOCS = [
   {
     code: "OKM1825",
     title: "Missing privilege",
-    summary: "The application role lacks a privilege on a managed object.",
+    summary: "A role lacks a privilege on a managed object.",
     fix: "Grant the privilege, or change the role. okm doctor reports the object and the privilege."
   },
   {
@@ -712,9 +750,53 @@ function indexDocs() {
   return index;
 }
 
-// src/tooling/migrate/lint.ts
+// src/tooling/migrate/files.ts
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+function loadMigrations(directory) {
+  if (!existsSync(directory))
+    return [];
+  const names = readdirSync(directory).filter((file) => file.endsWith(".sql")).sort();
+  const migrations = [];
+  for (const file of names) {
+    const id = file.slice(0, -".sql".length);
+    const catalogPath = join(directory, `${id}.catalog.json`);
+    if (!existsSync(catalogPath)) {
+      throw new OkmError2("invalid", `Migration ${id} is missing its catalog snapshot.`, {
+        fix: {
+          summary: "Generate the migration again so the SQL and the catalog are written together."
+        }
+      });
+    }
+    const plan = readMigrationPlan(join(directory, file));
+    const stored = parseCatalog2(readFileSync(catalogPath, "utf8"));
+    const startup = startupCatalog2(stored);
+    const hash = catalogHash2(startup);
+    migrations.push(startup === stored ? { id, catalogHash: hash, steps: plan.steps } : { id, catalogHash: hash, legacyHash: catalogHash2(stored), steps: plan.steps });
+  }
+  return migrations;
+}
+function readMigrationPlan(path) {
+  const text = prepareMigrationText(readFileSync(path, "utf8"), path);
+  const plan = parsePlan(text);
+  assertMigrationSteps(text, plan.steps.length, path);
+  return plan;
+}
+function loadHeadSnapshot(directory) {
+  const migrations = loadMigrations(directory);
+  const last = migrations.at(-1);
+  if (last === undefined)
+    return;
+  return {
+    id: last.id,
+    catalogHash: last.catalogHash,
+    catalog: parseCatalog2(readFileSync(join(directory, `${last.id}.catalog.json`), "utf8"))
+  };
+}
+
+// src/tooling/migrate/lint.ts
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
 
 // src/tooling/migrate/lint-rules.ts
 var INTEGER_WIDTH = {
@@ -751,7 +833,12 @@ var STEP_RULES = [
   rule("OKM1536", "locking", "error", "Adding a foreign key without NOT VALID locks the table while it scans.", (input) => hit(foreignKeyWithoutNotValid(input), "adds a foreign key without NOT VALID")),
   rule("OKM1537", "locking", "error", "SET NOT NULL locks the table while it scans for nulls.", (input) => hit(unsafeSetNotNull(input), "sets NOT NULL")),
   rule("OKM1538", "locking", "warning", "A type change that rewrites the table locks it for the rewrite.", (input) => typeChange(input, "rewrite")),
-  rule("OKM1542", "data-dependent", "error", "A data statement outside backfill(), or DO or CALL, is not a migration step.", (input) => dataStatement(input.step))
+  rule("OKM1542", "data-dependent", "error", "A data statement outside backfill(), or DO or CALL, is not a migration step.", (input) => dataStatement(input.step)),
+  rule("OKM1550", "destructive", "error", "Disabling row-level security, dropping a policy, creating or altering one that is not the emitted tenant predicate, granting BYPASSRLS, or changing the owner of a tenant table removes the rlsTenancy backstop.", (input) => weakensRls(input)),
+  rule("OKM1551", "destructive", "error", "Transaction control inside a step commits or leaves the migration transaction.", (input) => {
+    const word = transactionControl(input.step.sql);
+    return word === undefined ? [] : [`contains ${word}`];
+  })
 ];
 var COLUMN_RULES = [
   {
@@ -810,6 +897,146 @@ function normalized(sql) {
   }
   return out;
 }
+function weakensRls(input) {
+  const text = normalized(input.step.sql);
+  if (/\bdisable row level security\b/.test(text))
+    return ["disables row level security"];
+  if (/\bno force row level security\b/.test(text))
+    return ["stops forcing row level security"];
+  if (/^drop policy\b/.test(text))
+    return ["drops a policy"];
+  const drifted = policyDrift(input, text);
+  if (drifted !== undefined)
+    return [drifted];
+  if (/^(?:alter|create) (?:role|user)\b/.test(text) && /(?<!no)bypassrls\b/.test(text)) {
+    return ["grants BYPASSRLS"];
+  }
+  if (changesTenantOwner(input, text))
+    return ["changes the owner of a tenant table"];
+  return [];
+}
+function policyDrift(input, text) {
+  const header = /^(create|alter) policy\s+(\S+)\s+on\s+(\S+)/.exec(text);
+  const kind = header?.[1];
+  const table = lastName(header?.[3]);
+  if (kind === undefined || table === undefined)
+    return;
+  if (!hasPolicy(input.before, table) && !hasPolicy(input.after, table))
+    return;
+  const name = lastName(header?.[2]) ?? "";
+  const using = clause(text, "using");
+  const check = clause(text, "with check");
+  if (isTrue(using) || isTrue(check)) {
+    return kind === "alter" ? "widens a policy to match every row" : "creates a policy that matches every row";
+  }
+  if (kind === "alter" && using === undefined && check === undefined)
+    return;
+  const tenant = policyExpression(input, table, `${table}_tenant`);
+  const unscoped = policyExpression(input, table, `${table}_unscoped_select`);
+  const emitted = !/\bas restrictive\b/.test(text) && (matchesEmitted(name, `${table}_tenant`, using, check, tenant) || matchesEmitted(name, `${table}_unscoped_select`, using, check, unscoped));
+  if (emitted)
+    return;
+  return kind === "alter" ? "widens a policy away from the tenant predicate" : "creates a policy that is not the tenant predicate";
+}
+function matchesEmitted(name, expectedName, using, check, expression) {
+  if (name !== expectedName || expression === undefined || using === undefined)
+    return false;
+  if (!sameExpression(using, expression))
+    return false;
+  return check === undefined || sameExpression(check, expression);
+}
+function sameExpression(found, expected) {
+  return found === expected || unwrap(found) === unwrap(expected);
+}
+function unwrap(expression) {
+  const body = expression.trim();
+  if (!body.startsWith("(") || !body.endsWith(")"))
+    return body;
+  let depth = 0;
+  for (let index = 0;index < body.length; index += 1) {
+    const char = body[index];
+    if (char === "(")
+      depth += 1;
+    else if (char === ")") {
+      depth -= 1;
+      if (depth === 0)
+        return index === body.length - 1 ? body.slice(1, -1).trim() : body;
+    }
+  }
+  return body;
+}
+function isTrue(expression) {
+  return expression !== undefined && expression.replaceAll(" ", "") === "(true)";
+}
+function clause(text, keyword) {
+  const needle = keyword === "using" ? /\busing\s*\(/g : /\bwith check\s*\(/g;
+  const found = needle.exec(text);
+  if (found === null)
+    return;
+  return parenthesized(text, found.index + found[0].length - 1);
+}
+function parenthesized(text, open) {
+  let depth = 0;
+  let quoted = false;
+  let single = false;
+  for (let index = open;index < text.length; index += 1) {
+    const char = text[index];
+    if (single) {
+      if (char === "'" && text[index + 1] === "'") {
+        index += 1;
+        continue;
+      }
+      if (char === "'")
+        single = false;
+      continue;
+    }
+    if (quoted) {
+      if (char === '"')
+        quoted = false;
+      continue;
+    }
+    if (char === "'") {
+      single = true;
+      continue;
+    }
+    if (char === '"') {
+      quoted = true;
+      continue;
+    }
+    if (char === "(")
+      depth += 1;
+    else if (char === ")") {
+      depth -= 1;
+      if (depth === 0)
+        return text.slice(open, index + 1);
+    }
+  }
+  return;
+}
+function policyExpression(input, table, name) {
+  const expression = expressionOf(input.after, table, name) ?? expressionOf(input.before, table, name);
+  return expression === undefined ? undefined : normalized(expression);
+}
+function expressionOf(source, table, name) {
+  for (const object of source.objects) {
+    if (object.kind !== "policy")
+      continue;
+    if (object.identity.parent.name !== table || object.identity.name !== name)
+      continue;
+    return object.definition.expression;
+  }
+  return;
+}
+function changesTenantOwner(input, text) {
+  const match = /^alter table\s+(\S+)\s+owner to\b/.exec(text);
+  const table = lastName(match?.[1]);
+  if (table === undefined)
+    return false;
+  return hasPolicy(input.before, table) || hasPolicy(input.after, table);
+}
+function hasPolicy(source, table) {
+  return source.objects.some((object) => object.kind === "policy" && object.identity.parent.name === table);
+}
 function dataStatement(step) {
   const text = normalized(step.sql);
   if (/^(?:do|call)\b/.test(text))
@@ -1161,15 +1388,15 @@ function lintCatalog(source) {
   return findings;
 }
 function lintMigrationDirectory(directory, pending) {
-  if (!existsSync(directory))
+  if (!existsSync2(directory))
     return [];
-  const names = readdirSync(directory).filter((file) => file.endsWith(".sql")).sort();
+  const names = readdirSync2(directory).filter((file) => file.endsWith(".sql")).sort();
   let before = catalog([]);
   const findings = [];
   for (const file of names) {
     const id = file.slice(0, -".sql".length);
-    const plan = parsePlan(readFileSync(join(directory, file), "utf8"));
-    const after = parseCatalog2(readFileSync(join(directory, `${id}.catalog.json`), "utf8"));
+    const plan = readMigrationPlan(join2(directory, file));
+    const after = parseCatalog2(readFileSync2(join2(directory, `${id}.catalog.json`), "utf8"));
     if (pending === undefined || pending.has(id)) {
       for (const item of lintPlan(plan, before, after)) {
         findings.push({ ...item, place: `${id} ${item.place}` });
@@ -1288,8 +1515,8 @@ function columnPlace(column) {
 }
 
 // src/tooling/migrate/project.ts
-import { existsSync as existsSync2, mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync2, writeFileSync } from "node:fs";
-import { basename, join as join2 } from "node:path";
+import { existsSync as existsSync3, mkdirSync, readdirSync as readdirSync3, readFileSync as readFileSync3, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, join as join3 } from "node:path";
 import { pathToFileURL } from "node:url";
 
 // src/dialects/pg/declarations.ts
@@ -1331,7 +1558,7 @@ function sqlIdentifier(name, casing) {
 }
 
 // src/dialects/pg/emit.ts
-function emitRowTypes(source) {
+function emitRowTypes(source, jsonTypes) {
   const lines = [
     "/**",
     " * Row types emitted from the schema.",
@@ -1349,13 +1576,13 @@ function emitRowTypes(source) {
     inserts.push(`  readonly ${key}: ${name}Insert;`);
     updates.push(`  readonly ${key}: ${name}Update;`);
     lines.push(`export interface ${name} {`);
-    lines.push(fields(item, "row", source));
+    lines.push(fields(item, "row", source, jsonTypes));
     lines.push("}", "");
     lines.push(`export interface ${name}Insert {`);
-    lines.push(fields(item, "insert", source));
+    lines.push(fields(item, "insert", source, jsonTypes));
     lines.push("}", "");
     lines.push(`export interface ${name}Update {`);
-    lines.push(fields(item, "update", source));
+    lines.push(fields(item, "update", source, jsonTypes));
     lines.push("}", "");
   }
   lines.push("export interface Rows {");
@@ -1388,7 +1615,74 @@ ${body}`;
 function propertyName(name) {
   return /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ? name : JSON.stringify(name);
 }
-function fields(item, kind, source) {
+function jsonColumnTypes(source) {
+  const text = source.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/\/\/[^\n]*/g, " ");
+  const found = new Map;
+  const pattern = /(?:\bt\s*\.\s*)?(jsonb|json)\s*</g;
+  for (const match of text.matchAll(pattern)) {
+    const open = (match.index ?? 0) + match[0].length - 1;
+    const argument = readGeneric(text, open);
+    const field = propertyBefore(text, match.index ?? 0);
+    const table = tableBefore(text, match.index ?? 0);
+    if (argument === undefined || field === undefined || table === undefined)
+      continue;
+    found.set(`${table}.${field}`, argument);
+  }
+  return found;
+}
+function readGeneric(source, open) {
+  if (source[open] !== "<")
+    return;
+  let depth = 0;
+  let quote;
+  for (let index = open;index < source.length; index += 1) {
+    const char = source[index];
+    if (char === undefined)
+      return;
+    if (quote !== undefined) {
+      if (char === "\\") {
+        index += 1;
+        continue;
+      }
+      if (char === quote)
+        quote = undefined;
+      continue;
+    }
+    if (char === "'" || char === '"' || char === "`") {
+      quote = char;
+      continue;
+    }
+    if (char === "<")
+      depth += 1;
+    else if (char === ">") {
+      depth -= 1;
+      if (depth === 0)
+        return source.slice(open + 1, index).trim().replace(/\s+/g, " ");
+    }
+  }
+  return;
+}
+function propertyBefore(source, index) {
+  let cursor = index;
+  while (cursor > 0 && /\s/.test(source[cursor - 1] ?? ""))
+    cursor -= 1;
+  if (source[cursor - 1] !== ":")
+    return;
+  cursor -= 1;
+  while (cursor > 0 && /\s/.test(source[cursor - 1] ?? ""))
+    cursor -= 1;
+  const end = cursor;
+  while (cursor > 0 && /[\w$]/.test(source[cursor - 1] ?? ""))
+    cursor -= 1;
+  const name = source.slice(cursor, end);
+  return /^[$A-Za-z_][\w$]*$/.test(name) ? name : undefined;
+}
+function tableBefore(source, index) {
+  const head = source.slice(0, index);
+  const tables = [...head.matchAll(/table\(\s*["']([^"']+)["']/g)];
+  return tables.at(-1)?.[1];
+}
+function fields(item, kind, source, jsonTypes) {
   const printed = [];
   const options = item.options;
   const entries = Object.entries(item.columns);
@@ -1406,7 +1700,7 @@ function fields(item, kind, source) {
     const state = builder.state;
     if (kind === "row") {
       if (!state.hidden) {
-        printed.push(`  readonly ${field}: ${valueType(state)};`);
+        printed.push(`  readonly ${field}: ${valueType(state, jsonTypes?.get(`${item.name}.${field}`))};`);
       }
       continue;
     }
@@ -1415,7 +1709,7 @@ function fields(item, kind, source) {
       continue;
     }
     const mode = kind === "update" ? "optional" : written;
-    const label = valueType(state);
+    const label = valueType(state, jsonTypes?.get(`${item.name}.${field}`));
     printed.push(mode === "optional" ? `  readonly ${field}?: ${label};` : `  readonly ${field}: ${label};`);
   }
   return printed.join(`
@@ -1435,8 +1729,8 @@ function updateMode(state) {
     return "omit";
   return "optional";
 }
-function valueType(state) {
-  let label = scalarLabel(state);
+function valueType(state, jsonArg) {
+  let label = scalarLabel(state, jsonArg);
   if (state.dims > 0) {
     for (let rank = 0;rank < state.dims; rank += 1) {
       label = `readonly (${label})[]`;
@@ -1447,7 +1741,7 @@ function valueType(state) {
   }
   return label;
 }
-function scalarLabel(state) {
+function scalarLabel(state, jsonArg) {
   if (state.picklist !== undefined) {
     return state.picklist.values.map((value) => JSON.stringify(value)).join(" | ");
   }
@@ -1480,9 +1774,9 @@ function scalarLabel(state) {
     case "bytea":
       return "Uint8Array";
     case "json":
-      return "json<unknown>";
+      return `json<${jsonArg ?? "unknown"}>`;
     case "jsonb":
-      return "jsonb<unknown>";
+      return `jsonb<${jsonArg ?? "unknown"}>`;
     case "timestamptz":
       return "Temporal.Instant";
     case "timestamp":
@@ -1526,17 +1820,34 @@ function baseName(dataType) {
 }
 
 // src/dialects/pg/role/index.ts
+class RoleDeclarationError extends OkmError2 {
+  reason;
+  constructor(reason, message) {
+    super("invalid", message, {
+      kind: "invalid",
+      fix: {
+        summary: reason === "reporting_write" ? "Grant select, or use the application role for writes." : "Give the reporting role its own name."
+      }
+    });
+    this.name = "OkmError";
+    this.reason = reason;
+  }
+}
 var PROVENANCE = { origin: "file", name: "roles" };
 var RELATION = ["SELECT", "INSERT", "UPDATE", "DELETE"];
 var READ = ["SELECT"];
 var ROUTINE = ["EXECUTE"];
 var SEQUENCE = ["USAGE", "SELECT"];
-function attachRoles(source, input) {
-  return catalog([...source.objects, ...contributeRoles(input, source.objects)]);
+function attachRoles(source, input, exposure) {
+  return catalog([...source.objects, ...contributeRoles(input, source.objects, exposure)]);
 }
-function contributeRoles(input, built) {
+function contributeRoles(input, built, exposure) {
   const migration = requireName(input.migration, "migration");
   const app = requireName(input.app, "app");
+  const reporting = input.reporting === undefined ? undefined : requireName(input.reporting, "reporting");
+  if (reporting !== undefined && (reporting === app || reporting === migration)) {
+    throw new RoleDeclarationError("reporting_distinct", `Role ${reporting} cannot be the reporting role and also migration or app.`);
+  }
   const managed = new Map;
   for (const role of input.managed ?? []) {
     const name = requireName(role.name, "managed role");
@@ -1544,6 +1855,10 @@ function contributeRoles(input, built) {
   }
   const objects = [];
   const names = new Set([migration, app, ...managed.keys()]);
+  if (reporting !== undefined)
+    names.add(reporting);
+  for (const grant of input.columns ?? [])
+    names.add(requireName(grant.role, "column grant role"));
   for (const name of [...names].sort()) {
     const declaration = managed.get(name);
     objects.push(roleObject({
@@ -1558,8 +1873,10 @@ function contributeRoles(input, built) {
   }
   const roleIdentity = (name) => ({ kind: "role", name });
   const namespaces = new Set;
+  const exposed = indexExposure(exposure);
+  const columnGrants = new Map;
   for (const object of built) {
-    if (object.owner === "ignored")
+    if (object.owner === "ignored" || object.owner === "external")
       continue;
     const ref = grantRef(object);
     if (ref === undefined)
@@ -1577,6 +1894,7 @@ function contributeRoles(input, built) {
       }));
     }
   }
+  const relations = built.filter((object) => object.owner !== "ignored" && object.owner !== "external" && (object.kind === "table" || object.kind === "view" || object.kind === "materializedView"));
   const schemas = namespaces.size === 0 ? ["public"] : [...namespaces].sort();
   for (const name of schemas) {
     const namespace = staticNamespace2(name);
@@ -1597,6 +1915,45 @@ function contributeRoles(input, built) {
         }));
       }
     }
+    if (reporting !== undefined) {
+      objects.push(grantObject({
+        role: reporting,
+        object: { kind: "namespace", namespace, name },
+        privilege: "USAGE",
+        provenance: PROVENANCE,
+        dependencies: [roleIdentity(reporting)]
+      }));
+      objects.push(defaultPrivilegeObject({
+        forRole: migration,
+        namespace,
+        objectKind: "table",
+        grantee: reporting,
+        privilege: "SELECT",
+        provenance: PROVENANCE,
+        dependencies: [roleIdentity(migration), roleIdentity(reporting)]
+      }));
+    }
+  }
+  for (const grant of input.columns ?? []) {
+    noteColumnGrant(columnGrants, grant, built, exposed, reporting);
+  }
+  if (reporting !== undefined) {
+    for (const object of relations) {
+      const ref = grantRef(object);
+      if (ref === undefined)
+        continue;
+      noteReportingSelect(columnGrants, objects, reporting, object, ref, exposed, built);
+    }
+  }
+  for (const pending of [...columnGrants.values()].sort((left, right) => left.key < right.key ? -1 : left.key > right.key ? 1 : 0)) {
+    const target = pending.target;
+    objects.push(grantObject({
+      role: pending.role,
+      object: pending.object,
+      privilege: columnPrivilege(pending.privilege, [...pending.columns].sort()),
+      provenance: PROVENANCE,
+      dependencies: [roleIdentity(pending.role), target.identity]
+    }));
   }
   return objects;
 }
@@ -1638,6 +1995,137 @@ function privilegesFor(kind) {
 function objectIdentity(object) {
   return object.identity;
 }
+function indexExposure(exposure) {
+  const indexed = new Map;
+  for (const table of exposure ?? [])
+    indexed.set(table.table, table);
+  return indexed;
+}
+function noteReportingSelect(pending, objects, role, target, ref, exposed, built) {
+  const key = columnKey(role, ref, "SELECT");
+  const declared = pending.get(key);
+  if (ref.kind === "view" || ref.kind === "materializedView") {
+    if (declared !== undefined)
+      return;
+    objects.push(selectGrant(role, ref, target));
+    return;
+  }
+  const visible = visibleColumns(ref.name, exposed, built);
+  const hidden = hiddenColumns(ref.name, exposed);
+  if (hidden.size === 0) {
+    pending.delete(key);
+    objects.push(selectGrant(role, ref, target));
+    return;
+  }
+  const columns = new Set(visible);
+  for (const name of declared?.columns ?? [])
+    columns.add(name);
+  if (columns.size === 0) {
+    pending.delete(key);
+    return;
+  }
+  const next = declared ?? openColumnGrant(role, ref, "SELECT", target);
+  next.columns.clear();
+  for (const name of columns)
+    next.columns.add(name);
+  pending.set(key, next);
+}
+function selectGrant(role, ref, target) {
+  return grantObject({
+    role,
+    object: ref,
+    privilege: "SELECT",
+    provenance: PROVENANCE,
+    dependencies: [{ kind: "role", name: role }, target.identity]
+  });
+}
+function noteColumnGrant(pending, grant, built, exposed, reporting) {
+  const role = requireName(grant.role, "column grant role");
+  const target = findRelation(built, grant.on);
+  if (target.owner === "ignored") {
+    throw new OkmError2("invalid", `Column grant on ${grant.on} targets an ignored table.`, {
+      fix: { summary: "Remove the grant, or mark the table external." }
+    });
+  }
+  const ref = grantRef(target);
+  if (ref === undefined) {
+    throw new OkmError2("OKM1020", `Column grant on ${grant.on} is not a table or a view.`, {
+      fix: { summary: "Name a table, view, or materialized view in the schema." }
+    });
+  }
+  for (const privilege of ["select", "update"]) {
+    const names = grant[privilege];
+    if (names === undefined || names.length === 0)
+      continue;
+    if (role === reporting && privilege === "update") {
+      throw new RoleDeclarationError("reporting_write", `Role ${role} is the reporting role and cannot be granted update.`);
+    }
+    const upper = privilege === "select" ? "SELECT" : "UPDATE";
+    const resolved = names.map((name) => resolveColumn(target, built, ref.name, name, exposed));
+    const current = pending.get(columnKey(role, ref, upper)) ?? openColumnGrant(role, ref, upper, target);
+    for (const name of resolved)
+      current.columns.add(name);
+    pending.set(current.key, current);
+  }
+}
+function openColumnGrant(role, object, privilege, target) {
+  return {
+    key: columnKey(role, object, privilege),
+    role,
+    privilege,
+    object,
+    target,
+    columns: new Set
+  };
+}
+function columnKey(role, object, privilege) {
+  const namespace = object.namespace.form === "static" ? object.namespace.name : object.namespace.pattern;
+  return `${role}\x00${object.kind}\x00${namespace}\x00${object.name}\x00${privilege}`;
+}
+function findRelation(built, name) {
+  const found = built.filter((object) => (object.kind === "table" || object.kind === "view" || object.kind === "materializedView") && object.identity.name === name);
+  const target = found[0];
+  if (target === undefined) {
+    throw new OkmError2("OKM1020", `Column grant names ${name}, which is not in the schema.`, {
+      fix: { summary: "Use the SQL name of a table, view, or materialized view." }
+    });
+  }
+  if (found.length > 1) {
+    throw new OkmError2("OKM1020", `Column grant on ${name} matches more than one object.`, {
+      fix: { summary: "Rename one of the objects so the grant names one." }
+    });
+  }
+  return target;
+}
+function resolveColumn(target, built, table, name, exposed) {
+  const known = exposed.get(table);
+  const fromField = known?.columns.find((column) => column.field === name || column.sql === name);
+  if (fromField !== undefined)
+    return fromField.sql;
+  const sqlNames = columnNames(target, built, table);
+  if (sqlNames.includes(name))
+    return name;
+  throw new OkmError2("OKM1020", `Column ${table}.${name} is not in the schema.`, {
+    fix: { summary: "Name a column of that table or view." }
+  });
+}
+function visibleColumns(table, exposed, built) {
+  const known = exposed.get(table);
+  if (known !== undefined) {
+    return known.columns.filter((column) => !column.hidden).map((column) => column.sql);
+  }
+  return built.flatMap((object) => object.kind === "column" && object.identity.parent.name === table ? [object.identity.name] : []);
+}
+function hiddenColumns(table, exposed) {
+  const known = exposed.get(table);
+  return new Set((known?.columns ?? []).filter((column) => column.hidden).map((column) => column.sql));
+}
+function columnNames(target, built, table) {
+  if (target.kind === "view" || target.kind === "materializedView") {
+    return target.definition.columns.map((column) => column.name);
+  }
+  return built.flatMap((object) => object.kind === "column" && object.identity.parent.name === table ? [object.identity.name] : []);
+}
 
 // src/tooling/migrate/estimate.ts
 var LARGE_TABLE_ROWS = 1e6;
@@ -1677,15 +2165,13 @@ async function readRowEstimates(url, schema, tables) {
       return map;
     } catch (error) {
       if (began)
-        await connection.execute("rollback").catch(() => {
-          return;
-        });
-      throw error;
+        await finishQuiet(() => connection.execute("rollback"));
+      throw sessionFailure(error) ?? error;
     } finally {
-      await connection.release();
+      await finishQuiet(() => connection.release());
     }
   } finally {
-    await pool.close();
+    await finishQuiet(() => pool.close());
   }
 }
 function annotateLock(step, estimates, aliases = new Map) {
@@ -1842,15 +2328,17 @@ async function buildProject(cwd) {
 }
 async function generateProject(cwd, name, flags) {
   const prepared = await prepare(cwd, name, flags);
+  if (name === "init")
+    writeGitAttributes(cwd);
   writeArtifact(cwd, prepared.config, prepared.built);
   if (prepared.plan.steps.length === 0)
     return;
-  const directory = join2(cwd, prepared.config.migrations ?? "migrations");
+  const directory = projectPath(cwd, prepared.config.migrations ?? "migrations");
   mkdirSync(directory, { recursive: true });
   const base = `${nextNumber(directory)}_${safeName(name)}`;
-  const sqlPath = join2(directory, `${base}.sql`);
+  const sqlPath = join3(directory, `${base}.sql`);
   writeFileSync(sqlPath, formatPlan(prepared.plan));
-  writeFileSync(join2(directory, `${base}.catalog.json`), serializeCatalog2(prepared.built.catalog));
+  writeFileSync(join3(directory, `${base}.catalog.json`), serializeCatalog2(prepared.built.catalog));
   return { path: sqlPath, findings: lintPrepared(prepared) };
 }
 async function planProject(cwd, name, flags, invoke) {
@@ -1873,9 +2361,9 @@ async function checkProject(cwd, flags) {
   const targets = listTargets(opened.config);
   assertTargetAlias(targets);
   if (opened.config.tables !== undefined) {
-    const directory = join2(cwd, opened.config.tables);
-    const files = existsSync2(directory) ? readdirSync2(directory) : [];
-    const source = readFileSync2(join2(cwd, opened.config.schema), "utf8");
+    const directory = projectPath(cwd, opened.config.tables);
+    const files = existsSync3(directory) ? readdirSync3(directory) : [];
+    const source = readFileSync3(projectPath(cwd, opened.config.schema), "utf8");
     const missing = unlistedTableFiles(source, files);
     if (missing.length > 0) {
       throw new OkmError2("OKM1024", `Table file not in schema: ${missing.join(", ")}.`, {
@@ -1894,7 +2382,7 @@ async function checkProject(cwd, flags) {
   const target = selectTarget(opened.config, named);
   assertTargetPolicy(target, "check", flags?.allowProtected ?? false);
   assertTargetPolicy(target, "drift", flags?.allowProtected ?? false);
-  const { assertAuthorDrift } = await import("./6qd27mx0.js");
+  const { assertAuthorDrift } = await import("./1f0xa3cb.js");
   const allowPooler = flags?.allowPooler === true || opened.config.allowPooler === true;
   await assertAuthorDrift(target.url, opened.built.catalog, opened.config.roles, allowPooler);
   return findings;
@@ -1975,7 +2463,7 @@ async function openProject(cwd) {
   const config = await loadConfig(cwd);
   const built = withRoles(await loadSchema(cwd, config.schema), config);
   const declarations = schemaDeclarations(built);
-  const previous = readPrevious(join2(cwd, config.migrations ?? "migrations"));
+  const previous = readPrevious(projectPath(cwd, config.migrations ?? "migrations"));
   const stale = staleRenames(previous?.catalog, declarations.renames);
   if (stale.length > 0) {
     throw new OkmError2("OKM1020", stale.join(" "), {
@@ -1990,25 +2478,108 @@ async function openProject(cwd) {
   };
 }
 function withRoles(built, config) {
-  if (config.roles === undefined)
+  const marks = ownershipMarks(built);
+  const stamped = marks.size === 0 ? built.catalog : stampOwnership(built.catalog, marks);
+  const roles = config.roles;
+  const catalog = roles === undefined ? stamped : attachRoles(stamped, roles, exposureFor(built, roles));
+  if (catalog === built.catalog)
     return built;
-  return { ...built, catalog: attachRoles(built.catalog, config.roles) };
+  return { ...built, catalog };
+}
+function ownershipMarks(built) {
+  const marks = new Map;
+  const models = built.model;
+  for (const table of built.tables) {
+    const owner = tableOwner(table);
+    if (owner === undefined)
+      continue;
+    const model = models[table.name];
+    if (model === undefined)
+      continue;
+    marks.set(model.sql, owner);
+  }
+  return marks;
+}
+function exposureFor(built, roles) {
+  if (roles.reporting === undefined && (roles.columns === undefined || roles.columns.length === 0)) {
+    return;
+  }
+  return Object.values(built.model).map((model) => ({
+    table: model.sql,
+    columns: model.columns.map((column) => ({
+      field: column.field,
+      sql: column.sql,
+      hidden: column.hidden === true || column.hidden === "filter"
+    }))
+  }));
+}
+var GIT_ATTRIBUTES = [
+  "migrations/*.sql text eol=lf",
+  "*.catalog.json text eol=lf",
+  ".okm/** text eol=lf",
+  ""
+].join(`
+`);
+function writeGitAttributes(cwd) {
+  const path = projectPath(cwd, ".gitattributes");
+  if (existsSync3(path))
+    return;
+  writeFileSync(path, GIT_ATTRIBUTES);
+}
+function typesText(cwd, spec, built) {
+  return `${emitRowTypes(built, jsonColumnTypes(readSchemaSource(cwd, spec)))}${referenceAugmentation(built)}`;
+}
+function readSchemaSource(cwd, spec) {
+  const parts = [];
+  const seen = new Set;
+  const visit = (file) => {
+    if (seen.has(file) || !existsSync3(file))
+      return;
+    let stat;
+    try {
+      stat = statSync(file);
+    } catch {
+      return;
+    }
+    if (!stat.isFile())
+      return;
+    seen.add(file);
+    const text = readFileSync3(file, "utf8");
+    parts.push(text);
+    for (const match of text.matchAll(/from\s+["'](\.[^"']+)["']/g)) {
+      const rel = match[1];
+      if (rel === undefined)
+        continue;
+      const base = join3(dirname(file), rel);
+      const candidates = [base, `${base}.ts`, `${base}.tsx`, `${base}.mts`, join3(base, "index.ts")];
+      for (const candidate of candidates) {
+        if (existsSync3(candidate)) {
+          visit(candidate);
+          break;
+        }
+      }
+    }
+  };
+  visit(projectPath(cwd, spec));
+  return parts.join(`
+`);
 }
 function writeArtifact(cwd, config, built) {
-  const directory = join2(cwd, config.out ?? ".okm");
+  const directory = projectPath(cwd, config.out ?? ".okm");
   mkdirSync(directory, { recursive: true });
   const startup = startupCatalog2(built.catalog);
-  writeFileSync(join2(directory, "catalog.json"), serializeCatalog2(startup));
-  writeFileSync(join2(directory, "catalog.hash"), `${catalogHash2(startup)}
+  const text = catalogFileText2(serializeCatalog2(startup));
+  writeFileSync(join3(directory, "catalog.json"), text);
+  writeFileSync(join3(directory, "catalog.hash"), `${sha2562(text)}
 `);
-  writeFileSync(join2(directory, "types.d.ts"), `${emitRowTypes(built)}${referenceAugmentation(built)}`);
+  writeFileSync(join3(directory, "types.d.ts"), typesText(cwd, config.schema, built));
   return directory;
 }
 async function loadBuiltSchema(cwd, config) {
   return withRoles(await loadSchema(cwd, config.schema), config);
 }
 async function loadConfig(cwd) {
-  const path = join2(cwd, "okmodel.config.ts");
+  const path = projectPath(cwd, "okmodel.config.ts");
   const imported = await import(`${pathToFileURL(path).href}?okm=${Date.now()}`);
   const record = isRecord(imported) ? imported : {};
   const config = record.default ?? record.config;
@@ -2018,7 +2589,7 @@ async function loadConfig(cwd) {
   return config;
 }
 async function loadSchema(cwd, spec) {
-  const path = join2(cwd, spec);
+  const path = projectPath(cwd, spec);
   const imported = await import(`${pathToFileURL(path).href}?okm=${Date.now()}`);
   const record = isRecord(imported) ? imported : {};
   for (const value of Object.values(record)) {
@@ -2030,13 +2601,13 @@ async function loadSchema(cwd, spec) {
   throw new OkmError2("invalid", `${spec} must export a schema().`);
 }
 function readPrevious(directory) {
-  if (!existsSync2(directory))
+  if (!existsSync3(directory))
     return;
-  const catalogs = readdirSync2(directory).filter((file) => file.endsWith(".catalog.json")).sort();
+  const catalogs = readdirSync3(directory).filter((file) => file.endsWith(".catalog.json")).sort();
   const latest = catalogs.at(-1);
   if (latest === undefined)
     return;
-  const text = readFileSync2(join2(directory, latest), "utf8");
+  const text = readFileSync3(join3(directory, latest), "utf8");
   return { catalog: parseCatalog2(text) };
 }
 function referenceAugmentation(source) {
@@ -2061,8 +2632,8 @@ function referenceAugmentation(source) {
 }
 function nextNumber(directory) {
   let max = 0;
-  if (existsSync2(directory)) {
-    for (const file of readdirSync2(directory)) {
+  if (existsSync3(directory)) {
+    for (const file of readdirSync3(directory)) {
       const match = /^(\d+)_/.exec(file);
       const value = match?.[1];
       if (value !== undefined)
@@ -2103,14 +2674,14 @@ function projectImportsValidate(cwd) {
 function directoryImportsValidate(dir) {
   let entries;
   try {
-    entries = readdirSync2(dir, { withFileTypes: true });
+    entries = readdirSync3(dir, { withFileTypes: true });
   } catch {
     return false;
   }
   for (const entry of entries) {
     if (entry.name.startsWith(".") || SKIP_SCAN.has(entry.name))
       continue;
-    const path = join2(dir, entry.name);
+    const path = join3(dir, entry.name);
     if (entry.isDirectory()) {
       if (directoryImportsValidate(path))
         return true;
@@ -2118,7 +2689,7 @@ function directoryImportsValidate(dir) {
     }
     if (!/\.(?:ts|tsx|mts|cts)$/.test(entry.name))
       continue;
-    if (runtimeImportsValidate(readFileSync2(path, "utf8")))
+    if (runtimeImportsValidate(readFileSync3(path, "utf8")))
       return true;
   }
   return false;
@@ -2140,4 +2711,4 @@ function runtimeImportsValidate(source) {
   return false;
 }
 
-export { errorDoc, lintMigrationDirectory, formatFindings, hasError, lintRefusal, buildProject, generateProject, planProject, checkProject, projectHead, openProject, loadBuiltSchema, loadConfig, loadSchema };
+export { projectPath, errorDoc, loadMigrations, readMigrationPlan, loadHeadSnapshot, lintMigrationDirectory, formatFindings, hasError, lintRefusal, buildProject, generateProject, planProject, checkProject, projectHead, openProject, loadBuiltSchema, loadConfig, loadSchema };