okmodel 0.5.1 → 0.7.0

package/dist/shared/{87jvvhnt.js → 81ebdx9p.js}

@@ -1,25 +1,26 @@
+import {
+  noTimeout
+} from "./79dt02vc.js";
 import {
   PGLITE_CAPABILITIES,
   driverErrors,
   rejectClosed,
   rejectCancelled,
   rejectTimedOut,
-  mapFailure,
   nextTransactionDepth,
   runCall,
   EMPTY_NOTICES,
   resultFrom
-} from "./cgbamx3e.js";
+} from "./kb2sdhfb.js";
 
 // src/adapters/pg/pglite.ts
 import { PGlite } from "@electric-sql/pglite";
-var RESET_ALL = "RESET ALL";
-var UNLOCK = "SELECT pg_advisory_unlock_all()";
 async function open3(config = {}) {
+  const wire = await import("./g6evj1j3.js");
   const db = new PGlite({
     dataDir: config.dataDir ?? "memory://",
-    parsers: WIRE,
-    serializers: WIRE
+    parsers: wire.parsers,
+    serializers: wire.serializers
   });
   await db.waitReady;
   const acquireMs = config.timeouts?.acquire;
@@ -27,8 +28,8 @@ async function open3(config = {}) {
   const notices = noticeBuffer();
   const queryOptions = {
     rowMode: "array",
-    parsers: WIRE,
-    serializers: WIRE,
+    parsers: wire.parsers,
+    serializers: wire.serializers,
     onNotice(notice) {
       notices.push(notice);
     }
@@ -39,24 +40,35 @@ async function open3(config = {}) {
     inflight += 1;
   }, () => {
     inflight = Math.max(0, inflight - 1);
-  });
+  }, (error) => wire.fail(error));
   async function lease() {
     if (closed)
       return rejectClosed();
     await slot.acquire(acquireMs);
     let released = false;
     return {
-      execute: (text, params, options) => runCall(closed, options, (watch) => session.query(text, params, watch)),
-      batch: (statements, options) => runCall(closed, options, async (watch) => {
-        const { runAtomicBatch } = await import("./efmy2gcg.js");
-        return runAtomicBatch(session, statements, watch);
-      }),
+      execute: (text, params, options) => {
+        const refused = noTimeout(options);
+        if (refused !== undefined)
+          return refused;
+        return runCall(closed, options, (watch) => session.query(text, params, watch));
+      },
+      batch: (statements, options) => {
+        const refused = noTimeout(options);
+        if (refused !== undefined)
+          return refused;
+        return runCall(closed, options, async (watch) => {
+          const { runAtomicBatch } = await import("./b76b8d95.js");
+          return runAtomicBatch(session, statements, watch);
+        });
+      },
       async release() {
         if (released)
           return;
         released = true;
         try {
-          await reset(session);
+          const { resetQueried } = await import("./5fe3kbsh.js");
+          await resetQueried(session);
         } finally {
           slot.release();
         }
@@ -66,6 +78,9 @@ async function open3(config = {}) {
   return {
     capabilities: PGLITE_CAPABILITIES,
     execute(text, params, options) {
+      const refused = noTimeout(options);
+      if (refused !== undefined)
+        return refused;
       return runCall(closed, options, async (watch) => {
         await slot.acquire(acquireMs);
         try {
@@ -76,6 +91,9 @@ async function open3(config = {}) {
       });
     },
     async batch(statements, options) {
+      const refused = noTimeout(options);
+      if (refused !== undefined)
+        return refused;
       const connection = await lease();
       try {
         return await connection.batch(statements, options);
@@ -111,6 +129,12 @@ async function open3(config = {}) {
     }
   };
 }
+function seal2(pool) {
+  let closed = 0;
+  return new Proxy(pool, {
+    get: (inner, key) => key === "close" ? () => Promise.resolve(closed = 1) : (inner = inner[key], closed && inner?.call ? () => rejectClosed() : inner)
+  });
+}
 
 class PgliteSession {
   canCancel = false;
@@ -120,12 +144,14 @@ class PgliteSession {
   notices;
   enter;
   leave;
-  constructor(db, options, notices, enter, leave) {
+  fail;
+  constructor(db, options, notices, enter, leave, fail) {
     this.db = db;
     this.options = options;
     this.notices = notices;
     this.enter = enter;
     this.leave = leave;
+    this.fail = fail;
   }
   query(text, params, watch) {
     const why = watch?.reason();
@@ -142,7 +168,7 @@ class PgliteSession {
     }, (error) => {
       this.leave();
       this.notices.take();
-      return mapFailure(error).then((mapped) => {
+      return this.fail(stampQuery(error, text)).then((mapped) => {
         throw mapped;
       });
     });
@@ -226,56 +252,10 @@ class Slot {
     return this.waiters.length;
   }
 }
-async function reset(session) {
-  if (session.inTransaction())
-    await session.rollback().catch(() => {
-      return;
-    });
-  try {
-    await session.query(RESET_ALL, undefined, undefined);
-    await session.query(UNLOCK, undefined, undefined);
-  } catch {
-    await session.rollback().catch(() => {
-      return;
-    });
-    await session.query(RESET_ALL, undefined, undefined);
-    await session.query(UNLOCK, undefined, undefined);
-  }
-}
-function wireMap(oids) {
-  const parsers = {};
-  for (const oid of oids)
-    parsers[oid] = (value) => value;
-  return parsers;
+function stampQuery(error, text) {
+  if (typeof error === "object" && error !== null && !("query" in error))
+    Reflect.set(error, "query", text);
+  return error;
 }
-var WIRE = wireMap([
-  16,
-  17,
-  20,
-  21,
-  23,
-  25,
-  114,
-  700,
-  701,
-  1043,
-  1082,
-  1114,
-  1184,
-  1700,
-  2950,
-  3802,
-  1000,
-  1005,
-  1007,
-  1009,
-  1016,
-  1115,
-  1182,
-  1185,
-  1231,
-  199,
-  3807
-]);
 
-export { open3 };
+export { open3, seal2 };

package/dist/shared/{szm0cksa.js → 8skf0cam.js}

@@ -1,6 +1,6 @@
 import {
   FUNCTION_ARG_TYPES
-} from "./fancm5pt.js";
+} from "./b5pftnn2.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -9,6 +9,8 @@ import {
 async function assertRoleHealth(runner, roles, objects) {
   const managed = new Set((roles.managed ?? []).map((role) => role.name));
   const named = [roles.migration, roles.app];
+  if (roles.reporting !== undefined)
+    named.push(roles.reporting);
   for (const name of named) {
     if (managed.has(name))
       continue;
@@ -22,15 +24,16 @@ async function assertRoleHealth(runner, roles, objects) {
   if (managed.size > 0)
     await assertCreateRole(runner, await currentUser(runner));
   for (const object of objects) {
-    if (object.kind !== "grant" || object.identity.role !== roles.app)
+    if (object.kind !== "grant")
       continue;
+    if (managed.has(object.identity.role) && !await roleExists(runner, object.identity.role)) {
+      continue;
+    }
     await assertGrant(runner, object);
   }
 }
 async function assertCreateRole(runner, role) {
-  const result = await runner.execute("select rolcreaterole from pg_roles where rolname = $1", [
-    role
-  ]);
+  const result = await runner.execute("select rolsuper or rolcreaterole from pg_roles where rolname = $1", [role]);
   if (!truthy(result.rows[0]?.[0])) {
     throw new OkmError2("forbidden", `Role ${role} lacks CREATEROLE. Nothing was changed.`, {
       kind: "forbidden",
@@ -62,11 +65,36 @@ async function assertGrant(runner, object) {
       missing(object, `${schema}.${fn}`);
     return;
   }
-  if (target.kind === "namespace")
+  if (target.kind === "namespace") {
+    const allowed = await runner.execute(`select exists (
+         select 1 from pg_namespace n
+         cross join lateral aclexplode(n.nspacl) as a
+         where n.nspname = $2
+           and a.privilege_type = $3
+           and (
+             a.grantee = 0
+             or a.grantee = (select oid from pg_roles where rolname = $1)
+           )
+       )`, [object.identity.role, schema, privilege]);
+    if (!truthy(allowed.rows[0]?.[0]))
+      missing(object, `schema ${schema}`);
     return;
+  }
   const relkinds = target.kind === "sequence" ? "'S'" : target.kind === "view" ? "'v'" : target.kind === "materializedView" ? "'m'" : "'r', 'p'";
   if (!await relationExists(runner, schema, target.name, relkinds))
     return;
+  const column = /^(SELECT|UPDATE)\(([^)]*)\)$/.exec(privilege);
+  const listed = column?.[2];
+  const base = column?.[1];
+  if (listed !== undefined && base !== undefined) {
+    const names = listed.split(",").filter((name) => name.length > 0);
+    for (const name of names) {
+      const allowed = await runner.execute("select has_column_privilege($1, format('%I.%I', $2::text, $3::text), $4, $5)", [object.identity.role, schema, target.name, name, base]);
+      if (!truthy(allowed.rows[0]?.[0]))
+        missing(object, `${schema}.${target.name}.${name}`);
+    }
+    return;
+  }
   const probe = target.kind === "sequence" ? "select has_sequence_privilege($1, format('%I.%I', $2::text, $3::text), $4)" : "select has_table_privilege($1, format('%I.%I', $2::text, $3::text), $4)";
   const allowed = await runner.execute(probe, [
     object.identity.role,

package/dist/shared/{gjthds9j.js → 9628a9xt.js}

@@ -1,6 +1,6 @@
 import {
   required
-} from "./c9z5g0fm.js";
+} from "./ywr8hmey.js";
 import {
   rejected
 } from "./tmbdywx0.js";

package/dist/shared/9a4ae4p8.js

@@ -0,0 +1,31 @@
+// src/dialects/pg/ops/window.ts
+var RUNTIME = Symbol.for("okmodel.window");
+function isWindow(value) {
+  return typeof value === "object" && value !== null && RUNTIME in value;
+}
+function rowNumber2(options) {
+  return frame("rowNumber", "row_number", undefined, options);
+}
+function rank2(options) {
+  return frame("rank", "rank", undefined, options);
+}
+function denseRank2(options) {
+  return frame("denseRank", "dense_rank", undefined, options);
+}
+function runningTotal2(column, options) {
+  return frame("runningTotal", "sum", column, options);
+}
+function frame(label, fn, column, options) {
+  const spec = options ?? { orderBy: undefined, as: undefined, partitionBy: undefined };
+  return {
+    [RUNTIME]: true,
+    label,
+    fn,
+    column,
+    partitionBy: spec.partitionBy,
+    orderBy: spec.orderBy,
+    as: spec.as
+  };
+}
+
+export { isWindow, rowNumber2, rank2, denseRank2, runningTotal2 };

package/dist/shared/{8xsbagad.js → 9s0ypp87.js}

@@ -1,15 +1,15 @@
 import {
   creationOrder2
-} from "./8bwbwy8h.js";
+} from "./qq3899ht.js";
 import {
   isDomain
-} from "./g7ez901n.js";
+} from "./ywspezzx.js";
 import {
   quoteLiteral
 } from "./94ez8kzh.js";
 import {
   identityKey2
-} from "./t4tbsy9h.js";
+} from "./358zsv4r.js";
 import {
   fitIdentifier2
 } from "./nfzc5z0w.js";
@@ -22,6 +22,7 @@ function renderCatalog(source, schema) {
   const folded = foldedKeys(source);
   const statements = [];
   const ordered = creationOrder2(source);
+  const created = uniqueBeforeForeignKey(ordered);
   for (const object of ordered) {
     if (object.kind !== "type" || object.owner === "ignored")
       continue;
@@ -29,8 +30,8 @@ function renderCatalog(source, schema) {
     if (sql !== undefined)
       statements.push(sql);
   }
-  for (const object of ordered) {
-    if (object.kind === "type" || object.kind === "function" || object.kind === "trigger" || object.kind === "view" || object.kind === "materializedView" || ownedByView(object)) {
+  for (const object of created) {
+    if (object.kind === "type" || object.kind === "function" || object.kind === "trigger" || object.kind === "view" || object.kind === "materializedView" || object.kind === "policy" || ownedByView(object)) {
       continue;
     }
     if (object.owner === "ignored")
@@ -46,6 +47,12 @@ function renderCatalog(source, schema) {
     if (sql !== undefined)
       statements.push(sql);
   }
+  for (const object of created) {
+    if (object.kind !== "policy" || object.owner === "ignored")
+      continue;
+    for (const step of policyCreatePlan(object, schema))
+      statements.push(step.sql);
+  }
   for (const kind of ["function", "trigger"]) {
     for (const object of ordered) {
       if (object.kind !== kind || object.owner === "ignored")
@@ -73,6 +80,48 @@ function renderCatalog(source, schema) {
   }
   return statements;
 }
+function uniqueBeforeForeignKey(objects) {
+  const uniques = objects.filter((object) => object.kind === "constraint" && object.definition.constraintKind === "unique");
+  if (uniques.length === 0)
+    return objects;
+  const emitted = new Set;
+  const result = [];
+  for (const object of objects) {
+    if (emitted.has(object))
+      continue;
+    if (object.kind === "constraint" && object.definition.constraintKind === "foreignKey") {
+      const target = object.definition.references;
+      if (target !== undefined && !coveredByPrimary(objects, target.parent, target.columns)) {
+        const columns = target.columns.join("\x00");
+        for (const unique of uniques) {
+          if (emitted.has(unique))
+            continue;
+          if (!sameRef(unique.identity.parent, target.parent))
+            continue;
+          if (unique.definition.columns.join("\x00") !== columns)
+            continue;
+          result.push(unique);
+          emitted.add(unique);
+        }
+      }
+    }
+    result.push(object);
+    emitted.add(object);
+  }
+  return result;
+}
+function coveredByPrimary(objects, parent, columns) {
+  const key = columns.join("\x00");
+  return objects.some((object) => object.kind === "constraint" && object.definition.constraintKind === "primaryKey" && sameRef(object.identity.parent, parent) && object.definition.columns.join("\x00") === key);
+}
+function sameRef(left, right) {
+  if (left.name !== right.name || left.namespace.form !== right.namespace.form)
+    return false;
+  if (left.namespace.form === "static" && right.namespace.form === "static") {
+    return left.namespace.name === right.namespace.name;
+  }
+  return left.namespace.form === "template" && right.namespace.form === "template" ? left.namespace.pattern === right.namespace.pattern : false;
+}
 function ownedByView(object) {
   if (object.kind !== "index")
     return false;
@@ -149,7 +198,39 @@ function functionSql(object, schema, replace) {
 }
 function viewSql(object, schema, replace) {
   const verb = replace ? "create or replace view" : "create view";
-  return `${verb} ${qualify(schema, object.identity.name)} as ${object.definition.query}`;
+  const invoker = object.definition.securityInvoker === true ? " with (security_invoker = true)" : "";
+  return `${verb} ${qualify(schema, object.identity.name)}${invoker} as ${object.definition.query}`;
+}
+function policyCreatePlan(object, schema) {
+  const table = qualify(schema, object.identity.parent.name);
+  const name = quoteIdent(object.identity.name);
+  const command = object.definition.command === "all" ? "all" : "select";
+  const check = object.definition.command === "all" ? ` with check ${object.definition.expression}` : "";
+  const create = {
+    sql: `create policy ${name} on ${table} as permissive for ${command} using ${object.definition.expression}${check}`,
+    kind: "create-policy"
+  };
+  if (object.definition.command !== "all")
+    return [create];
+  return [
+    { sql: `alter table ${table} enable row level security`, kind: "enable-rls" },
+    { sql: `alter table ${table} force row level security`, kind: "enable-rls" },
+    create
+  ];
+}
+function policyDropPlan(object, schema) {
+  const table = qualify(schema, object.identity.parent.name);
+  const drop = {
+    sql: `drop policy ${quoteIdent(object.identity.name)} on ${table}`,
+    kind: "drop-policy"
+  };
+  if (object.definition.command !== "all")
+    return [drop];
+  return [
+    drop,
+    { sql: `alter table ${table} no force row level security`, kind: "disable-rls" },
+    { sql: `alter table ${table} disable row level security`, kind: "disable-rls" }
+  ];
 }
 function materializedViewSql(object, schema) {
   return `create materialized view ${qualify(schema, object.identity.name)} as ${object.definition.query} with no data`;
@@ -315,4 +396,4 @@ function qualify(schema, name) {
   return `${quoteIdent(schema)}.${quoteIdent(name)}`;
 }
 
-export { quoteIdent, renderCatalog, ownedByView, dropObjectSql, createObjectSql, functionSql, viewSql, refreshMaterializedViewSql, alterColumnSql, identitySequence, createTableSql, qualify };
+export { quoteIdent, renderCatalog, uniqueBeforeForeignKey, ownedByView, dropObjectSql, createObjectSql, functionSql, viewSql, policyCreatePlan, policyDropPlan, refreshMaterializedViewSql, alterColumnSql, identitySequence, createTableSql, qualify };