okmodel 0.9.0 → 0.9.1

package/dist/tooling/migrate/drift.d.ts

@@ -19,6 +19,18 @@ import type { RolesInput } from "../../dialects/pg/role/index.js";
  * @param roles - `defineConfig({ roles })`, when set
  */
 export declare function assertAuthorDrift(url: string, author: Catalog, roles?: RolesInput, allowPooler?: boolean): Promise<void>;
+/**
+ * Reprints each domain check the way this server stores it.
+ *
+ * Author spellings such as `VALUE > 0` become `((VALUE > 0))`, so a plan
+ * against a live catalog does not treat the reprint as a permanent change.
+ * The catalog hash still uses the author text (B-37).
+ *
+ * @param runner - Database connection
+ * @param source - Catalog whose domain checks may still be author SQL
+ * @returns A catalog whose domain checks carry the server reprint
+ */
+export declare function sealDomainChecks(runner: CatalogQuery, source: Catalog): Promise<Catalog>;
 /**
  * Turns a postgres.js handle into the query shape introspection uses.
  *

package/dist/tooling/migrate/driver-url.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Connection URL helpers for migrate commands.
+ *
+ * Pooler client hints in the query string are not Postgres startup parameters.
+ * Every migrate path that opens a driver must strip those hints first. The
+ * URL guard still reads `pgbouncer=true` on the original URL before this runs.
+ */
+/**
+ * Removes the `pgbouncer` query parameter before a driver opens a connection.
+ *
+ * Other pooler hints in the URL are left alone: this version does not
+ * interpret them.
+ *
+ * @param url - A `postgres://` or `postgresql://` URL
+ * @returns The same URL without `pgbouncer` in the query string
+ */
+export declare function driverUrl(url: string): string;

package/dist/tooling/migrate/index.js

@@ -3,17 +3,19 @@ import {
   parseCatalog2
 } from "../../shared/12z7aznj.js";
 import"../../shared/fk9vef30.js";
-import"../../shared/dd5pmnky.js";
+import"../../shared/jvxcp1qk.js";
 import"../../shared/n442h54c.js";
+import"../../shared/4pkz5nvw.js";
 import {
   applyTarget2,
   backfillTiming2
-} from "../../shared/ccsmhv9r.js";
+} from "../../shared/8ma6drzr.js";
 import {
   readReference
-} from "../../shared/3456242y.js";
-import"../../shared/jpybhf98.js";
-import"../../shared/myk8fswx.js";
+} from "../../shared/8p2bgye0.js";
+import"../../shared/6xqvesa5.js";
+import"../../shared/e1c55v04.js";
+import"../../shared/mz48rs74.js";
 import {
   projectPath,
   LOGICAL_FORMAT,
@@ -21,11 +23,11 @@ import {
   loadHeadSnapshot,
   loadBuiltSchema,
   loadConfig
-} from "../../shared/2zdxkt7b.js";
+} from "../../shared/wp7y8q3y.js";
 import {
   assertTargetPolicy,
   selectTarget
-} from "../../shared/6nae0spm.js";
+} from "../../shared/bdekbvmt.js";
 import {
   canonicalJson
 } from "../../shared/358zsv4r.js";

package/dist/tooling/migrate/policy.d.ts

@@ -56,17 +56,29 @@ export declare function assertTargetAlias(targets: readonly TargetRecord[]): voi
  * @param allowPooler - The invocation opted in
  */
 export declare function assertDirectConnection(url: string, allowPooler: boolean): void;
+/** Options for {@link assertStableBackend}. */
+export type StableBackendOptions = {
+    /**
+     * Holds another backend between pid reads so a LIFO transaction-mode
+     * pooler cannot hand the next read the same server. Resolves to a release
+     * function that ends the hold.
+     */
+    readonly holdBackend?: () => Promise<() => Promise<void>>;
+};
 /**
- * Refuses a session whose backend pid changes between two statements.
+ * Refuses a session whose backend pid changes across eight statements.
  *
- * The two reads are separate round trips and are not wrapped in a
- * transaction. A transaction-mode pooler can hand back a different backend
- * for the second one. `--allow-pooler` skips the probe.
+ * The reads are separate round trips and are not wrapped in a transaction.
+ * A transaction-mode pooler can hand back a different backend. Two reads
+ * miss a default PgBouncer with `server_round_robin=0` (LIFO); eight reads
+ * plus an optional hold between them catch that case. A direct session
+ * keeps one pid. `--allow-pooler` skips the probe.
  *
  * @param readPid - Reads `pg_backend_pid()` on the session under test
  * @param allowPooler - The invocation opted in
+ * @param options - Optional hold used by the migrate warm-and-hold probe
  */
-export declare function assertStableBackend(readPid: () => Promise<string>, allowPooler: boolean): Promise<void>;
+export declare function assertStableBackend(readPid: () => Promise<string>, allowPooler: boolean, options?: StableBackendOptions): Promise<void>;
 /**
  * Lists configured targets.
  *

package/dist/tooling/migrate/pooler-probe.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Pid probe for transaction-mode poolers (B-41).
+ *
+ * Eight separate `pg_backend_pid()` reads on the caller's session. Two or
+ * more distinct pids mean a pooler handed out a new backend. A direct
+ * session keeps one pid.
+ *
+ * Warm-and-hold for LIFO PgBouncer (`server_round_robin=0`) needs extra
+ * connections and deadlocks a single-connection target (PGlite wire) when
+ * apply/seed already hold `max: 1`. That path stays in the PgBouncer test
+ * via {@link holdBackendBetweenReads}; production keeps URL heuristics plus
+ * these eight reads.
+ */
+import { type StableBackendOptions } from "./policy.js";
+/**
+ * Refuses a session whose backend pid changes across eight reads.
+ *
+ * @param _url - Target URL (unused; kept for call-site stability)
+ * @param readPid - Reads `pg_backend_pid()` on the session under test
+ * @param allowPooler - The invocation opted in
+ * @param options - Optional hold between reads (PgBouncer tests)
+ */
+export declare function probeStableBackend(_url: string, readPid: () => Promise<string>, allowPooler: boolean, options?: StableBackendOptions): Promise<void>;

package/dist/tooling/migrate/pull.d.ts

@@ -56,6 +56,9 @@ export declare function pullLayout(cwd: string, schema: string, tables: string |
 /**
  * Refuses an existing file, writes the rest, and formats them.
  *
+ * When `oxfmt` is missing or fails, the files stay as written and a notice is
+ * printed on stderr. The pull or import report still returns.
+ *
  * @param files - Files from {@link emitPull}
  * @param verb - `Pull` or `Import`, named in OKM1855
  */

package/dist/tooling/migrate/runner.d.ts

@@ -7,6 +7,7 @@
  * `okm_backfill` after each commit.
  */
 import type { DriverConnection } from "../../contracts/driver.js";
+import { OkmError } from "../../contracts/error.js";
 import type { PlanStep } from "./plan.js";
 /** One step with its index in the migration file. */
 export type RunnableStep = {
@@ -79,7 +80,9 @@ export declare function runTarget(connection: DriverConnection, run: TargetRun,
 /**
  * Assumes `role` for the rest of this connection.
  *
- * A second call with the same role does nothing.
+ * A second call with the same role does nothing. A non-superuser that created
+ * the role with `CREATEROLE` is granted membership first: Postgres 15 creates
+ * no membership row, and Postgres 16+ grants `ADMIN` without `SET`.
  *
  * @param connection - Reserved connection
  * @param role - Migration role
@@ -88,6 +91,15 @@ export declare function runTarget(connection: DriverConnection, run: TargetRun,
 export declare function assumeRole(connection: DriverConnection, role: string, session: {
     setRole?: string;
 }): Promise<void>;
+/**
+ * Maps a Postgres role-privilege refusal to a clear `OkmError`.
+ *
+ * @param error - Driver failure
+ * @param role - Role named in the step, when known
+ * @returns A forbidden error that names CREATEROLE or the SET option, or
+ *   `undefined` when the failure is something else
+ */
+export declare function rolePrivilegeError(error: unknown, role?: string): OkmError | undefined;
 /**
  * Lets a new migration role create objects in `schema`.
  *
@@ -110,6 +122,17 @@ export declare function grantAppMeta(connection: DriverConnection, role: string
     setRole?: string;
 }): Promise<void>;
 export declare function grantSchema(connection: DriverConnection, schema: string, role: string): Promise<void>;
+/**
+ * Makes `role` the owner of `schema` when the connecting role can.
+ *
+ * Grants on the schema to reporting and other roles need the migration role
+ * to own it. A connecting role that is not the owner leaves the schema as is.
+ *
+ * @param connection - Reserved connection, before `SET ROLE`
+ * @param schema - Schema the migration writes
+ * @param role - Migration role that was just created
+ */
+export declare function ownSchema(connection: DriverConnection, schema: string, role: string): Promise<void>;
 /**
  * Fails when `GRANT USAGE ON SCHEMA` did not add the role.
  *

package/dist/tooling/shared/{0j0jtse1.js → 09a6vsys.js}

@@ -1,6 +1,6 @@
 import {
   fail2
-} from "./hfq3n3bd.js";
+} from "./2jdn09e2.js";
 
 // src/runtime/result-name.ts
 var PROTOTYPE_KEYS = ",__proto__,constructor,toString,hasOwnProperty,valueOf,isPrototypeOf,propertyIsEnumerable,toLocaleString,__defineGetter__,__defineSetter__,__lookupGetter__,__lookupSetter__,then,";

package/dist/tooling/shared/{68tf18v4.js → 0v9ptnxp.js}

@@ -1,20 +1,20 @@
 import {
-  open5,
-  connectClient3,
-  send4
-} from "./am04v8na.js";
+  open2,
+  connectClient2,
+  send2
+} from "./4ec0nxvw.js";
 import {
   NEON_WEBSOCKET_CAPABILITIES,
   NEON_HTTP_CAPABILITIES,
   readCapability2,
   hasCapability2
-} from "./5x3pf400.js";
+} from "./ry2f3w8p.js";
 export {
   NEON_WEBSOCKET_CAPABILITIES as capabilities,
-  connectClient3 as connectClient,
+  connectClient2 as connectClient,
   hasCapability2 as hasCapability,
   NEON_HTTP_CAPABILITIES as httpCapabilities,
-  open5 as open,
+  open2 as open,
   readCapability2 as readCapability,
-  send4 as send
+  send2 as send
 };

package/dist/tooling/shared/{qartgazh.js → 0wtzps9p.js}

@@ -1,11 +1,11 @@
 import {
   OkmError,
   catalogFileText2
-} from "./hfq3n3bd.js";
+} from "./2jdn09e2.js";
 import {
   artifactDir,
   readText
-} from "./dhatassp.js";
+} from "./8g0m0rvd.js";
 
 // src/runtime/drift.ts
 async function assertCompatible(pool, schema, recordedHash, source, options, namespace = "public") {
@@ -16,7 +16,7 @@ async function assertCompatible(pool, schema, recordedHash, source, options, nam
   if (code.artifact !== undefined) {
     const artifact = code.artifact;
     await loadOnce(`text\x00${artifact.hash}`, async () => {
-      const { loadTrustedCatalog } = await import("./yb4kd19s.js");
+      const { loadTrustedCatalog } = await import("./2v4nwnkb.js");
       loadTrustedCatalog(artifact.text, artifact.hash);
     });
   } else if (code.fromFile) {
@@ -30,11 +30,11 @@ async function assertCompatible(pool, schema, recordedHash, source, options, nam
           }
         });
       }
-      const { loadTrustedCatalog } = await import("./yb4kd19s.js");
+      const { loadTrustedCatalog } = await import("./2v4nwnkb.js");
       loadTrustedCatalog(text, code.hash);
     });
   }
-  const { assertDrift } = await import("./6vk28rjp.js");
+  const { assertDrift } = await import("./vg68k11z.js");
   await assertDrift(pool, code.hash, recordedHash, options, namespace);
 }
 async function codeHash(schema, source) {
@@ -44,7 +44,7 @@ async function codeHash(schema, source) {
   const listed = await readHashFile(source.catalogDir);
   if (listed !== undefined)
     return { hash: listed, fromFile: true };
-  const { catalogHash } = await import("./yb4kd19s.js");
+  const { catalogHash } = await import("./2v4nwnkb.js");
   return { hash: catalogHash(schemaCatalog(schema)), fromFile: false };
 }
 function schemaCatalog(schema) {

package/dist/tooling/shared/{1800eymw.js → 0yhf1db4.js}

@@ -1,22 +1,22 @@
 import {
   markClientPool2,
-  open2
-} from "./rcywj2w8.js";
+  open3
+} from "./3f6etb9z.js";
 import {
   createClient
-} from "./jr2nmr81.js";
+} from "./gjj71hfh.js";
 
 // src/runtime/pg/bun.ts
 function connect(target, options) {
   if (typeof target === "object" && !isPool(target)) {
-    return import("./kbqnrs1x.js").then((mod) => mod.default(target, options, (config) => {
-      const pool = open2(config);
+    return import("./bt3tjemb.js").then((mod) => mod.default(target, options, (config) => {
+      const pool = open3(config);
       markClientPool2(pool);
       return pool;
     }));
   }
   const owned = !isPool(target);
-  const pool = isPool(target) ? target : open2({
+  const pool = isPool(target) ? target : open3({
     url: target,
     ...options.max !== undefined ? { max: options.max } : {},
     ...options.timeouts !== undefined ? { timeouts: options.timeouts } : {},

package/dist/tooling/shared/{s6qha57m.js → 19msgrsc.js}

@@ -1,12 +1,12 @@
 import {
   open6,
   seal2
-} from "./t6zjeake.js";
+} from "./xn6p01fh.js";
 import {
   PGLITE_CAPABILITIES,
   readCapability2,
   hasCapability2
-} from "./5x3pf400.js";
+} from "./ry2f3w8p.js";
 export {
   PGLITE_CAPABILITIES as capabilities,
   hasCapability2 as hasCapability,

package/dist/tooling/shared/{3yn79q5m.js → 1fwfm5m3.js}

@@ -1,6 +1,6 @@
 import {
   rejectUncancellable
-} from "./5x3pf400.js";
+} from "./ry2f3w8p.js";
 
 // src/adapters/pg/no-inflight-timeout.ts
 function noTimeout(options) {

package/dist/tooling/shared/{hfq3n3bd.js → 2jdn09e2.js}

@@ -531,7 +531,7 @@ function mapPostgresError2(error, options) {
     return error;
   if (!isDriverError2(error))
     return OkmError.from(error);
-  const search = searchInputError(error);
+  const search = searchInputError(error, options);
   if (search !== undefined)
     return search;
   const kind = kindOf(error);
@@ -540,6 +540,7 @@ function mapPostgresError2(error, options) {
   const fieldReason = hint?.reason ?? (kind === "not_null" ? "not_null" : reasonOf(kind, error.table, error.constraint, columns, options?.schema));
   const values = options?.includeValues === true ? valuesOf(error.detail, columns) : undefined;
   const code = kind === "outcome_unknown" ? "OKM1401" : kind;
+  const redactCause = options?.includeValues !== true && needsSafeCause(options?.schema, error.table, columns);
   return new OkmError(code, summaryOf(kind, error, columns, fieldReason), {
     kind,
     fieldReason,
@@ -549,11 +550,59 @@ function mapPostgresError2(error, options) {
     ...error.constraint !== undefined ? { constraint: error.constraint } : {},
     ...error.sqlstate !== undefined ? { sqlstate: error.sqlstate } : {},
     batchIndex: error.batchIndex,
-    cause: error.cause ?? error,
+    cause: redactCause ? safeCause(error) : error.cause ?? error,
     ...options?.includeValues === true && values !== undefined ? { includeValues: true, values } : {},
     ...options?.http !== undefined ? { http: options.http } : {}
   });
 }
+function needsSafeCause(schema, table, columns) {
+  if (schema === undefined)
+    return false;
+  const model = modelForTable(schema, table);
+  if (model !== undefined && model.columns.some((column) => column.sensitive === true)) {
+    return true;
+  }
+  if (columns.length === 0)
+    return false;
+  for (const item of Object.values(schema.model)) {
+    for (const column of item.columns) {
+      if (column.sensitive !== true)
+        continue;
+      for (const name of columns) {
+        if (column.sql === name || column.field === name)
+          return true;
+      }
+    }
+  }
+  return false;
+}
+function safeCause(error) {
+  const out = { name: "DriverError" };
+  if (error.sqlstate !== undefined)
+    out.sqlstate = error.sqlstate;
+  if (error.constraint !== undefined)
+    out.constraint = error.constraint;
+  if (error.table !== undefined)
+    out.table = error.table;
+  if (error.column !== undefined)
+    out.column = error.column;
+  const nested = error.cause;
+  if (typeof nested === "object" && nested !== null) {
+    const code = Reflect.get(nested, "code");
+    if (typeof code === "string" && code.length > 0 && code.length <= 64)
+      out.code = code;
+  }
+  return out;
+}
+function modelForTable(schema, table) {
+  if (table === undefined)
+    return;
+  for (const item of Object.values(schema.model)) {
+    if (item.sql === table)
+      return item;
+  }
+  return schema.model[table];
+}
 var TLS_CODE = /^(ERR_TLS_|ERR_POSTGRES_TLS_|SELF_SIGNED_CERT_|DEPTH_ZERO_SELF_SIGNED_CERT$|UNABLE_TO_VERIFY_LEAF_SIGNATURE$)/;
 function isTlsFailure(error) {
   const cause = error.cause;
@@ -572,14 +621,15 @@ function searchQuery(error) {
   const query = Reflect.get(cause, "query");
   return typeof query === "string" && query.includes("to_tsquery");
 }
-function searchInputError(error) {
+function searchInputError(error, options) {
   const sqlstate = error.sqlstate;
   const message = error.message;
+  const cause = options?.includeValues !== true && needsSafeCause(options?.schema, error.table, columnsOf(error)) ? safeCause(error) : error.cause ?? error;
   if (sqlstate === "42601" && (message.includes("tsquery") || searchQuery(error))) {
     return new OkmError("OKM1120", `Search input is not valid. ${stripRowValues(message)}`, {
       kind: "invalid",
       sqlstate,
-      cause: error.cause ?? error,
+      cause,
       fix: { summary: "Fix the advanced search text, or use natural, all-words, or phrase." }
     });
   }
@@ -587,7 +637,7 @@ function searchInputError(error) {
     return new OkmError("OKM1122", stripRowValues(message), {
       kind: "invalid",
       sqlstate,
-      cause: error.cause ?? error,
+      cause,
       fix: {
         summary: "Use a text search configuration that exists, such as english, or omit language."
       }

package/dist/tooling/shared/{v6j1ep6w.js → 2qrte2ct.js}

@@ -1,17 +1,17 @@
 import {
-  open4
-} from "./asgr07mp.js";
+  open5
+} from "./ppybjw50.js";
 import {
   createClient
-} from "./jr2nmr81.js";
+} from "./gjj71hfh.js";
 
 // src/runtime/pg/pg.ts
 function connect(target, options) {
   if (typeof target === "object" && !isPool(target)) {
-    return import("./kbqnrs1x.js").then((mod) => mod.default(target, options, open4));
+    return import("./bt3tjemb.js").then((mod) => mod.default(target, options, open5));
   }
   const owned = !isPool(target);
-  const pool = isPool(target) ? target : open4({
+  const pool = isPool(target) ? target : open5({
     url: target,
     ...options.max !== undefined ? { max: options.max } : {},
     ...options.timeouts !== undefined ? { timeouts: options.timeouts } : {},

package/dist/tooling/shared/{yb4kd19s.js → 2v4nwnkb.js}

@@ -3,7 +3,7 @@ import {
   catalogHash2,
   loadTrustedCatalog2,
   catalogFileText2
-} from "./hfq3n3bd.js";
+} from "./2jdn09e2.js";
 export {
   catalogFileText2 as catalogFileText,
   catalogHash2 as catalogHash,