okmodel 0.5.1 → 0.6.0

package/dist/shared/{kfjp0gck.js → venqrjna.js}

@@ -2,10 +2,11 @@ import {
   readHandle,
   readCall,
   attachHttp
-} from "./hf22e0wt.js";
+} from "./j60w0dvr.js";
 import {
   emitWhere,
   emitOrder,
+  refuseHidden,
   rejectKeys,
   readLimit,
   projectExpr,
@@ -15,7 +16,7 @@ import {
   list,
   isRecord,
   fail
-} from "./gbtcc2d7.js";
+} from "./2z7wv5tj.js";
 import {
   OkmError2,
   throwNamed2
@@ -68,8 +69,11 @@ function plan(session, table, options, mods, view) {
     if (!isRecord(orderBy))
       fail("OKM1120", "orderBy must be an object of fields.");
     for (const field of Object.keys(orderBy)) {
-      if (!spec.groups.some((column) => column.field === field)) {
-        throwNamed2("OKM1120", field, spec.groups.map((column) => column.field), `aggregate() orders by a groupBy field. Accepted names: ${list(spec.groups.map((column) => column.field))}.`);
+      const column = indexed.columns.get(field);
+      if (column !== undefined)
+        refuseHidden(column);
+      if (!spec.groups.some((group) => group.field === field)) {
+        throwNamed2("OKM1120", field, spec.groups.map((group) => group.field), `aggregate() orders by a groupBy field. Accepted names: ${list(spec.groups.map((group) => group.field))}.`);
       }
     }
   }

package/dist/shared/{fancm5pt.js → vjpnzwjz.js}

@@ -2,28 +2,34 @@ import {
   roleObject,
   grantObject,
   defaultPrivilegeObject
-} from "./8bwbwy8h.js";
+} from "./qq3899ht.js";
+import {
+  columnPrivilege
+} from "./ttmg09vd.js";
 import {
   quoteIdent
-} from "./8xsbagad.js";
+} from "./9s0ypp87.js";
+import {
+  policyObject
+} from "./bdk4sty6.js";
 import {
   functionObject,
   triggerObject
-} from "./9x25fxhc.js";
+} from "./y34a8714.js";
 import {
   normaliseViewQuery,
   viewObject,
   materializedViewObject,
   materializedViewIndex
-} from "./y005b761.js";
+} from "./zy8r7qvz.js";
 import {
   extensionObject
-} from "./8ktwd3rh.js";
+} from "./r3j8s5y0.js";
 import {
   catalog,
   enumType,
   domainType
-} from "./g7ez901n.js";
+} from "./ywspezzx.js";
 import {
   staticNamespace2,
   identityKey2,
@@ -32,7 +38,7 @@ import {
   index3,
   constraint2,
   sequence2
-} from "./t4tbsy9h.js";
+} from "./358zsv4r.js";
 import {
   referentialAction
 } from "./4e4c6vq2.js";
@@ -123,7 +129,8 @@ async function introspectSchema(runner, concrete, logical = "public", options) {
     triggers,
     functionDeps,
     views,
-    viewDeps
+    viewDeps,
+    policies
   ] = await Promise.all([
     runner.query(TABLES, params),
     runner.query(COLUMNS, params),
@@ -137,7 +144,8 @@ async function introspectSchema(runner, concrete, logical = "public", options) {
     runner.query(TRIGGERS, params),
     runner.query(FUNCTION_DEPS, params),
     runner.query(VIEWS, params),
-    runner.query(VIEW_DEPENDENCIES, params)
+    runner.query(VIEW_DEPENDENCIES, params),
+    runner.query(POLICIES, params)
   ]);
   const objects = [];
   const parents = new Map;
@@ -380,12 +388,38 @@ async function introspectSchema(runner, concrete, logical = "public", options) {
     const columns = printedColumns(text(row, "columns"));
     const query = normaliseViewQuery(text(row, "query"));
     const name = text(row, "name");
+    const invoker = kind === "view" && securityInvokerOption(text(row, "options"));
     if (kind === "materializedView") {
       objects.push(materializedViewObject({ namespace, name, columns, query, provenance }));
     } else {
-      objects.push(viewObject({ namespace, name, columns, query, provenance }));
+      objects.push(viewObject({
+        namespace,
+        name,
+        columns,
+        query,
+        provenance,
+        ...invoker ? { securityInvoker: true } : {}
+      }));
     }
   }
+  for (const row of policies) {
+    const parentName = text(row, "table_name");
+    const parent = parents.get(parentName);
+    if (parent === undefined)
+      continue;
+    const command = policyCommand(text(row, "command"));
+    if (command === undefined || text(row, "enabled") !== "true")
+      continue;
+    objects.push(policyObject({
+      parent,
+      name: text(row, "name"),
+      command,
+      expression: text(row, "using_expr"),
+      force: text(row, "force") === "true",
+      provenance,
+      dependencies: [{ kind: "table", namespace, name: parentName }]
+    }));
+  }
   const viewEdges = viewDependencyEdges(viewDeps, namespace, objects);
   for (let index = 0;index < objects.length; index += 1) {
     const object = objects[index];
@@ -402,7 +436,8 @@ async function introspectSchema(runner, concrete, logical = "public", options) {
       columns: object.definition.columns,
       query: object.definition.query,
       provenance,
-      dependencies
+      dependencies,
+      ...object.definition.securityInvoker === true ? { securityInvoker: true } : {}
     }) : materializedViewObject({
       namespace,
       name: object.identity.name,
@@ -413,7 +448,7 @@ async function introspectSchema(runner, concrete, logical = "public", options) {
     });
   }
   if (options?.managedRoles !== undefined) {
-    objects.push(...await readPrivileges(runner, concrete, namespace, provenance, objects, options.managedRoles));
+    objects.push(...await readPrivileges(runner, concrete, logical, namespace, provenance, objects, options.managedRoles, options.reportingRole));
   }
   return catalog(objects);
 }
@@ -452,6 +487,30 @@ var FUNCTION_GRANTS = `select p.proname as name,
       select 1 from pg_depend d
       where d.classid = 'pg_proc'::regclass and d.objid = p.oid and d.deptype = 'e'
     )`;
+var COLUMN_GRANTS = `select c.relname as name,
+  case c.relkind when 'v' then 'view' when 'm' then 'materializedView' else 'table' end as kind,
+  a.attname as column_name,
+  r.rolname as role, x.privilege_type as privilege
+  from pg_class c
+  join pg_namespace n on n.oid = c.relnamespace
+  join pg_attribute a on a.attrelid = c.oid and a.attnum > 0 and not a.attisdropped
+  cross join lateral aclexplode(a.attacl) as x
+  join pg_roles r on r.oid = x.grantee
+  where n.nspname = $1
+    and c.relkind in ('r', 'p', 'v', 'm')
+    and a.attacl is not null
+    and x.grantee <> 0
+    and x.grantee <> c.relowner`;
+var SCHEMA_USAGE = `select 1 as ok
+  from pg_namespace n
+  cross join lateral aclexplode(n.nspacl) as a
+  where n.nspname = $1
+    and a.privilege_type = 'USAGE'
+    and (
+      a.grantee = 0
+      or a.grantee = (select oid from pg_roles where rolname = $2)
+    )
+  limit 1`;
 var DEFAULT_PRIVILEGES = `select owner_role.rolname as for_role, grantee.rolname as grantee,
   case d.defaclobjtype when 'S' then 'sequence' when 'f' then 'function' else 'table' end as object_kind,
   a.privilege_type as privilege
@@ -463,13 +522,15 @@ var DEFAULT_PRIVILEGES = `select owner_role.rolname as for_role, grantee.rolname
   where n.nspname = $1
     and d.defaclobjtype in ('r', 'S', 'f')
     and a.grantee <> 0`;
-async function readPrivileges(runner, concrete, namespace, provenance, built, managedRoles) {
+async function readPrivileges(runner, concrete, logical, namespace, provenance, built, managedRoles, reportingRole) {
   const managed = new Set(managedRoles);
-  const [roles, relations, functions, defaults] = await Promise.all([
+  const [roles, relations, functions, defaults, columns, usage] = await Promise.all([
     runner.query(ROLES, []),
     runner.query(RELATION_GRANTS, [concrete]),
     runner.query(FUNCTION_GRANTS, [concrete]),
-    runner.query(DEFAULT_PRIVILEGES, [concrete])
+    runner.query(DEFAULT_PRIVILEGES, [concrete]),
+    runner.query(COLUMN_GRANTS, [concrete]),
+    reportingRole === undefined ? Promise.resolve([]) : runner.query(SCHEMA_USAGE, [concrete, reportingRole])
   ]);
   const objects = [];
   for (const row of roles) {
@@ -530,6 +591,42 @@ async function readPrivileges(runner, concrete, namespace, provenance, built, ma
       ]
     }));
   }
+  const grouped = new Map;
+  for (const row of columns) {
+    const privilege = text(row, "privilege").toUpperCase();
+    if (privilege !== "SELECT" && privilege !== "UPDATE")
+      continue;
+    const kind = grantKind(text(row, "kind"));
+    if (kind !== "table" && kind !== "view" && kind !== "materializedView")
+      continue;
+    const name = text(row, "name");
+    const role = text(row, "role");
+    const key = `${role}\x00${kind}\x00${name}\x00${privilege}`;
+    const current = grouped.get(key) ?? { role, kind, name, privilege, columns: [] };
+    current.columns.push(text(row, "column_name"));
+    grouped.set(key, current);
+  }
+  for (const group of grouped.values()) {
+    const target = built.find((object) => privilegeTarget(object) === `${group.kind}:${group.name}`);
+    if (target === undefined)
+      continue;
+    objects.push(grantObject({
+      role: group.role,
+      object: { kind: group.kind, namespace, name: group.name },
+      privilege: columnPrivilege(group.privilege, group.columns),
+      provenance,
+      dependencies: [{ kind: "role", name: group.role }, target.identity]
+    }));
+  }
+  if (usage.length > 0 && reportingRole !== undefined) {
+    objects.push(grantObject({
+      role: reportingRole,
+      object: { kind: "namespace", namespace, name: logical },
+      privilege: "USAGE",
+      provenance,
+      dependencies: [{ kind: "role", name: reportingRole }]
+    }));
+  }
   return objects;
 }
 function privilegeTarget(object) {
@@ -788,6 +885,7 @@ var TRIGGERS = `
 `;
 var VIEWS = `
   select c.relname as name, c.relkind as kind, pg_get_viewdef(c.oid, true) as query,
+    coalesce(array_to_string(c.reloptions, ','), '') as options,
     (
       select coalesce(string_agg(
         a.attname || '|' || format_type(a.atttypid, a.atttypmod),
@@ -821,6 +919,31 @@ var FUNCTION_DEPS = `
     and p.prokind = 'f'
     and p.prosrc = ''
 `;
+var POLICIES = `
+  select c.relname as table_name,
+    p.polname as name,
+    p.polcmd as command,
+    coalesce(pg_get_expr(p.polqual, p.polrelid), '') as using_expr,
+    c.relforcerowsecurity::text as force,
+    c.relrowsecurity::text as enabled
+  from pg_policy p
+  join pg_class c on c.oid = p.polrelid
+  join pg_namespace n on n.oid = c.relnamespace
+  where n.nspname = $1
+    and c.relkind = 'r'
+    and ${CHILD}
+    and ${member("c.oid", "pg_class")}
+`;
+function securityInvokerOption(options) {
+  return options.split(",").some((item) => item === "security_invoker=true" || item === "security_invoker=on");
+}
+function policyCommand(command) {
+  if (command === "*")
+    return "all";
+  if (command === "r")
+    return "select";
+  return;
+}
 function member(oid, classid) {
   return `not exists (
     select 1 from pg_depend member

package/dist/shared/{32zqc1dw.js → vmfkhszw.js}

@@ -9,7 +9,7 @@ import {
   isRecord,
   registerFailFix,
   fail
-} from "./gbtcc2d7.js";
+} from "./2z7wv5tj.js";
 import {
   throwNamed2
 } from "./52szzakm.js";
@@ -112,11 +112,13 @@ function samePrimary(table, columns) {
 }
 function uniqueColumns(table, on, tenantKey) {
   const names = conflictNames(on);
+  const keys = keyList(tenantKey);
   for (const unique of table.model.uniques) {
-    if (!same(unique, names))
+    const fields = fieldsOf(unique, names, keys);
+    if (fields === undefined)
       continue;
     const columns = [];
-    for (const name of names) {
+    for (const name of fields) {
       const column = table.columns.get(name);
       if (column === undefined) {
         fail("OKM1104", `onConflict column ${name} is not on ${table.model.name}.`);
@@ -125,14 +127,14 @@ function uniqueColumns(table, on, tenantKey) {
     }
     return columns;
   }
-  const accepted = acceptedConstraints(table.model, tenantKey);
-  const implicit = tenantKey === undefined ? "" : ` The tenant key ${tenantKey} is part of each one and is not named here.`;
+  const accepted = acceptedConstraints(table.model, keys);
+  const implicit = keys.length === 0 ? "" : ` The tenant key ${keys.join(", ")} is part of each one and is not named here.`;
   throwNamed2("OKM1104", names.join(", "), accepted, `onConflict on ${table.model.name} names ${names.join(", ")}, which is not a unique constraint. Accepted: ${list(accepted)}.${implicit}`);
 }
-function acceptedConstraints(model, key) {
+function acceptedConstraints(model, keys) {
   const shown = new Set;
   for (const fields of model.uniques) {
-    const named = key === undefined ? fields : fields.filter((field) => field !== key);
+    const named = keys.length === 0 ? fields : fields.filter((field) => !keys.includes(field));
     if (named.length === 0)
       continue;
     shown.add(named.length > 1 ? `(${named.join(", ")})` : named.join(""));
@@ -166,6 +168,28 @@ function conflictNames(on) {
   }
   fail("OKM1104", "onConflict on must name a unique constraint's columns.");
 }
+function fieldsOf(unique, names, tenantKeys) {
+  if (tenantKeys.some((key) => unique.includes(key))) {
+    const rest = [];
+    for (const field of unique) {
+      if (!tenantKeys.includes(field))
+        rest.push(field);
+    }
+    if (!same(rest, names))
+      return;
+    return unique;
+  }
+  if (!same(unique, names))
+    return;
+  return names;
+}
+function keyList(tenantKey) {
+  if (tenantKey === undefined)
+    return [];
+  if (typeof tenantKey === "string")
+    return [tenantKey];
+  return tenantKey;
+}
 function same(unique, names) {
   if (unique.length !== names.length)
     return false;

package/dist/shared/{krxx77g0.js → wkme6tep.js}

@@ -62,13 +62,15 @@ class PoolSockets {
   }
   wake() {
     for (const socket of this.held)
-      socket.ref();
+      if (socket.writable)
+        socket.ref();
   }
   park() {
     if (this.busy > 0 || this.listeners > 0)
       return;
     for (const socket of this.held)
-      socket.unref();
+      if (socket.writable)
+        socket.unref();
   }
 }
 function driverOptions(config, state) {
@@ -117,7 +119,7 @@ function open2(config) {
     },
     async batch(statements, options) {
       return sockets.occupy(async () => {
-        const { checkout } = await import("./caw8b9d8.js");
+        const { checkout } = await import("./r1fdd0f6.js");
         const connection = await checkout(held);
         try {
           return await connection.batch(statements, options);
@@ -129,12 +131,12 @@ function open2(config) {
     reserve() {
       const gate = sockets.busyGate();
       gate.enter();
-      return import("./caw8b9d8.js").then((mod) => mod.holdCheckout(gate, () => mod.checkout(held)), (error) => {
+      return import("./r1fdd0f6.js").then((mod) => mod.holdCheckout(gate, () => mod.checkout(held)), (error) => {
         gate.leave();
         throw error;
       });
     },
-    describe: (text, params) => sockets.occupy(() => import("./caw8b9d8.js").then((mod) => mod.describe(sql, text, params))),
+    describe: (text, params) => sockets.occupy(() => import("./r1fdd0f6.js").then((mod) => mod.describe(sql, text, params))),
     stream(text, params) {
       const gate = sockets.busyGate();
       return async function* () {
@@ -149,7 +151,7 @@ function open2(config) {
     listen(channel, onNotify) {
       const gate = sockets.listenerGate();
       gate.enter();
-      return import("./caw8b9d8.js").then((mod) => mod.holdListener(gate, async () => {
+      return import("./r1fdd0f6.js").then((mod) => mod.holdListener(gate, async () => {
         const listening = await sql.listen(channel, onNotify);
         return async () => {
           await listening.unlisten();
@@ -219,7 +221,7 @@ class PgSession {
       onAbort();
     else
       watch.signal.addEventListener("abort", onAbort, { once: true });
-    return import("./caw8b9d8.js").then((mod) => mod.watchQuery(pending, watch, onAbort, {
+    return import("./r1fdd0f6.js").then((mod) => mod.watchQuery(pending, watch, onAbort, {
       start,
       text,
       notices: this.notices,
@@ -271,7 +273,7 @@ class PgSession {
   }
 }
 async function* loadStream(sql, text, params) {
-  const { stream } = await import("./caw8b9d8.js");
+  const { stream } = await import("./r1fdd0f6.js");
   yield* stream(sql, text, params);
 }
 function send(sql, text, params, named) {

package/dist/shared/{ps7a6h14.js → wt5rzv1h.js}

@@ -1,22 +1,24 @@
 import {
   open2
-} from "./krxx77g0.js";
-import"./8bwbwy8h.js";
+} from "./wkme6tep.js";
+import"./qq3899ht.js";
 import"./n442h54c.js";
 import {
   assertRoleHealth
-} from "./szm0cksa.js";
-import"./fancm5pt.js";
+} from "./knmes2kh.js";
+import"./vjpnzwjz.js";
 import {
   errorDoc,
   openProject
-} from "./qv2ydck9.js";
+} from "./t3g0k88x.js";
 import {
   omitManagedObjects,
+  sessionFailure,
+  finishQuiet,
   assertTargetPolicy,
   selectTarget
-} from "./ga3sfy93.js";
-import"./8xsbagad.js";
+} from "./ttmg09vd.js";
+import"./9s0ypp87.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -43,8 +45,10 @@ ${doc.fix}
     const pool = open2({ url: target.url, max: 1 });
     try {
       await assertRoleHealth(pool, opened.config.roles, objects);
+    } catch (error) {
+      throw sessionFailure(error) ?? error;
     } finally {
-      await pool.close();
+      await finishQuiet(() => pool.close());
     }
   }
   return formatTriggers(objects);

package/dist/shared/wxr8cwns.js

@@ -0,0 +1,6 @@
+import {
+  noTimeout2
+} from "./8dqhth8c.js";
+export {
+  noTimeout2 as noTimeout
+};

package/dist/shared/{6mnp99hx.js → wynzeggs.js}

@@ -1,7 +1,7 @@
 import {
   open2
-} from "./krxx77g0.js";
-import"./8bwbwy8h.js";
+} from "./wkme6tep.js";
+import"./qq3899ht.js";
 import"./n442h54c.js";
 import {
   CURRENT,
@@ -12,26 +12,28 @@ import {
   failedAt
 } from "./9yn6a2vd.js";
 import {
-  loadMigrations,
   expandProvisioned,
   provisionHistoryIsKnown
-} from "./gde73es6.js";
-import"./szm0cksa.js";
-import"./fancm5pt.js";
+} from "./p248q79y.js";
+import"./knmes2kh.js";
+import"./vjpnzwjz.js";
 import {
+  projectPath,
+  loadMigrations,
   loadConfig
-} from "./qv2ydck9.js";
+} from "./t3g0k88x.js";
 import {
+  sessionFailure,
+  finishQuiet,
   assertTargetPolicy,
   listTargets
-} from "./ga3sfy93.js";
-import"./8xsbagad.js";
+} from "./ttmg09vd.js";
+import"./9s0ypp87.js";
 import {
   OkmError2
 } from "./52szzakm.js";
 
 // src/tooling/migrate/status.ts
-import { join } from "node:path";
 function describeStatus(migrations, history, recorded) {
   const known = new Set(migrations.map((migration) => migration.id));
   const done = expandProvisioned(migrations, new Set(history.map((row) => `${row.migrationId}:${String(row.stepIndex)}`)), history.map((row) => row.migrationId));
@@ -99,14 +101,16 @@ async function readTargetStatus(input) {
       protected: input.protected,
       backfills: await readBackfills(pool)
     };
+  } catch (error) {
+    throw sessionFailure(error) ?? error;
   } finally {
-    await pool.close();
+    await finishQuiet(() => pool.close());
   }
 }
 async function statusProject(cwd, flags) {
   const config = await loadConfig(cwd);
   const targets = chosen(listTargets(config), flags.target);
-  const migrations = loadMigrations(join(cwd, config.migrations ?? "migrations"));
+  const migrations = loadMigrations(projectPath(cwd, config.migrations ?? "migrations"));
   const rows = [];
   for (const target of targets) {
     rows.push(await readTargetStatus({