okmodel 0.8.0 → 0.9.1

package/dist/shared/{pan0370z.js → 8ma6drzr.js}

@@ -1,9 +1,18 @@
 import {
   open2
-} from "./35q0n9tz.js";
+} from "./jvxcp1qk.js";
 import {
   startupHash2
 } from "./12z7aznj.js";
+import {
+  quoteIdent2
+} from "./fk9vef30.js";
+import {
+  sealViews,
+  sealDomainChecks2,
+  catalogQuery2,
+  managedRoleOptions2
+} from "./4pkz5nvw.js";
 import {
   runTarget,
   assumeRole,
@@ -14,14 +23,21 @@ import {
   provisionMark,
   expandProvisioned,
   installSnapshot
-} from "./mnvjvqyp.js";
+} from "./8p2bgye0.js";
 import {
   assertCreateRole,
   currentUser,
   roleExists
-} from "./kj9d8maq.js";
+} from "./6xqvesa5.js";
+import {
+  probeStableBackend
+} from "./e1c55v04.js";
+import {
+  introspectSchema
+} from "./mz48rs74.js";
 import {
   projectPath,
+  assertSnapshots,
   loadMigrations,
   loadHeadSnapshot,
   lintMigrationDirectory,
@@ -30,8 +46,9 @@ import {
   projectHead,
   loadBuiltSchema,
   loadConfig
-} from "./f4jy1j7x.js";
+} from "./wp7y8q3y.js";
 import {
+  driverUrl,
   changesRole,
   batchSizeField,
   assertExtensionsAvailable,
@@ -39,9 +56,8 @@ import {
   finishQuiet,
   assertTargetPolicy,
   assertDirectConnection,
-  assertStableBackend,
   selectTarget
-} from "./dpc2r7rb.js";
+} from "./bdekbvmt.js";
 import {
   UUIDV7_POSTGRES,
   uuidv7NeedsPostgres
@@ -96,6 +112,7 @@ function unquote(name) {
 }
 
 // src/tooling/migrate/apply.ts
+import postgres from "postgres";
 var DEFAULT_LOCK_MS = 5000;
 var DEFAULT_STATEMENT_MS = 30000;
 var DEFAULT_RETRIES = 3;
@@ -170,8 +187,9 @@ function applyUnits(migration, done) {
 }
 async function applyTarget2(request) {
   assertDirectConnection(request.url, request.allowPooler === true);
+  const url = driverUrl(request.url);
   const pool = open2({
-    url: request.url,
+    url,
     max: 1,
     ...request.searchPath !== undefined ? { searchPath: request.searchPath } : {}
   });
@@ -185,7 +203,7 @@ async function applyTarget2(request) {
   const connection = reserved;
   let locked = false;
   try {
-    await assertStableBackend(() => backendPid(connection), request.allowPooler === true);
+    await probeStableBackend(request.url, () => backendPid(connection), request.allowPooler === true);
     await assertStandardStrings(connection);
     await setTimeouts(connection, request);
     await lockTarget(connection, request.target);
@@ -198,6 +216,7 @@ async function applyTarget2(request) {
     await prepareMigrationRole(connection, request, session);
     await assertExtensionsAvailable(connection, request.migrations);
     await assertUuidV7Available(connection, request.migrations);
+    await enterCatalogSchema(connection, request.schema ?? "public");
     const state = request.snapshot === undefined ? undefined : await targetState(connection);
     if (request.snapshot !== undefined && state !== undefined) {
       if (state.kind === "empty") {
@@ -230,8 +249,11 @@ async function applyTarget2(request) {
     if (request.snapshot !== undefined) {
       await insertReference(connection, request);
     }
+    const desiredHash = request.headHash;
+    const headStamp = desiredHash === undefined || request.restampHead !== true ? [] : await restampHeadHash(connection, request, nextSequenceId("restamp", history.ids), desiredHash);
     await grantAppMeta(connection, request.appRole, session);
-    return restamped.length === 0 ? report : { ...report, restamped };
+    const stamped = [...restamped, ...headStamp];
+    return stamped.length === 0 ? report : { ...report, restamped: stamped };
   } finally {
     if (locked) {
       await finishQuiet(() => connection.execute("select pg_advisory_unlock(hashtext($1))", [lockKey(request.target)]));
@@ -255,7 +277,10 @@ nothing to apply
       return;
     throw error;
   });
+  if (built !== undefined)
+    assertSnapshots(cwd, config, built.catalog);
   const progress = [];
+  const externalConfigured = (config.external ?? []).length > 0;
   const report = await applyTarget2({
     url: target.url,
     target: target.name,
@@ -272,7 +297,10 @@ nothing to apply
       catalogHash: head.catalogHash,
       reference: built === undefined ? [] : readReference(built.tables, built.casing, head.catalog)
     },
+    ...built !== undefined ? { headHash: startupHash2(built.catalog) } : {},
+    ...externalConfigured ? { restampHead: true } : {},
     ...config.roles !== undefined ? { migrationRole: config.roles.migration, appRole: config.roles.app } : {},
+    ...catalogSchema(config.namespace),
     lintDirectory: directory,
     onProgress: (line) => {
       if (write !== undefined)
@@ -294,35 +322,176 @@ async function pushProject2(cwd, flags) {
   const target = selectTarget(config, flags.target);
   assertTargetPolicy(target, "push", flags.allowProtected);
   const head = await projectHead(cwd);
-  const plan = planMigration({
-    before: head.previous,
-    after: head.catalog,
-    renames: head.renames,
-    name: "push",
-    ...batchSizeField(config.backfill?.batchSize)
-  });
-  if (plan.steps.length === 0)
-    return `target ${target.name}
-no changes
-`;
-  const report = await applyTarget2({
+  assertSnapshots(cwd, config, head.catalog);
+  const catalogHash = startupHash2(head.catalog);
+  const report = await pushTarget({
     url: target.url,
     target: target.name,
     protected: target.protected,
     allowProtected: flags.allowProtected,
     allowPooler: flags.allowPooler || config.allowPooler === true,
     ...backfillTiming2(config.backfill),
-    migrations: [
-      {
-        id: "push",
-        catalogHash: startupHash2(head.catalog),
-        steps: plan.steps
-      }
-    ],
-    ...config.roles !== undefined ? { migrationRole: config.roles.migration, appRole: config.roles.app } : {}
+    after: head.catalog,
+    renames: head.renames,
+    catalogHash,
+    ...config.roles !== undefined ? { migrationRole: config.roles.migration, appRole: config.roles.app, roles: config.roles } : {},
+    ...catalogSchema(config.namespace),
+    ...batchSizeField(config.backfill?.batchSize)
   });
+  if (report.applied.length === 0 && (report.restamped ?? []).length === 0) {
+    return `target ${target.name}
+no changes
+`;
+  }
   return formatReport(report);
 }
+async function pushTarget(request) {
+  assertDirectConnection(request.url, request.allowPooler === true);
+  const url = driverUrl(request.url);
+  const pool = open2({
+    url,
+    max: 1,
+    ...request.searchPath !== undefined ? { searchPath: request.searchPath } : {}
+  });
+  if (pool.reserve === undefined) {
+    await pool.close();
+    throw new OkmError2("invalid", "The driver cannot reserve a connection.", {
+      fix: { summary: "Push needs a driver with interactive transactions." }
+    });
+  }
+  const connection = await pool.reserve();
+  let locked = false;
+  try {
+    await probeStableBackend(request.url, () => backendPid(connection), request.allowPooler === true);
+    await assertStandardStrings(connection);
+    await setTimeouts(connection, {
+      url: request.url,
+      target: request.target,
+      protected: request.protected,
+      migrations: []
+    });
+    await lockTarget(connection, request.target);
+    locked = true;
+    const session = {};
+    const schema = request.schema ?? "public";
+    await enterCatalogSchema(connection, schema);
+    await ensureMigrationTables2((sql) => connection.execute(sql));
+    const history = await readHistory(connection);
+    const pushId = nextSequenceId("push", history.ids);
+    const sql = postgres(url, {
+      max: 1,
+      connect_timeout: 5,
+      idle_timeout: 1,
+      onnotice: () => {},
+      ...schema !== "public" ? { connection: { search_path: schema } } : {}
+    });
+    let planSteps = [];
+    try {
+      const runner = catalogQuery2(sql);
+      if (schema !== "public") {
+        await sql.unsafe(`create schema if not exists ${quoteIdent2(schema)}`);
+        await sql.unsafe(`set search_path to ${quoteIdent2(schema)}`);
+      }
+      const authorViews = await sealViews(runner, request.after);
+      const author = await sealDomainChecks2(runner, authorViews);
+      const live = await introspectSchema(runner, schema, schema, managedRoleOptions2(request.roles));
+      const plan = planMigration({
+        before: live,
+        after: author,
+        renames: request.renames,
+        name: pushId,
+        ...request.schema !== undefined ? { schema: request.schema } : {},
+        ...request.batchSize !== undefined ? { batchSize: request.batchSize } : {}
+      });
+      planSteps = plan.steps;
+    } finally {
+      await finishQuiet(() => sql.end({ timeout: 5 }));
+    }
+    if (planSteps.length === 0) {
+      const stamped = await restampHeadHash(connection, request, pushId, request.catalogHash);
+      await grantAppMeta(connection, request.appRole, session);
+      if (stamped.length === 0) {
+        return { target: request.target, applied: [] };
+      }
+      return { target: request.target, applied: [], restamped: stamped };
+    }
+    const migration = {
+      id: pushId,
+      catalogHash: request.catalogHash,
+      steps: planSteps
+    };
+    await prepareMigrationRole(connection, {
+      url: request.url,
+      target: request.target,
+      protected: request.protected,
+      migrations: [migration],
+      ...request.migrationRole !== undefined ? { migrationRole: request.migrationRole } : {},
+      ...request.schema !== undefined ? { schema: request.schema } : {}
+    }, session);
+    await assertExtensionsAvailable(connection, [migration]);
+    await assertUuidV7Available(connection, [migration]);
+    const units = applyUnits(migration, new Set);
+    const report = await runTarget(connection, {
+      policy: {
+        target: request.target,
+        protected: request.protected,
+        allowProtected: request.allowProtected === true
+      },
+      units,
+      retries: DEFAULT_RETRIES,
+      lockTimeoutMs: DEFAULT_LOCK_MS,
+      statementTimeoutMs: DEFAULT_STATEMENT_MS,
+      backfillStatementTimeoutMs: request.backfillStatementTimeoutMs ?? DEFAULT_STATEMENT_MS,
+      ...request.backfillPauseMs !== undefined ? { backfillPauseMs: request.backfillPauseMs } : {},
+      ...request.migrationRole !== undefined ? { migrationRole: request.migrationRole } : {},
+      ...request.schema !== undefined ? { schema: request.schema } : {}
+    }, session);
+    await grantAppMeta(connection, request.appRole, session);
+    return report;
+  } finally {
+    if (locked) {
+      await finishQuiet(() => connection.execute("select pg_advisory_unlock(hashtext($1))", [lockKey(request.target)]));
+    }
+    await finishQuiet(() => connection.release());
+    await finishQuiet(() => pool.close());
+  }
+}
+async function restampHeadHash(connection, request, migrationId, catalogHash) {
+  const present = await connection.execute("select to_regclass('okm_meta') is not null");
+  if (!wireTrue(present.rows[0]?.[0]))
+    return [];
+  const current = await connection.execute("select catalog_hash from okm_meta where id = 'head'");
+  const stored = current.rows[0]?.[0];
+  if (typeof stored === "string" && stored === catalogHash)
+    return [];
+  assertTargetPolicy({ name: request.target, protected: request.protected }, "history-repair", request.allowProtected === true);
+  await connection.execute("begin");
+  try {
+    await connection.execute("insert into okm_history (migration_id, step_index, class, catalog_hash) values ($1, 0, 'expand', $2)", [migrationId, catalogHash]);
+    await connection.execute(`insert into okm_meta (id, catalog_hash, migration_id) values ('head', $1, $2)
+       on conflict (id) do update set catalog_hash = excluded.catalog_hash, migration_id = excluded.migration_id`, [catalogHash, migrationId]);
+    await connection.execute("commit");
+  } catch (error) {
+    await connection.execute("rollback").catch(() => {
+      return;
+    });
+    throw error;
+  }
+  return [migrationId];
+}
+function nextSequenceId(prefix, ids) {
+  const pattern = new RegExp(`^${prefix}-(\\d+)$`);
+  let max = 0;
+  for (const id of ids) {
+    const match = pattern.exec(id);
+    if (match === null)
+      continue;
+    const value = Number(match[1]);
+    if (Number.isFinite(value) && value > max)
+      max = value;
+  }
+  return `${prefix}-${String(max + 1)}`;
+}
 function backfillTiming2(backfill) {
   return {
     ...backfill?.pauseMs !== undefined ? { backfillPauseMs: backfill.pauseMs } : {},
@@ -334,10 +503,11 @@ function formatReport(report) {
 ` : "";
   const restamped = (report.restamped ?? []).map((id) => `restamped ${id}
 `).join("");
-  if (report.applied.length === 0)
+  if (report.applied.length === 0) {
     return `target ${report.target}
 ${role}${restamped}nothing to apply
 `;
+  }
   return `target ${report.target}
 ${role}${restamped}${report.applied.map((id) => `applied ${id}`).join(`
 `)}
@@ -514,6 +684,17 @@ async function insertReference(connection, request) {
 function concreteSchema(request) {
   return request.searchPath ?? request.schema ?? "public";
 }
+function catalogSchema(namespace) {
+  if (namespace === undefined || namespace === "public")
+    return;
+  return { schema: namespace };
+}
+async function enterCatalogSchema(connection, schema) {
+  if (schema === "public")
+    return;
+  await connection.execute(`create schema if not exists ${quoteIdent2(schema)}`);
+  await connection.execute(`set search_path to ${quoteIdent2(schema)}`);
+}
 async function targetState(connection) {
   const meta = await connection.execute(`select to_regclass('okm_meta') is not null
          or to_regclass('okm_history') is not null

package/dist/shared/{mnvjvqyp.js → 8p2bgye0.js}

@@ -1,13 +1,18 @@
 import {
   serializeCatalog2
 } from "./12z7aznj.js";
+import {
+  quoteIdent2,
+  qualify2
+} from "./fk9vef30.js";
 import {
   roleExists
-} from "./kj9d8maq.js";
+} from "./6xqvesa5.js";
 import {
   canonicalTypeName,
   createdRoleName,
   createRoleOnce,
+  changesRole,
   DEFAULT_BACKFILL_PAUSE_MS,
   DEFAULT_BACKFILL_STATEMENT_TIMEOUT_MS,
   boundaryQuery,
@@ -16,14 +21,10 @@ import {
   planMigration,
   sessionFailure,
   assertTargetPolicy
-} from "./dpc2r7rb.js";
+} from "./bdekbvmt.js";
 import {
   snakeCase
-} from "./gcefca6p.js";
-import {
-  quoteIdent,
-  qualify
-} from "./sjk86yrx.js";
+} from "./f9t9g54z.js";
 import {
   catalog,
   isDomain
@@ -70,21 +71,97 @@ async function runTarget(connection, run, session) {
 async function assumeRole(connection, role, session) {
   if (session.setRole === role)
     return;
-  await connection.execute(`set role ${quoteIdent(role)}`);
+  await ensureSetOption(connection, role);
+  await connection.execute(`set role ${quoteIdent2(role)}`);
   session.setRole = role;
 }
+async function ensureSetOption(connection, role) {
+  const who = await connection.execute("select current_user, rolsuper from pg_roles where rolname = current_user");
+  const current = who.rows[0]?.[0];
+  if (typeof current !== "string" || current === role)
+    return;
+  if (roleFlag(who.rows[0]?.[1]))
+    return;
+  const version = await connection.execute("show server_version_num");
+  const versionNum = Number(version.rows[0]?.[0] ?? 0);
+  if (Number.isFinite(versionNum) && versionNum >= 160000) {
+    const option = await connection.execute(`select am.set_option
+         from pg_auth_members am
+         join pg_roles r on r.oid = am.roleid
+         join pg_roles m on m.oid = am.member
+        where r.rolname = $1 and m.rolname = $2`, [role, current]);
+    if (roleFlag(option.rows[0]?.[0]))
+      return;
+    await connection.execute(`grant ${quoteIdent2(role)} to ${quoteIdent2(current)} with set true`);
+    return;
+  }
+  const member = await connection.execute("select pg_has_role($1, $2, 'MEMBER')", [current, role]);
+  if (roleFlag(member.rows[0]?.[0]))
+    return;
+  await connection.execute(`grant ${quoteIdent2(role)} to ${quoteIdent2(current)}`);
+}
+function rolePrivilegeError(error, role) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (/permission denied to create role/i.test(message)) {
+    return new OkmError2("forbidden", "CREATEROLE is required to create roles. Nothing was changed.", {
+      kind: "forbidden",
+      cause: error,
+      fix: {
+        summary: "Grant CREATEROLE to the connecting role, or connect as a superuser."
+      }
+    });
+  }
+  if (/permission denied to set role/i.test(message)) {
+    const name = role ?? "the migration role";
+    return new OkmError2("forbidden", `Cannot SET ROLE ${name}: the connecting role lacks the SET option on that membership.`, {
+      kind: "forbidden",
+      cause: error,
+      fix: {
+        summary: `Grant ${name} to the connecting role (WITH SET TRUE on Postgres 16+), or connect as a superuser.`
+      }
+    });
+  }
+  if (/must be able to SET ROLE|not a member/i.test(message)) {
+    const name = role ?? "the migration role";
+    return new OkmError2("forbidden", `Cannot SET ROLE ${name}: the connecting role is not a member with the SET option.`, {
+      kind: "forbidden",
+      cause: error,
+      fix: {
+        summary: `Grant ${name} to the connecting role (WITH SET TRUE on Postgres 16+), or connect as a superuser.`
+      }
+    });
+  }
+  return;
+}
 async function grantAppMeta(connection, role, session) {
   if (role === undefined)
     return;
   const previous = session.setRole;
   if (previous !== undefined)
     await connection.execute("reset role");
-  await connection.execute(`grant select on okm_meta to ${quoteIdent(role)}`);
+  await connection.execute(`grant select on okm_meta to ${quoteIdent2(role)}`);
   if (previous !== undefined)
-    await connection.execute(`set role ${quoteIdent(previous)}`);
+    await connection.execute(`set role ${quoteIdent2(previous)}`);
 }
 async function grantSchema(connection, schema, role) {
-  await connection.execute(`grant usage, create on schema ${quoteIdent(schema)} to ${quoteIdent(role)}`);
+  await connection.execute(`grant usage, create on schema ${quoteIdent2(schema)} to ${quoteIdent2(role)}`);
+}
+async function ownSchema(connection, schema, role) {
+  await ensureSetOption(connection, role);
+  await connection.execute("savepoint okm_own_schema");
+  try {
+    const database = await databaseName(connection);
+    await connection.execute(`grant create on database ${quoteIdent2(database)} to ${quoteIdent2(role)}`);
+    await connection.execute(`alter schema ${quoteIdent2(schema)} owner to ${quoteIdent2(role)}`);
+    await connection.execute("release savepoint okm_own_schema");
+  } catch {
+    await connection.execute("rollback to savepoint okm_own_schema");
+  }
+}
+async function databaseName(connection) {
+  const result = await connection.execute("select current_database()");
+  const name = result.rows[0]?.[0];
+  return typeof name === "string" ? name : "postgres";
 }
 async function runUnit(connection, unit, run, session) {
   const only = unit.steps.length === 1 ? unit.steps[0] : undefined;
@@ -102,6 +179,9 @@ async function runUnit(connection, unit, run, session) {
       }
       for (const item of unit.steps) {
         current = item.index;
+        if (run.migrationRole !== undefined && !changesRole(item.step.sql) && session.setRole !== run.migrationRole && await roleExists(connection, run.migrationRole)) {
+          await assumeRole(connection, run.migrationRole, session);
+        }
         await rebuildInvalidIndex(connection, item.step.sql);
         const created = createdRoleName(item.step.sql);
         const existed = created !== undefined && await roleExists(connection, created);
@@ -110,12 +190,10 @@ async function runUnit(connection, unit, run, session) {
           await assertSchemaUsageLanded(connection, item.step.sql);
         } else if (!existed)
           await connection.execute(createRoleOnce(item.step.sql));
-        if (created !== undefined && created === run.migrationRole) {
-          if (!existed) {
-            await grantSchema(connection, run.schema ?? "public", created);
-            await connection.execute(`grant select, insert, update on okm_meta, okm_history, okm_backfill to ${quoteIdent(created)}`);
-          }
-          await assumeRole(connection, created, session);
+        if (created !== undefined && created === run.migrationRole && !existed) {
+          await grantSchema(connection, run.schema ?? "public", created);
+          await ownSchema(connection, run.schema ?? "public", created);
+          await connection.execute(`grant select, insert, update on okm_meta, okm_history, okm_backfill to ${quoteIdent2(created)}`);
         }
         if (!unit.transactional) {
           await connection.execute("begin");
@@ -127,6 +205,9 @@ async function runUnit(connection, unit, run, session) {
           began = false;
         }
       }
+      if (run.migrationRole !== undefined && session.setRole !== run.migrationRole && await roleExists(connection, run.migrationRole)) {
+        await assumeRole(connection, run.migrationRole, session);
+      }
       if (unit.transactional) {
         for (const item of unit.steps)
           await writeStep(connection, unit, item);
@@ -182,7 +263,7 @@ async function runBackfill(connection, unit, item, spec, run) {
       rows,
       lastKey: committed.lastKey
     };
-    run.onProgress?.(`backfill ${unit.migrationId} step ${String(item.index)} batch ${String(batches)} rows ${String(rows)} key ${committed.lastKey ?? "-"}`);
+    run.onProgress?.(`backfill ${unit.migrationId} step ${String(item.index + 1)} batch ${String(batches)} rows ${String(rows)} key ${committed.lastKey ?? "-"}`);
     await run.afterBatch?.(note);
     if (committed.final)
       return;
@@ -305,7 +386,7 @@ async function rebuildInvalidIndex(connection, sql) {
   const valid = found.rows[0]?.[0];
   if (valid === undefined || wireTrue(valid))
     return;
-  await connection.execute(`drop index concurrently if exists ${quoteIdent(name)}`);
+  await connection.execute(`drop index concurrently if exists ${quoteIdent2(name)}`);
 }
 function concurrentIndexName(sql) {
   const match = /^create\s+(?:unique\s+)?index\s+concurrently\s+(?:if\s+not\s+exists\s+)?(?:"([^"]+)"|([A-Za-z_][\w$]*))/i.exec(sql.trim());
@@ -325,13 +406,12 @@ async function assertSchemaUsageLanded(connection, sql) {
        join pg_roles r on r.oid = a.grantee
        where n.nspname = $1 and r.rolname = $2 and a.privilege_type = 'USAGE'
      )`, [schema, role]);
-  const landed = found.rows[0]?.[0];
-  if (landed === "t" || landed === "true")
+  if (roleFlag(found.rows[0]?.[0]))
     return;
   throw new OkmError2("OKM1825", `Grant usage on schema ${schema} to ${role} did not take effect.`, {
     kind: "forbidden",
     fix: {
-      summary: `Make the migration role the owner of schema ${schema}. ALTER SCHEMA ${quoteIdent(schema)} OWNER TO <migration role>.`
+      summary: `Make the migration role the owner of schema ${schema}. ALTER SCHEMA ${quoteIdent2(schema)} OWNER TO <migration role>.`
     }
   });
 }
@@ -340,6 +420,10 @@ function failStep(unit, index, error) {
   if (lost !== undefined) {
     return new OkmError2(lost.code, `Migration ${unit.migrationId} failed at step ${String(index + 1)}: ${lost.message}`, { kind: lost.kind, cause: error, fix: lost.fix });
   }
+  const privilege = rolePrivilegeError(error, undefined);
+  if (privilege !== undefined) {
+    return new OkmError2(privilege.code, `Migration ${unit.migrationId} failed at step ${String(index + 1)}: ${privilege.message}`, { kind: privilege.kind, cause: error, fix: privilege.fix });
+  }
   if (error instanceof OkmError2)
     return error;
   const message = error instanceof Error ? error.message : "The step failed.";
@@ -359,6 +443,9 @@ function isLockTimeout(error) {
 function wireTrue(value) {
   return value === "t" || value === "true";
 }
+function roleFlag(value) {
+  return value === true || value === "t" || value === "true";
+}
 function unquote(token) {
   if (token.startsWith('"') && token.endsWith('"')) {
     return token.slice(1, -1).replaceAll('""', '"');
@@ -423,11 +510,11 @@ function readReference(tables, casing, head) {
 function referenceInserts(tables, schema) {
   const statements = [];
   for (const item of tables) {
-    const conflict = item.key.map((name) => quoteIdent(name)).join(", ");
+    const conflict = item.key.map((name) => quoteIdent2(name)).join(", ");
     for (const row of item.rows) {
-      const columns = row.map(([name]) => quoteIdent(name)).join(", ");
+      const columns = row.map(([name]) => quoteIdent2(name)).join(", ");
       const values = row.map(([, value]) => literal(value)).join(", ");
-      statements.push(`insert into ${qualify(schema, item.table)} (${columns}) values (${values}) on conflict (${conflict}) do nothing`);
+      statements.push(`insert into ${qualify2(schema, item.table)} (${columns}) values (${values}) on conflict (${conflict}) do nothing`);
     }
   }
   return statements;
@@ -598,13 +685,14 @@ async function installSnapshot(connection, head, schema, reference, session, mig
     for (const step of plan.steps) {
       if (step.backfill !== undefined)
         continue;
+      if (migrationRole !== undefined && !changesRole(step.sql) && session.setRole !== migrationRole && await roleExists(connection, migrationRole)) {
+        await flush();
+        await assumeRole(connection, migrationRole, session);
+      }
       const created = createdRoleName(step.sql);
       const existed = created !== undefined && await roleExists(connection, created);
-      if (created !== undefined && existed) {
-        if (created === migrationRole)
-          await assumeRole(connection, created, session);
+      if (created !== undefined && existed)
         continue;
-      }
       const sql = created === undefined ? step.sql : createRoleOnce(step.sql);
       if (step.transactional && !statementOutsideTransaction(step.sql)) {
         batch.push(sql);
@@ -616,10 +704,14 @@ async function installSnapshot(connection, head, schema, reference, session, mig
       if (created !== undefined && created === migrationRole) {
         await flush();
         await grantSchema(connection, schema, created);
-        await connection.execute(`grant select, insert, update on okm_meta, okm_history, okm_backfill to ${quoteIdent(created)}`);
-        await assumeRole(connection, created, session);
+        await ownSchema(connection, schema, created);
+        await connection.execute(`grant select, insert, update on okm_meta, okm_history, okm_backfill to ${quoteIdent2(created)}`);
       }
     }
+    if (migrationRole !== undefined && session.setRole !== migrationRole && await roleExists(connection, migrationRole)) {
+      await flush();
+      await assumeRole(connection, migrationRole, session);
+    }
     await flush();
     for (const sql of referenceInserts(reference, schema)) {
       if (!began) {
@@ -754,4 +846,4 @@ function normaliseFunction(object) {
   };
 }
 
-export { runTarget, assumeRole, grantAppMeta, grantSchema, assertSchemaUsageLanded, statementOutsideTransaction, readReference, referenceInserts, catalogsEqual, provisionMark, expandProvisioned, provisionHistoryIsKnown, installSnapshot, snapshotDifference };
+export { runTarget, assumeRole, grantAppMeta, grantSchema, ownSchema, assertSchemaUsageLanded, statementOutsideTransaction, readReference, referenceInserts, catalogsEqual, provisionMark, expandProvisioned, provisionHistoryIsKnown, installSnapshot, snapshotDifference };