okmodel 0.5.1 → 0.6.0

package/dist/shared/{ga3sfy93.js → ttmg09vd.js}

@@ -2,29 +2,35 @@ import {
   creationOrder2,
   renameColumn2,
   renameTable2
-} from "./8bwbwy8h.js";
+} from "./qq3899ht.js";
+import {
+  isConnectionLost
+} from "./gwn6v667.js";
 import {
   quoteIdent,
+  uniqueBeforeForeignKey,
   ownedByView,
   dropObjectSql,
   createObjectSql,
   functionSql,
   viewSql,
+  policyCreatePlan,
+  policyDropPlan,
   refreshMaterializedViewSql,
   alterColumnSql,
   identitySequence,
   createTableSql,
   qualify
-} from "./8xsbagad.js";
+} from "./9s0ypp87.js";
 import {
   isExactVersion,
   compareExtensionVersions,
   sameExtensionDefinition
-} from "./8ktwd3rh.js";
+} from "./r3j8s5y0.js";
 import {
   isDomain,
   sameEnumLabels
-} from "./g7ez901n.js";
+} from "./ywspezzx.js";
 import {
   quoteLiteral
 } from "./94ez8kzh.js";
@@ -33,7 +39,7 @@ import {
   identityKey2,
   identityLabel2,
   compareText
-} from "./t4tbsy9h.js";
+} from "./358zsv4r.js";
 import {
   fitIdentifier2
 } from "./nfzc5z0w.js";
@@ -41,6 +47,332 @@ import {
   OkmError2
 } from "./52szzakm.js";
 
+// src/tooling/migrate/sql-lex.ts
+function sqlStatements(sql) {
+  return scan(sql).statements;
+}
+function sqlQuoteOpen(sql) {
+  return scan(sql).open;
+}
+function scan(sql) {
+  const statements = [];
+  const parts = [];
+  let index = 0;
+  let open = false;
+  let atomic = 0;
+  const flush = () => {
+    const text = parts.join("").trim();
+    parts.length = 0;
+    if (text.length > 0)
+      statements.push(text);
+  };
+  while (index < sql.length) {
+    if (sql.startsWith("--", index)) {
+      parts.push(" ");
+      index = lineCommentEnd(sql, index + 2);
+      continue;
+    }
+    if (sql.startsWith("/*", index)) {
+      parts.push(" ");
+      const block = blockComment(sql, index + 2);
+      index = block.index;
+      if (block.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    const dollar = dollarAt(sql, index);
+    if (dollar !== undefined) {
+      const closed = takeDollar(sql, dollar);
+      parts.push(sql.slice(index, closed.index));
+      index = closed.index;
+      if (closed.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    if (isEscapeString(sql, index)) {
+      const quote = takeQuoted(sql, index + 2, true);
+      parts.push(sql.slice(index, quote.index));
+      index = quote.index;
+      if (quote.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    const char = sql[index];
+    if (char === "'") {
+      const quote = takeQuoted(sql, index + 1, false);
+      parts.push(sql.slice(index, quote.index));
+      index = quote.index;
+      if (quote.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    if (char === '"') {
+      const quote = takeIdent(sql, index + 1);
+      parts.push(sql.slice(index, quote.index));
+      index = quote.index;
+      if (quote.open) {
+        open = true;
+        break;
+      }
+      continue;
+    }
+    if (char === ";") {
+      if (atomic === 0)
+        flush();
+      else
+        parts.push(";");
+      index += 1;
+      continue;
+    }
+    if (isIdentStart(sql.charCodeAt(index))) {
+      const word = readWord(sql, index);
+      const lower = word.toLowerCase();
+      if (atomic > 0 && lower === "case")
+        atomic += 1;
+      else if (atomic > 0 && lower === "end")
+        atomic -= 1;
+      else if (lower === "begin" && nextWordIs(sql, index + word.length, "atomic")) {
+        if (atomic > 0 || isRoutineHead(parts.join("")))
+          atomic += 1;
+      }
+      parts.push(word);
+      index += word.length;
+      continue;
+    }
+    parts.push(char ?? "");
+    index += 1;
+  }
+  flush();
+  return { statements, open: open || atomic > 0 };
+}
+function transactionControl(sql) {
+  for (const statement of sqlStatements(sql)) {
+    const top = controlWord(statement, false);
+    if (top !== undefined)
+      return top;
+    if (!isDo(statement))
+      continue;
+    for (const body of dollarBodies(statement)) {
+      for (const inner of sqlStatements(body)) {
+        const hit = controlWord(inner, true);
+        if (hit !== undefined)
+          return hit;
+      }
+    }
+  }
+  return;
+}
+function isDo(statement) {
+  return /^do(?:\s|$)/i.test(statement.trim());
+}
+function controlWord(statement, insideBody) {
+  let text = statement.trim().replace(/\s+/g, " ").toLowerCase();
+  if (insideBody && /^begin(?:\s|$)/.test(text) && !/^begin\s+(?:work|transaction)\b/.test(text)) {
+    text = text.replace(/^begin\s+/, "").trim();
+    if (text.length === 0)
+      return;
+  }
+  if (/^commit(?:\s+(?:work|transaction|prepared\b.*))?$/.test(text))
+    return "commit";
+  if (text === "abort")
+    return "abort";
+  if (/^rollback(?:\s+(?:work|transaction|prepared\b.*))?$/.test(text))
+    return "rollback";
+  if (/^prepare\s+transaction\b/.test(text))
+    return "prepare transaction";
+  if (/^start\s+transaction\b/.test(text))
+    return "start transaction";
+  if (/^begin(?:\s+(?:work|transaction)\b.*)?$/.test(text) || /^begin\s+\S/.test(text)) {
+    if (insideBody && !/^begin\s+(?:work|transaction)\b/.test(text))
+      return;
+    return "begin";
+  }
+  if (/^end(?:\s+(?:work|transaction))?$/.test(text)) {
+    if (insideBody && text === "end")
+      return;
+    return "end";
+  }
+  return;
+}
+function dollarBodies(sql) {
+  const bodies = [];
+  let index = 0;
+  while (index < sql.length) {
+    if (sql.startsWith("--", index)) {
+      index = lineCommentEnd(sql, index + 2);
+      continue;
+    }
+    if (sql.startsWith("/*", index)) {
+      index = blockComment(sql, index + 2).index;
+      continue;
+    }
+    if (isEscapeString(sql, index)) {
+      index = takeQuoted(sql, index + 2, true).index;
+      continue;
+    }
+    if (sql[index] === "'") {
+      index = takeQuoted(sql, index + 1, false).index;
+      continue;
+    }
+    if (sql[index] === '"') {
+      index = takeIdent(sql, index + 1).index;
+      continue;
+    }
+    const dollar = dollarAt(sql, index);
+    if (dollar !== undefined) {
+      const closed = takeDollar(sql, dollar);
+      if (!closed.open) {
+        const closer = `$${dollar.tag}$`.length;
+        bodies.push(sql.slice(dollar.end, closed.index - closer));
+      }
+      index = closed.index;
+      continue;
+    }
+    index += 1;
+  }
+  return bodies;
+}
+function readWord(sql, index) {
+  let cursor = index + 1;
+  while (isIdentCont(sql.charCodeAt(cursor)))
+    cursor += 1;
+  return sql.slice(index, cursor);
+}
+function nextWordIs(sql, index, expected) {
+  const at = skipTrivia(sql, index);
+  if (!isIdentStart(sql.charCodeAt(at)))
+    return false;
+  return readWord(sql, at).toLowerCase() === expected;
+}
+function skipTrivia(sql, index) {
+  while (index < sql.length) {
+    const code = sql.charCodeAt(index);
+    if (code === 32 || code === 9 || code === 10 || code === 13) {
+      index += 1;
+      continue;
+    }
+    if (sql.startsWith("--", index)) {
+      index = lineCommentEnd(sql, index + 2);
+      continue;
+    }
+    if (sql.startsWith("/*", index)) {
+      const block = blockComment(sql, index + 2);
+      if (block.open)
+        return sql.length;
+      index = block.index;
+      continue;
+    }
+    return index;
+  }
+  return index;
+}
+function isRoutineHead(text) {
+  return /^create(?:\s+or\s+replace)?\s+(?:function|procedure)\b/i.test(text.replace(/\s+/g, " ").trim());
+}
+function lineCommentEnd(sql, index) {
+  while (index < sql.length && sql.charCodeAt(index) !== 10)
+    index += 1;
+  return index;
+}
+function blockComment(sql, index) {
+  let depth = 1;
+  while (index < sql.length) {
+    if (sql.startsWith("/*", index)) {
+      depth += 1;
+      index += 2;
+      continue;
+    }
+    if (sql.startsWith("*/", index)) {
+      depth -= 1;
+      index += 2;
+      if (depth === 0)
+        return { index, open: false };
+      continue;
+    }
+    index += 1;
+  }
+  return { index, open: true };
+}
+function dollarAt(sql, index) {
+  if (sql.charCodeAt(index) !== 36)
+    return;
+  const next = index + 1;
+  if (sql.charCodeAt(next) === 36)
+    return { tag: "", end: next + 1 };
+  if (!isIdentStart(sql.charCodeAt(next)))
+    return;
+  let cursor = next + 1;
+  while (isIdentCont(sql.charCodeAt(cursor)))
+    cursor += 1;
+  if (sql.charCodeAt(cursor) !== 36)
+    return;
+  return { tag: sql.slice(next, cursor), end: cursor + 1 };
+}
+function takeDollar(sql, dollar) {
+  const closer = `$${dollar.tag}$`;
+  const found = sql.indexOf(closer, dollar.end);
+  if (found === -1)
+    return { index: sql.length, open: true };
+  return { index: found + closer.length, open: false };
+}
+function takeQuoted(sql, index, escape) {
+  while (index < sql.length) {
+    const char = sql[index];
+    if (escape && char === "\\") {
+      if (index + 1 >= sql.length)
+        return { index: sql.length, open: true };
+      index += 2;
+      continue;
+    }
+    if (char === "'") {
+      if (sql[index + 1] === "'") {
+        index += 2;
+        continue;
+      }
+      return { index: index + 1, open: false };
+    }
+    index += 1;
+  }
+  return { index, open: true };
+}
+function takeIdent(sql, index) {
+  while (index < sql.length) {
+    if (sql[index] === '"') {
+      if (sql[index + 1] === '"') {
+        index += 2;
+        continue;
+      }
+      return { index: index + 1, open: false };
+    }
+    index += 1;
+  }
+  return { index, open: true };
+}
+function isEscapeString(sql, index) {
+  const code = sql.charCodeAt(index);
+  if (code !== 69 && code !== 101)
+    return false;
+  if (sql.charCodeAt(index + 1) !== 39)
+    return false;
+  if (index > 0 && isIdentCont(sql.charCodeAt(index - 1)))
+    return false;
+  return true;
+}
+function isIdentStart(code) {
+  return code >= 65 && code <= 90 || code >= 97 && code <= 122 || code === 95;
+}
+function isIdentCont(code) {
+  return isIdentStart(code) || code >= 48 && code <= 57;
+}
+
 // src/tooling/migrate/type-name.ts
 function canonicalTypeName(typeName) {
   const suffix = arraySuffix(typeName);
@@ -108,6 +440,10 @@ function canonicalTime(name, precision) {
 
 // src/dialects/pg/role/sql.ts
 var PRIVILEGE = /^(select|insert|update|delete|execute|usage)$/;
+var COLUMN_PRIVILEGE = /^(select|update)\(([^)]*)\)$/i;
+function columnPrivilege(name, columns) {
+  return `${name.toUpperCase()}(${[...columns].sort().join(",")})`;
+}
 function privilegeSql(before, after, schema, recreated = new Set) {
   const beforeBy = index(before);
   const afterBy = index(after);
@@ -145,7 +481,13 @@ function privilegeSql(before, after, schema, recreated = new Set) {
       const target = grantTargetKey(object.identity.object);
       if (previous !== undefined && (target === undefined || !recreated.has(target)))
         continue;
+      const tighten = tightenColumnSelect(object, after, schema);
+      if (tighten !== undefined)
+        grant.push(tighten);
       grant.push({ sql: grantStatement(object, schema, false), kind: "grant" });
+      const writes = revokeMatviewWrites(object, after, schema);
+      if (writes !== undefined)
+        grant.push(writes);
       continue;
     }
     if (previous !== undefined)
@@ -191,12 +533,48 @@ function login(object) {
 function inherit(object) {
   return object.definition.inherit ? "inherit" : "noinherit";
 }
+function tightenColumnSelect(object, after, schema) {
+  if (!/^select\([^)]*\)$/.test(object.identity.privilege.toLowerCase()))
+    return;
+  const target = object.identity.object;
+  const covered = after.some((item) => item.kind === "grant" && item.identity.role === object.identity.role && item.identity.privilege.toUpperCase() === "SELECT" && item.identity.object.kind === target.kind && item.identity.object.name === target.name);
+  if (covered)
+    return;
+  return {
+    sql: `revoke select on ${grantTarget(target, schema)} from ${quoteIdent(object.identity.role)}`,
+    kind: "revoke"
+  };
+}
+function revokeMatviewWrites(object, after, schema) {
+  if (object.identity.privilege.toUpperCase() !== "SELECT")
+    return;
+  const target = object.identity.object;
+  if (target.kind !== "materializedView")
+    return;
+  const inheritsWrites = after.some((item) => item.kind === "defaultPrivilege" && item.identity.grantee === object.identity.role && item.identity.objectKind === "table" && (item.identity.privilege === "INSERT" || item.identity.privilege === "UPDATE" || item.identity.privilege === "DELETE"));
+  if (!inheritsWrites)
+    return;
+  return {
+    sql: `revoke insert, update, delete on ${grantTarget(target, schema)} from ${quoteIdent(object.identity.role)}`,
+    kind: "revoke"
+  };
+}
 function grantStatement(object, schema, revoke) {
-  const privilege = object.identity.privilege.toLowerCase();
-  assertPrivilege(privilege);
+  const privilege = object.identity.privilege;
+  const column = COLUMN_PRIVILEGE.exec(privilege);
   const verb = revoke ? "revoke" : "grant";
   const direction = revoke ? "from" : "to";
-  return `${verb} ${privilege} on ${grantTarget(object.identity.object, schema)} ${direction} ${quoteIdent(object.identity.role)}`;
+  const target = grantTarget(object.identity.object, schema);
+  const role = quoteIdent(object.identity.role);
+  const listed = column?.[2];
+  const base = column?.[1];
+  if (listed !== undefined && base !== undefined) {
+    const names = listed.split(",").filter((name) => name.length > 0).map((name) => quoteIdent(name)).join(", ");
+    return `${verb} ${base.toLowerCase()} (${names}) on ${target} ${direction} ${role}`;
+  }
+  const keyword = privilege.toLowerCase();
+  assertPrivilege(keyword);
+  return `${verb} ${keyword} on ${target} ${direction} ${role}`;
 }
 function defaultStatement(object, schema, revoke) {
   const privilege = object.identity.privilege.toLowerCase();
@@ -229,7 +607,7 @@ function grantTarget(object, schema) {
   if (object.kind === "function")
     return functionTarget(object.name, schema);
   if (object.kind === "namespace")
-    return `schema ${quoteIdent(object.name)}`;
+    return `schema ${quoteIdent(schema)}`;
   return `table ${qualify(schema, object.name)}`;
 }
 function functionTarget(name, schema) {
@@ -481,6 +859,10 @@ var STEP_CLASS = {
   "rename-sequence": "contract",
   "backfill-expand": "expand",
   "backfill-contract": "contract",
+  "enable-rls": "expand",
+  "create-policy": "expand",
+  "drop-policy": "contract",
+  "disable-rls": "contract",
   "raw-sql": "unclassified"
 };
 var STEP_KINDS = Object.keys(STEP_CLASS);
@@ -690,6 +1072,43 @@ function managedSequence(name) {
   return name === "okm_meta" || name === "okm_history" || name === "okm_backfill" || name.startsWith("okm_meta_") || name.startsWith("okm_history_") || name.startsWith("okm_backfill_");
 }
 
+// src/tooling/migrate/text.ts
+var FIX = {
+  "no-steps": "Add -- no steps when the migration is intentionally empty. Otherwise the file needs a statement okm can read.",
+  utf16: "Save the file as UTF-8. okm does not read UTF-16."
+};
+
+class MigrationTextError extends OkmError2 {
+  reason;
+  constructor(reason, message) {
+    super("invalid", message, {
+      kind: "invalid",
+      fieldReason: reason,
+      fix: { summary: FIX[reason] }
+    });
+    this.name = "OkmError";
+    this.reason = reason;
+  }
+}
+function prepareMigrationText(text, label = "Migration SQL") {
+  if (text.includes("\x00")) {
+    throw new MigrationTextError("utf16", `${label} is UTF-16. Save the file as UTF-8.`);
+  }
+  const withoutBom = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+  return withoutBom.replaceAll(`\r
+`, `
+`).replaceAll("\r", `
+`);
+}
+function assertMigrationSteps(text, stepCount, label) {
+  if (stepCount > 0 || text.trim().length === 0)
+    return;
+  if (text.split(`
+`).includes("-- no steps"))
+    return;
+  throw new MigrationTextError("no-steps", `${label} has text but no steps. okm did not apply it.`);
+}
+
 // src/tooling/migrate/safe.ts
 var ACCESS = "ACCESS EXCLUSIVE";
 var SHARE_UPDATE = "SHARE UPDATE EXCLUSIVE";
@@ -976,189 +1395,6 @@ function functionCalls(expression) {
   return names;
 }
 
-// src/tooling/migrate/sql-lex.ts
-function sqlStatements(sql) {
-  return scan(sql).statements;
-}
-function sqlQuoteOpen(sql) {
-  return scan(sql).open;
-}
-function scan(sql) {
-  const statements = [];
-  const parts = [];
-  let index = 0;
-  let open = false;
-  const flush = () => {
-    const text = parts.join("").trim();
-    parts.length = 0;
-    if (text.length > 0)
-      statements.push(text);
-  };
-  while (index < sql.length) {
-    if (sql.startsWith("--", index)) {
-      parts.push(" ");
-      index = lineCommentEnd(sql, index + 2);
-      continue;
-    }
-    if (sql.startsWith("/*", index)) {
-      parts.push(" ");
-      const block = blockComment(sql, index + 2);
-      index = block.index;
-      if (block.open) {
-        open = true;
-        break;
-      }
-      continue;
-    }
-    const dollar = dollarAt(sql, index);
-    if (dollar !== undefined) {
-      const closed = takeDollar(sql, dollar);
-      parts.push(sql.slice(index, closed.index));
-      index = closed.index;
-      if (closed.open) {
-        open = true;
-        break;
-      }
-      continue;
-    }
-    if (isEscapeString(sql, index)) {
-      const quote = takeQuoted(sql, index + 2, true);
-      parts.push(sql.slice(index, quote.index));
-      index = quote.index;
-      if (quote.open) {
-        open = true;
-        break;
-      }
-      continue;
-    }
-    const char = sql[index];
-    if (char === "'") {
-      const quote = takeQuoted(sql, index + 1, false);
-      parts.push(sql.slice(index, quote.index));
-      index = quote.index;
-      if (quote.open) {
-        open = true;
-        break;
-      }
-      continue;
-    }
-    if (char === '"') {
-      const quote = takeIdent(sql, index + 1);
-      parts.push(sql.slice(index, quote.index));
-      index = quote.index;
-      if (quote.open) {
-        open = true;
-        break;
-      }
-      continue;
-    }
-    if (char === ";") {
-      flush();
-      index += 1;
-      continue;
-    }
-    parts.push(char ?? "");
-    index += 1;
-  }
-  flush();
-  return { statements, open };
-}
-function lineCommentEnd(sql, index) {
-  while (index < sql.length && sql.charCodeAt(index) !== 10)
-    index += 1;
-  return index;
-}
-function blockComment(sql, index) {
-  let depth = 1;
-  while (index < sql.length) {
-    if (sql.startsWith("/*", index)) {
-      depth += 1;
-      index += 2;
-      continue;
-    }
-    if (sql.startsWith("*/", index)) {
-      depth -= 1;
-      index += 2;
-      if (depth === 0)
-        return { index, open: false };
-      continue;
-    }
-    index += 1;
-  }
-  return { index, open: true };
-}
-function dollarAt(sql, index) {
-  if (sql.charCodeAt(index) !== 36)
-    return;
-  const next = index + 1;
-  if (sql.charCodeAt(next) === 36)
-    return { tag: "", end: next + 1 };
-  if (!isIdentStart(sql.charCodeAt(next)))
-    return;
-  let cursor = next + 1;
-  while (isIdentCont(sql.charCodeAt(cursor)))
-    cursor += 1;
-  if (sql.charCodeAt(cursor) !== 36)
-    return;
-  return { tag: sql.slice(next, cursor), end: cursor + 1 };
-}
-function takeDollar(sql, dollar) {
-  const closer = `$${dollar.tag}$`;
-  const found = sql.indexOf(closer, dollar.end);
-  if (found === -1)
-    return { index: sql.length, open: true };
-  return { index: found + closer.length, open: false };
-}
-function takeQuoted(sql, index, escape) {
-  while (index < sql.length) {
-    const char = sql[index];
-    if (escape && char === "\\") {
-      if (index + 1 >= sql.length)
-        return { index: sql.length, open: true };
-      index += 2;
-      continue;
-    }
-    if (char === "'") {
-      if (sql[index + 1] === "'") {
-        index += 2;
-        continue;
-      }
-      return { index: index + 1, open: false };
-    }
-    index += 1;
-  }
-  return { index, open: true };
-}
-function takeIdent(sql, index) {
-  while (index < sql.length) {
-    if (sql[index] === '"') {
-      if (sql[index + 1] === '"') {
-        index += 2;
-        continue;
-      }
-      return { index: index + 1, open: false };
-    }
-    index += 1;
-  }
-  return { index, open: true };
-}
-function isEscapeString(sql, index) {
-  const code = sql.charCodeAt(index);
-  if (code !== 69 && code !== 101)
-    return false;
-  if (sql.charCodeAt(index + 1) !== 39)
-    return false;
-  if (index > 0 && isIdentCont(sql.charCodeAt(index - 1)))
-    return false;
-  return true;
-}
-function isIdentStart(code) {
-  return code >= 65 && code <= 90 || code >= 97 && code <= 122 || code === 95;
-}
-function isIdentCont(code) {
-  return isIdentStart(code) || code >= 48 && code <= 57;
-}
-
 // src/tooling/migrate/values.ts
 function parseReplace(flag) {
   const eq = flag.indexOf("=");
@@ -1230,17 +1466,24 @@ function planMigration(input) {
     if (!afterBy.has(item.key)) {
       if (item.object.kind === "role")
         continue;
+      if (handsOff(item.object) || childOfHandsOff(item.object, afterBy))
+        continue;
       dropKeys.add(item.key);
     }
   }
   for (const item of afterList) {
-    if (!beforeBy.has(item.key))
+    if (!beforeBy.has(item.key)) {
+      if (handsOff(item.object) || childOfHandsOff(item.object, afterBy))
+        continue;
       createKeys.add(item.key);
+    }
   }
   for (const item of afterList) {
     const previous = beforeBy.get(item.key);
     if (previous === undefined || sameDefinition(previous, item.object))
       continue;
+    if (handsOff(item.object) || childOfHandsOff(item.object, afterBy))
+      continue;
     if (previous.kind === "extension" && item.object.kind === "extension")
       continue;
     if (previous.kind === "role" && item.object.kind === "role")
@@ -1276,6 +1519,8 @@ function planMigration(input) {
   refuseRoutineDrops(beforeBy, afterBy, dropKeys);
   omitOwnedSequences(createKeys, afterBy, request.after);
   omitOwnedSequences(dropKeys, beforeBy, renamed);
+  releaseHandsOff(dropKeys, beforeBy, afterBy);
+  releaseHandsOff(createKeys, afterBy, afterBy);
   const recreated = new Set;
   for (const key of createKeys) {
     if (dropKeys.has(key))
@@ -1294,7 +1539,7 @@ function planMigration(input) {
   const deferred = new Set(picklists.map((change) => identityKey2(change.before.identity)));
   const typeDrops = [];
   const extensionDrops = [];
-  const reverse = [...creationOrder2(renamed)].reverse();
+  const reverse = [...uniqueBeforeForeignKey(creationOrder2(renamed))].reverse();
   const emitDrop = (object) => {
     const key = identityKey2(object.identity);
     if (!dropKeys.has(key) || deferred.has(key) || covered(object, droppedTables))
@@ -1328,7 +1573,17 @@ function planMigration(input) {
       emitDrop(object);
   }
   for (const object of reverse) {
-    if (object.kind === "trigger" || object.kind === "function" || object.kind === "view" || object.kind === "materializedView" || ownedByView(object)) {
+    if (object.kind !== "policy")
+      continue;
+    const key = identityKey2(object.identity);
+    if (!dropKeys.has(key) || deferred.has(key))
+      continue;
+    for (const item of policyDropPlan(object, schema)) {
+      steps.push(step(item.sql, item.kind, "ddl", ACCESS2, true, [object.identity.parent.name]));
+    }
+  }
+  for (const object of reverse) {
+    if (object.kind === "trigger" || object.kind === "function" || object.kind === "view" || object.kind === "materializedView" || object.kind === "policy" || ownedByView(object)) {
       continue;
     }
     const key = identityKey2(object.identity);
@@ -1400,8 +1655,8 @@ function planMigration(input) {
       continue;
     steps.push(step(sql, kind, "ddl", ACCESS2));
   }
-  for (const object of creationOrder2(request.after)) {
-    if (object.kind === "type" || object.kind === "extension" || object.kind === "function" || object.kind === "trigger" || object.kind === "view" || object.kind === "materializedView" || ownedByView(object)) {
+  for (const object of uniqueBeforeForeignKey(creationOrder2(request.after))) {
+    if (object.kind === "type" || object.kind === "extension" || object.kind === "function" || object.kind === "trigger" || object.kind === "view" || object.kind === "materializedView" || object.kind === "policy" || ownedByView(object)) {
       continue;
     }
     const key = identityKey2(object.identity);
@@ -1432,6 +1687,17 @@ function planMigration(input) {
     }
     steps.push(step(sql, kind, "ddl", object.kind === "index" ? SHARE : ACCESS2));
   }
+  for (const object of creationOrder2(request.after)) {
+    if (object.kind !== "policy")
+      continue;
+    const key = identityKey2(object.identity);
+    if (!createKeys.has(key) || emitted.has(key))
+      continue;
+    emitted.add(key);
+    for (const item of policyCreatePlan(object, schema)) {
+      steps.push(step(item.sql, item.kind, "ddl", ACCESS2, true, [object.identity.parent.name]));
+    }
+  }
   for (const change of replaces) {
     if (sameDefinition(change.before, change.after))
       continue;
@@ -1528,7 +1794,7 @@ function formatPlan(plan, lockText) {
 `);
 }
 function parsePlan(text) {
-  const lines = text.split(`
+  const lines = prepareMigrationText(text).split(`
 `);
   let name = "migration";
   let planClass = "expand";
@@ -1752,7 +2018,7 @@ function withoutNameKey(value) {
 }
 function renameShapeStep(pair, schema) {
   if (pair.from.kind === "index" && pair.to.kind === "index") {
-    return step(`alter index ${qualify(schema, pair.from.identity.name)} rename to ${quoteIdent(pair.to.identity.name)}`, "rename-index", "ddl", ACCESS2);
+    return step(`alter index ${qualify(schema, pair.from.identity.name)} rename to ${quoteIdent(pair.to.identity.name)}`, "rename-index", "ddl", SHARE_UPDATE2);
   }
   if (pair.from.kind !== "constraint" || pair.to.kind !== "constraint") {
     throw new OkmError2("invalid", "A same-shape rename is an index or a constraint.", {
@@ -2325,6 +2591,25 @@ function reprintedDefaultBase(typeName) {
     return `${time[1] ?? ""} ${time[2] ?? ""}`;
   return;
 }
+function handsOff(object) {
+  return object.owner === "external" || object.owner === "ignored";
+}
+function childOfHandsOff(object, catalog) {
+  if (object.kind !== "column" && object.kind !== "index" && object.kind !== "constraint" && object.kind !== "trigger" && object.kind !== "policy") {
+    return false;
+  }
+  const parent = object.identity.parent;
+  const table = catalog.get(identityKey2({ kind: "table", namespace: parent.namespace, name: parent.name }));
+  return table !== undefined && handsOff(table);
+}
+function releaseHandsOff(keys, objects, parents) {
+  for (const key of keys) {
+    const object = objects.get(key);
+    if (object !== undefined && (handsOff(object) || childOfHandsOff(object, parents))) {
+      keys.delete(key);
+    }
+  }
+}
 function sameDefinition(left, right) {
   if (left.kind === "materializedView" && right.kind === "materializedView") {
     return stable(canonicalColumns(left.definition.columns)) === stable(canonicalColumns(right.definition.columns)) && left.definition.query === right.definition.query;
@@ -2364,6 +2649,9 @@ function forComparison(object) {
       if (!isDomain(object.definition))
         return object.definition;
       return { ...object.definition, base: canonicalTypeName(object.definition.base) };
+    case "constraint":
+    case "index":
+      return withoutNameKey(object.definition);
     default:
       return object.definition;
   }
@@ -2622,6 +2910,53 @@ function order(value) {
   return value;
 }
 
+// src/tooling/migrate/lost.ts
+var UNAVAILABLE_FIX = {
+  summary: "The connection to Postgres closed. Run the command again when the database is reachable."
+};
+function sessionFailure(error) {
+  if (error instanceof OkmError2) {
+    if (error.kind === "outcome_unknown" || error.kind === "unavailable")
+      return error;
+    const cause = error.cause;
+    if (cause === undefined || cause === error || error.kind !== "invalid")
+      return;
+    const inner = sessionFailure(cause);
+    if (inner === undefined)
+      return;
+    return new OkmError2(inner.code, error.message, {
+      kind: inner.kind,
+      cause: error,
+      fix: inner.fix
+    });
+  }
+  if (isOutcomeUnknown(error)) {
+    return new OkmError2("OKM1401", "The commit outcome is unknown. The result never arrived.", {
+      kind: "outcome_unknown",
+      cause: error,
+      fix: {
+        summary: "Check whether the write landed before retrying. This error is never retried automatically."
+      }
+    });
+  }
+  if (!isConnectionLost(error))
+    return;
+  const message = error instanceof Error && error.message.length > 0 ? error.message : "The database is unavailable.";
+  return new OkmError2("unavailable", message, {
+    kind: "unavailable",
+    cause: error,
+    fix: UNAVAILABLE_FIX
+  });
+}
+async function finishQuiet(run) {
+  await run().catch(() => {
+    return;
+  });
+}
+function isOutcomeUnknown(error) {
+  return typeof error === "object" && error !== null && Reflect.get(error, "kind") === "outcome_unknown";
+}
+
 // src/tooling/migrate/policy.ts
 var READ = new Set([
   "plan",
@@ -2783,4 +3118,4 @@ function endpointOf(url) {
   };
 }
 
-export { canonicalTypeName, createdRoleName, createRoleOnce, changesRole, DEFAULT_BACKFILL_PAUSE_MS, DEFAULT_BACKFILL_STATEMENT_TIMEOUT_MS, batchSizeField, aboutBatchCount, boundaryQuery, checkedCast, classOf, strictestClass, assertExtensionsAvailable, omitManagedObjects, sqlStatements, parseReplace, planMigration, formatPlan, parsePlan, staleRenames, assertTargetPolicy, assertTargetAlias, assertDirectConnection, assertStableBackend, listTargets, selectTarget };
+export { sqlStatements, transactionControl, canonicalTypeName, prepareMigrationText, assertMigrationSteps, columnPrivilege, createdRoleName, createRoleOnce, changesRole, DEFAULT_BACKFILL_PAUSE_MS, DEFAULT_BACKFILL_STATEMENT_TIMEOUT_MS, batchSizeField, aboutBatchCount, boundaryQuery, checkedCast, classOf, strictestClass, assertExtensionsAvailable, omitManagedObjects, parseReplace, planMigration, formatPlan, parsePlan, staleRenames, sessionFailure, finishQuiet, assertTargetPolicy, assertTargetAlias, assertDirectConnection, assertStableBackend, listTargets, selectTarget };