okmodel 0.9.0 → 0.9.1

package/dist/shared/{3456242y.js → 8p2bgye0.js}

@@ -7,11 +7,12 @@ import {
 } from "./fk9vef30.js";
 import {
   roleExists
-} from "./jpybhf98.js";
+} from "./6xqvesa5.js";
 import {
   canonicalTypeName,
   createdRoleName,
   createRoleOnce,
+  changesRole,
   DEFAULT_BACKFILL_PAUSE_MS,
   DEFAULT_BACKFILL_STATEMENT_TIMEOUT_MS,
   boundaryQuery,
@@ -20,10 +21,10 @@ import {
   planMigration,
   sessionFailure,
   assertTargetPolicy
-} from "./6nae0spm.js";
+} from "./bdekbvmt.js";
 import {
   snakeCase
-} from "./gcefca6p.js";
+} from "./f9t9g54z.js";
 import {
   catalog,
   isDomain
@@ -70,9 +71,68 @@ async function runTarget(connection, run, session) {
 async function assumeRole(connection, role, session) {
   if (session.setRole === role)
     return;
+  await ensureSetOption(connection, role);
   await connection.execute(`set role ${quoteIdent2(role)}`);
   session.setRole = role;
 }
+async function ensureSetOption(connection, role) {
+  const who = await connection.execute("select current_user, rolsuper from pg_roles where rolname = current_user");
+  const current = who.rows[0]?.[0];
+  if (typeof current !== "string" || current === role)
+    return;
+  if (roleFlag(who.rows[0]?.[1]))
+    return;
+  const version = await connection.execute("show server_version_num");
+  const versionNum = Number(version.rows[0]?.[0] ?? 0);
+  if (Number.isFinite(versionNum) && versionNum >= 160000) {
+    const option = await connection.execute(`select am.set_option
+         from pg_auth_members am
+         join pg_roles r on r.oid = am.roleid
+         join pg_roles m on m.oid = am.member
+        where r.rolname = $1 and m.rolname = $2`, [role, current]);
+    if (roleFlag(option.rows[0]?.[0]))
+      return;
+    await connection.execute(`grant ${quoteIdent2(role)} to ${quoteIdent2(current)} with set true`);
+    return;
+  }
+  const member = await connection.execute("select pg_has_role($1, $2, 'MEMBER')", [current, role]);
+  if (roleFlag(member.rows[0]?.[0]))
+    return;
+  await connection.execute(`grant ${quoteIdent2(role)} to ${quoteIdent2(current)}`);
+}
+function rolePrivilegeError(error, role) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (/permission denied to create role/i.test(message)) {
+    return new OkmError2("forbidden", "CREATEROLE is required to create roles. Nothing was changed.", {
+      kind: "forbidden",
+      cause: error,
+      fix: {
+        summary: "Grant CREATEROLE to the connecting role, or connect as a superuser."
+      }
+    });
+  }
+  if (/permission denied to set role/i.test(message)) {
+    const name = role ?? "the migration role";
+    return new OkmError2("forbidden", `Cannot SET ROLE ${name}: the connecting role lacks the SET option on that membership.`, {
+      kind: "forbidden",
+      cause: error,
+      fix: {
+        summary: `Grant ${name} to the connecting role (WITH SET TRUE on Postgres 16+), or connect as a superuser.`
+      }
+    });
+  }
+  if (/must be able to SET ROLE|not a member/i.test(message)) {
+    const name = role ?? "the migration role";
+    return new OkmError2("forbidden", `Cannot SET ROLE ${name}: the connecting role is not a member with the SET option.`, {
+      kind: "forbidden",
+      cause: error,
+      fix: {
+        summary: `Grant ${name} to the connecting role (WITH SET TRUE on Postgres 16+), or connect as a superuser.`
+      }
+    });
+  }
+  return;
+}
 async function grantAppMeta(connection, role, session) {
   if (role === undefined)
     return;
@@ -86,6 +146,23 @@ async function grantAppMeta(connection, role, session) {
 async function grantSchema(connection, schema, role) {
   await connection.execute(`grant usage, create on schema ${quoteIdent2(schema)} to ${quoteIdent2(role)}`);
 }
+async function ownSchema(connection, schema, role) {
+  await ensureSetOption(connection, role);
+  await connection.execute("savepoint okm_own_schema");
+  try {
+    const database = await databaseName(connection);
+    await connection.execute(`grant create on database ${quoteIdent2(database)} to ${quoteIdent2(role)}`);
+    await connection.execute(`alter schema ${quoteIdent2(schema)} owner to ${quoteIdent2(role)}`);
+    await connection.execute("release savepoint okm_own_schema");
+  } catch {
+    await connection.execute("rollback to savepoint okm_own_schema");
+  }
+}
+async function databaseName(connection) {
+  const result = await connection.execute("select current_database()");
+  const name = result.rows[0]?.[0];
+  return typeof name === "string" ? name : "postgres";
+}
 async function runUnit(connection, unit, run, session) {
   const only = unit.steps.length === 1 ? unit.steps[0] : undefined;
   if (only?.step.backfill !== undefined) {
@@ -102,6 +179,9 @@ async function runUnit(connection, unit, run, session) {
       }
       for (const item of unit.steps) {
         current = item.index;
+        if (run.migrationRole !== undefined && !changesRole(item.step.sql) && session.setRole !== run.migrationRole && await roleExists(connection, run.migrationRole)) {
+          await assumeRole(connection, run.migrationRole, session);
+        }
         await rebuildInvalidIndex(connection, item.step.sql);
         const created = createdRoleName(item.step.sql);
         const existed = created !== undefined && await roleExists(connection, created);
@@ -110,12 +190,10 @@ async function runUnit(connection, unit, run, session) {
           await assertSchemaUsageLanded(connection, item.step.sql);
         } else if (!existed)
           await connection.execute(createRoleOnce(item.step.sql));
-        if (created !== undefined && created === run.migrationRole) {
-          if (!existed) {
-            await grantSchema(connection, run.schema ?? "public", created);
-            await connection.execute(`grant select, insert, update on okm_meta, okm_history, okm_backfill to ${quoteIdent2(created)}`);
-          }
-          await assumeRole(connection, created, session);
+        if (created !== undefined && created === run.migrationRole && !existed) {
+          await grantSchema(connection, run.schema ?? "public", created);
+          await ownSchema(connection, run.schema ?? "public", created);
+          await connection.execute(`grant select, insert, update on okm_meta, okm_history, okm_backfill to ${quoteIdent2(created)}`);
         }
         if (!unit.transactional) {
           await connection.execute("begin");
@@ -127,6 +205,9 @@ async function runUnit(connection, unit, run, session) {
           began = false;
         }
       }
+      if (run.migrationRole !== undefined && session.setRole !== run.migrationRole && await roleExists(connection, run.migrationRole)) {
+        await assumeRole(connection, run.migrationRole, session);
+      }
       if (unit.transactional) {
         for (const item of unit.steps)
           await writeStep(connection, unit, item);
@@ -182,7 +263,7 @@ async function runBackfill(connection, unit, item, spec, run) {
       rows,
       lastKey: committed.lastKey
     };
-    run.onProgress?.(`backfill ${unit.migrationId} step ${String(item.index)} batch ${String(batches)} rows ${String(rows)} key ${committed.lastKey ?? "-"}`);
+    run.onProgress?.(`backfill ${unit.migrationId} step ${String(item.index + 1)} batch ${String(batches)} rows ${String(rows)} key ${committed.lastKey ?? "-"}`);
     await run.afterBatch?.(note);
     if (committed.final)
       return;
@@ -325,8 +406,7 @@ async function assertSchemaUsageLanded(connection, sql) {
        join pg_roles r on r.oid = a.grantee
        where n.nspname = $1 and r.rolname = $2 and a.privilege_type = 'USAGE'
      )`, [schema, role]);
-  const landed = found.rows[0]?.[0];
-  if (landed === "t" || landed === "true")
+  if (roleFlag(found.rows[0]?.[0]))
     return;
   throw new OkmError2("OKM1825", `Grant usage on schema ${schema} to ${role} did not take effect.`, {
     kind: "forbidden",
@@ -340,6 +420,10 @@ function failStep(unit, index, error) {
   if (lost !== undefined) {
     return new OkmError2(lost.code, `Migration ${unit.migrationId} failed at step ${String(index + 1)}: ${lost.message}`, { kind: lost.kind, cause: error, fix: lost.fix });
   }
+  const privilege = rolePrivilegeError(error, undefined);
+  if (privilege !== undefined) {
+    return new OkmError2(privilege.code, `Migration ${unit.migrationId} failed at step ${String(index + 1)}: ${privilege.message}`, { kind: privilege.kind, cause: error, fix: privilege.fix });
+  }
   if (error instanceof OkmError2)
     return error;
   const message = error instanceof Error ? error.message : "The step failed.";
@@ -359,6 +443,9 @@ function isLockTimeout(error) {
 function wireTrue(value) {
   return value === "t" || value === "true";
 }
+function roleFlag(value) {
+  return value === true || value === "t" || value === "true";
+}
 function unquote(token) {
   if (token.startsWith('"') && token.endsWith('"')) {
     return token.slice(1, -1).replaceAll('""', '"');
@@ -598,13 +685,14 @@ async function installSnapshot(connection, head, schema, reference, session, mig
     for (const step of plan.steps) {
       if (step.backfill !== undefined)
         continue;
+      if (migrationRole !== undefined && !changesRole(step.sql) && session.setRole !== migrationRole && await roleExists(connection, migrationRole)) {
+        await flush();
+        await assumeRole(connection, migrationRole, session);
+      }
       const created = createdRoleName(step.sql);
       const existed = created !== undefined && await roleExists(connection, created);
-      if (created !== undefined && existed) {
-        if (created === migrationRole)
-          await assumeRole(connection, created, session);
+      if (created !== undefined && existed)
         continue;
-      }
       const sql = created === undefined ? step.sql : createRoleOnce(step.sql);
       if (step.transactional && !statementOutsideTransaction(step.sql)) {
         batch.push(sql);
@@ -616,10 +704,14 @@ async function installSnapshot(connection, head, schema, reference, session, mig
       if (created !== undefined && created === migrationRole) {
         await flush();
         await grantSchema(connection, schema, created);
+        await ownSchema(connection, schema, created);
         await connection.execute(`grant select, insert, update on okm_meta, okm_history, okm_backfill to ${quoteIdent2(created)}`);
-        await assumeRole(connection, created, session);
       }
     }
+    if (migrationRole !== undefined && session.setRole !== migrationRole && await roleExists(connection, migrationRole)) {
+      await flush();
+      await assumeRole(connection, migrationRole, session);
+    }
     await flush();
     for (const sql of referenceInserts(reference, schema)) {
       if (!began) {
@@ -754,4 +846,4 @@ function normaliseFunction(object) {
   };
 }
 
-export { runTarget, assumeRole, grantAppMeta, grantSchema, assertSchemaUsageLanded, statementOutsideTransaction, readReference, referenceInserts, catalogsEqual, provisionMark, expandProvisioned, provisionHistoryIsKnown, installSnapshot, snapshotDifference };
+export { runTarget, assumeRole, grantAppMeta, grantSchema, ownSchema, assertSchemaUsageLanded, statementOutsideTransaction, readReference, referenceInserts, catalogsEqual, provisionMark, expandProvisioned, provisionHistoryIsKnown, installSnapshot, snapshotDifference };

package/dist/shared/{ebhz8vh6.js → 8qwqrxed.js}

@@ -3,9 +3,10 @@ import {
 } from "./cm3w0ywp.js";
 import {
   armDriverError,
+  logClientError,
   send,
   connectClient
-} from "./1mxm04fy.js";
+} from "./tyqapcgk.js";
 import {
   resetSession2
 } from "./99qp9vtg.js";
@@ -31,8 +32,10 @@ async function checkout(held) {
   const client = await connectClient(pool, held.acquireMs, counters);
   counters.reserved += 1;
   let lost = false;
-  const onError = () => {
+  const onError = (error) => {
     lost = true;
+    if (error !== undefined)
+      logClientError(held.notices, error);
   };
   const events = client;
   events.on("error", onError);
@@ -40,7 +43,7 @@ async function checkout(held) {
   const session = new WireSession((text, params) => {
     const pending = send(client, text, params, named, client);
     const guarded = pending.catch((error) => {
-      if (isConnectionLost(error) || lost) {
+      if (isConnectionLost(error) || lost || pgClosed(error)) {
         lost = true;
         if (isConnectionLost(error))
           throw error;
@@ -77,6 +80,8 @@ async function checkout(held) {
       try {
         if (!lost)
           await reset(session, client);
+      } catch {
+        lost = true;
       } finally {
         counters.reserved = Math.max(0, counters.reserved - 1);
         events.removeListener("error", onError);
@@ -85,6 +90,9 @@ async function checkout(held) {
     }
   };
 }
+function pgClosed(error) {
+  return error instanceof Error && error.message === "Client has encountered a connection error and is not queryable";
+}
 async function reset(session, client) {
   await resetSession2(session.depth(), (text) => client.query(text));
 }

package/dist/shared/{ss2kv2rs.js → 8v7vzpgt.js}

@@ -1,26 +1,29 @@
 import {
   open2
-} from "./dd5pmnky.js";
+} from "./jvxcp1qk.js";
 import"./12z7aznj.js";
 import"./fk9vef30.js";
 import {
   createdOf,
   testing2
-} from "./2szgv6yj.js";
+} from "./ns35jqz0.js";
 import"./n442h54c.js";
+import {
+  probeStableBackend
+} from "./e1c55v04.js";
 import {
   projectPath,
   loadConfig,
   loadSchema
-} from "./2zdxkt7b.js";
+} from "./wp7y8q3y.js";
 import {
+  driverUrl,
   sessionFailure,
   finishQuiet,
   assertTargetPolicy,
   assertDirectConnection,
-  assertStableBackend,
   selectTarget
-} from "./6nae0spm.js";
+} from "./bdekbvmt.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -41,13 +44,13 @@ async function seedProject(cwd, file, flags) {
   const allowPooler = flags.allowPooler || config.allowPooler === true;
   assertDirectConnection(target.url, allowPooler);
   const schema = await loadSchema(cwd, config.schema);
-  const pool = open2({ url: target.url, max: 1 });
+  const pool = open2({ url: driverUrl(target.url), max: 1 });
   let harness;
   try {
     const held = await pool.reserve?.();
     if (held !== undefined) {
       try {
-        await assertStableBackend(async () => {
+        await probeStableBackend(target.url, async () => {
           const result = await held.execute("select pg_backend_pid()::text");
           const cell = result.rows[0]?.[0];
           return cell === null || cell === undefined ? "" : String(cell);

package/dist/shared/{8qzkd9f3.js → ak61ye1f.js}

@@ -1,14 +1,14 @@
 import"./12z7aznj.js";
 import"./n442h54c.js";
 import"./fk9vef30.js";
-import"./dd5pmnky.js";
+import"./jvxcp1qk.js";
 import {
   projectPath,
   loadConfig
-} from "./2zdxkt7b.js";
+} from "./wp7y8q3y.js";
 import {
   listTargets
-} from "./6nae0spm.js";
+} from "./bdekbvmt.js";
 
 // src/tooling/migrate/dev.ts
 import { mkdirSync } from "node:fs";

package/dist/shared/{6nae0spm.js → bdekbvmt.js}

@@ -47,6 +47,20 @@ import {
   OkmError2
 } from "./52szzakm.js";
 
+// src/tooling/migrate/driver-url.ts
+function driverUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return url;
+  }
+  if (!parsed.searchParams.has("pgbouncer"))
+    return url;
+  parsed.searchParams.delete("pgbouncer");
+  return parsed.toString();
+}
+
 // src/tooling/migrate/sql-lex.ts
 function sqlStatements(sql) {
   return scan(sql).statements;
@@ -545,6 +559,9 @@ function privilegeSql(before, after, schema, recreated = new Set) {
       const tighten = tightenColumnSelect(object, after, schema);
       if (tighten !== undefined)
         grant.push(tighten);
+      const fromPublic = revokePublicExecute(object, schema);
+      if (fromPublic !== undefined)
+        grant.push(fromPublic);
       grant.push({ sql: grantStatement(object, schema, false), kind: "grant" });
       const writes = revokeMatviewWrites(object, after, schema);
       if (writes !== undefined)
@@ -554,6 +571,9 @@ function privilegeSql(before, after, schema, recreated = new Set) {
     if (previous !== undefined)
       continue;
     if (object.kind === "defaultPrivilege") {
+      const fromPublic = revokePublicDefaultExecute(object, schema);
+      if (fromPublic !== undefined)
+        defaults.push(fromPublic);
       defaults.push({ sql: defaultStatement(object, schema, false), kind: "grant-default" });
     }
   }
@@ -606,6 +626,26 @@ function tightenColumnSelect(object, after, schema) {
     kind: "revoke"
   };
 }
+function revokePublicExecute(object, schema) {
+  if (object.identity.privilege.toUpperCase() !== "EXECUTE")
+    return;
+  if (object.identity.object.kind !== "function")
+    return;
+  return {
+    sql: `revoke execute on ${grantTarget(object.identity.object, schema)} from public`,
+    kind: "revoke"
+  };
+}
+function revokePublicDefaultExecute(object, schema) {
+  if (object.identity.objectKind !== "function")
+    return;
+  if (object.identity.privilege.toUpperCase() !== "EXECUTE")
+    return;
+  return {
+    sql: `alter default privileges for role ${quoteIdent2(object.identity.forRole)} in schema ${quoteIdent2(schema)} revoke execute on functions from public`,
+    kind: "grant-default"
+  };
+}
 function revokeMatviewWrites(object, after, schema) {
   if (object.identity.privilege.toUpperCase() !== "SELECT")
     return;
@@ -3082,14 +3122,36 @@ function assertDirectConnection(url, allowPooler) {
     throw new OkmError2("invalid", `Refusing pooler host ${host}. Apply needs a direct connection.`, { fix: { summary: "Use a direct connection, or pass --allow-pooler." } });
   }
 }
-async function assertStableBackend(readPid, allowPooler) {
+async function assertStableBackend(readPid, allowPooler, options) {
   if (allowPooler)
     return;
-  const first = await readPid();
-  const second = await readPid();
-  if (first === second)
-    return;
-  throw new OkmError2("OKM1854", `The backend pid changed from ${first} to ${second}. A pooler is handing out a new session between statements.`, { fix: { summary: "Use a direct connection, or pass --allow-pooler." } });
+  const seen = new Set;
+  let first = "";
+  let release;
+  try {
+    for (let i = 0;i < 8; i += 1) {
+      const pid = await readPid();
+      if (first.length === 0)
+        first = pid;
+      seen.add(pid);
+      if (seen.size >= 2) {
+        const second = [...seen].find((value) => value !== first) ?? pid;
+        throw new OkmError2("OKM1854", `The backend pid changed from ${first} to ${second}. A pooler is handing out a new session between statements.`, { fix: { summary: "Use a direct connection, or pass --allow-pooler." } });
+      }
+      if (release !== undefined) {
+        await release();
+        release = undefined;
+      }
+      if (i < 7 && options?.holdBackend !== undefined) {
+        release = await options.holdBackend();
+      }
+    }
+  } finally {
+    if (release !== undefined)
+      await release().catch(() => {
+        return;
+      });
+  }
 }
 function listTargets(config) {
   if (config.database !== undefined && config.targets !== undefined) {
@@ -3179,4 +3241,4 @@ function endpointOf(url) {
   };
 }
 
-export { sqlStatements, transactionControl, sqlIdentifiers, canonicalTypeName, prepareMigrationText, assertMigrationSteps, columnPrivilege, createdRoleName, createRoleOnce, changesRole, DEFAULT_BACKFILL_PAUSE_MS, DEFAULT_BACKFILL_STATEMENT_TIMEOUT_MS, batchSizeField, aboutBatchCount, boundaryQuery, checkedCast, classOf, strictestClass, assertExtensionsAvailable, omitManagedObjects, parseReplace, planMigration, formatPlan, parsePlan, staleRenames, sessionFailure, finishQuiet, assertTargetPolicy, assertTargetAlias, assertDirectConnection, assertStableBackend, listTargets, selectTarget };
+export { driverUrl, sqlStatements, transactionControl, sqlIdentifiers, canonicalTypeName, prepareMigrationText, assertMigrationSteps, columnPrivilege, createdRoleName, createRoleOnce, changesRole, DEFAULT_BACKFILL_PAUSE_MS, DEFAULT_BACKFILL_STATEMENT_TIMEOUT_MS, batchSizeField, aboutBatchCount, boundaryQuery, checkedCast, classOf, strictestClass, assertExtensionsAvailable, omitManagedObjects, parseReplace, planMigration, formatPlan, parsePlan, staleRenames, sessionFailure, finishQuiet, assertTargetPolicy, assertTargetAlias, assertDirectConnection, assertStableBackend, listTargets, selectTarget };

package/dist/shared/{tw1nvvfj.js → bxjq6xqv.js}

@@ -1,9 +1,9 @@
 import {
   build3
-} from "./cexb7z6b.js";
+} from "./gr9sn4za.js";
 import {
   attachHttp
-} from "./npdftanb.js";
+} from "./xbvz446k.js";
 import {
   rejectKeys,
   readLimit,