okmodel 0.8.0 → 0.9.0

package/dist/shared/rbxt795q.js

@@ -0,0 +1,1766 @@
+import {
+  functionObject,
+  viewObject,
+  materializedViewObject
+} from "./12z7aznj.js";
+import {
+  quoteIdent2,
+  renderCatalog2,
+  createObjectSql2,
+  identitySequence2,
+  createTableSql2
+} from "./fk9vef30.js";
+import {
+  cellText,
+  introspectSchema
+} from "./myk8fswx.js";
+import {
+  projectPath,
+  loadConfig
+} from "./2zdxkt7b.js";
+import {
+  sqlIdentifiers,
+  sessionFailure,
+  finishQuiet,
+  assertTargetPolicy,
+  selectTarget
+} from "./6nae0spm.js";
+import {
+  dependencyOrder,
+  catalog,
+  isDomain
+} from "./ywspezzx.js";
+import {
+  staticNamespace2,
+  identityKey2
+} from "./358zsv4r.js";
+import {
+  OkmError2
+} from "./52szzakm.js";
+
+// src/tooling/migrate/pull.ts
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname as dirname2, join } from "node:path";
+import postgres from "postgres";
+
+// src/tooling/migrate/pull-emit.ts
+import { relative, dirname } from "node:path";
+
+// src/tooling/migrate/pull-routines.ts
+var BINDING_SEED = ["schema", "extension", "fn", "trigger", "view", "materializedView"];
+function planRoutines(source, tableExports) {
+  const namespace = staticNamespace2("public");
+  const used = new Set([...BINDING_SEED, ...tableExports.values()]);
+  const tables = new Map;
+  for (const name of tableExports.keys()) {
+    tables.set(name, { kind: "table", namespace, name });
+  }
+  const functions = source.objects.filter((object) => object.kind === "function");
+  const functionByName = new Map;
+  for (const object of functions) {
+    const list = functionByName.get(object.identity.name) ?? [];
+    list.push(object);
+    functionByName.set(object.identity.name, list);
+  }
+  const views = source.objects.filter((object) => object.kind === "view" || object.kind === "materializedView");
+  const viewByName = new Map;
+  for (const object of views)
+    viewByName.set(object.identity.name, object);
+  const skipped = [];
+  const plannedFunctions = [];
+  const pulledFunctions = new Map;
+  const orderEdges = new Map;
+  const sortedFunctions = [...functions].sort((left, right) => compare(`${left.identity.name}\x00${left.identity.argTypes.join(",")}`, `${right.identity.name}\x00${right.identity.argTypes.join(",")}`));
+  for (const object of sortedFunctions) {
+    const label = functionLabel(object);
+    if (object.definition.security === "definer" && (object.definition.searchPath === undefined || object.definition.searchPath.length === 0)) {
+      skipped.push(skip(object, label, "security definer without search_path is OKM1823", object.definition.body));
+      continue;
+    }
+    const binding = freshBinding(object.identity.name, used);
+    const atomic = object.definition.atomic === true;
+    const dependsOn = [];
+    const edges = [];
+    if (atomic) {
+      for (const edge of object.dependencies) {
+        const fragment = dependFragment(edge.target, tableExports);
+        if (fragment === undefined)
+          continue;
+        dependsOn.push(fragment);
+      }
+    } else {
+      const matched = matchNames(object.definition.body, tables, viewByName, functionByName);
+      for (const name of matched.tables) {
+        const exportName = tableExports.get(name);
+        const identity = tables.get(name);
+        if (exportName === undefined || identity === undefined)
+          continue;
+        dependsOn.push(exportName);
+        edges.push(identity);
+      }
+      for (const identity of matched.views)
+        edges.push(identity);
+      for (const identity of matched.functions) {
+        if (identityKey2(identity) === identityKey2(object.identity))
+          continue;
+        edges.push(identity);
+      }
+    }
+    if (edges.length > 0)
+      orderEdges.set(identityKey2(object.identity), edges);
+    const planned = { object, binding, dependsOn };
+    plannedFunctions.push(planned);
+    pulledFunctions.set(identityKey2(object.identity), planned);
+  }
+  const plannedTriggers = [];
+  const triggers = source.objects.filter((object) => object.kind === "trigger");
+  for (const object of [...triggers].sort((left, right) => compare(`${left.identity.parent.name}.${left.identity.name}`, `${right.identity.parent.name}.${right.identity.name}`))) {
+    const label = `${object.identity.parent.name}.${object.identity.name}`;
+    const tableBinding = tableExports.get(object.identity.parent.name);
+    if (tableBinding === undefined) {
+      skipped.push(skip(object, label, "the table was not pulled", ""));
+      continue;
+    }
+    const callKey = identityKey2({
+      kind: "function",
+      namespace: object.definition.calls.namespace,
+      name: object.definition.calls.name,
+      argTypes: object.definition.calls.argTypes
+    });
+    const call = pulledFunctions.get(callKey);
+    if (call === undefined) {
+      skipped.push(skip(object, label, "the function was not pulled", ""));
+      continue;
+    }
+    const binding = freshBinding(object.identity.name, used);
+    plannedTriggers.push({ object, binding, on: tableBinding, calls: call.binding });
+  }
+  const indexes = source.objects.filter((object) => object.kind === "index");
+  const plannedViews = [];
+  for (const object of [...views].sort((left, right) => compare(left.identity.name, right.identity.name))) {
+    if (object.kind === "view" && object.definition.securityInvoker === true) {
+      skipped.push(skip(object, object.identity.name, "view() sets security_invoker from tenancy, and pull does not declare tenancy", object.definition.query));
+      continue;
+    }
+    const owned = indexes.filter((index) => index.identity.parent.name === object.identity.name);
+    const kept = [];
+    if (object.kind === "materializedView") {
+      for (const index of [...owned].sort((left, right) => compare(left.identity.name, right.identity.name))) {
+        if (index.definition.columns.length === 0 || index.definition.expression !== undefined || index.definition.predicate !== undefined) {
+          skipped.push(skip(index, `${object.identity.name}.${index.identity.name}`, "materializedView() stores a column index, not an expression or a predicate", ""));
+          continue;
+        }
+        kept.push(index);
+      }
+    }
+    const matched = matchNames(object.definition.query, tables, viewByName, functionByName);
+    const self = identityKey2(object.identity);
+    const edges = [];
+    for (const name of matched.tables) {
+      const identity = tables.get(name);
+      if (identity !== undefined)
+        edges.push(identity);
+    }
+    for (const identity of matched.views) {
+      if (identityKey2(identity) !== self)
+        edges.push(identity);
+    }
+    for (const identity of matched.functions) {
+      if (identityKey2(identity) !== self)
+        edges.push(identity);
+    }
+    if (edges.length > 0)
+      orderEdges.set(self, edges);
+    plannedViews.push({
+      object,
+      binding: freshBinding(object.identity.name, used),
+      indexes: kept
+    });
+  }
+  return {
+    functions: plannedFunctions,
+    triggers: plannedTriggers,
+    views: plannedViews,
+    skipped,
+    orderEdges
+  };
+}
+function renderRoutines(plan, verdicts) {
+  const imports = [];
+  if (plan.functions.length > 0 || plan.triggers.length > 0) {
+    const names = [];
+    if (plan.functions.length > 0)
+      names.push("fn");
+    if (plan.triggers.length > 0)
+      names.push("trigger");
+    imports.push(`import { ${names.join(", ")} } from "okmodel/fn";`);
+  }
+  if (plan.views.length > 0) {
+    const hasView = plan.views.some((item) => item.object.kind === "view");
+    const hasMat = plan.views.some((item) => item.object.kind === "materializedView");
+    const names = [];
+    if (hasMat)
+      names.push("materializedView");
+    if (hasView)
+      names.push("view");
+    imports.push(`import { ${names.join(", ")} } from "okmodel/view";`);
+  }
+  const lines = [];
+  for (const item of plan.functions) {
+    lines.push(commentFor(verdicts.get(identityKey2(item.object.identity)), "function"));
+    lines.push(functionSource(item));
+    lines.push("");
+  }
+  for (const item of plan.triggers) {
+    lines.push(commentFor(verdicts.get(identityKey2(item.object.identity)), "trigger"));
+    lines.push(triggerSource(item));
+    lines.push("");
+  }
+  for (const item of plan.views) {
+    lines.push(commentFor(verdicts.get(identityKey2(item.object.identity)), item.object.kind === "materializedView" ? "materializedView" : "view"));
+    lines.push(viewSource(item));
+    lines.push("");
+  }
+  return {
+    imports,
+    body: lines.join(`
+`),
+    functions: plan.functions.map((item) => item.binding),
+    triggers: plan.triggers.map((item) => item.binding),
+    views: plan.views.map((item) => item.binding)
+  };
+}
+function verdictsWithoutScratch(plan, detail) {
+  const verdicts = [];
+  for (const item of plan.functions) {
+    const plpgsql = item.object.definition.language === "plpgsql";
+    verdicts.push({
+      key: identityKey2(item.object.identity),
+      kind: "function",
+      label: functionLabel(item.object),
+      status: plpgsql ? "candidate-only" : "unverified",
+      detail
+    });
+  }
+  for (const item of plan.triggers) {
+    verdicts.push({
+      key: identityKey2(item.object.identity),
+      kind: "trigger",
+      label: `${item.object.identity.parent.name}.${item.object.identity.name}`,
+      status: "unverified",
+      detail
+    });
+  }
+  for (const item of plan.views) {
+    verdicts.push({
+      key: identityKey2(item.object.identity),
+      kind: item.object.kind,
+      label: item.object.identity.name,
+      status: "unverified",
+      detail
+    });
+  }
+  return verdicts;
+}
+function matchNames(body, tables, views, functions) {
+  const tableHits = new Set;
+  const viewHits = new Map;
+  const functionHits = new Map;
+  for (const name of sqlIdentifiers(body)) {
+    if (name.quoted) {
+      const table = tables.get(name.text);
+      if (table !== undefined)
+        tableHits.add(name.text);
+      const view = views.get(name.text);
+      if (view !== undefined)
+        viewHits.set(identityKey2(view.identity), view.identity);
+      for (const fn of functions.get(name.text) ?? []) {
+        functionHits.set(identityKey2(fn.identity), fn.identity);
+      }
+      continue;
+    }
+    const folded = name.text.toLowerCase();
+    for (const [table, identity] of tables) {
+      if (table.toLowerCase() === folded) {
+        tableHits.add(table);
+      }
+    }
+    for (const [viewName, view] of views) {
+      if (viewName.toLowerCase() === folded)
+        viewHits.set(identityKey2(view.identity), view.identity);
+    }
+    for (const [fnName, list] of functions) {
+      if (fnName.toLowerCase() !== folded)
+        continue;
+      for (const fn of list)
+        functionHits.set(identityKey2(fn.identity), fn.identity);
+    }
+  }
+  return {
+    tables: [...tableHits].sort(compare),
+    views: [...viewHits.values()],
+    functions: [...functionHits.values()]
+  };
+}
+function dependFragment(target, tableExports) {
+  if (target.kind === "table") {
+    const binding = tableExports.get(target.name);
+    return binding;
+  }
+  if (target.kind === "column") {
+    const binding = tableExports.get(target.parent.name);
+    if (binding === undefined)
+      return;
+    return `{ table: ${binding}, column: ${JSON.stringify(target.name)} }`;
+  }
+  return;
+}
+function functionSource(item) {
+  const definition = item.object.definition;
+  const fields = [
+    definition.arguments.length > 0 ? `arguments: [${definition.arguments.map((argument) => `{ name: ${JSON.stringify(argument.name)}, type: ${JSON.stringify(argument.type)} }`).join(", ")}]` : "",
+    `returns: ${JSON.stringify(definition.returns)}`,
+    `language: ${JSON.stringify(definition.language)}`,
+    definition.volatility !== "volatile" ? `volatility: ${JSON.stringify(definition.volatility)}` : "",
+    definition.security === "definer" ? `security: "definer"` : "",
+    definition.searchPath !== undefined ? `searchPath: ${JSON.stringify(definition.searchPath)}` : "",
+    `body: ${JSON.stringify(definition.body)}`,
+    item.dependsOn.length > 0 || definition.language === "plpgsql" ? `dependsOn: [${item.dependsOn.join(", ")}]` : ""
+  ].filter((field) => field.length > 0);
+  return `const ${item.binding} = fn(${JSON.stringify(item.object.identity.name)}, {
+  ${fields.join(`,
+  `)},
+});`;
+}
+function triggerSource(item) {
+  const definition = item.object.definition;
+  const fields = [
+    `on: ${item.on}`,
+    `timing: ${JSON.stringify(definition.timing)}`,
+    `events: [${definition.events.map((event) => JSON.stringify(event)).join(", ")}]`,
+    `level: ${JSON.stringify(definition.level)}`,
+    definition.updateOf !== undefined ? `updateOf: [${definition.updateOf.map((column) => JSON.stringify(column)).join(", ")}]` : "",
+    definition.when !== undefined ? `when: ${JSON.stringify(definition.when)}` : "",
+    `calls: ${item.calls}`
+  ].filter((field) => field.length > 0);
+  return `const ${item.binding} = trigger(${JSON.stringify(item.object.identity.name)}, {
+  ${fields.join(`,
+  `)},
+});`;
+}
+function viewSource(item) {
+  const definition = item.object.definition;
+  const columns = definition.columns.map((column) => `{ name: ${JSON.stringify(column.name)}, type: ${JSON.stringify(column.dataType)} }`).join(", ");
+  const fields = [`columns: [${columns}]`, `query: ${JSON.stringify(definition.query)}`];
+  if (item.object.kind === "materializedView" && item.indexes.length > 0) {
+    const indexes = item.indexes.map((index) => {
+      const parts = [
+        `name: ${JSON.stringify(index.identity.name)}`,
+        `columns: [${index.definition.columns.map((column) => JSON.stringify(column)).join(", ")}]`
+      ];
+      if (index.definition.unique)
+        parts.push("unique: true");
+      return `{ ${parts.join(", ")} }`;
+    }).join(", ");
+    fields.push(`indexes: [${indexes}]`);
+  }
+  const call = item.object.kind === "materializedView" ? "materializedView" : "view";
+  return `const ${item.binding} = ${call}(${JSON.stringify(item.object.identity.name)}, {
+  ${fields.join(`,
+  `)},
+});`;
+}
+function commentFor(verdict, kind) {
+  const status = verdict?.status ?? (kind === "function" ? "candidate-only" : "unverified");
+  if (status === "verified" && kind === "function") {
+    return "// verified: scratch replay created this function with check_function_bodies on.";
+  }
+  if (status === "verified" && kind === "trigger") {
+    return "// verified: scratch replay created this trigger.";
+  }
+  if (status === "verified") {
+    return "// verified: scratch replay created this view.";
+  }
+  if (status === "candidate-only") {
+    return "// candidate-only: a plpgsql body is not proved by creation. dependsOn is a lexical match.";
+  }
+  if (kind === "function")
+    return "// unverified: scratch replay did not create this function.";
+  if (kind === "trigger")
+    return "// unverified: scratch replay did not create this trigger.";
+  return "// unverified: scratch replay did not create this view.";
+}
+function functionLabel(object) {
+  return `${object.identity.name}(${object.identity.argTypes.join(", ")})`;
+}
+function skip(object, label, reason, sql) {
+  return { key: identityKey2(object.identity), kind: object.kind, label, reason, sql };
+}
+function freshBinding(sql, used) {
+  let name = bindingIdent(sql);
+  if (name === "table" || name === "columns")
+    name = `${name}Name`;
+  let salt = 2;
+  while (used.has(name)) {
+    name = `${bindingIdent(sql)}_${String(salt)}`;
+    salt += 1;
+  }
+  used.add(name);
+  return name;
+}
+function bindingIdent(sql) {
+  let out = "";
+  for (const char of sql) {
+    const ok = char >= "A" && char <= "Z" || char >= "a" && char <= "z" || char >= "0" && char <= "9" || char === "_";
+    out += ok ? char : "_";
+  }
+  if (out.length === 0)
+    out = "routine";
+  const first = out[0] ?? "";
+  if (first >= "0" && first <= "9")
+    out = `r_${out}`;
+  if (BINDING_RESERVED.has(out))
+    out = `${out}Name`;
+  return out;
+}
+var BINDING_RESERVED = new Set([
+  "await",
+  "break",
+  "case",
+  "catch",
+  "class",
+  "const",
+  "continue",
+  "debugger",
+  "default",
+  "delete",
+  "do",
+  "else",
+  "enum",
+  "export",
+  "extends",
+  "false",
+  "finally",
+  "for",
+  "function",
+  "if",
+  "implements",
+  "import",
+  "in",
+  "instanceof",
+  "interface",
+  "let",
+  "new",
+  "null",
+  "package",
+  "private",
+  "protected",
+  "public",
+  "return",
+  "static",
+  "super",
+  "switch",
+  "this",
+  "throw",
+  "true",
+  "try",
+  "typeof",
+  "var",
+  "void",
+  "while",
+  "with",
+  "yield"
+]);
+function compare(left, right) {
+  if (left < right)
+    return -1;
+  if (left > right)
+    return 1;
+  return 0;
+}
+
+// src/tooling/migrate/pull-emit.ts
+var DEFERRED = [
+  { kind: "policy", reason: "a later step writes policies" },
+  { kind: "role", reason: "a later step writes roles and grants" },
+  { kind: "grant", reason: "a later step writes roles and grants" },
+  { kind: "defaultPrivilege", reason: "a later step writes roles and grants" }
+];
+var RESERVED = new Set([
+  "await",
+  "break",
+  "case",
+  "catch",
+  "class",
+  "const",
+  "continue",
+  "debugger",
+  "default",
+  "delete",
+  "do",
+  "else",
+  "enum",
+  "export",
+  "extends",
+  "false",
+  "finally",
+  "for",
+  "function",
+  "if",
+  "implements",
+  "import",
+  "in",
+  "instanceof",
+  "interface",
+  "let",
+  "new",
+  "null",
+  "package",
+  "private",
+  "protected",
+  "public",
+  "return",
+  "static",
+  "super",
+  "switch",
+  "this",
+  "throw",
+  "true",
+  "try",
+  "typeof",
+  "var",
+  "void",
+  "while",
+  "with",
+  "yield"
+]);
+function emitPull(source, layout, review) {
+  const statements = rendered(source);
+  const skipped = [];
+  const enums = enumLabels(source);
+  const domains = domainDefs(source);
+  const byParent = groupByParent(source);
+  const tables = source.objects.filter((object) => object.kind === "table").sort((left, right) => compare2(left.identity.name, right.identity.name));
+  const files = [];
+  const imports = [];
+  const usedFiles = new Set;
+  const identitySequences = new Set;
+  const tableExports = new Map;
+  for (const table of tables) {
+    if (table.definition.partition !== undefined) {
+      skipped.push(skip2(table, "table", table.identity.name, "table() has no partition option", statementFor(statements, table.identity.name)));
+      skipChildren(table.identity.name, byParent, statements, skipped);
+      continue;
+    }
+    const planned = planTable(table, byParent, enums, domains, statements, skipped);
+    if (planned === undefined)
+      continue;
+    if (planned.identitySequence !== undefined)
+      identitySequences.add(planned.identitySequence);
+    tableExports.set(table.identity.name, planned.exportName);
+    const fileName = uniqueFile(planned.exportName, usedFiles);
+    const path = `${layout.tablesDir}/${fileName}.ts`;
+    files.push({ path, text: planned.text });
+    imports.push({ name: planned.exportName, file: path });
+  }
+  const skippedKeys = new Set(skipped.map((item) => item.key));
+  for (const object of source.objects) {
+    if (object.kind !== "sequence" || skippedKeys.has(identityKey2(object.identity)))
+      continue;
+    if (identitySequences.has(object.identity.name))
+      continue;
+    const parent = object.dependencies.find((edge) => edge.target.kind === "table");
+    const parentName = parent !== undefined && parent.target.kind === "table" ? parent.target.name : "";
+    const kept = parentName.length > 0 && tables.some((table) => table.identity.name === parentName && table.definition.partition === undefined);
+    if (kept)
+      continue;
+    skipped.push(skip2(object, "sequence", object.identity.name, "table() has no standalone sequence. An identity column writes its own", statementFor(statements, object.identity.name)));
+  }
+  const plan = review?.plan ?? planRoutines(source, tableExports);
+  for (const item of plan.skipped)
+    skipped.push(item);
+  for (const object of source.objects) {
+    if (!isDeferred(object.kind))
+      continue;
+    skipped.push(skip2(object, object.kind, objectLabel(object), deferredReason(object.kind), statementFor(statements, objectName(object))));
+  }
+  for (const object of source.objects) {
+    if (object.kind !== "type")
+      continue;
+    if (typeIsUsed(object.identity.name, source, skipped))
+      continue;
+    const label = object.identity.name;
+    skipped.push(skip2(object, "type", label, "no pulled column uses this type", statementFor(statements, label)));
+  }
+  const verdictList = review?.verdicts ?? [];
+  const routines = renderRoutines(plan, new Map(verdictList.map((item) => [item.key, item])));
+  files.push({
+    path: layout.schemaFile,
+    text: schemaText(layout.schemaFile, imports, extensionCalls(source), routines)
+  });
+  files.sort((left, right) => compare2(left.path, right.path));
+  skipped.sort((left, right) => compare2(`${left.kind}\x00${left.label}`, `${right.kind}\x00${right.label}`));
+  const viewCount = plan.views.filter((item) => item.object.kind === "view").length;
+  return {
+    files,
+    skipped,
+    verdicts: verdictList,
+    counts: {
+      tables: tables.length - skippedTables(source, skipped),
+      functions: plan.functions.length,
+      triggers: plan.triggers.length,
+      views: viewCount,
+      materializedViews: plan.views.length - viewCount
+    }
+  };
+}
+function skippedTables(source, skipped) {
+  let count = 0;
+  for (const object of source.objects) {
+    if (object.kind !== "table")
+      continue;
+    if (skipped.some((item) => item.key === identityKey2(object.identity)))
+      count += 1;
+  }
+  return count;
+}
+function formatPullReport(counts, skipped, verdicts = [], unexpressed = [], verb = "pulled") {
+  const lines = [
+    verb === "imported" ? `imported ${counted(counts.tables, "table", "tables")}` : `pulled ${counted(counts.tables, "table", "tables")}, ${counted(counts.functions, "function", "functions")}, ${counted(counts.triggers, "trigger", "triggers")}, ${counted(counts.views, "view", "views")}, ${counted(counts.materializedViews, "materialized view", "materialized views")}`
+  ];
+  const marked = [...verdicts].sort((left, right) => compare2(left.label, right.label));
+  for (const item of marked) {
+    const detail = item.detail.length > 0 ? ` — ${item.detail}` : "";
+    lines.push(`  ${item.label}: ${item.status}${detail}`);
+  }
+  lines.push(verb === "imported" ? "not imported" : "not pulled yet");
+  const deferredKinds = ["policy", "role", "grant", "defaultPrivilege"];
+  for (const kind of deferredKinds) {
+    const rows = skipped.filter((item) => item.kind === kind);
+    const reason = deferredReason(kind);
+    lines.push(`  ${kindLabel(kind)}: ${String(rows.length)} — ${reason}`);
+    for (const row of rows)
+      lines.push(`    ${row.label}`);
+  }
+  for (const item of unexpressed) {
+    lines.push(`  ${kindLabel(item.kind)}: ${String(item.count)} — ${item.reason}`);
+  }
+  const rest = skipped.filter((item) => !deferredKinds.includes(item.kind));
+  const groups = new Map;
+  for (const item of rest) {
+    const group = groups.get(item.kind) ?? [];
+    group.push(item);
+    groups.set(item.kind, group);
+  }
+  for (const kind of [...groups.keys()].sort()) {
+    const rows = groups.get(kind) ?? [];
+    lines.push(`  ${kindLabel(kind)}: ${String(rows.length)} — ${rows[0]?.reason ?? ""}`);
+    for (const row of rows) {
+      lines.push(`    ${row.label}`);
+      if (row.sql.length > 0)
+        lines.push(`      ${row.sql}`);
+    }
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+function planTable(table, byParent, enums, domains, statements, skipped) {
+  const bag = byParent.get(table.identity.name) ?? {
+    columns: [],
+    constraints: [],
+    indexes: [],
+    sequences: []
+  };
+  const names = new Set;
+  const fields = new Map;
+  const columnLines = [];
+  const emitted = new Set;
+  const primary = bag.constraints.find((item) => item.definition.constraintKind === "primaryKey");
+  const primaryColumns = primary?.definition.columns ?? [];
+  const identityColumn = bag.columns.find((column) => column.definition.identity?.always === true && !column.definition.nullable && primaryColumns.length === 1 && primaryColumns[0] === column.identity.name && column.definition.dataType === "bigint");
+  for (const column of [...bag.columns].sort((left, right) => compare2(left.identity.name, right.identity.name))) {
+    const field = freshIdent(declaredIdent(column.provenance.source, column.identity.name), names);
+    fields.set(column.identity.name, field);
+    if (column === identityColumn) {
+      const renamed = column.provenance.source !== undefined && field !== column.identity.name ? `.sqlName(${JSON.stringify(column.identity.name)})` : "";
+      columnLines.push(`    ${field}: t.identity()${renamed},`);
+      emitted.add(column.identity.name);
+      continue;
+    }
+    const built = columnSource(column, field, enums, domains);
+    if (built === undefined) {
+      skipped.push(skip2(column, "column", `${table.identity.name}.${column.identity.name}`, columnReason(column), ""));
+      continue;
+    }
+    columnLines.push(`    ${field}: ${built},`);
+    emitted.add(column.identity.name);
+  }
+  const options = [];
+  const exportName = table.provenance.source === undefined ? exportNameOf(table.identity.name) : freshIdent(declaredIdent(table.provenance.source, table.identity.name), new Set);
+  if (exportName !== table.identity.name) {
+    options.push(`    sqlName: ${JSON.stringify(table.identity.name)},`);
+  }
+  if (primary !== undefined && identityColumn === undefined && primaryColumns.length > 0) {
+    if (primaryColumns.every((name) => emitted.has(name)) && plainConstraint(primary)) {
+      const list = primaryColumns.map((name) => JSON.stringify(fields.get(name) ?? name)).join(", ");
+      options.push(`    primaryKey: [${list}],`);
+    } else {
+      skipped.push(skip2(primary, "constraint", `${table.identity.name}.${primary.identity.name}`, "primary key uses a column this step did not pull", statementFor(statements, primary.identity.name)));
+    }
+  }
+  const uniques = [];
+  const checks = [];
+  const foreign = new Map;
+  for (const constraint of [...bag.constraints].sort((left, right) => compare2(left.identity.name, right.identity.name))) {
+    const kind = constraint.definition.constraintKind;
+    if (kind === "primaryKey")
+      continue;
+    const label = `${table.identity.name}.${constraint.identity.name}`;
+    if (!constraint.definition.columns.every((name) => emitted.has(name))) {
+      skipped.push(skip2(constraint, "constraint", label, "a column of this constraint was not pulled", statementFor(statements, constraint.identity.name)));
+      continue;
+    }
+    if (!plainConstraint(constraint)) {
+      skipped.push(skip2(constraint, "constraint", label, "deferrable, initially deferred, and nulls not distinct are not table() options", statementFor(statements, constraint.identity.name)));
+      continue;
+    }
+    if (kind === "unique") {
+      const cols = constraint.definition.columns.map((name) => JSON.stringify(fields.get(name) ?? name)).join(", ");
+      uniques.push(`      ${jsKey(constraint.definition.nameKey)}: [${cols}],`);
+      continue;
+    }
+    if (kind === "check" && constraint.definition.expression !== undefined) {
+      const touches = constraint.definition.columns.map((name) => `void columns.${fields.get(name) ?? name}`).join("; ");
+      const touch = touches.length > 0 ? `${touches}; ` : "";
+      checks.push(`      ${jsKey(constraint.definition.nameKey)}: (columns) => { ${touch}return ${sqlTemplate(constraint.definition.expression)}; },`);
+      continue;
+    }
+    if (kind === "foreignKey") {
+      const local = constraint.definition.columns;
+      const references = constraint.definition.references;
+      const field = local[0] === undefined ? undefined : fields.get(local[0]);
+      if (field !== undefined && foreign.has(field)) {
+        skipped.push(skip2(constraint, "constraint", label, "references() is one foreign key on a column", statementFor(statements, constraint.identity.name)));
+        continue;
+      }
+      if (local.length !== 1 || local[0] === undefined || references === undefined) {
+        skipped.push(skip2(constraint, "constraint", label, "references() takes one local column", statementFor(statements, constraint.identity.name)));
+        continue;
+      }
+      if (field === undefined)
+        continue;
+      foreign.set(field, referenceCall(references));
+      continue;
+    }
+    skipped.push(skip2(constraint, "constraint", label, "table() cannot store this constraint", statementFor(statements, constraint.identity.name)));
+  }
+  if (uniques.length > 0) {
+    options.push("    unique: {");
+    options.push(...uniques);
+    options.push("    },");
+  }
+  if (checks.length > 0) {
+    options.push("    checks: {");
+    options.push(...checks);
+    options.push("    },");
+  }
+  const indexLines = [];
+  let needsIndex = false;
+  let needsSql = checks.length > 0;
+  for (const index of [...bag.indexes].sort((left, right) => compare2(left.identity.name, right.identity.name))) {
+    const label = `${table.identity.name}.${index.identity.name}`;
+    if (!index.definition.columns.every((name) => emitted.has(name))) {
+      skipped.push(skip2(index, "index", label, "a column of this index was not pulled", statementFor(statements, index.identity.name)));
+      continue;
+    }
+    if (index.definition.columns.length === 0) {
+      skipped.push(skip2(index, "index", label, "index() needs a column. This index is an expression", statementFor(statements, index.identity.name)));
+      continue;
+    }
+    indexLines.push(`      ${indexCall(index, fields)},`);
+    needsIndex = true;
+    if (index.definition.predicate !== undefined || index.definition.expression !== undefined) {
+      needsSql = true;
+    }
+  }
+  if (indexLines.length > 0) {
+    options.push("    indexes: (columns) => [");
+    options.push(...indexLines);
+    options.push("    ],");
+  }
+  for (const sequence of bag.sequences) {
+    const owned = identityColumn !== undefined && sequence.identity.name === identitySequence(table.identity.name, identityColumn.identity.name) && sequence.definition.dataType === "bigint" && sequence.definition.start === "1" && sequence.definition.increment === "1" && sequence.definition.cycle === false;
+    if (owned)
+      continue;
+    skipped.push(skip2(sequence, "sequence", sequence.identity.name, "table() has no standalone sequence. An identity column writes its own", statementFor(statements, sequence.identity.name)));
+  }
+  const columnText = rewriteForeign(columnLines, foreign);
+  const needsTable = true;
+  const imports = importLine(needsTable, needsIndex, needsSql);
+  const optionBlock = options.length === 0 ? "" : `,
+  {
+${options.join(`
+`)}
+  }`;
+  const text = `${imports}
+
+export const ${exportName} = table(
+  ${JSON.stringify(exportName === table.identity.name ? table.identity.name : exportName)},
+  {
+${columnText.join(`
+`)}
+  }${optionBlock},
+);
+`;
+  return {
+    exportName,
+    text,
+    ...identityColumn === undefined ? {} : { identitySequence: identitySequence(table.identity.name, identityColumn.identity.name) }
+  };
+}
+function columnSource(column, field, enums, domains) {
+  if (column.definition.identity !== undefined)
+    return;
+  if (column.definition.generated !== undefined && column.definition.generated.stored !== true) {
+    return;
+  }
+  const labels = enums.get(column.definition.dataType);
+  const domain = domains.get(column.definition.dataType);
+  let call;
+  if (labels !== undefined) {
+    const list = labels.map((label) => JSON.stringify(label)).join(", ");
+    call = `t.enum(${JSON.stringify(column.definition.dataType)}, [${list}])`;
+  } else if (domain !== undefined) {
+    const base = builderCall(domain.base, 0);
+    if (base === undefined)
+      return;
+    call = `t.domain(${JSON.stringify(column.definition.dataType)}, ${base}, ${JSON.stringify(domain.check)})`;
+  } else {
+    call = builderFor(column.definition.dataType);
+  }
+  if (call === undefined)
+    return;
+  if (field !== column.identity.name)
+    call += `.sqlName(${JSON.stringify(column.identity.name)})`;
+  if (column.definition.nullable)
+    call += ".nullable()";
+  if (column.definition.defaultExpression !== undefined) {
+    call += `.defaultSql(${JSON.stringify(column.definition.defaultExpression)})`;
+  }
+  if (column.definition.generated !== undefined) {
+    call += `.generated(${JSON.stringify(column.definition.generated.expression)})`;
+  }
+  if (column.definition.collation !== undefined)
+    return;
+  return call;
+}
+function builderFor(dataType) {
+  const dims = arrayDims(dataType);
+  const scalar = dims === 0 ? dataType : dataType.slice(0, dataType.length - 2 * dims);
+  const call = builderCall(scalar, dims);
+  return call;
+}
+function builderCall(scalar, dims) {
+  const simple = {
+    integer: "t.integer()",
+    bigint: "t.bigint()",
+    smallint: "t.smallint()",
+    text: "t.text()",
+    boolean: "t.boolean()",
+    bytea: "t.bytea()",
+    uuid: "t.uuid()",
+    jsonb: "t.jsonb()",
+    json: "t.json()",
+    real: "t.real()",
+    "double precision": "t.double()",
+    numeric: "t.numeric()",
+    date: "t.date()",
+    inet: "t.inet()",
+    cidr: "t.cidr()",
+    macaddr: "t.macaddr()",
+    macaddr8: "t.macaddr8()",
+    point: "t.point()",
+    line: "t.line()",
+    tsvector: "t.tsvector()",
+    ltree: "t.ltree()",
+    citext: "t.citext()",
+    tstzrange: "t.tstzrange()",
+    daterange: "t.daterange()",
+    int4range: "t.int4range()",
+    int8range: "t.int8range()",
+    numrange: "t.numrange()",
+    interval: "t.interval()"
+  };
+  let call = simple[scalar];
+  if (call === undefined)
+    call = typedCall(scalar);
+  if (call === undefined)
+    return;
+  if (dims === 0)
+    return call;
+  if (dims === 1)
+    return `${call}.array()`;
+  return `${call}.array({ dims: ${String(dims)} })`;
+}
+function typedCall(scalar) {
+  const varying = /^(?:character varying|varchar)\((\d+)\)$/.exec(scalar);
+  if (varying !== null)
+    return `t.varchar(${varying[1] ?? ""})`;
+  const fixed = /^(?:character|char)\((\d+)\)$/.exec(scalar);
+  if (fixed !== null)
+    return `t.char(${fixed[1] ?? ""})`;
+  const numeric = /^numeric\((\d+)(?:,(\d+))?\)$/.exec(scalar);
+  if (numeric !== null) {
+    const scale = numeric[2];
+    return scale === undefined ? `t.numeric(${numeric[1] ?? ""})` : `t.numeric(${numeric[1] ?? ""}, ${scale})`;
+  }
+  const zone = /^(timestamp|time)(?:\((\d+)\))? (with|without) time zone$/.exec(scalar);
+  if (zone !== null) {
+    const precision = zone[2];
+    const arg = precision === undefined ? "" : precision;
+    const name = zone[1];
+    const withZone = zone[3] === "with";
+    if (name === "timestamp" && withZone)
+      return arg.length === 0 ? "t.timestamptz()" : `t.timestamptz(${arg})`;
+    if (name === "timestamp")
+      return arg.length === 0 ? "t.timestamp()" : `t.timestamp(${arg})`;
+    if (withZone)
+      return arg.length === 0 ? "t.timetz()" : `t.timetz(${arg})`;
+    return arg.length === 0 ? "t.time()" : `t.time(${arg})`;
+  }
+  const interval = /^interval (.+)$/.exec(scalar);
+  if (interval !== null) {
+    const fields = interval[1] ?? "";
+    if (!INTERVAL_FIELDS.has(fields))
+      return;
+    return `t.interval(${JSON.stringify(fields)})`;
+  }
+  return;
+}
+var INTERVAL_FIELDS = new Set([
+  "year",
+  "month",
+  "day",
+  "hour",
+  "minute",
+  "second",
+  "year to month",
+  "day to hour",
+  "day to minute",
+  "day to second",
+  "hour to minute",
+  "hour to second",
+  "minute to second"
+]);
+function arrayDims(dataType) {
+  let dims = 0;
+  let end = dataType.length;
+  while (end >= 2 && dataType.endsWith("[]", end)) {
+    dims += 1;
+    end -= 2;
+  }
+  return dims;
+}
+function columnReason(column) {
+  if (column.definition.identity !== undefined) {
+    return "t.identity() is generated always, bigint, and the only primary key";
+  }
+  if (column.definition.generated !== undefined && column.definition.generated.stored !== true) {
+    return "generated columns are stored";
+  }
+  if (column.definition.collation !== undefined)
+    return "table() has no collation option";
+  return `table() has no builder for ${column.definition.dataType}`;
+}
+function rewriteForeign(lines, foreign) {
+  return lines.map((line) => {
+    const match = /^    ([A-Za-z_$][A-Za-z0-9_$]*): (.+),$/.exec(line);
+    if (match === null)
+      return line;
+    const field = match[1] ?? "";
+    const call = foreign.get(field);
+    if (call === undefined)
+      return line;
+    return `    ${field}: ${match[2] ?? ""}${call},`;
+  });
+}
+function referenceCall(references) {
+  const options = [];
+  if (references.columns.length > 0) {
+    options.push(`columns: [${references.columns.map((name) => JSON.stringify(name)).join(", ")}]`);
+  }
+  if (references.onDelete !== undefined)
+    options.push(`onDelete: ${JSON.stringify(references.onDelete)}`);
+  if (references.onUpdate !== undefined)
+    options.push(`onUpdate: ${JSON.stringify(references.onUpdate)}`);
+  const optionText = options.length === 0 ? "" : `, { ${options.join(", ")} }`;
+  return `.references(${JSON.stringify(references.parent.name)}${optionText})`;
+}
+function indexCall(index, fields) {
+  const columns = index.definition.columns.map((name) => `columns.${fields.get(name) ?? name}`).join(", ");
+  const predicate = index.definition.predicate;
+  const expression = index.definition.expression;
+  if (predicate === undefined && expression === undefined) {
+    const call = `index(${columns})`;
+    return index.definition.unique ? `${call}.unique()` : call;
+  }
+  const fieldsText = [
+    `columns: [${index.definition.columns.map((name) => `columns.${fields.get(name) ?? name}.name`).join(", ")}]`,
+    `isUnique: ${index.definition.unique ? "true" : "false"}`
+  ];
+  if (predicate !== undefined)
+    fieldsText.push(`predicate: ${JSON.stringify(predicate)}`);
+  if (expression !== undefined)
+    fieldsText.push(`expression: ${JSON.stringify(expression)}`);
+  return `{ ${fieldsText.join(", ")}, unique() { return this; } }`;
+}
+function plainConstraint(constraint) {
+  return !constraint.definition.deferrable && constraint.definition.initially === "immediate" && !constraint.definition.nullsNotDistinct;
+}
+function skipChildren(table, byParent, statements, skipped) {
+  const bag = byParent.get(table);
+  if (bag === undefined)
+    return;
+  for (const column of bag.columns) {
+    skipped.push(skip2(column, "column", `${table}.${column.identity.name}`, "the table is partitioned, and table() has no partition option", ""));
+  }
+  for (const constraint of bag.constraints) {
+    skipped.push(skip2(constraint, "constraint", `${table}.${constraint.identity.name}`, "the table is partitioned, and table() has no partition option", statementFor(statements, constraint.identity.name)));
+  }
+  for (const index of bag.indexes) {
+    skipped.push(skip2(index, "index", `${table}.${index.identity.name}`, "the table is partitioned, and table() has no partition option", statementFor(statements, index.identity.name)));
+  }
+  for (const sequence of bag.sequences) {
+    skipped.push(skip2(sequence, "sequence", sequence.identity.name, "the owning table is partitioned, and table() has no partition option", statementFor(statements, sequence.identity.name)));
+  }
+}
+function identitySequence(table, column) {
+  return `${table}_${column}_seq`;
+}
+function schemaText(schemaFile, imports, extensions, routines) {
+  const lines = ['import { schema } from "okmodel/pg";'];
+  if (extensions.length > 0)
+    lines.push('import { extension } from "okmodel/ext";');
+  for (const line of routines.imports)
+    lines.push(line);
+  const sorted = [...imports].sort((left, right) => compare2(left.name, right.name));
+  for (const item of sorted) {
+    lines.push(`import { ${item.name} } from ${JSON.stringify(importSpecifier(schemaFile, item.file))};`);
+  }
+  const tables = sorted.map((item) => item.name).join(", ");
+  const extensionBlock = extensions.length === 0 ? "" : `,
+  extensions: [
+${extensions.map((call) => `    ${call},`).join(`
+`)}
+  ]`;
+  const functionBlock = routines.functions.length === 0 ? "" : `,
+  functions: [${routines.functions.join(", ")}]`;
+  const triggerBlock = routines.triggers.length === 0 ? "" : `,
+  triggers: [${routines.triggers.join(", ")}]`;
+  const viewBlock = routines.views.length === 0 ? "" : `,
+  views: [${routines.views.join(", ")}]`;
+  const body = routines.body.length === 0 ? "" : `
+${routines.body}`;
+  return `${lines.join(`
+`)}
+${body}
+export default schema({
+  tables: [${tables}]${extensionBlock}${functionBlock}${triggerBlock}${viewBlock},
+});
+`;
+}
+function extensionCalls(source) {
+  const calls = [];
+  for (const object of source.objects) {
+    if (object.kind !== "extension")
+      continue;
+    const options = [`schema: ${JSON.stringify(object.definition.schema)}`];
+    if (object.definition.version !== undefined) {
+      options.push(`version: ${JSON.stringify(object.definition.version)}`);
+    }
+    options.push(`relocatable: ${object.definition.relocatable ? "true" : "false"}`);
+    calls.push(`extension(${JSON.stringify(object.identity.name)}, { ${options.join(", ")} })`);
+  }
+  calls.sort();
+  return calls;
+}
+function importLine(needsTable, needsIndex, needsSql) {
+  const names = ["t"];
+  if (needsIndex)
+    names.push("index");
+  if (needsSql)
+    names.push("sql");
+  if (needsTable)
+    names.push("table");
+  names.sort();
+  return `import { ${names.join(", ")} } from "okmodel/pg";`;
+}
+function importSpecifier(fromFile, toFile) {
+  let spec = relative(dirname(fromFile), toFile).replaceAll("\\", "/");
+  if (spec.endsWith(".ts"))
+    spec = spec.slice(0, -3);
+  if (!spec.startsWith("."))
+    spec = `./${spec}`;
+  return spec;
+}
+function groupByParent(source) {
+  const map = new Map;
+  const ensure = (name) => {
+    const found = map.get(name);
+    if (found !== undefined)
+      return found;
+    const bag = { columns: [], constraints: [], indexes: [], sequences: [] };
+    map.set(name, bag);
+    return bag;
+  };
+  for (const object of source.objects) {
+    if (object.kind === "column" || object.kind === "constraint" || object.kind === "index") {
+      const bag = ensure(object.identity.parent.name);
+      if (object.kind === "column")
+        bag.columns.push(object);
+      else if (object.kind === "constraint")
+        bag.constraints.push(object);
+      else
+        bag.indexes.push(object);
+      continue;
+    }
+    if (object.kind === "sequence") {
+      const owned = object.dependencies.find((edge) => edge.target.kind === "table");
+      if (owned === undefined || owned.target.kind !== "table")
+        continue;
+      ensure(owned.target.name).sequences.push(object);
+    }
+  }
+  return map;
+}
+function enumLabels(source) {
+  const labels = new Map;
+  for (const object of source.objects) {
+    if (object.kind !== "type" || isDomain(object.definition))
+      continue;
+    labels.set(object.identity.name, object.definition.labels);
+  }
+  return labels;
+}
+function domainDefs(source) {
+  const domains = new Map;
+  for (const object of source.objects) {
+    if (object.kind !== "type" || !isDomain(object.definition))
+      continue;
+    domains.set(object.identity.name, {
+      base: object.definition.base,
+      check: object.definition.check
+    });
+  }
+  return domains;
+}
+function typeIsUsed(name, source, skipped) {
+  const skippedKeys = new Set(skipped.map((item) => item.key));
+  for (const object of source.objects) {
+    if (object.kind !== "column")
+      continue;
+    if (skippedKeys.has(identityKey2(object.identity)))
+      continue;
+    if (object.definition.dataType === name)
+      return true;
+    if (object.dependencies.some((edge) => edge.target.kind === "type" && edge.target.name === name)) {
+      return true;
+    }
+  }
+  return false;
+}
+function rendered(source) {
+  try {
+    return renderCatalog2(source, "public");
+  } catch {
+    return [];
+  }
+}
+function statementFor(statements, name) {
+  if (name.length === 0)
+    return "";
+  const quoted = `"${name.replaceAll('"', '""')}"`;
+  return statements.find((statement) => statement.includes(quoted)) ?? "";
+}
+function skip2(object, kind, label, reason, sql) {
+  return { key: identityKey2(object.identity), kind, label, reason, sql };
+}
+function isDeferred(kind) {
+  return DEFERRED.some((item) => item.kind === kind);
+}
+function deferredReason(kind) {
+  return DEFERRED.find((item) => item.kind === kind)?.reason ?? "a later step writes this object";
+}
+function kindLabel(kind) {
+  if (kind === "materializedView")
+    return "materialized views";
+  if (kind === "defaultPrivilege")
+    return "default privileges";
+  if (kind === "eventTrigger")
+    return "event triggers";
+  if (kind === "policy")
+    return "policies";
+  if (kind.endsWith("s"))
+    return kind;
+  return `${kind}s`;
+}
+function counted(count, one, many) {
+  return `${String(count)} ${count === 1 ? one : many}`;
+}
+function objectLabel(object) {
+  if ("name" in object.identity && typeof object.identity.name === "string") {
+    if ("parent" in object.identity)
+      return `${object.identity.parent.name}.${object.identity.name}`;
+    return object.identity.name;
+  }
+  return object.kind;
+}
+function objectName(object) {
+  if ("name" in object.identity && typeof object.identity.name === "string")
+    return object.identity.name;
+  return "";
+}
+function uniqueFile(name, used) {
+  let file = name;
+  let salt = 2;
+  while (used.has(file)) {
+    file = `${name}_${String(salt)}`;
+    salt += 1;
+  }
+  used.add(file);
+  return file;
+}
+function tableExportNames(source) {
+  const names = new Map;
+  for (const object of source.objects) {
+    if (object.kind !== "table" || object.definition.partition !== undefined)
+      continue;
+    names.set(object.identity.name, exportNameOf(object.identity.name));
+  }
+  return names;
+}
+function exportNameOf(name) {
+  const sqlName = jsIdent(name);
+  if (sqlName === name)
+    return name;
+  return freshIdent(name, new Set);
+}
+function declaredIdent(source, fallback) {
+  if (source === undefined)
+    return fallback;
+  const field = prefixed(source, "field:");
+  if (field !== undefined)
+    return field;
+  const exported = prefixed(source, "export:");
+  if (exported !== undefined)
+    return exported;
+  return fallback;
+}
+function prefixed(source, prefix) {
+  if (!source.startsWith(prefix))
+    return;
+  const name = source.slice(prefix.length);
+  return name.length > 0 ? name : undefined;
+}
+function freshIdent(sql, used) {
+  let name = jsIdent(sql);
+  if (name === "table" || name === "columns")
+    name = `${name}Name`;
+  let salt = 2;
+  while (used.has(name)) {
+    name = `${jsIdent(sql)}_${String(salt)}`;
+    salt += 1;
+  }
+  used.add(name);
+  return name;
+}
+function jsIdent(sql) {
+  let out = "";
+  for (const char of sql) {
+    const ok = char >= "A" && char <= "Z" || char >= "a" && char <= "z" || char >= "0" && char <= "9" || char === "_";
+    out += ok ? char : "_";
+  }
+  if (out.length === 0)
+    out = "table";
+  const first = out[0] ?? "";
+  if (first >= "0" && first <= "9")
+    out = `t_${out}`;
+  if (RESERVED.has(out))
+    out = `${out}Name`;
+  return out;
+}
+function jsKey(name) {
+  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) && !RESERVED.has(name))
+    return name;
+  return JSON.stringify(name);
+}
+function sqlTemplate(expression) {
+  const body = expression.replaceAll("\\", "\\\\").replaceAll("`", "\\`").replaceAll("${", "\\${");
+  return `sql\`${body}\``;
+}
+function compare2(left, right) {
+  if (left < right)
+    return -1;
+  if (left > right)
+    return 1;
+  return 0;
+}
+
+// src/tooling/migrate/pull-verify.ts
+var SCRATCH = "okm_pull_verify";
+async function verifyPulled(runner, source, plan) {
+  if (plan.functions.length === 0 && plan.triggers.length === 0 && plan.views.length === 0) {
+    return [];
+  }
+  await dropScratch(runner);
+  try {
+    await runner.query(`create schema ${quoteIdent2(SCRATCH)}`);
+  } catch (error) {
+    return verdictsWithoutScratch(plan, firstLine(error));
+  }
+  const savedPath = await setting(runner, "search_path");
+  const savedBodies = await setting(runner, "check_function_bodies");
+  const path = `${quoteIdent2(SCRATCH)}, public`;
+  try {
+    await runner.query(`select set_config('check_function_bodies', 'on', false)`);
+    await runner.query(`select set_config('search_path', $1, false)`, [path]);
+    await createTypes(runner, source);
+    const routinePath = `${quoteIdent2(SCRATCH)}, pg_catalog`;
+    const failures = new Map;
+    for (const object of ordered(source, plan)) {
+      if (!creates(object, source, plan))
+        continue;
+      const statement = object.kind === "table" ? createTableSql2(object, source, SCRATCH) : createObjectSql2(object, SCRATCH);
+      if (statement === undefined)
+        continue;
+      const routine = object.kind === "function" || object.kind === "view" || object.kind === "materializedView" || object.kind === "trigger";
+      if (routine)
+        await runner.query(`select set_config('search_path', $1, false)`, [routinePath]);
+      else
+        await runner.query(`select set_config('search_path', $1, false)`, [path]);
+      try {
+        await runner.query(statement);
+      } catch (error) {
+        failures.set(identityKey2(object.identity), firstLine(error));
+      }
+    }
+    return verdicts(plan, failures);
+  } finally {
+    await runner.query(`select set_config('search_path', $1, false)`, [savedPath]).catch(() => {
+      return;
+    });
+    await runner.query(`select set_config('check_function_bodies', $1, false)`, [savedBodies]).catch(() => {
+      return;
+    });
+    await dropScratch(runner);
+  }
+}
+function ordered(source, plan) {
+  const augmented = augment(source, plan.orderEdges);
+  try {
+    return dependencyOrder(augmented);
+  } catch (error) {
+    if (error instanceof OkmError2 && error.code === "OKM1026")
+      return dependencyOrder(source.objects);
+    throw error;
+  }
+}
+function augment(source, edges) {
+  return source.objects.map((object) => {
+    const extra = edges.get(identityKey2(object.identity));
+    if (extra === undefined || extra.length === 0)
+      return object;
+    const dependencies = [...object.dependencies.map((edge) => edge.target), ...extra];
+    if (object.kind === "function")
+      return copyFunction(object, dependencies);
+    if (object.kind === "view")
+      return copyView(object, dependencies);
+    if (object.kind === "materializedView")
+      return copyMatview(object, dependencies);
+    return object;
+  });
+}
+function copyFunction(object, dependencies) {
+  return functionObject({
+    namespace: object.identity.namespace,
+    name: object.identity.name,
+    arguments: object.definition.arguments,
+    returns: object.definition.returns,
+    language: object.definition.language,
+    volatility: object.definition.volatility,
+    security: object.definition.security,
+    body: object.definition.body,
+    ...object.definition.searchPath !== undefined ? { searchPath: object.definition.searchPath } : {},
+    ...object.definition.atomic === true ? { atomic: true } : {},
+    owner: object.owner,
+    provenance: object.provenance,
+    dependencies
+  });
+}
+function copyView(object, dependencies) {
+  return viewObject({
+    namespace: object.identity.namespace,
+    name: object.identity.name,
+    columns: object.definition.columns,
+    query: object.definition.query,
+    ...object.definition.securityInvoker === true ? { securityInvoker: true } : {},
+    owner: object.owner,
+    provenance: object.provenance,
+    dependencies
+  });
+}
+function copyMatview(object, dependencies) {
+  return materializedViewObject({
+    namespace: object.identity.namespace,
+    name: object.identity.name,
+    columns: object.definition.columns,
+    query: object.definition.query,
+    ...object.definition.refresh !== undefined ? { refresh: object.definition.refresh } : {},
+    owner: object.owner,
+    provenance: object.provenance,
+    dependencies
+  });
+}
+function creates(object, source, plan) {
+  if (object.kind === "type")
+    return false;
+  if (object.kind === "column")
+    return false;
+  if (object.kind === "constraint" && object.definition.constraintKind === "primaryKey")
+    return false;
+  if (object.kind === "sequence" && identitySequence2(object, source))
+    return false;
+  if (object.kind === "table")
+    return object.definition.partition === undefined;
+  if (object.kind === "extension" || object.kind === "policy" || object.kind === "role")
+    return false;
+  if (object.kind === "grant" || object.kind === "defaultPrivilege")
+    return false;
+  const key = identityKey2(object.identity);
+  if (object.kind === "function")
+    return plan.functions.some((item) => identityKey2(item.object.identity) === key);
+  if (object.kind === "trigger")
+    return plan.triggers.some((item) => identityKey2(item.object.identity) === key);
+  if (object.kind === "view" || object.kind === "materializedView") {
+    return plan.views.some((item) => identityKey2(item.object.identity) === key);
+  }
+  return true;
+}
+async function createTypes(runner, source) {
+  const types = source.objects.filter((object) => object.kind === "type");
+  const enums = types.filter((object) => object.kind === "type" && !isDomain(object.definition));
+  const domains = types.filter((object) => object.kind === "type" && isDomain(object.definition));
+  for (const object of [...enums, ...domains]) {
+    const statement = createObjectSql2(object, SCRATCH);
+    if (statement !== undefined)
+      await runner.query(statement);
+  }
+}
+function verdicts(plan, failures) {
+  const verdicts = [];
+  for (const item of plan.functions) {
+    const key = identityKey2(item.object.identity);
+    const failed = failures.get(key);
+    const plpgsql = item.object.definition.language === "plpgsql";
+    let status = "verified";
+    if (failed !== undefined)
+      status = "unverified";
+    else if (plpgsql)
+      status = "candidate-only";
+    verdicts.push({
+      key,
+      kind: "function",
+      label: `${item.object.identity.name}(${item.object.identity.argTypes.join(", ")})`,
+      status,
+      detail: failed ?? ""
+    });
+  }
+  for (const item of plan.triggers) {
+    const key = identityKey2(item.object.identity);
+    const failed = failures.get(key);
+    verdicts.push({
+      key,
+      kind: "trigger",
+      label: `${item.object.identity.parent.name}.${item.object.identity.name}`,
+      status: failed !== undefined ? "unverified" : "verified",
+      detail: failed ?? ""
+    });
+  }
+  for (const item of plan.views) {
+    const key = identityKey2(item.object.identity);
+    const failed = failures.get(key);
+    verdicts.push({
+      key,
+      kind: item.object.kind,
+      label: item.object.identity.name,
+      status: failed !== undefined ? "unverified" : "verified",
+      detail: failed ?? ""
+    });
+  }
+  return verdicts;
+}
+async function setting(runner, name) {
+  const rows = await runner.query(`select current_setting($1) as value`, [name]);
+  return cellText(rows[0]?.value);
+}
+async function dropScratch(runner) {
+  await runner.query(`drop schema if exists ${quoteIdent2(SCRATCH)} cascade`).catch(() => {
+    return;
+  });
+}
+function firstLine(error) {
+  const message = error instanceof Error && error.message.length > 0 ? error.message : "create failed";
+  const line = message.split(`
+`)[0] ?? message;
+  return line.length > 200 ? `${line.slice(0, 200)}…` : line;
+}
+
+// src/tooling/migrate/pull.ts
+async function pullProject2(cwd, argv) {
+  const flags = parsePullArgs(argv);
+  const config = await loadConfig(cwd);
+  const target = selectTarget(config, flags.target);
+  assertTargetPolicy(target, "pull", flags.allowProtected);
+  const layout = layoutOf(cwd, config.schema, config.tables, flags.out);
+  const sql = postgres(target.url, {
+    max: 1,
+    connect_timeout: 5,
+    idle_timeout: 1,
+    onnotice: () => {}
+  });
+  try {
+    const read = await readCatalog(sql, flags.schemas);
+    const query = queryOf(sql);
+    const plan = planRoutines(read.catalog, tableExportNames(read.catalog));
+    const verdicts = await verifyPulled(query, read.catalog, plan);
+    const unexpressed = await countUnexpressed(query, read.schemas);
+    const emitted = emitPull(read.catalog, layout, { plan, verdicts, unexpressed });
+    const tables = emitted.files.filter((file) => file.path !== layout.schemaFile);
+    if (tables.length === 0) {
+      const name = read.schemas.join(", ");
+      throw new OkmError2("invalid", `Namespace ${name} has no tables.`, {
+        fix: { summary: "Pass --schema <name> for a namespace that has tables." }
+      });
+    }
+    commitPullFiles2(emitted.files, "Pull");
+    return {
+      text: formatPullReport(emitted.counts, emitted.skipped, emitted.verdicts, unexpressed),
+      skipped: emitted.skipped
+    };
+  } catch (error) {
+    if (error instanceof OkmError2)
+      throw error;
+    throw sessionFailure(error) ?? unavailable(error);
+  } finally {
+    await finishQuiet(() => sql.end({ timeout: 5 }));
+  }
+}
+function parsePullArgs(argv) {
+  let target;
+  let out;
+  let allowProtected = false;
+  const schemas = [];
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index] ?? "";
+    if (arg === "--allow-protected") {
+      allowProtected = true;
+      continue;
+    }
+    if (arg === "--target" || arg === "--schema" || arg === "--out") {
+      const value = argv[index + 1];
+      if (value === undefined || value.startsWith("--")) {
+        throw new OkmError2("invalid", `${arg} needs a value.`, {
+          fix: { summary: `Pass ${arg} <value>.` }
+        });
+      }
+      if (arg === "--target")
+        target = value;
+      else if (arg === "--out")
+        out = value;
+      else
+        schemas.push(...splitSchemas(value));
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("--target=")) {
+      target = arg.slice("--target=".length);
+      continue;
+    }
+    if (arg.startsWith("--out=")) {
+      out = arg.slice("--out=".length);
+      continue;
+    }
+    if (arg.startsWith("--schema=")) {
+      schemas.push(...splitSchemas(arg.slice("--schema=".length)));
+      continue;
+    }
+    throw new OkmError2("invalid", `Unknown flag ${arg}.`, {
+      fix: { summary: "okm pull accepts --target, --schema, --out, and --allow-protected." }
+    });
+  }
+  return { target, allowProtected, out, schemas };
+}
+async function readCatalog(sql, schemas) {
+  try {
+    const chosen = schemas.length > 0 ? schemas : [await currentSchema(sql)];
+    const objects = [];
+    for (const name of chosen) {
+      const live = await introspectSchema(queryOf(sql), name, "public");
+      objects.push(...live.objects);
+    }
+    return { catalog: catalog(objects), schemas: chosen };
+  } catch (error) {
+    if (error instanceof OkmError2)
+      throw error;
+    throw sessionFailure(error) ?? unavailable(error);
+  }
+}
+var UNEXPRESSED = `
+  select
+    (select count(*)::int from pg_proc p
+      join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = $1 and p.prokind = 'a') as aggregates,
+    (select count(*)::int from pg_proc p
+      join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = $1 and p.prokind = 'p') as procedures,
+    (select count(*)::int from pg_event_trigger) as event_triggers,
+    (select count(*)::int from pg_rewrite r
+      join pg_class c on c.oid = r.ev_class
+      join pg_namespace n on n.oid = c.relnamespace
+      where n.nspname = $1 and r.rulename <> '_RETURN') as rules
+`;
+async function countUnexpressed(query, schemas) {
+  let aggregates = 0;
+  let procedures = 0;
+  let eventTriggers = 0;
+  let rules = 0;
+  for (const name of schemas) {
+    const rows = await query.query(UNEXPRESSED, [name]);
+    const row = rows[0];
+    aggregates += countCell(row?.aggregates);
+    procedures += countCell(row?.procedures);
+    eventTriggers = countCell(row?.event_triggers);
+    rules += countCell(row?.rules);
+  }
+  return [
+    { kind: "aggregate", count: aggregates, reason: "the catalog has no aggregate kind" },
+    { kind: "procedure", count: procedures, reason: "the catalog has no procedure kind" },
+    {
+      kind: "eventTrigger",
+      count: eventTriggers,
+      reason: "the catalog has no event trigger kind"
+    },
+    { kind: "rule", count: rules, reason: "the catalog has no rule kind" }
+  ];
+}
+function countCell(value) {
+  if (typeof value === "number" && Number.isFinite(value))
+    return value;
+  if (typeof value === "bigint")
+    return Number(value);
+  if (typeof value === "string" && value.length > 0)
+    return Number(value);
+  return 0;
+}
+async function currentSchema(sql) {
+  const rows = await sql`select current_schema() as name`;
+  const name = rows[0]?.name;
+  if (name === null || name === undefined || name.length === 0) {
+    throw new OkmError2("invalid", "The target has no current schema.", {
+      fix: { summary: "Pass --schema <name>." }
+    });
+  }
+  return name;
+}
+function queryOf(sql) {
+  return {
+    async query(text, params) {
+      const rows = await sql.unsafe(text, params === undefined ? undefined : [...params]);
+      return rows.map((row) => {
+        const copy = {};
+        for (const [key, value] of Object.entries(row))
+          copy[key] = value;
+        return copy;
+      });
+    }
+  };
+}
+function pullLayout2(cwd, schema, tables, out) {
+  return layoutOf(cwd, schema, tables, out);
+}
+function commitPullFiles2(files, verb = "Pull") {
+  refuseExisting(files, verb);
+  for (const file of files) {
+    mkdirSync(dirname2(file.path), { recursive: true });
+    writeFileSync(file.path, file.text);
+  }
+  formatFiles(files.map((file) => file.path));
+}
+function layoutOf(cwd, schema, tables, out) {
+  if (out !== undefined) {
+    const root = projectPath(cwd, out);
+    return { schemaFile: join(root, "schema.ts"), tablesDir: join(root, "tables") };
+  }
+  const schemaFile = projectPath(cwd, schema);
+  const tablesDir = tables !== undefined ? projectPath(cwd, tables) : join(dirname2(schemaFile), "tables");
+  return { schemaFile, tablesDir };
+}
+function refuseExisting(files, verb) {
+  for (const file of files) {
+    if (!existsSync(file.path))
+      continue;
+    throw new OkmError2("OKM1855", `${verb} would overwrite ${file.path}.`, {
+      fix: {
+        summary: `Pass --out <directory> to write somewhere else, or move ${file.path}.`
+      }
+    });
+  }
+}
+function formatFiles(files) {
+  if (files.length === 0)
+    return;
+  const root = formatterRoot(dirname2(files[0] ?? "."));
+  const binary = join(root, "node_modules", ".bin", "oxfmt");
+  const result = spawnSync(binary, ["--write", ...files], {
+    cwd: root,
+    encoding: "utf8"
+  });
+  if (result.error !== undefined || result.status !== 0) {
+    const detail = result.stderr || result.stdout || "oxfmt failed";
+    throw new OkmError2("invalid", `The pulled files were not formatted. ${detail.trim()}`, {
+      fix: { summary: "Run oxfmt on the pulled files, or fix the formatter settings." }
+    });
+  }
+}
+function formatterRoot(start) {
+  let dir = start;
+  for (;; ) {
+    if (existsSync(join(dir, ".oxfmtrc.json")))
+      return dir;
+    const parent = dirname2(dir);
+    if (parent === dir)
+      return start;
+    dir = parent;
+  }
+}
+function splitSchemas(value) {
+  const names = value.split(",").map((name) => name.trim()).filter((name) => name.length > 0);
+  if (names.length === 0) {
+    throw new OkmError2("invalid", "--schema needs a name.", {
+      fix: { summary: "Pass --schema <name>. Repeat the flag to read more than one." }
+    });
+  }
+  return names;
+}
+function unavailable(error) {
+  const message = error instanceof Error && error.message.length > 0 ? error.message : "The database is unavailable.";
+  return new OkmError2("unavailable", message, {
+    kind: "unavailable",
+    cause: error,
+    fix: { summary: "Check the target URL. okm pull only reads." }
+  });
+}
+
+export { emitPull, formatPullReport, pullProject2, pullLayout2, commitPullFiles2 };