okmodel 0.5.1 → 0.6.0

package/dist/shared/{v36c5g6p.js → 8x72s86k.js}

@@ -1,9 +1,13 @@
 import {
   renderCatalog
-} from "./8xsbagad.js";
+} from "./9s0ypp87.js";
+import {
+  viewGlobalReason,
+  viewMentions
+} from "./x3jc53kg.js";
 import {
   createClient
-} from "./hf22e0wt.js";
+} from "./j60w0dvr.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -36,6 +40,41 @@ function readFacts(schema) {
   }
   return facts;
 }
+function readViews(schema) {
+  const tables = new Set;
+  const listed = new Map;
+  for (const object of schema.catalog.objects) {
+    if (object.kind === "table")
+      tables.add(object.identity.name);
+    if (object.kind !== "view" && object.kind !== "materializedView")
+      continue;
+    listed.set(object.identity.name, { kind: object.kind, query: object.definition.query });
+  }
+  const views = [];
+  for (const name of Object.keys(schema.model)) {
+    const model = schema.model[name];
+    if (model === undefined || tables.has(model.sql))
+      continue;
+    const meta = listed.get(model.sql);
+    if (meta === undefined)
+      continue;
+    const reason = viewGlobalReason(model);
+    views.push({
+      name,
+      sql: model.sql,
+      kind: meta.kind,
+      query: meta.query,
+      columns: model.columns.map((column) => ({
+        field: column.field,
+        dataType: column.dataType,
+        guarded: column.guarded
+      })),
+      tenant: reason === undefined && isTenant(schema.tenancy, model),
+      globalReason: reason
+    });
+  }
+  return views;
+}
 function isRequired(column) {
   if (!column.writable || column.guarded || column.fill)
     return false;
@@ -113,7 +152,7 @@ function isTenant(tenancy, model) {
   try {
     return tenancy.predicate({
       table: model.name,
-      fieldSql: (field) => field === tenancy.key ? key?.sql : undefined,
+      fieldSql: (field) => model.columns.find((column) => column.field === field)?.sql,
       encode: key?.encode,
       alias: "t",
       appended: false,
@@ -348,7 +387,7 @@ function paired(host, child, parent, childSql, parentSql, row) {
   return linked;
 }
 async function writeRow(host, facts, data, tenant) {
-  const client = facts.tenant && tenant !== undefined ? openScope(host.db, host.schema.tenancy?.key ?? "tenantId", tenant) : host.db;
+  const client = facts.tenant && tenant !== undefined ? openScope(host.db, host.schema.tenancy, tenant) : host.db;
   const handle = tableHandle(client, facts.name);
   const inserted = await handle.insert(data);
   if (!isRow(inserted)) {
@@ -472,13 +511,17 @@ function refOf(value) {
   const table = value[REF];
   return typeof table === "string" ? table : undefined;
 }
-function openScope(db, key, tenant) {
+function openScope(db, tenancy, tenant) {
   if (!("for" in db) || typeof db.for !== "function") {
     throw new OkmError2("invalid", "This schema has no for().", {
       fix: { summary: "Pass columnTenancy() to schema({ tenancy })." }
     });
   }
-  const opened = db.for({ [key]: tenant });
+  const keys = tenancy?.keys ?? [tenancy?.key ?? "tenantId"];
+  const input = {};
+  for (const key of keys)
+    input[key] = tenant;
+  const opened = db.for(input);
   if (typeof opened !== "object" || opened === null) {
     throw new OkmError2("invalid", "for() did not return a client.", {
       fix: { summary: "The tenant key must be a uuid." }
@@ -509,6 +552,15 @@ async function isolation(host) {
   const saved = host.cache;
   host.cache = new Map;
   try {
+    if (host.schema.tenancy?.strategy === "rls") {
+      const check = host.db["~rls"];
+      if (check === undefined) {
+        throw new OkmError2("invalid", "Row-level security has no policy check on this client.", {
+          fix: { summary: "Open the client from a schema that uses rlsTenancy()." }
+        });
+      }
+      await check();
+    }
     const checked = [];
     const skipped = [];
     const tenantA = crypto.randomUUID();
@@ -520,10 +572,19 @@ async function isolation(host) {
       }
       if (!facts.tenant)
         continue;
-      await checkTable(host, facts, tenantA, tenantB);
+      const hops = host.schema.tenancy?.pathOf?.(facts.name);
+      if (hops !== undefined && hops.length > 0) {
+        await checkPath(host, facts, hops, tenantA, tenantB);
+      } else {
+        await checkTable(host, facts, tenantA, tenantB);
+        const keys = tenantKeys(host);
+        if (keys.length > 1)
+          await checkFlips(host, facts, keys, tenantA, tenantB);
+      }
       checked.push(facts.name);
     }
-    return { checked, skipped };
+    const views = await checkViews(host, tenantA, tenantB, skipped);
+    return { checked, skipped, views };
   } finally {
     host.cache = saved;
   }
@@ -532,13 +593,14 @@ async function checkTable(host, facts, tenantA, tenantB) {
   const key = host.schema.tenancy?.key;
   if (key === undefined)
     return;
+  const keys = tenantKeys(host);
   if (host.definitions.size > 0 && !host.definitions.has(facts.name)) {
     throw new OkmError2("invalid", `Factory ${facts.name} is missing.`, {
       fix: { summary: `Add ${facts.name} to factories().` }
     });
   }
   const row = await insertRow(host, facts.name, { [key]: tenantB }, undefined, tenantB);
-  const where = primaryWhere(facts, row, key);
+  const where = primaryWhere(facts, row, keys);
   const client = openTenant(host, tenantA);
   const handle = tableHandle2(client, facts.name);
   try {
@@ -649,10 +711,10 @@ function valueFrom(host, facts, field, row) {
     return host.rng.uuid();
   }
 }
-function primaryWhere(facts, row, tenantKey) {
+function primaryWhere(facts, row, tenantKeys) {
   const where = {};
   for (const field of facts.primary) {
-    if (field === tenantKey)
+    if (tenantKeys.includes(field))
       continue;
     where[field] = row[field];
   }
@@ -669,15 +731,340 @@ ${JSON.stringify(row)}`, {
     fix: { summary: "A query under tenant A returned a row inserted for tenant B." }
   });
 }
+function tenantKeys(host) {
+  const tenancy = host.schema.tenancy;
+  if (tenancy === undefined)
+    return [];
+  if (tenancy.keys !== undefined && tenancy.keys.length > 0)
+    return tenancy.keys;
+  return [tenancy.key];
+}
+function scopeFor(keys, tenant) {
+  const input = {};
+  for (const key of keys)
+    input[key] = tenant;
+  return input;
+}
+async function checkFlips(host, facts, keys, tenantA, tenantB) {
+  const template = await insertRow(host, facts.name, undefined, undefined, tenantB);
+  const data = { ...template };
+  for (const key of keys)
+    delete data[key];
+  const clientA = openTenant(host, scopeFor(keys, tenantA));
+  try {
+    for (let index = 0;index < keys.length; index += 1) {
+      const values = scopeFor(keys, tenantA);
+      const flipped = keys[index];
+      if (flipped === undefined)
+        continue;
+      values[flipped] = tenantB;
+      const client = openTenant(host, values);
+      const stored = await tableHandle2(client, facts.name).insert(data);
+      if (!isRow2(stored))
+        continue;
+      const where = primaryWhere(facts, stored, keys);
+      await readTenant(facts, tableHandle2(clientA, facts.name), where);
+      await tableHandle2(client, facts.name).delete({ where }).catch(() => {
+        return;
+      });
+    }
+  } finally {
+    const where = primaryWhere(facts, template, keys);
+    await tableHandle2(openTenant(host, tenantB), facts.name).delete({ where }).catch(() => {
+      return;
+    });
+    forgetCached(host, facts.name, tenantB);
+  }
+}
+async function checkPath(host, facts, hops, tenantA, tenantB) {
+  const keys = tenantKeys(host);
+  const created = [];
+  const last = hops[hops.length - 1];
+  if (last === undefined)
+    return;
+  let parent = await insertRow(host, last.parent, undefined, undefined, tenantB);
+  created.push({
+    table: last.parent,
+    where: primaryWhere(requireFacts(host, last.parent), parent, keys)
+  });
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop === undefined)
+      continue;
+    const row = await insertRow(host, hop.child, { [hop.localField]: parent[hop.remoteField] }, undefined, tenantB);
+    parent = row;
+    created.push({
+      table: hop.child,
+      where: primaryWhere(requireFacts(host, hop.child), row, keys)
+    });
+  }
+  const where = primaryWhere(facts, parent, keys);
+  const client = openTenant(host, tenantA);
+  try {
+    await readTenant(facts, tableHandle2(client, facts.name), where);
+    const set = updateSet(host, facts, parent);
+    if (set !== undefined) {
+      const updated = asCount(await tableHandle2(client, facts.name).update({ where, set }));
+      if (updated > 0)
+        leak(facts.name, "update", { count: updated });
+    }
+    const removed = asCount(await tableHandle2(client, facts.name).delete({ where }));
+    if (removed > 0)
+      leak(facts.name, "delete", { count: removed });
+  } finally {
+    for (let index = created.length - 1;index >= 0; index -= 1) {
+      const item = created[index];
+      if (item === undefined)
+        continue;
+      await tableHandle2(openTenant(host, tenantB), item.table).delete({ where: item.where }).catch(() => {
+        return;
+      });
+      forgetCached(host, item.table, tenantB);
+    }
+  }
+}
+var SCAN_LIMIT = 100;
+async function checkViews(host, tenantA, tenantB, skipped) {
+  const checked = [];
+  const keys = tenantKeys(host);
+  for (const view of readViews(host.schema)) {
+    if (view.globalReason !== undefined) {
+      skipped.push({ table: view.name, reason: view.globalReason });
+      continue;
+    }
+    if (!view.tenant)
+      continue;
+    await checkView(host, view, keys, tenantA, tenantB);
+    checked.push(view.name);
+  }
+  return checked;
+}
+async function checkView(host, view, keys, tenantA, tenantB) {
+  const sources = orderSources(host, sourceNames(host, view.query));
+  if (sources.length === 0) {
+    throw new OkmError2("invalid", `View ${view.name} names no table isolation can seed.`, {
+      fieldReason: "no-source",
+      fix: { summary: 'Point the view at a table in this schema, or mark it global("reason").' }
+    });
+  }
+  for (const name of sources) {
+    if (host.definitions.size > 0 && !host.definitions.has(name)) {
+      throw new OkmError2("invalid", `Factory ${name} is missing.`, {
+        fix: { summary: `Add ${name} to factories().` }
+      });
+    }
+  }
+  const before = new Map(host.cache);
+  const seeded = [];
+  try {
+    for (const tenant of [tenantA, tenantB]) {
+      for (const name of sources) {
+        const facts = requireFacts(host, name);
+        const key = keys[0];
+        const overrides = markerFor(view, facts, keys, tenant);
+        if (key !== undefined)
+          overrides[key] = tenant;
+        const row = await insertRow(host, name, overrides, undefined, tenant);
+        if (tenant === tenantB)
+          seeded.push(row);
+      }
+    }
+    const handle = viewHandle(openTenant(host, tenantA), view.name);
+    if (view.kind === "materializedView") {
+      if (handle.refresh === undefined) {
+        throw new OkmError2("invalid", `View ${view.name} has no refresh().`, {
+          fieldReason: "no-refresh",
+          fix: { summary: "A materialized view refreshes before the isolation read." }
+        });
+      }
+      await handle.refresh();
+    }
+    await readView(view, handle, keys, tenantB, seeded);
+  } finally {
+    await dropNewRows(host, before, keys);
+  }
+}
+function sourceNames(host, query) {
+  const names = [];
+  for (const facts of host.facts.values()) {
+    if (viewMentions(query, facts.sql) || viewMentions(query, facts.name))
+      names.push(facts.name);
+  }
+  return names;
+}
+function orderSources(host, names) {
+  const wanted = new Set(names);
+  const ordered = [];
+  const pending = [...names];
+  const guard = pending.length * pending.length + 1;
+  let spins = 0;
+  while (pending.length > 0 && spins < guard) {
+    spins += 1;
+    const name = pending.shift();
+    if (name === undefined)
+      break;
+    const facts = host.facts.get(name);
+    const waiting = facts?.foreignKeys.some((key) => {
+      let parent;
+      for (const item of host.facts.values()) {
+        if (item.sql === key.target)
+          parent = item.name;
+      }
+      return parent !== undefined && wanted.has(parent) && !ordered.includes(parent);
+    });
+    if (waiting)
+      pending.push(name);
+    else
+      ordered.push(name);
+  }
+  return ordered.length === names.length ? ordered : [...names];
+}
+function markerFor(view, facts, keys, tenant) {
+  const value = `isolation-${tenant}`;
+  const out = {};
+  for (const column of view.columns) {
+    if (column.guarded || keys.includes(column.field))
+      continue;
+    if (column.dataType.toLowerCase() !== "text")
+      continue;
+    const source = facts.columns.find((item) => item.field === column.field);
+    if (source === undefined || !source.writable || source.guarded)
+      continue;
+    if (keys.includes(source.field))
+      continue;
+    if (facts.foreignKeys.some((key) => key.columns.includes(source.sql)))
+      continue;
+    out[source.field] = value;
+  }
+  return out;
+}
+async function readView(view, handle, keys, tenantB, seeded) {
+  const exposed = view.columns.filter((column) => keys.includes(column.field));
+  const where = markerWhere(view, keys, seeded);
+  if (where === undefined && exposed.length === 0) {
+    throw new OkmError2("invalid", `View ${view.name} exposes no tenant key and no text column isolation can match.`, {
+      fieldReason: "no-marker",
+      fix: { summary: "Expose the tenant key, or a text column isolation can match." }
+    });
+  }
+  if (where !== undefined)
+    await readFiltered(view.name, handle, where);
+  if (exposed.length === 0)
+    return;
+  const rows = asRows(await handle.find({ limit: SCAN_LIMIT }));
+  const needle = tenantB.toLowerCase();
+  for (const row of rows) {
+    for (const column of exposed) {
+      const value = row[column.field];
+      if (typeof value === "string" && value.toLowerCase() === needle)
+        leak(view.name, "find", row);
+    }
+  }
+}
+function markerWhere(view, keys, rows) {
+  for (const column of view.columns) {
+    if (column.guarded || keys.includes(column.field))
+      continue;
+    if (column.dataType.toLowerCase() !== "text")
+      continue;
+    for (const row of rows) {
+      const value = row[column.field];
+      if (typeof value === "string")
+        return { [column.field]: value };
+    }
+  }
+  return;
+}
+async function readFiltered(name, handle, where) {
+  const query = handle.find({ where, limit: 1 });
+  const rows = asRows(await query);
+  if (rows.length > 0)
+    leak(name, "find", rows[0]);
+  const streamed = handle.find({ where, limit: 1 });
+  if (typeof streamed.stream === "function") {
+    try {
+      for await (const item of streamed.stream()) {
+        if (isRow2(item))
+          leak(name, "stream", item);
+      }
+    } catch (error) {
+      if (!(error instanceof OkmError2) || error.code !== "OKM1111")
+        throw error;
+    }
+  }
+  const one = await handle.one({ where });
+  if (isRow2(one))
+    leak(name, "one", one);
+  if (asCount(await handle.count({ where })) > 0)
+    leak(name, "count", { count: 1 });
+  if (await handle.exists({ where }) === true)
+    leak(name, "exists", { exists: true });
+}
+async function dropNewRows(host, before, keys) {
+  const added = [];
+  for (const [key, row] of host.cache) {
+    if (!before.has(key))
+      added.push({ key, row });
+  }
+  for (let index = added.length - 1;index >= 0; index -= 1) {
+    const item = added[index];
+    if (item === undefined)
+      continue;
+    const colon = item.key.indexOf(":");
+    const scope = item.key.slice(0, colon);
+    const table = item.key.slice(colon + 1);
+    const facts = host.facts.get(table);
+    const tenant = scope === "*" ? undefined : scope;
+    if (facts !== undefined) {
+      try {
+        const where = primaryWhere(facts, item.row, keys);
+        const client = tenant === undefined ? host.db : openTenant(host, tenant);
+        await tableHandle2(client, table).delete({ where });
+      } catch {}
+    }
+    forgetCached(host, table, tenant);
+  }
+}
+function viewHandle(client, name) {
+  const views = "views" in client ? client.views : undefined;
+  if (typeof views !== "object" || views === null) {
+    throw new OkmError2("invalid", "The client has no views.", {
+      fix: { summary: "Declare the view on schema({ views }) and connect with that schema." }
+    });
+  }
+  const handle = views[name];
+  if (!isViewQuery(handle)) {
+    throw new OkmError2("invalid", `View ${name} is not on this client.`, {
+      fix: { summary: "A tenant view is read through for().views." }
+    });
+  }
+  return handle;
+}
+function isViewQuery(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const record = value;
+  return typeof record.find === "function" && typeof record.one === "function";
+}
+function requireFacts(host, name) {
+  const facts = host.facts.get(name);
+  if (facts === undefined) {
+    throw new OkmError2("invalid", `Table ${name} is not in the schema.`, {
+      fix: { summary: "The path must name a table in this schema." }
+    });
+  }
+  return facts;
+}
 function openTenant(host, tenant) {
-  const key = host.schema.tenancy?.key ?? "tenantId";
+  const keys = tenantKeys(host);
+  const input = typeof tenant === "string" ? scopeFor(keys, tenant) : tenant;
   const db = host.db;
   if (!("for" in db) || typeof db.for !== "function") {
     throw new OkmError2("invalid", "This schema has no for().", {
       fix: { summary: "Pass columnTenancy() to schema({ tenancy })." }
     });
   }
-  const opened = db.for({ [key]: tenant });
+  const opened = db.for(input);
   if (typeof opened !== "object" || opened === null) {
     throw new OkmError2("invalid", "for() did not return a client.", {
       fix: { summary: "The tenant key must be a uuid." }

package/dist/shared/{nxdp2ze3.js → 929h19xp.js}

@@ -1,10 +1,10 @@
 import {
   isConnectionSqlstate,
   isConnectionErrno
-} from "./pf0d8f77.js";
+} from "./gwn6v667.js";
 import {
   createClient
-} from "./hf22e0wt.js";
+} from "./j60w0dvr.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -331,7 +331,8 @@ async function openEndpoint(open, url, max, defaults, name, role, weight, probeM
     timer: undefined,
     current: 0,
     inflight: 0,
-    latencyMs: null
+    latencyMs: null,
+    generation: 0
   };
 }
 async function detectPosition(endpoint) {
@@ -345,8 +346,11 @@ async function detectPosition(endpoint) {
 async function sample(handle, endpoint) {
   try {
     const sampled = await readPosition(handle, endpoint);
+    const reopened = endpoint.circuit === "open";
     endpoint.failures = 0;
     endpoint.circuit = "closed";
+    if (reopened)
+      endpoint.generation += 1;
     applySample(endpoint, sampled);
   } catch {
     endpoint.failures += 1;
@@ -515,6 +519,7 @@ function routePool(handle) {
         replicaRefused();
       const reason = options?.route === "primary" ? "constraint:primary" : "primary-required";
       tell(handle, { op: "write", endpoint: primary.name, reason });
+      await callGuard(primary);
       const result = await primary.pool.batch(statements, strip(options));
       await noteWrite(handle, primary.pool);
       return result;
@@ -555,6 +560,14 @@ function routePool(handle) {
         endpoint.pool.cancel?.();
     };
   }
+  const routed = pool;
+  routed.okmReadOnlyUnit = (text, params, prelude, options) => readOnlyUnit(handle, text, params, prelude, options);
+  routed.okmReadOnlyStream = (text, params, prelude, options) => readOnlyStream(handle, text, params, prelude, options);
+  routed.okmEndpoints = () => handle.endpoints.map((endpoint) => ({
+    name: endpoint.name,
+    generation: endpoint.generation,
+    pool: endpoint.pool
+  }));
   return pool;
 }
 function derive(schema, handle, router, shared, route) {
@@ -601,8 +614,82 @@ function force(handle, router, route) {
   }
   if (router.cancel !== undefined)
     pool.cancel = () => router.cancel();
+  const unit = router.okmReadOnlyUnit;
+  const stream = router.okmReadOnlyStream;
+  const forced = pool;
+  if (unit !== undefined) {
+    forced.okmReadOnlyUnit = (text, params, prelude, options) => unit(text, params, prelude, { ...options, route });
+  }
+  if (stream !== undefined) {
+    forced.okmReadOnlyStream = (text, params, prelude, options) => stream(text, params, prelude, { ...options, route });
+  }
   return pool;
 }
+async function readOnlyUnit(handle, text, params, prelude, options) {
+  if (handle.closed)
+    closed();
+  const choice = await choose(handle, text, options?.route);
+  return attempt(handle, choice, async (endpoint) => {
+    if (endpoint.pool.reserve === undefined)
+      replicaReserve();
+    const conn = await endpoint.pool.reserve();
+    try {
+      await conn.execute("begin read only");
+      try {
+        await conn.execute(prelude.text, prelude.params);
+        const result = await conn.execute(text, params, strip(options));
+        await conn.execute("commit");
+        return result;
+      } catch (error) {
+        await conn.execute("rollback").catch(() => {
+          return;
+        });
+        throw error;
+      }
+    } finally {
+      await conn.release();
+    }
+  });
+}
+function readOnlyStream(handle, text, params, prelude, options) {
+  return async function* () {
+    if (handle.closed)
+      closed();
+    const choice = await choose(handle, text, options?.route);
+    tell(handle, { op: choice.op, endpoint: choice.endpoint.name, reason: choice.reason });
+    await callGuard(choice.endpoint);
+    if (choice.endpoint.pool.reserve === undefined)
+      replicaReserve();
+    const conn = await choice.endpoint.pool.reserve();
+    try {
+      await conn.execute("begin read only");
+      try {
+        await conn.execute(prelude.text, prelude.params);
+        await conn.execute(`declare okm_rls no scroll cursor for ${text}`, params);
+        for (;; ) {
+          const chunk = await conn.execute("fetch 64 from okm_rls");
+          if (chunk.rows.length === 0)
+            break;
+          yield chunk.rows;
+        }
+        await conn.execute("close okm_rls");
+        await conn.execute("commit");
+      } catch (error) {
+        await conn.execute("rollback").catch(() => {
+          return;
+        });
+        throw error;
+      }
+    } finally {
+      await conn.release();
+    }
+  }();
+}
+function replicaReserve() {
+  throw new OkmError2("OKM1111", "Row-level security needs a driver that can reserve a connection.", {
+    fix: { summary: "Use a Postgres driver that supports interactive transactions." }
+  });
+}
 function classOf(text) {
   const head = text.trimStart().toLowerCase().replace(/\s+/g, " ");
   if (/^(begin|start transaction|commit|rollback|savepoint|release|set|reset)\b/.test(head)) {
@@ -612,7 +699,7 @@ function classOf(text) {
     return "lock";
   if (/\sfor (no key update|key share|update|share)\b/.test(head))
     return "lock";
-  if (/^(insert|update|delete|with|create|alter|drop|truncate|grant|revoke|comment|vacuum|analyze|reindex|copy)\b/.test(head)) {
+  if (/^(insert|update|delete|refresh|with|create|alter|drop|truncate|grant|revoke|comment|vacuum|analyze|reindex|copy)\b/.test(head)) {
     return "write";
   }
   return "read";
@@ -626,7 +713,7 @@ async function choose(handle, text, route) {
   if (primary === undefined)
     throw new OkmError2("OKM1120", "A topology needs one primary URL.");
   if (text.trimStart().toLowerCase().startsWith("select current_setting")) {
-    return { endpoint: primary, op: "read", reason: "primary-required" };
+    return { endpoint: primary, op: "read", reason: "primary-required", skipGuard: true };
   }
   if (route === "replica" && op !== "read")
     replicaRefused();
@@ -673,17 +760,32 @@ async function* readStream(handle, text, route, params, fallback) {
 async function attempt(handle, choice, run) {
   tell(handle, { op: choice.op, endpoint: choice.endpoint.name, reason: choice.reason });
   try {
+    if (choice.skipGuard !== true)
+      await callGuard(choice.endpoint);
     return await tracked(choice.endpoint, choice.op === "read", () => run(choice.endpoint));
   } catch (error) {
     if (choice.op !== "read" || !isUnreachable(error))
       throw error;
+    choice.endpoint.generation += 1;
     const next = await retryOf(handle, choice);
     if (next === undefined)
       throw error;
     tell(handle, { op: "read", endpoint: next.endpoint.name, reason: next.reason });
+    if (choice.skipGuard !== true)
+      await callGuard(next.endpoint);
     return tracked(next.endpoint, true, () => run(next.endpoint));
   }
 }
+function callGuard(endpoint) {
+  const guard = endpoint.pool.okmGuard;
+  if (guard === undefined)
+    return Promise.resolve();
+  return guard({
+    name: endpoint.name,
+    generation: endpoint.generation,
+    pool: endpoint.pool
+  });
+}
 var CHAIN_DEPTH = 8;
 function isUnreachable(error) {
   const seen = new Set;

package/dist/shared/{gjthds9j.js → 9628a9xt.js}

@@ -1,6 +1,6 @@
 import {
   required
-} from "./c9z5g0fm.js";
+} from "./ywr8hmey.js";
 import {
   rejected
 } from "./tmbdywx0.js";