okmodel 0.8.0 → 0.9.1

package/dist/shared/{jp36k7dp.js → rw4tpcd0.js}

@@ -1,63 +1,73 @@
 import {
   parseCatalog2
 } from "./12z7aznj.js";
+import {
+  quoteIdent2
+} from "./fk9vef30.js";
 import"./n442h54c.js";
 import"./cm3w0ywp.js";
-import"./35q0n9tz.js";
+import"./jvxcp1qk.js";
 import {
   watchReserved2
-} from "./wcrheftc.js";
-import {
-  ensureMigrationTables2
-} from "./pan0370z.js";
+} from "./3dr444ny.js";
 import {
   sealViews,
   catalogQuery2,
   managedRoleOptions2
-} from "./mkrn359n.js";
+} from "./4pkz5nvw.js";
+import {
+  ensureMigrationTables2
+} from "./8ma6drzr.js";
 import {
   assumeRole,
   grantSchema,
+  ownSchema,
   assertSchemaUsageLanded,
   catalogsEqual,
   snapshotDifference
-} from "./mnvjvqyp.js";
+} from "./8p2bgye0.js";
 import {
   roleExists
-} from "./kj9d8maq.js";
+} from "./6xqvesa5.js";
+import {
+  probeStableBackend
+} from "./e1c55v04.js";
 import {
   introspectSchema
-} from "./p3xbdcvt.js";
+} from "./mz48rs74.js";
 import {
   projectPath,
+  loadSnapshots,
+  assertSnapshots,
+  assertLiveExternal,
   loadMigrations,
   readMigrationPlan,
+  lintReprints,
   lintMigrationDirectory,
+  formatFindings,
   hasError,
   lintRefusal,
   openProject
-} from "./f4jy1j7x.js";
+} from "./wp7y8q3y.js";
 import {
+  driverUrl,
   sqlStatements,
   transactionControl,
   canonicalTypeName,
   createdRoleName,
   createRoleOnce,
+  changesRole,
   classOf,
   strictestClass,
   planMigration,
   sessionFailure,
   finishQuiet,
   assertDirectConnection,
-  assertStableBackend,
   selectTarget
-} from "./dpc2r7rb.js";
+} from "./bdekbvmt.js";
 import {
   isConnectionLost
 } from "./cnkky55j.js";
-import {
-  quoteIdent
-} from "./sjk86yrx.js";
 import {
   catalog,
   isDomain
@@ -77,6 +87,7 @@ import { join } from "node:path";
 import postgres from "postgres";
 async function replayCheckHistory(url, scratch, config, allowPooler, history) {
   const skips = [];
+  const reprints = [];
   let stop;
   await inCheckTransaction(url, scratch, config, allowPooler, async (sql) => {
     const connection = driverOf(sql);
@@ -88,7 +99,10 @@ async function replayCheckHistory(url, scratch, config, allowPooler, history) {
       await replayMigration(sql, connection, scratch, config, migration, session, skips);
       await restoreSession(sql, session);
       const runner = catalogQuery2(sql);
-      const live = await introspectSchema(runner, scratch, "public", managedRoleOptions2(config.roles));
+      const live = await introspectSchema(runner, scratch, config.namespace ?? "public", managedRoleOptions2(config.roles));
+      for (const item of lintReprints(migration.catalog, live, migration.steps)) {
+        reprints.push({ ...item, place: `${migration.id} ${item.place}` });
+      }
       const sealed = await sealViews(runner, migration.catalog);
       const back = planMigration({ before: live, after: sealed, name: migration.id });
       if (back.steps.length === 0)
@@ -97,7 +111,7 @@ async function replayCheckHistory(url, scratch, config, allowPooler, history) {
       return;
     }
   });
-  return stop === undefined ? { skips } : { skips, stop };
+  return stop === undefined ? { skips, reprints } : { skips, reprints, stop };
 }
 async function proveCheckSnapshot(url, provided, replayed, config, allowPooler, history) {
   const head = history.at(-1);
@@ -115,10 +129,10 @@ async function proveCheckSnapshot(url, provided, replayed, config, allowPooler,
     await runSteps(sql, connection, provided, config.roles?.migration, {
       id: "snapshot",
       catalog: head.catalog,
-      steps: retargetSteps(planned.steps, provided)
+      steps: retargetSteps(planned.steps, provided, config.namespace ?? "public")
     }, session, []);
     await restoreSession(sql, session);
-    return introspectSchema(catalogQuery2(sql), provided, "public", managedRoleOptions2(config.roles));
+    return introspectSchema(catalogQuery2(sql), provided, config.namespace ?? "public", managedRoleOptions2(config.roles));
   });
   const again = await inCheckTransaction(url, replayed, config, allowPooler, async (sql) => {
     const connection = driverOf(sql);
@@ -127,17 +141,17 @@ async function proveCheckSnapshot(url, provided, replayed, config, allowPooler,
       await replayMigration(sql, connection, replayed, config, migration, session, []);
     }
     await restoreSession(sql, session);
-    return introspectSchema(catalogQuery2(sql), replayed, "public", managedRoleOptions2(config.roles));
+    return introspectSchema(catalogQuery2(sql), replayed, config.namespace ?? "public", managedRoleOptions2(config.roles));
   });
   return snapshotDifference(installed, again);
 }
-function retargetSteps(steps, schema) {
-  const from = `${quoteIdent("public")}.`;
-  const to = `${quoteIdent(schema)}.`;
-  const fromDefaults = `in schema ${quoteIdent("public")} `;
-  const toDefaults = `in schema ${quoteIdent(schema)} `;
-  const fromSchema = `on schema ${quoteIdent("public")}`;
-  const toSchema = `on schema ${quoteIdent(schema)}`;
+function retargetSteps(steps, schema, source = "public") {
+  const from = `${quoteIdent2(source)}.`;
+  const to = `${quoteIdent2(schema)}.`;
+  const fromDefaults = `in schema ${quoteIdent2(source)} `;
+  const toDefaults = `in schema ${quoteIdent2(schema)} `;
+  const fromSchema = `on schema ${quoteIdent2(source)}`;
+  const toSchema = `on schema ${quoteIdent2(schema)}`;
   return steps.map((step) => ({
     ...step,
     sql: step.sql.replaceAll(from, to).replaceAll(fromDefaults, toDefaults).replaceAll(fromSchema, toSchema),
@@ -145,7 +159,7 @@ function retargetSteps(steps, schema) {
   }));
 }
 async function inCheckTransaction(url, scratch, config, allowPooler, run) {
-  const sql = postgres(url, {
+  const sql = postgres(driverUrl(url), {
     max: 1,
     connect_timeout: 5,
     idle_timeout: 1,
@@ -165,7 +179,7 @@ async function inCheckTransaction(url, scratch, config, allowPooler, run) {
   let rolledBack = false;
   let xid = "";
   try {
-    await assertStableBackend(async () => {
+    await probeStableBackend(url, async () => {
       const rows = await reserved.unsafe("select pg_backend_pid()::text as pid");
       const pid = cell(rows[0], "pid");
       return pid ?? "";
@@ -173,9 +187,9 @@ async function inCheckTransaction(url, scratch, config, allowPooler, run) {
     await reserved.unsafe("begin");
     open = true;
     xid = await readXid(reserved);
-    await reserved.unsafe(`create schema ${quoteIdent(scratch)}`);
+    await reserved.unsafe(`create schema ${quoteIdent2(scratch)}`);
     created = true;
-    await reserved.unsafe(`set local search_path to ${quoteIdent(scratch)}`);
+    await reserved.unsafe(`set local search_path to ${quoteIdent2(scratch)}`);
     await setLocalTimeout(reserved, "lock_timeout", config.timeouts?.lock);
     await setLocalTimeout(reserved, "statement_timeout", config.timeouts?.statement);
     await ownScratch(reserved, scratch, config.roles?.migration);
@@ -264,14 +278,14 @@ function closedError() {
   return Object.assign(new Error("CONNECTION_CLOSED"), { code: "CONNECTION_CLOSED" });
 }
 async function dropScratch(url, scratch) {
-  const sql = postgres(url, {
+  const sql = postgres(driverUrl(url), {
     max: 1,
     connect_timeout: 5,
     idle_timeout: 1,
     onnotice: () => {}
   });
   try {
-    await sql.unsafe(`drop schema if exists ${quoteIdent(scratch)} cascade`);
+    await sql.unsafe(`drop schema if exists ${quoteIdent2(scratch)} cascade`);
     const rows = await sql`
       select nspname from pg_namespace where nspname = ${scratch}
     `;
@@ -299,7 +313,7 @@ async function restoreSession(sql, session) {
   delete session.setRole;
 }
 async function replayMigration(sql, connection, scratch, config, migration, session, skips) {
-  await runSteps(sql, connection, scratch, config.roles?.migration, { ...migration, steps: retargetSteps(migration.steps, scratch) }, session, skips);
+  await runSteps(sql, connection, scratch, config.roles?.migration, { ...migration, steps: retargetSteps(migration.steps, scratch, config.namespace ?? "public") }, session, skips);
 }
 async function runSteps(sql, connection, scratch, migrationRole, migration, session, skips) {
   for (let index = 0;index < migration.steps.length; index += 1) {
@@ -313,6 +327,9 @@ async function runSteps(sql, connection, scratch, migrationRole, migration, sess
     if (prepared.sql.length === 0)
       continue;
     try {
+      if (migrationRole !== undefined && !changesRole(step.sql) && session.setRole !== migrationRole && await roleExists(connection, migrationRole)) {
+        await assumeRole(connection, migrationRole, session);
+      }
       const created = createdRoleName(step.sql);
       const existed = created !== undefined && await roleExists(connection, created);
       if (step.backfill !== undefined) {
@@ -323,17 +340,18 @@ async function runSteps(sql, connection, scratch, migrationRole, migration, sess
       } else if (!existed) {
         await sql.unsafe(createRoleOnce(prepared.sql.replace(/;\s*$/, "")));
       }
-      if (created !== undefined && created === migrationRole) {
-        if (!existed) {
-          await grantSchema(connection, scratch, created);
-          await connection.execute(`grant select, insert, update on okm_meta, okm_history, okm_backfill to ${quoteIdent(created)}`);
-        }
-        await assumeRole(connection, created, session);
+      if (created !== undefined && created === migrationRole && !existed) {
+        await grantSchema(connection, scratch, created);
+        await ownSchema(connection, scratch, created);
+        await connection.execute(`grant select, insert, update on okm_meta, okm_history, okm_backfill to ${quoteIdent2(created)}`);
       }
     } catch (error) {
       throw failStep(migration.id, index, error);
     }
   }
+  if (migrationRole !== undefined && session.setRole !== migrationRole && await roleExists(connection, migrationRole)) {
+    await assumeRole(connection, migrationRole, session);
+  }
 }
 function prepareCheckSql(sql) {
   const parts = sqlStatements(sql);
@@ -378,7 +396,7 @@ async function ownScratch(sql, scratch, role) {
   const exists = await sql.unsafe("select exists (select 1 from pg_roles where rolname = $1) as ok", [role]);
   const present = cell(exists[0], "ok");
   if (present === "t" || present === "true") {
-    await sql.unsafe(`alter schema ${quoteIdent(scratch)} owner to ${quoteIdent(role)}`);
+    await sql.unsafe(`alter schema ${quoteIdent2(scratch)} owner to ${quoteIdent2(role)}`);
   }
 }
 async function setLocalTimeout(sql, name, ms) {
@@ -476,6 +494,8 @@ async function checkMigrations(cwd, flags, options) {
       }
     });
   }
+  assertSnapshots(cwd, opened.config, opened.built.catalog);
+  await assertLiveExternal(target.url, opened.built.catalog, loadSnapshots(cwd, opened.config));
   const directory = projectPath(cwd, opened.config.migrations ?? "migrations");
   const history = readHistory(directory);
   const previous = previousFailures(history);
@@ -490,16 +510,21 @@ async function checkMigrations(cwd, flags, options) {
       throwFailure([equivalence]);
   }
   const replayed = await replayHistory(opened.config, target.url, flags, history);
+  const reprintErrors = replayed.reprints.filter((item) => item.severity === "error");
+  const reprintWarnings = replayed.reprints.filter((item) => item.severity === "warning");
   const failures = [...replayed.failures, ...previous, ...stale, ...lint];
+  if (reprintErrors.length > 0) {
+    const refusal = lintRefusal(reprintErrors);
+    failures.push({ code: refusal.code, message: refusal.message, fix: refusal.fix.summary });
+  }
   if (failures.length > 0)
-    throwFailure(failures);
+    throwFailure(failures, reprintWarnings);
   const summary = `ok ${String(history.length)} migrations
 `;
-  if (replayed.skips.length === 0)
-    return summary;
-  return `${summary}${replayed.skips.join(`
+  const skipped = replayed.skips.length === 0 ? "" : `${replayed.skips.join(`
 `)}
 `;
+  return `${summary}${skipped}${formatFindings(reprintWarnings)}`;
 }
 function previousCatalogGaps(before, after) {
   const afterBy = new Map(after.objects.map((object) => [identityKey2(object.identity), object]));
@@ -597,14 +622,16 @@ ${difference}`,
 }
 async function replayHistory(config, url, flags, history) {
   if (history.length === 0)
-    return { failures: [], skips: [] };
+    return { failures: [], skips: [], reprints: [] };
   const scratch = `${CHECK_SCHEMA_PREFIX}${crypto.randomUUID().replaceAll("-", "")}`;
   const outcome = await replayCheckHistory(url, scratch, config, flags.allowPooler || config.allowPooler === true, history);
-  if (outcome.stop === undefined)
-    return { failures: [], skips: outcome.skips };
+  if (outcome.stop === undefined) {
+    return { failures: [], skips: outcome.skips, reprints: outcome.reprints };
+  }
   return {
     failures: [historyFailure(history, outcome.stop.index, outcome.stop.back)],
-    skips: outcome.skips
+    skips: outcome.skips,
+    reprints: outcome.reprints
   };
 }
 function refuseTransactionControl(history) {
@@ -676,13 +703,16 @@ function readHistory(directory) {
     catalog: parseCatalog2(readFileSync(join(directory, `${migration.id}.catalog.json`), "utf8"))
   }));
 }
-function throwFailure(failures) {
+function throwFailure(failures, warnings = []) {
   const first = failures[0];
   if (first === undefined)
     throw new Error("okm migrate check has no failure to report.");
   const message = failures.length === 1 ? first.message : failures.map((failure) => `${failure.code} ${failure.message}`).join(`
 `);
-  throw new OkmError2(first.code, message, { fix: { summary: first.fix } });
+  const notes = formatFindings(warnings).trim();
+  const text = notes.length === 0 ? message : `${message}
+${notes}`;
+  throw new OkmError2(first.code, text, { fix: { summary: first.fix } });
 }
 function checkedKind(kind) {
   return kind === "table" || kind === "column" || kind === "constraint" || kind === "type";

package/dist/shared/{bsek72fg.js → s5qe47a6.js}

@@ -54,6 +54,9 @@ function scanLiteral(literal, state) {
   for (let index = 0;index < literal.length; index += 1) {
     const char = literal[index] ?? "";
     const code = literal.charCodeAt(index);
+    if (char === "\\") {
+      fragmentError("A fragment cannot include a backslash.", "Pass the value as an interpolation.");
+    }
     if (state.quote !== undefined) {
       if (char !== state.quote)
         continue;

package/dist/shared/{1d9q9cv2.js → smxzjz60.js}

@@ -1,7 +1,7 @@
 import {
   emitSqlSelect,
   decodeSqlNumber
-} from "./3bb7wsqt.js";
+} from "./ycnft340.js";
 import {
   refusePrototypeKey
 } from "./a62rb2da.js";
@@ -10,7 +10,7 @@ import {
 } from "./9a4ae4p8.js";
 import {
   readSelectFragment
-} from "./bsek72fg.js";
+} from "./s5qe47a6.js";
 import {
   emitWhere,
   emitOrder,

package/dist/shared/{wz2a78mp.js → th5rnaxw.js}

@@ -1,7 +1,7 @@
 import {
   build2,
   identityColumn2
-} from "./g5yc06ka.js";
+} from "./67w3kn71.js";
 export {
   build2 as build,
   identityColumn2 as identityColumn

package/dist/{tooling/shared/rs1jb051.js → shared/tr64w5p0.js}

@@ -1,6 +1,6 @@
 import {
   rejectUncancellable
-} from "./xhrnjch9.js";
+} from "./mfvx6kjx.js";
 
 // src/adapters/pg/no-inflight-timeout.ts
 function noTimeout(options) {

package/dist/shared/{14x60fbf.js → tyqapcgk.js}

@@ -1,23 +1,35 @@
 import {
   noticeBuffer,
   WireSession
-} from "./mtw6jz76.js";
+} from "./e275q7sd.js";
 import {
   NODE_POSTGRES_CAPABILITIES,
   driverErrors,
   rejectClosed,
+  rejectCancelled,
+  rejectTimedOut,
   mapFailure,
   runCall
-} from "./ae4j5f42.js";
+} from "./mfvx6kjx.js";
 
 // src/adapters/pg/nodepostgres.ts
 import net from "node:net";
 import pg from "pg";
 var CANCEL_CODE = 80877102;
+var ABORT_GRACE_MS = 250;
 var identity = (value) => value;
 function armDriverError(source, handle = () => {}) {
   source.on("error", handle);
 }
+function logClientError(notices, error) {
+  const message = error instanceof Error ? error.message : typeof error === "string" ? error : "client error";
+  const code = typeof error === "object" && error !== null && "code" in error ? Reflect.get(error, "code") : undefined;
+  notices.push({
+    severity: "ERROR",
+    message,
+    ...typeof code === "string" && code.length > 0 ? { code } : {}
+  });
+}
 var WIRE = {
   getTypeParser() {
     return identity;
@@ -25,7 +37,7 @@ var WIRE = {
 };
 function open4(config) {
   const max = config.max ?? 10;
-  const acquireMs = config.timeouts?.acquire;
+  const acquireMs = config.timeouts?.acquire ?? 1e4;
   const counters = { reserved: 0, busy: 0, reservedBusy: 0, waiting: 0 };
   const inflight = new Set;
   const notices = noticeBuffer();
@@ -43,11 +55,16 @@ function open4(config) {
     ...config.ssl !== undefined ? { ssl: config.ssl } : {},
     ...config.searchPath !== undefined ? { options: `-c search_path=${config.searchPath}` } : {}
   });
-  armDriverError(pool);
+  armDriverError(pool, (error) => {
+    logClientError(notices, error);
+  });
   pool.on("connect", (client) => {
     client.on("notice", (notice) => {
       notices.push(notice);
     });
+    armDriverError(client, (error) => {
+      logClientError(notices, error);
+    });
   });
   const root = new WireSession((text, params) => send(pool, text, params, named, undefined), notices, isClosed, true, () => {
     counters.busy += 1;
@@ -55,7 +72,7 @@ function open4(config) {
     counters.busy = Math.max(0, counters.busy - 1);
   }, inflight);
   const held = { pool, acquireMs, counters, notices, named, isClosed };
-  const checkout = () => closed ? rejectClosed() : import("./mfedzr74.js").then((mod) => mod.checkout(held));
+  const checkout = () => closed ? rejectClosed() : import("./8qwqrxed.js").then((mod) => mod.checkout(held));
   return {
     capabilities: NODE_POSTGRES_CAPABILITIES,
     execute(text, params, options) {
@@ -63,17 +80,31 @@ function open4(config) {
         if (watch === undefined)
           return root.query(text, params, undefined);
         const client = await connectClient(pool, acquireMs, counters);
+        if (watch.signal.aborted) {
+          client.release();
+          return watch.reason() === "cancelled" ? rejectCancelled() : rejectTimedOut();
+        }
         counters.busy += 1;
+        const slot = trackCheckout(client, () => {
+          counters.busy = Math.max(0, counters.busy - 1);
+        });
         const session = new WireSession((statement, values) => send(client, statement, values, named, client), notices, isClosed, true, () => {
           return;
         }, () => {
           return;
         }, inflight);
+        const onAbort = () => {
+          slot.abandon();
+        };
+        if (watch.signal.aborted)
+          onAbort();
+        else
+          watch.signal.addEventListener("abort", onAbort, { once: true });
         try {
           return await session.query(text, params, watch);
         } finally {
-          counters.busy = Math.max(0, counters.busy - 1);
-          client.release();
+          watch.signal.removeEventListener("abort", onAbort);
+          slot.release();
         }
       });
     },
@@ -88,14 +119,14 @@ function open4(config) {
     reserve: () => checkout(),
     stream(text, params) {
       return async function* () {
-        const { streamRows } = await import("./mfedzr74.js");
+        const { streamRows } = await import("./8qwqrxed.js");
         yield* streamRows(checkout, text, params);
       }();
     },
     listen(channel, onNotify) {
       if (closed)
         return rejectClosed();
-      return import("./mfedzr74.js").then((mod) => mod.listen(held, channel, onNotify));
+      return import("./8qwqrxed.js").then((mod) => mod.listen(held, channel, onNotify));
     },
     cancel() {
       for (const pending of inflight)
@@ -149,6 +180,38 @@ function cancelBackend(client) {
     socket.end(bytes);
   });
 }
+function trackCheckout(client, done) {
+  let dead = false;
+  let released = false;
+  let grace;
+  const onError = () => {
+    dead = true;
+  };
+  const events = client;
+  events.on("error", onError);
+  const release = () => {
+    if (released)
+      return;
+    released = true;
+    if (grace !== undefined)
+      clearTimeout(grace);
+    events.removeListener("error", onError);
+    done();
+    client.release(dead ? true : undefined);
+  };
+  return {
+    abandon() {
+      if (released || grace !== undefined)
+        return;
+      grace = setTimeout(() => {
+        dead = true;
+        release();
+      }, ABORT_GRACE_MS);
+      grace.unref();
+    },
+    release
+  };
+}
 function connectClient(pool, acquireMs, counters) {
   counters.waiting += 1;
   let settled = false;
@@ -191,4 +254,4 @@ function statsOf(counters, size) {
   };
 }
 
-export { armDriverError, open4, send, connectClient };
+export { armDriverError, logClientError, open4, send, connectClient };

package/dist/shared/vsna85qf.js

@@ -0,0 +1,8 @@
+import {
+  historySql2,
+  acceptServer2
+} from "./k73e8n9d.js";
+export {
+  acceptServer2 as acceptServer,
+  historySql2 as historySql
+};

package/dist/shared/{63qtkrca.js → vy47ryqa.js}

@@ -14,7 +14,7 @@ function mapPostgresError(error, options) {
     return error;
   if (!isDriverError(error))
     return OkmError2.from(error);
-  const search = searchInputError(error);
+  const search = searchInputError(error, options);
   if (search !== undefined)
     return search;
   const kind = kindOf(error);
@@ -23,6 +23,7 @@ function mapPostgresError(error, options) {
   const fieldReason = hint?.reason ?? (kind === "not_null" ? "not_null" : reasonOf(kind, error.table, error.constraint, columns, options?.schema));
   const values = options?.includeValues === true ? valuesOf(error.detail, columns) : undefined;
   const code = kind === "outcome_unknown" ? "OKM1401" : kind;
+  const redactCause = options?.includeValues !== true && needsSafeCause(options?.schema, error.table, columns);
   return new OkmError2(code, summaryOf(kind, error, columns, fieldReason), {
     kind,
     fieldReason,
@@ -32,11 +33,59 @@ function mapPostgresError(error, options) {
     ...error.constraint !== undefined ? { constraint: error.constraint } : {},
     ...error.sqlstate !== undefined ? { sqlstate: error.sqlstate } : {},
     batchIndex: error.batchIndex,
-    cause: error.cause ?? error,
+    cause: redactCause ? safeCause(error) : error.cause ?? error,
     ...options?.includeValues === true && values !== undefined ? { includeValues: true, values } : {},
     ...options?.http !== undefined ? { http: options.http } : {}
   });
 }
+function needsSafeCause(schema, table, columns) {
+  if (schema === undefined)
+    return false;
+  const model = modelForTable(schema, table);
+  if (model !== undefined && model.columns.some((column) => column.sensitive === true)) {
+    return true;
+  }
+  if (columns.length === 0)
+    return false;
+  for (const item of Object.values(schema.model)) {
+    for (const column of item.columns) {
+      if (column.sensitive !== true)
+        continue;
+      for (const name of columns) {
+        if (column.sql === name || column.field === name)
+          return true;
+      }
+    }
+  }
+  return false;
+}
+function safeCause(error) {
+  const out = { name: "DriverError" };
+  if (error.sqlstate !== undefined)
+    out.sqlstate = error.sqlstate;
+  if (error.constraint !== undefined)
+    out.constraint = error.constraint;
+  if (error.table !== undefined)
+    out.table = error.table;
+  if (error.column !== undefined)
+    out.column = error.column;
+  const nested = error.cause;
+  if (typeof nested === "object" && nested !== null) {
+    const code = Reflect.get(nested, "code");
+    if (typeof code === "string" && code.length > 0 && code.length <= 64)
+      out.code = code;
+  }
+  return out;
+}
+function modelForTable(schema, table) {
+  if (table === undefined)
+    return;
+  for (const item of Object.values(schema.model)) {
+    if (item.sql === table)
+      return item;
+  }
+  return schema.model[table];
+}
 var TLS_CODE = /^(ERR_TLS_|ERR_POSTGRES_TLS_|SELF_SIGNED_CERT_|DEPTH_ZERO_SELF_SIGNED_CERT$|UNABLE_TO_VERIFY_LEAF_SIGNATURE$)/;
 function isTlsFailure(error) {
   const cause = error.cause;
@@ -55,14 +104,15 @@ function searchQuery(error) {
   const query = Reflect.get(cause, "query");
   return typeof query === "string" && query.includes("to_tsquery");
 }
-function searchInputError(error) {
+function searchInputError(error, options) {
   const sqlstate = error.sqlstate;
   const message = error.message;
+  const cause = options?.includeValues !== true && needsSafeCause(options?.schema, error.table, columnsOf(error)) ? safeCause(error) : error.cause ?? error;
   if (sqlstate === "42601" && (message.includes("tsquery") || searchQuery(error))) {
     return new OkmError2("OKM1120", `Search input is not valid. ${stripRowValues(message)}`, {
       kind: "invalid",
       sqlstate,
-      cause: error.cause ?? error,
+      cause,
       fix: { summary: "Fix the advanced search text, or use natural, all-words, or phrase." }
     });
   }
@@ -70,7 +120,7 @@ function searchInputError(error) {
     return new OkmError2("OKM1122", stripRowValues(message), {
       kind: "invalid",
       sqlstate,
-      cause: error.cause ?? error,
+      cause,
       fix: {
         summary: "Use a text search configuration that exists, such as english, or omit language."
       }