okmodel 0.5.1 → 0.7.0

package/dist/adapters/capabilities.d.ts

@@ -5,6 +5,9 @@
  * OKM11xx for a driver that lacks a flag: OKM1110 is the engine-version gate,
  * and OKM1801 is a dialect mismatch. This module does not invent a code and
  * does not throw for a missing flag.
+ *
+ * `stream` means the driver can open a server cursor. `.stream()` does not
+ * read it. That method walks keyset batches on every driver.
  */
 import type { DriverCapabilities } from "../contracts/driver.js";
 /** Capability names a caller can read. */

package/dist/adapters/failure.d.ts

@@ -13,10 +13,21 @@ export declare function driverErrors(): Promise<ErrorModule>;
 /**
  * Rejects with a closed-pool {@link import("./error.js").DriverError}.
  *
- * @param message - Error text
+ * The text and SQLSTATE `08006` load with the lazy error module. Classification
+ * reads the SQLSTATE. The message is "The pool is closed."
+ *
+ * @returns A rejected promise
+ */
+export declare function rejectClosed(): Promise<never>;
+/**
+ * Rejects with OKM1120 when a driver cannot cancel a positive timeout.
+ *
+ * The message stays `timeout`. Kind stays `invalid`. Bun.sql and PGlite call
+ * this. Other drivers do not, so their connect graphs omit it.
+ *
  * @returns A rejected promise
  */
-export declare function rejectClosed(message?: string): Promise<never>;
+export declare function rejectUncancellable(): Promise<never>;
 /**
  * Rejects with kind `cancelled`.
  *

package/dist/adapters/lazy-errors.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Error text a connect entry does not need until a call fails.
+ *
+ * Loaded on the first closed pool or on a positive `timeout` for a driver
+ * that cannot cancel. A successful execute does not import this module.
+ */
+/**
+ * OKM1120 for a positive `timeout` on Bun.sql or PGlite.
+ *
+ * Kind stays `invalid`. The message stays `timeout` (D224, D239).
+ *
+ * @returns A rejected promise
+ */
+export declare function refused(): Promise<never>;
+/**
+ * A pool that has already been closed.
+ *
+ * The message is for people. Classification reads SQLSTATE `08006`.
+ *
+ * @returns A rejected promise
+ */
+export declare function closed(): Promise<never>;

package/dist/adapters/pg/bunsql-extra.d.ts

@@ -1,9 +1,11 @@
 /**
  * Reserved connections for Bun.sql.
  *
- * Loaded on the first reserve, batch, or stream. A read does not use it.
+ * Loaded on the first reserve, batch, stream, or dead connection. A read that
+ * succeeds does not use it.
  */
-import type { DriverConnection } from "../../contracts/driver.js";
+import type { ReservedSQL, SQL } from "bun";
+import type { DriverConnection, WireValue } from "../../contracts/driver.js";
 import { type HeldPool } from "./bunsql.js";
 /**
  * Checks out one connection and clears it on release.
@@ -14,4 +16,53 @@ import { type HeldPool } from "./bunsql.js";
  * @param held - The pool and its counters
  * @returns A connection the caller must release
  */
-export declare function checkout(held: HeldPool): Promise<DriverConnection>;
+/**
+ * Drops a dead pooled socket, then runs `again` once when that is safe.
+ *
+ * A `57P01` or a socket Bun has already closed is evicted before another
+ * statement can take it. A client read is tried once more when `depth` is 0.
+ * A raw pool retries only when the socket had already closed, or Bun rejected
+ * the statement before the server saw it, so a query killed while it was
+ * running is not started again. `again` does not pass through `recover`.
+ *
+ * @param sql - The pool
+ * @param error - The failure from the first attempt
+ * @param text - Statement text, used to decide the retry
+ * @param depth - Open transaction depth. Above zero, an earlier command was sent
+ * @param clientRead - The pool was opened for a client, which retries a read once
+ * @param closedDuring - `onclose` ran after this statement was sent
+ * @param again - The same statement, on whatever connection the pool hands out next
+ * @returns The retried result, or a rejection of `error`
+ */
+export declare function recover<T>(sql: SQL, error: unknown, text: string, depth: number, clientRead: boolean, closedDuring: boolean, again: () => Promise<T>): Promise<T>;
+/**
+ * Spends a closed socket before the caller's statement is sent.
+ *
+ * @param sql - The pool
+ */
+export declare function drainClosed(sql: SQL): Promise<void>;
+/**
+ * Subscribes on one pooled connection.
+ *
+ * @param sql - The pool
+ * @param parked - Reserved handles to put back first
+ * @param closed - The pool is closed
+ * @param channel - Notify channel
+ * @param onNotify - Payload callback
+ * @returns Stops the subscription
+ */
+export declare function listen(sql: SQL, parked: ReservedSQL[], closed: boolean, channel: string, onNotify: (payload: string) => void): Promise<() => Promise<void>>;
+export declare function checkout(held: HeldPool): Promise<DriverConnection & {
+    evict(): void;
+}>;
+/**
+ * Yields cursor chunks from one checked-out Bun.sql connection.
+ *
+ * @param checkout - Reserves the connection
+ * @param text - Query to stream
+ * @param params - Wire parameters
+ * @returns Chunks of wire rows
+ */
+export declare function streamRows(checkout: () => Promise<DriverConnection & {
+    evict?: () => void;
+}>, text: string, params: readonly WireValue[] | undefined): AsyncIterable<readonly (readonly WireValue[])[]>;

package/dist/adapters/pg/bunsql.d.ts

@@ -11,9 +11,10 @@
  */
 import { SQL, type ReservedSQL } from "bun";
 import type { DriverPool, DriverPoolConfig, WireValue } from "../../contracts/driver.js";
+import { DriverError } from "../error.js";
 import { noticeBuffer, type WireQuery } from "./session.js";
 export { BUNSQL_CAPABILITIES as capabilities, hasCapability, readCapability, } from "../capabilities.js";
-export { DriverError } from "../error.js";
+export { DriverError };
 /** TLS values Bun.sql accepts that this adapter forwards. */
 export type BunSqlTls = boolean | "disable" | "allow" | "prefer" | "require" | "verify-ca" | "verify-full";
 /** Options for {@link open}. */
@@ -40,7 +41,19 @@ export type HeldPool = {
     readonly counters: Counters;
     readonly notices: ReturnType<typeof noticeBuffer>;
     readonly isClosed: () => boolean;
+    /** Sockets this pool has closed. The count never returns to zero. */
+    readonly closures: () => number;
 };
+/**
+ * Marks a pool opened for a client.
+ *
+ * A client read that finds a dead socket is tried once. A pool from raw
+ * {@link open} is not marked, so a statement the server killed while it was
+ * running is not started again.
+ *
+ * @param pool - The pool `connect` just opened
+ */
+export declare function markClientPool(pool: DriverPool): void;
 /** Pool occupancy. */
 export type Counters = {
     reserved: number;

package/dist/adapters/pg/cursor.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Server-side cursor for drivers that stream through a checked-out connection.
+ *
+ * Loaded with the stream chunk. A read does not import this.
+ */
+import type { ExecuteResult, WireValue } from "../../contracts/driver.js";
+/**
+ * Yields cursor chunks from one connection that is already checked out.
+ *
+ * The cursor is session-local. `ROLLBACK` in the end drops it.
+ *
+ * @param run - Executes on the checked-out connection
+ * @param text - Query to stream
+ * @param params - Wire parameters
+ * @returns Chunks of wire rows
+ */
+export declare function cursorStream(run: (text: string, params?: readonly WireValue[]) => Promise<ExecuteResult>, text: string, params: readonly WireValue[] | undefined): AsyncIterable<readonly (readonly WireValue[])[]>;

package/dist/adapters/pg/no-inflight-timeout.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Refusal for a driver that cannot cancel an in-flight statement (D224).
+ *
+ * Bun.sql and PGlite refuse a positive `timeout`. The OKM1120 text loads with
+ * the lazy error module, so a connect entry does not carry it. Kind is
+ * `invalid`, which separates it from kind `timeout`. `timeout: 0` still fails
+ * immediately as kind `timeout`. `signal` is unchanged. postgres.js and
+ * node-postgres do not import this.
+ */
+/**
+ * Returns a rejected OKM1120 when `timeout` is a positive number.
+ *
+ * Absent, and a non-positive timeout, return `undefined` so the caller runs.
+ *
+ * @param options - Per-call options
+ * @returns A rejected promise, or `undefined` when the call may run
+ */
+export declare function noTimeout(options: {
+    readonly timeout?: number;
+} | undefined): Promise<never> | undefined;

package/dist/adapters/pg/nodepostgres-extra.d.ts

@@ -3,7 +3,7 @@
  *
  * Loaded on the first reserve, batch, or stream. A read does not use it.
  */
-import type { DriverConnection } from "../../contracts/driver.js";
+import type { DriverConnection, WireValue } from "../../contracts/driver.js";
 import { type HeldPool } from "./nodepostgres.js";
 /**
  * Checks out one client and clears it on release.
@@ -16,3 +16,24 @@ import { type HeldPool } from "./nodepostgres.js";
  * @returns A connection the caller must release
  */
 export declare function checkout(held: HeldPool): Promise<DriverConnection>;
+/**
+ * Listens on one checked-out client.
+ *
+ * The client has no pool error listener. One is set here so a dropped socket
+ * is not an uncaught `error` event.
+ *
+ * @param held - The pool and its counters
+ * @param channel - Notification channel
+ * @param onNotify - Called with each payload
+ * @returns Stops the listener
+ */
+export declare function listen(held: HeldPool, channel: string, onNotify: (payload: string) => void): Promise<() => Promise<void>>;
+/**
+ * Yields cursor chunks from one checked-out client.
+ *
+ * @param checkout - Reserves the connection
+ * @param text - Query to stream
+ * @param params - Wire parameters
+ * @returns Chunks of wire rows
+ */
+export declare function streamRows(checkout: () => Promise<DriverConnection>, text: string, params: readonly WireValue[] | undefined): AsyncIterable<readonly (readonly WireValue[])[]>;

package/dist/adapters/pg/nodepostgres.d.ts

@@ -44,6 +44,18 @@ export type Counters = {
     reservedBusy: number;
     waiting: number;
 };
+/**
+ * Attaches the one error listener a pool or a checked-out client can use.
+ *
+ * node-postgres types list `connect` and `notification` only. An idle pool
+ * client and a `LISTEN` client both emit `error` with no listener, and that
+ * is an uncaught exception. The default handler ignores it. The pool has
+ * already removed an idle client.
+ *
+ * @param source - Pool or client
+ * @param handle - What to do with the error
+ */
+export declare function armDriverError(source: object, handle?: () => void): void;
 /**
  * Opens a node-postgres pool for one endpoint.
  *

package/dist/adapters/pg/pglite-wire.d.ts

@@ -0,0 +1,24 @@
+/**
+ * PGlite wire codecs, loaded from {@link import("./pglite.ts").open}.
+ *
+ * A JS number, bigint, or boolean is sent as wire text. An `08P01` from a
+ * bad parameter is a driver error. A lost connection stays `unavailable`.
+ */
+declare const parsers: Record<number, (value: string) => string>;
+declare const serializers: Record<number, (value: unknown) => string>;
+/** Identity parsers. The dialect owns parsing. */
+export { parsers };
+/** Wire-text serializers. Number, bigint, and boolean are text. */
+export { serializers };
+/**
+ * Maps a PGlite failure.
+ *
+ * `08P01` means the parameter did not fit the protocol message. The
+ * replacement carries the message and neither a SQLSTATE nor a cause, so the
+ * kind is `driver`. Any other failure, including a closed connection, is
+ * mapped unchanged.
+ *
+ * @param error - Caught value
+ * @returns A normalised driver error
+ */
+export declare function fail(error: unknown): Promise<unknown>;

package/dist/adapters/pg/pglite.d.ts

@@ -19,3 +19,13 @@ export type PgliteConfig = DriverPoolConfig & {
  * @returns The pool
  */
 export declare function open(config?: PgliteConfig): Promise<DriverPool>;
+/**
+ * A pool whose `close` marks this client only.
+ *
+ * The inner pool stays open. A later call fails as unavailable.
+ * The body stays this small: the PGlite incremental figure is 11,510, 500 under its gate.
+ *
+ * @param pool - The caller's pool
+ * @returns A pool the client owns
+ */
+export declare function seal(pool: DriverPool): DriverPool;

package/dist/adapters/pg/postgres-extra.d.ts

@@ -4,9 +4,14 @@
  * Loaded on the first reserve, batch, describe, or stream.
  */
 import type { Sql } from "postgres";
-import type { DescribeResult, DriverConnection, ExecuteResult, WireValue } from "../../contracts/driver.js";
+import type { DescribeResult, DriverConnection, ExecuteOptions, ExecuteResult, Statement, WireValue } from "../../contracts/driver.js";
 import { type Watch } from "./call.js";
 import { type Canceller, type Counters, type NoticeBuffer } from "./postgresjs.js";
+type Lost = {
+    on: boolean;
+    /** Rejects the reset or drain that is using this reserved connection. */
+    stop: () => void;
+};
 /** State `open` shares with a checkout. */
 export type HeldPool = {
     readonly sql: Sql;
@@ -23,7 +28,7 @@ export type HeldPool = {
  * @param pool - The open pool
  * @returns A connection the caller must release
  */
-export declare function checkout(pool: HeldPool): Promise<DriverConnection>;
+export declare function checkout(pool: HeldPool, timeoutMs?: number): Promise<DriverConnection>;
 /**
  * Describes a statement.
  *
@@ -42,7 +47,40 @@ export declare function describe(sql: Sql, text: string, params?: readonly WireV
  * @returns Chunks of wire rows
  */
 export declare function stream(sql: Sql, text: string, params?: readonly WireValue[]): AsyncIterable<readonly (readonly WireValue[])[]>;
-/** Refcount a checkout or a listener borrows from the pool. */
+/**
+ * Settles `run` when `ms` elapses, the reserved connection closes, or every
+ * slot in the pool has closed.
+ *
+ * A positive `ms` rejects with `timeout` and does not use the pool close hook.
+ * `link` is the reserved connection's lost flag, or the pool client.
+ *
+ * @param ms - Deadline in milliseconds. `0` waits for a close
+ * @param run - Driver operation
+ * @param link - Connection flag, or the pool client when the wait has no connection
+ * @returns The operation's value
+ */
+export declare function deadline<T>(ms: number, run: () => Promise<T>, link?: Lost | Sql): Promise<T>;
+/**
+ * Checks out one connection, runs one batch, and releases it.
+ *
+ * The call timeout covers acquiring the connection and clearing it on release.
+ *
+ * @param pool - The open pool
+ * @param statements - Statements in order
+ * @param options - Call timeout and signal
+ * @returns One result per statement
+ */
+export declare function runBatch(pool: HeldPool, statements: readonly Statement[], options: ExecuteOptions | undefined): Promise<readonly ExecuteResult[]>;
+/**
+ * Sets `lost` when the reserved socket closes.
+ *
+ * The first statement installs `onclose`. Later statements see the flag
+ * before they write.
+ *
+ * @param sql - Reserved connection
+ * @param lost - Set when that socket closes
+ */
+export declare function watchReserved(sql: Sql, lost: Lost): void;
 type Gate = {
     enter(): void;
     leave(): void;

package/dist/adapters/pg/reserved.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Shared reset and lost-connection guard for a reserved connection.
+ *
+ * node-postgres, Bun.sql, and PGlite load this with the first reserve.
+ * postgres.js keeps its own copy: a second module in that adapter bundle
+ * crosses the incremental size gate.
+ */
+/** Set when the reserved socket is gone. */
+export type Lost = {
+    on: boolean;
+};
+/**
+ * Clears session state on a reserved connection.
+ *
+ * A failed reset rolls back and tries once more. The caller supplies `run`.
+ *
+ * @param depth - Open transaction depth. Above zero, roll back first
+ * @param run - Executes one statement on the reserved connection
+ */
+export declare function resetSession(depth: number, run: (text: string) => Promise<unknown>): Promise<void>;
+/**
+ * Clears a PGlite session the same way {@link resetSession} clears the others.
+ *
+ * Rollback goes through the session so its depth is cleared on failure too.
+ *
+ * @param session - The single PGlite connection
+ */
+export declare function resetQueried(session: {
+    inTransaction(): boolean;
+    rollback(): Promise<void>;
+    query(text: string, params: undefined, watch: undefined): Promise<unknown>;
+}): Promise<void>;
+/**
+ * Refuses the next statement after the reserved connection is gone.
+ *
+ * The first lost-connection error sets the flag.
+ *
+ * @param lost - Set when the socket is gone
+ * @param run - The statement
+ * @returns The statement, or a closed-pool rejection
+ */
+export declare function refuseWhenLost<T>(lost: Lost, run: () => Promise<T>): Promise<T>;

package/dist/adapters/pg/session.d.ts

@@ -23,13 +23,6 @@ export type NoticeBuffer = {
         readonly code?: string | undefined;
     }): void;
 };
-/**
- * Quotes one identifier.
- *
- * @param name - Channel or cursor name
- * @returns A double-quoted identifier
- */
-export declare function quoteIdent(name: string): string;
 /**
  * An empty notice buffer the pool fills as the server sends notices.
  *
@@ -81,14 +74,3 @@ export declare class WireSession implements BatchSession {
     private watched;
     private finishWatched;
 }
-/**
- * Yields cursor chunks from one connection that is already checked out.
- *
- * The cursor is session-local. `ROLLBACK` in the end drops it.
- *
- * @param run - Executes on the checked-out connection
- * @param text - Query to stream
- * @param params - Wire parameters
- * @returns Chunks of wire rows
- */
-export declare function cursorStream(run: (text: string, params?: readonly WireValue[]) => Promise<ExecuteResult>, text: string, params: readonly WireValue[] | undefined): AsyncIterable<readonly (readonly WireValue[])[]>;

package/dist/contracts/catalog/document.d.ts

@@ -67,11 +67,13 @@ export declare function catalogHash(source: Catalog): string;
  *
  * Roles, grants, and default privileges come from the migration config, not
  * the schema, so they are left out. A `schema()` catalog never has them, so
- * `connect()` hashes it unchanged. `okm check` still verifies them. A
- * catalog without them is returned as is.
+ * `connect()` hashes it unchanged. `okm check` still verifies them. An
+ * `external` or `ignored` owner is planning state. The startup copy writes
+ * it back to `managed`, which is what `schema()` stored. A catalog with
+ * neither privileges nor those owners is returned as is.
  *
  * @param source - Catalog document
- * @returns The catalog without role, grant, and default-privilege objects
+ * @returns The catalog `connect()` hashes
  */
 export declare function startupCatalog(source: Catalog): Catalog;
 /**
@@ -89,11 +91,23 @@ export declare function startupHash(source: Catalog): string;
  * stored hash and the version, then trusts the objects (D133). `okm check`
  * and dev keep {@link parseCatalog}.
  *
- * @param text - Canonical catalog JSON
- * @param hash - SHA-256 of `text`, stored beside the artifact
+ * @param text - Catalog JSON. A BOM is stripped and `\r` is removed before the hash check
+ * @param hash - SHA-256 of that normalized text, stored beside the artifact
  * @returns The catalog document
  */
 export declare function loadTrustedCatalog(text: string, hash: string): Catalog;
+/**
+ * Catalog file bytes the hash covers.
+ *
+ * A leading UTF-8 BOM is dropped. Carriage returns are removed, so a CRLF
+ * checkout hashes like the LF file the writer stored. An LF file is unchanged.
+ * UTF-16 is OKM1027.
+ *
+ * @param text - Raw catalog JSON or hash file
+ * @param label - Name used when the text is UTF-16
+ * @returns Text to hash and parse
+ */
+export declare function catalogFileText(text: string, label?: string): string;
 /**
  * Reads canonical catalog JSON.
  *

package/dist/contracts/catalog/object.d.ts

@@ -106,7 +106,8 @@ export declare function index(input: IndexInput): IndexObject;
  * Builds a constraint object.
  *
  * Primary key names are `{parent}_pkey` and do not include column names.
- * Other names use `nameKey`, which stays fixed when a field is renamed.
+ * Unique and foreign-key names use every SQL column. Checks use `nameKey`,
+ * which stays fixed when a field is renamed. `nameKey` is always stored.
  *
  * @param input - Parent, kind, columns, and the stable name key
  * @returns A constraint envelope

package/dist/contracts/catalog/policy.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Row-level security policy catalog objects.
+ *
+ * The factory stores the record. It does not plan SQL. Postgres DDL stays in
+ * the dialect. A schema that never imports `rlsTenancy` does not load this.
+ */
+import type { ObjectIdentity, ObjectRef, Owner, PolicyCommand, PolicyObject, Provenance } from "./types.js";
+/** Input for {@link policyObject}. */
+export type PolicyInput = {
+    readonly parent: ObjectRef;
+    readonly name: string;
+    readonly command: PolicyCommand;
+    readonly expression: string;
+    /** True when the table is `FORCE ROW LEVEL SECURITY`. */
+    readonly force: boolean;
+    readonly owner?: Owner;
+    readonly provenance: Provenance;
+    /** Extra edges. The parent table is always included. */
+    readonly dependencies?: readonly ObjectIdentity[];
+};
+/**
+ * Predicate stored for `{table}_tenant`.
+ *
+ * The text is what `pg_get_expr` prints, so a replayed catalog matches.
+ * An unset `app.tenant` becomes null and the comparison matches no row.
+ *
+ * @param column - SQL name of the tenant column
+ * @param dataType - Postgres type of that column
+ * @returns The `USING` and `WITH CHECK` expression
+ */
+export declare function tenantPolicyExpression(column: string, dataType: string): string;
+/**
+ * Predicate stored for `{table}_unscoped_select`.
+ *
+ * `SELECT` only. Writes stay on the tenant policy.
+ *
+ * @returns The `USING` expression
+ */
+export declare function unscopedPolicyExpression(): string;
+/**
+ * Builds a policy record.
+ *
+ * Identity is `(parent, name)`. A name past the dialect limit is fitted.
+ *
+ * @param input - Parent table, command, and expression
+ * @returns The catalog object
+ */
+export declare function policyObject(input: PolicyInput): PolicyObject;

package/dist/contracts/catalog/types.d.ts

@@ -393,6 +393,13 @@ export type ViewColumn = {
 export type ViewDefinition = {
     readonly columns: readonly ViewColumn[];
     readonly query: string;
+    /**
+     * `WITH (security_invoker = true)`.
+     *
+     * Set only for a view over tenant tables under `rlsTenancy`. Omitted
+     * otherwise, so a view under another strategy keeps the same catalog bytes.
+     */
+    readonly securityInvoker?: true;
 };
 /**
  * Materialized view definition.
@@ -440,10 +447,27 @@ export type RoleObject = CatalogEnvelope<"role", RoleIdentity, RoleDefinition>;
 export type GrantObject = CatalogEnvelope<"grant", GrantIdentity, GrantDefinition>;
 /** A default privilege. Identity is `(forRole, namespace, objectKind, grantee, privilege)`. */
 export type DefaultPrivilegeObject = CatalogEnvelope<"defaultPrivilege", DefaultPrivilegeIdentity, DefaultPrivilegeDefinition>;
+/** Which statements a policy covers. `all` is every command. `select` is reads. */
+export type PolicyCommand = "all" | "select";
+/**
+ * One row-level security policy.
+ *
+ * `expression` is the `USING` text, and the `WITH CHECK` text when `command`
+ * is `all`. `force` is true when the table is `FORCE ROW LEVEL SECURITY`.
+ */
+export type PolicyDefinition = {
+    readonly command: PolicyCommand;
+    readonly expression: string;
+    readonly force: boolean;
+};
+/** A policy. Identity is `(parent, name)`. */
+export type PolicyObject = CatalogEnvelope<"policy", AnchoredIdentity & {
+    readonly kind: "policy";
+}, PolicyDefinition>;
 /**
  * One built catalog object.
  */
-export type CatalogObject = TableObject | ColumnObject | IndexObject | ConstraintObject | SequenceObject | TypeObject | ExtensionObject | FunctionObject | TriggerObject | ViewObject | MaterializedViewObject | RoleObject | GrantObject | DefaultPrivilegeObject;
+export type CatalogObject = TableObject | ColumnObject | IndexObject | ConstraintObject | SequenceObject | TypeObject | ExtensionObject | FunctionObject | TriggerObject | ViewObject | MaterializedViewObject | RoleObject | GrantObject | DefaultPrivilegeObject | PolicyObject;
 /** Format version stored in the serialized catalog. */
 export declare const CATALOG_VERSION = 1;
 /** A catalog document. Object order is identity-key order. */

package/dist/contracts/catalog/view.d.ts

@@ -11,6 +11,8 @@ export type ViewInput = {
     readonly name: string;
     readonly columns: readonly ViewColumn[];
     readonly query: string;
+    /** `WITH (security_invoker = true)`. Omitted from the record when unset. */
+    readonly securityInvoker?: true;
     readonly owner?: Owner;
     readonly provenance: Provenance;
     readonly dependencies?: readonly ObjectIdentity[];

package/dist/contracts/connection.d.ts

@@ -24,8 +24,10 @@ export declare function isConnectionErrno(code: string): boolean;
 /**
  * Reports whether `error` is a dropped or refused connection.
  *
- * Constraint failures are not connection failures. `23505` stays a unique
- * violation even when it is raised at commit.
+ * The decision is a driver `code` ({@link isConnectionErrno}, including
+ * `CONNECT_TIMEOUT`, or `ERR_POSTGRES_CONNECTION_CLOSED`) or a SQLSTATE in
+ * class `08` or `57P01`–`57P03`. A server SQLSTATE outside that set is never
+ * a lost connection. Message text is not read.
  *
  * @param error - Caught value
  * @returns `true` when no session remains
@@ -35,10 +37,9 @@ export declare function isConnectionFailure(error: unknown): boolean;
  * Reports whether the connection is gone after `error`, or the outcome of a
  * statement on it is unknown (`outcome_unknown`).
  *
- * It reads what {@link isConnectionFailure} reads, plus the messages node-postgres
- * ("Connection terminated unexpectedly") and Bun.sql (`ERR_POSTGRES_CONNECTION_CLOSED`)
- * give, and the error's `cause`. Nothing more should be sent to such a connection:
- * not a rollback, not a reset. Loaded with the code that reserves a connection.
+ * It reads what {@link isConnectionFailure} reads, and the error's `cause`.
+ * Nothing more should be sent to such a connection: not a rollback, not a
+ * reset. Loaded with the code that reserves a connection.
  *
  * @param error - Caught value
  * @returns `true` when the session cannot be used again

package/dist/contracts/internal.js

@@ -13,7 +13,7 @@ import {
   index3,
   constraint2,
   sequence2
-} from "../shared/t4tbsy9h.js";
+} from "../shared/358zsv4r.js";
 import {
   OWNERS2,
   OBJECT_KINDS2,

package/dist/contracts/location.d.ts

@@ -14,6 +14,16 @@
  * @returns `file.ts:line`, or `undefined` when the runtime has no stack
  */
 export declare function callerLocation(skip: number): string | undefined;
+/**
+ * File and line from stack lines, skipping `location.ts` frames.
+ *
+ * A frame may use `/` or `\`.
+ *
+ * @param lines - `Error.stack` split on `\n`
+ * @param skip - Callers to pass before the frame that is recorded
+ * @returns `file.ts:line`, or `undefined` when no frame remains
+ */
+export declare function locationFromLines(lines: readonly string[], skip: number): string | undefined;
 /**
  * Appends a source location to an error message.
  *