tablewalk 0.0.1

package/dist/server/connections.js

@@ -0,0 +1,615 @@
+/**
+ * The connection registry.
+ *
+ * The server used to hold exactly one adapter. It now holds several, opened
+ * lazily: naming a connection costs nothing until you look at it, which
+ * matters when a config file lists eight databases and you only wanted one.
+ *
+ * Two rules shape everything here.
+ *
+ * A connection string is a credential. It is read from disk or the command
+ * line, kept in this module, and never sent to the browser — the client sees
+ * an id, a name and a dialect. Anything that reaches the page has been
+ * through `publicView`, and there is a test asserting a password does not
+ * survive the trip.
+ *
+ * Introspection is per connection and cached, because it is the expensive
+ * part of connecting and the schema does not change while you browse. It is
+ * refreshable on request, since sometimes it does.
+ */
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { connect } from '../adapters/connect.js';
+import { shapeOnly } from './shapeonly.js';
+import { resolveConnection, keychainAvailable, keychainSet, writeCredential } from './credentials.js';
+export class Registry {
+    entries = new Map();
+    activeId = null;
+    add(config) {
+        const id = config.id ?? slug(config.name);
+        /* Ids have to be unique because the client addresses connections by them;
+           a duplicate name gets a suffix rather than silently replacing. */
+        let unique = id;
+        let n = 2;
+        while (this.entries.has(unique))
+            unique = `${id}-${n++}`;
+        const full = { ...config, id: unique };
+        this.entries.set(unique, { config: full, busy: 0, idle: [] });
+        if (!this.activeId)
+            this.activeId = unique;
+        return full;
+    }
+    has(id) {
+        return this.entries.has(id);
+    }
+    /** The stored configuration, for the manager to edit and to write back. */
+    configOf(id) {
+        return this.entries.get(id)?.config;
+    }
+    /** Every stored configuration, in order, including its secrets as written. */
+    configs() {
+        return [...this.entries.values()].map((e) => e.config);
+    }
+    /**
+     * Change a connection's name, target or schema list.
+     *
+     * The open adapter is discarded whenever the target changes, because an
+     * entry whose URL says one database while its schema describes another is
+     * the worst of both: it looks edited and behaves as it did before. The name
+     * alone can change without reconnecting.
+     */
+    async update(id, patch) {
+        const entry = this.entries.get(id);
+        if (!entry)
+            throw new Error(`No connection called "${id}".`);
+        const retarget = (patch.url !== undefined && patch.url !== entry.config.url) ||
+            (patch.schemas !== undefined &&
+                JSON.stringify(patch.schemas) !== JSON.stringify(entry.config.schemas));
+        entry.config = { ...entry.config, ...patch, id };
+        if (retarget) {
+            await this.drain(id);
+            await entry.adapter?.close().catch(() => { });
+            entry.adapter = undefined;
+            entry.schema = undefined;
+            entry.error = undefined;
+        }
+        return entry.config;
+    }
+    /**
+     * Forget a connection.
+     *
+     * This used to refuse the last one, and the reason it gave was honest: a
+     * browser with no database to browse was a page that could not do anything,
+     * and the way out of that state was not obvious. Both halves of that have
+     * stopped being true — the server starts with nothing now, and the page it
+     * serves in that state exists to do exactly one thing, which is get you out
+     * of it. A rule that guards against a state the product supports is just a
+     * connection you cannot remove.
+     *
+     * The active connection moves to whatever remains, or to nothing.
+     */
+    async remove(id) {
+        const entry = this.entries.get(id);
+        if (!entry)
+            throw new Error(`No connection called "${id}".`);
+        await this.drain(id);
+        await entry.adapter?.close().catch(() => { });
+        this.entries.delete(id);
+        if (this.activeId === id)
+            this.activeId = [...this.entries.keys()][0] ?? null;
+    }
+    get active() {
+        return this.activeId;
+    }
+    /**
+     * Choose the default connection, or `null` for none.
+     *
+     * Null is reachable now that the server starts with nothing, and it is what
+     * an add has to fall back to when the connection it just made turns out not
+     * to open: `add` makes the first one active before anything has tried to
+     * dial it, so a failed first add left the whole application pointed at a
+     * connection that had never worked.
+     */
+    setActive(id) {
+        if (id !== null && !this.entries.has(id))
+            throw new Error(`No connection called "${id}".`);
+        this.activeId = id;
+    }
+    list() {
+        return [...this.entries.values()].map((e) => publicView(e));
+    }
+    /**
+     * Open a connection if it is not already open, and return it with its
+     * schema. A failure is recorded on the entry rather than thrown away, so
+     * the sidebar can show which connection is broken and why.
+     */
+    async open(id) {
+        const entry = this.entries.get(id);
+        if (!entry)
+            throw new Error(`No connection called "${id}".`);
+        if (entry.adapter && entry.schema)
+            return { adapter: entry.adapter, schema: entry.schema };
+        /* Already dialling: wait for that one rather than starting a second.
+           Two tabs selecting the same unopened connection at the same moment used
+           to open two real connections and leak whichever finished first. */
+        if (entry.opening)
+            return entry.opening;
+        entry.opening = this.dial(entry);
+        try {
+            return await entry.opening;
+        }
+        finally {
+            entry.opening = undefined;
+        }
+    }
+    async dial(entry) {
+        /* Declared out here so the catch can sweep it. It holds the secret in its
+           expanded form, which is exactly what a driver quotes back on failure. */
+        let resolved;
+        try {
+            /* The stored URL may be a reference rather than a secret: an env var,
+               a keychain entry, or a name in the credentials file. It is resolved
+               here, at the last possible moment, and the resolved form is handed
+               straight to the adapter without being stored anywhere. */
+            resolved = await resolveConnection(entry.config.name, entry.config.url);
+            entry.secret = resolved.source;
+            entry.warning = resolved.warning;
+            const adapter = connect(resolved.url, {
+                schemas: entry.config.schemas ?? [],
+                label: entry.config.name,
+            });
+            const schema = await adapter.introspect();
+            /* Wrapped before it is stored, so nothing can reach the unwrapped one:
+               the boundary is a property of the connection, not a rule each caller
+               remembers. Introspection happens first because the catalog is the
+               part a shape-only connection exists to serve. */
+            entry.adapter = entry.config.rows === false ? shapeOnly(adapter, entry.config.name) : adapter;
+            entry.schema = schema;
+            entry.error = undefined;
+            /* The stored one, which is the wrapped one where it matters. Returning
+               the raw adapter here would hand the first caller a way past the
+               boundary the line above just put up. */
+            return { adapter: entry.adapter, schema };
+        }
+        catch (err) {
+            /* Scrubbed here, at the one place a failure becomes a stored string.
+            
+               `resolved` is the URL with the secret expanded into it, and it is the
+               thing a driver quotes back. It may not exist yet — `resolveConnection`
+               can be what failed — so the configured URL is swept as well, since an
+               inline password lives in that one. */
+            entry.error = scrubSecrets(err.message, resolved?.url, entry.config.url);
+            /* A missing password, said as one.
+            
+               Moving a secret to the keychain gives this tool a failure mode it did
+               not have before: the entry can be removed, or the keychain locked, or
+               the file copied to a machine that has neither. What the driver says
+               then is its own internal complaint — Postgres answers "SASL:
+               SCRAM-SERVER-FIRST-MESSAGE: client password must be a string", which
+               names nothing a reader can act on and does not even contain the word
+               "password" in a useful position.
+      
+               So when the URL names a user, no password was found for it, and the
+               connection failed, the reason is stated where the reader is already
+               looking. Only then: guessing at any other failure would be worse than
+               the driver's own words, which are usually right. */
+            if (resolved?.source === 'none' && namesUserWithoutPassword(resolved.url)) {
+                entry.error = `no password found for "${entry.config.name}". `
+                    + 'Looked in the environment, the keychain, and the credentials file. '
+                    + 'If it was moved to the keychain and has since been removed, add the connection again '
+                    + `with its password. (The database said: ${entry.error})`;
+            }
+            // Rethrown with the connection named, because "ECONNREFUSED" on its own
+            // does not say which of eight databases is down.
+            throw new Error(`${entry.config.name}: ${entry.error}`);
+        }
+    }
+    /**
+       * Hold a connection open for the length of one request.
+       *
+       * Closing an adapter is not an operation the thing using it finds out
+       * about. A slow `/api/run` in one tab and a `refresh` in another meant the
+       * pg client was ended mid-query — the read came back as a driver-level
+       * "connection closed" 500, and on SQLite as a use-after-close. Nothing
+       * counted who was using what.
+       *
+       * The lease is taken when a request resolves its connection and released
+       * when the response ends, whichever way it ends.
+       */
+    lease(id) {
+        const entry = this.entries.get(id);
+        if (!entry)
+            return () => { };
+        entry.busy += 1;
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            entry.busy -= 1;
+            if (entry.busy <= 0) {
+                entry.busy = 0;
+                for (const wake of entry.idle.splice(0))
+                    wake();
+            }
+        };
+    }
+    /**
+     * Wait for the requests using a connection to finish.
+     *
+     * Bounded, because a query can be stuck for as long as the statement
+     * timeout allows and "the close hangs" is a worse failure than "the close
+     * was slightly rude". After the wait it closes anyway — which is the old
+     * behaviour, now as a last resort rather than as the only one.
+     */
+    async drain(id, ms = 5_000) {
+        const entry = this.entries.get(id);
+        if (!entry || entry.busy <= 0)
+            return;
+        await new Promise((resolve) => {
+            const timer = setTimeout(resolve, ms);
+            entry.idle.push(() => {
+                clearTimeout(timer);
+                resolve();
+            });
+        });
+    }
+    /** Drop the cached schema so the next open re-reads the catalog. */
+    async refresh(id) {
+        const entry = this.entries.get(id);
+        if (!entry)
+            throw new Error(`No connection called "${id}".`);
+        await this.drain(id);
+        if (entry.adapter)
+            await entry.adapter.close();
+        entry.adapter = undefined;
+        entry.schema = undefined;
+        return this.open(id);
+    }
+    async closeAll() {
+        await Promise.allSettled([...this.entries.values()].map((e) => e.adapter?.close()));
+    }
+}
+function publicView(entry) {
+    return {
+        id: entry.config.id,
+        name: entry.config.name,
+        dialect: dialectOf(entry.config.url),
+        detail: redact(entry.config.url),
+        source: entry.config.source,
+        connected: Boolean(entry.schema),
+        tables: entry.schema?.tables.length,
+        error: entry.error,
+        secret: entry.secret,
+        warning: entry.warning,
+        /* Safe to send, unlike the URL: a schema list is a set of names the user
+           chose to browse, and the manager needs them to prefill its editor. */
+        schemas: entry.config.schemas,
+        /* Sent so the interface can be honest about it: a write toggle offered on
+           a connection the server will refuse to write is a button that lies. */
+        writable: Boolean(entry.config.writable),
+        /* Same reason as `writable`: an interface that offers a query bar on a
+           connection the server will not read rows from is an interface that
+           lies. */
+        ...(entry.config.rows === false ? { rows: false } : {}),
+    };
+}
+/* Read off the scheme, with SQLite as the fallback because a SQLite target is
+   a bare file path and has no scheme to read.
+
+   This listed only Postgres, so every MySQL connection was labelled "sqlite" in
+   the picker and the connection manager — a wrong answer to the one question
+   those labels exist to answer. Adding an adapter means adding its scheme here;
+   `connect.ts` is the other half of the same list. */
+function dialectOf(url) {
+    if (/^postgres(ql)?:\/\//i.test(url))
+        return 'postgres';
+    if (/^mysql:\/\//i.test(url))
+        return 'mysql';
+    if (/^mariadb:\/\//i.test(url))
+        return 'mariadb';
+    return 'sqlite';
+}
+/**
+ * A displayable form of a target with no credential in it.
+ *
+ * `URL` parses out the password for us; the fallback matters because a
+ * malformed URL must not fall through to printing the original string.
+ */
+export function redact(url) {
+    if (!/^[a-z][\w+.-]*:\/\//i.test(url)) {
+        // A bare file path. Show the file name, not the whole tree.
+        return url.split('/').pop() || url;
+    }
+    try {
+        const parsed = new URL(url);
+        const user = parsed.username ? `${parsed.username}@` : '';
+        const port = parsed.port ? `:${parsed.port}` : '';
+        return `${user}${parsed.hostname}${port}${parsed.pathname}`;
+    }
+    catch {
+        return '(connection)';
+    }
+}
+/**
+ * Take the credentials out of anything on its way to the browser.
+ *
+ * `redact` produces the public form of a URL we chose to show. This is for
+ * the other direction: text we did not write, going somewhere we did not
+ * intend. A driver's failure message quotes what it was handed, and what it
+ * was handed is the *resolved* connection string — the one with the password
+ * expanded out of the keychain and into it. That message was stored on the
+ * entry and served by every `GET /api/connections` from then on.
+ *
+ * Two passes, because there are two shapes of leak:
+ *
+ *   1. The whole DSN, echoed. Any `scheme://…` in the text is replaced with
+ *      its redacted form, so the message keeps saying which host it could not
+ *      reach — which is the useful half — without the credentials.
+ *   2. The password alone, quoted without its URL. Rarer, and caught by
+ *      sweeping for the literal value.
+ *
+ * A password shorter than four characters is swept too. It mangles a message
+ * that happens to contain those letters, and that is the right trade: a
+ * garbled sentence is a nuisance, and a password on screen is not.
+ */
+export function scrubSecrets(text, ...urls) {
+    let out = text.replace(/\b[a-z][\w+.-]*:\/\/[^\s'"`,)\]]+/gi, (match) => redact(match));
+    for (const url of urls) {
+        if (!url)
+            continue;
+        for (const secret of passwordsIn(url)) {
+            if (!secret)
+                continue;
+            out = out.split(secret).join('\u2022\u2022\u2022\u2022');
+        }
+    }
+    return out;
+}
+/**
+ * The password in a URL, in both the spellings it can appear in.
+ *
+ * `new URL` gives it percent-decoded, and a driver may quote either that or
+ * the raw form it was handed. Both are swept.
+ */
+function passwordsIn(url) {
+    const found = new Set();
+    try {
+        const parsed = new URL(url);
+        if (parsed.password) {
+            found.add(parsed.password);
+            found.add(decodeURIComponent(parsed.password));
+        }
+    }
+    catch {
+        /* Not a URL — a file path, or a string with a `${VAR}` still in it. There
+           is no password to find, and failing to parse is not an error here. */
+    }
+    return [...found];
+}
+function slug(name) {
+    const s = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return s || 'connection';
+}
+/**
+ * Where a config file may live, in order.
+ *
+ * Project-local first, because a repo that ships a `tablewalk.json` should win
+ * for anyone working in it; the user's own file is the fallback.
+ */
+export function configLocations(explicit) {
+    if (explicit)
+        return [explicit];
+    const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+    return [
+        join(process.cwd(), 'tablewalk.json'),
+        join(process.cwd(), '.tablewalk.json'),
+        join(xdg, 'tablewalk', 'connections.json'),
+        /* The former name, still read. A config file is something a person wrote
+           by hand, and a rename that silently stops reading it looks exactly like
+           the tool losing their connections. */
+        join(process.cwd(), 'datawalk.json'),
+        join(process.cwd(), '.datawalk.json'),
+        join(xdg, 'datawalk', 'connections.json'),
+    ];
+}
+/**
+ * Read the first config file that exists.
+ *
+ * A missing file is not an error — most people will never write one. A file
+ * that exists but is malformed *is* an error, and is reported rather than
+ * skipped: silently ignoring a config someone wrote is worse than refusing.
+ */
+export async function loadConfig(explicit) {
+    for (const path of configLocations(explicit)) {
+        let text;
+        try {
+            text = await readFile(path, 'utf8');
+        }
+        catch {
+            if (explicit)
+                throw new Error(`No config file at ${path}`);
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch (err) {
+            throw new Error(`${path} is not valid JSON: ${err.message}`);
+        }
+        const connections = parsed?.connections;
+        if (!Array.isArray(connections)) {
+            throw new Error(`${path} needs a "connections" array.`);
+        }
+        connections.forEach((c, i) => {
+            if (!c || typeof c.url !== 'string' || !c.url) {
+                throw new Error(`${path}: connection ${i + 1} has no "url".`);
+            }
+            if (typeof c.name !== 'string' || !c.name) {
+                throw new Error(`${path}: connection ${i + 1} has no "name".`);
+            }
+            /* Refused rather than coerced. `"writable": "false"` is a string, and
+               every non-empty string is truthy — quietly reading that as permission
+               to write to production is the one mistake in this file worth being
+               loud about. */
+            if (c.writable !== undefined && typeof c.writable !== 'boolean') {
+                throw new Error(`${path}: connection "${c.name}" has "writable": ${JSON.stringify(c.writable)}. ` +
+                    `It must be true or false, without quotes.`);
+            }
+            /* Same reasoning one boundary further out: `"rows": "false"` is a
+               truthy string, and reading it as permission would open exactly the
+               connection someone wrote it to close. */
+            if (c.rows !== undefined && typeof c.rows !== 'boolean') {
+                throw new Error(`${path}: connection "${c.name}" has "rows": ${JSON.stringify(c.rows)}. ` +
+                    `It must be true or false, without quotes.`);
+            }
+            if (c.rows === false && c.writable) {
+                /* Writing is how rows get in, and an insert answers with the stored
+                   row. Allowing both would be a boundary with a door in it. */
+                throw new Error(`${path}: connection "${c.name}" is both "writable" and "rows": false. ` +
+                    `A shape-only connection cannot be written to — drop one of them.`);
+            }
+        });
+        return { path, connections };
+    }
+    return undefined;
+}
+/**
+ * Split a connection string into a URL worth persisting and a secret worth
+ * protecting, then store the secret where the platform can protect it.
+ *
+ * The URL that gets written to disk never contains the password. That is the
+ * property worth having: a config file that leaks is embarrassing, not a
+ * breach, and a connection list can be shared or committed without thinking
+ * about it.
+ */
+/**
+ * A URL that names a user and carries no password.
+ *
+ * The shape that means "a password was expected from somewhere else" — which
+ * is exactly the shape `storeSecret` leaves behind, and so the shape whose
+ * failure deserves an explanation rather than the driver's own words.
+ */
+function namesUserWithoutPassword(url) {
+    try {
+        const parsed = new URL(url);
+        return Boolean(parsed.username) && !parsed.password;
+    }
+    catch {
+        return false;
+    }
+}
+export async function storeSecret(name, url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return undefined; // A file path has no secret to store.
+    }
+    if (!parsed.password)
+        return undefined;
+    const secret = decodeURIComponent(parsed.password);
+    /* An environment reference is not a secret to move — it is the *absence* of
+       one, and the arrangement this file recommends first.
+       `postgres://app:${PROD_PASSWORD}@host/db` stores nothing anywhere; the
+       value arrives from the environment at open time. Moving it would put the
+       literal characters `${PROD_PASSWORD}` into the keychain and strip the
+       reference out of the URL, breaking the workflow in the course of trying
+       to secure it.
+  
+       Checked on the raw password rather than with `hasInlinePassword`, which
+       is only asked *after* expansion — by then a reference has already become
+       the value it names, and the distinction this needs is gone. */
+    if (/\$\{?[A-Za-z_]/.test(secret))
+        return undefined;
+    parsed.password = '';
+    const withoutSecret = parsed.toString();
+    if (keychainAvailable() && (await keychainSet(name, secret))) {
+        return { stored: 'keychain', url: withoutSecret };
+    }
+    await writeCredential(name, secret);
+    return { stored: 'file', url: withoutSecret };
+}
+/**
+ * Write connections back to a config file.
+ *
+ * The rule this respects: **a page never edits a file on disk without being
+ * told to.** Adding or editing a connection changes the running session only;
+ * this is the separate, explicit act of making that permanent, and the UI has
+ * to name the file it is about to write.
+ *
+ * URLs are stored exactly as they were typed, which is what makes
+ * `postgres://app:${PROD_PASSWORD}@db/app` survive a round trip as a
+ * reference rather than being resolved into the secret it points at. The
+ * corollary is that a password someone typed inline gets written inline —
+ * true of any config file, and the reason the UI warns about it before this
+ * is ever called.
+ *
+ * Only the `connections` key is rewritten. The registry knows about
+ * connections and nothing else, so building the file out of it alone deleted
+ * the `views` and `queries` a team had committed — and reported success. A
+ * file with a section this function does not understand is a file it has no
+ * business rewriting from scratch.
+ */
+export async function saveConfig(path, connections) {
+    const body = {
+        ...(await existingConfig(path)),
+        connections: connections
+            // Session connections are included: making them permanent is the whole
+            // point of pressing the button.
+            .map((c) => ({
+            name: c.name,
+            url: c.url,
+            ...(c.schemas?.length ? { schemas: c.schemas } : {}),
+            // Written only when true. Absent means read-only, and a file full of
+            // `"writable": false` would suggest the flag is doing something.
+            ...(c.writable ? { writable: true } : {}),
+            // And the same rule inverted: only written when it is doing something.
+            ...(c.rows === false ? { rows: false } : {}),
+        })),
+    };
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${JSON.stringify(body, null, 2)}\n`);
+}
+/**
+ * What is already in the file, so that writing connections back keeps it.
+ *
+ * A file that does not exist yet is simply an empty object — the first save
+ * writes a file with one key in it. A file that exists and cannot be parsed
+ * is the case worth stopping on: overwriting it would replace something
+ * hand-edited with a machine-generated stub, and the person who typed the
+ * stray comma would find their views gone rather than their typo reported.
+ */
+async function existingConfig(path) {
+    let text;
+    try {
+        text = await readFile(path, 'utf8');
+    }
+    catch {
+        return {};
+    }
+    if (!text.trim())
+        return {};
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        throw new Error(`${path} is not valid JSON (${err.message}), so its other settings cannot be `
+            + 'preserved. Fix the file, or save to a different path.');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return {};
+    /* `connections` is dropped because it is about to be written from the
+       registry; everything else — views, queries, comments, keys a later
+       version adds — is carried through untouched. */
+    const { connections: _drop, ...rest } = parsed;
+    return rest;
+}

package/dist/server/constraints.js

@@ -0,0 +1,62 @@
+import { findTable, referencesFrom } from '../shared/schema.js';
+/** Every engine's way of saying a foreign key was not satisfied. */
+const FOREIGN_KEY = /foreign key|violates foreign key constraint|a foreign key constraint fails/i;
+/**
+ * The referenced row that is missing, if the message says one is.
+ *
+ * Returns the original message unchanged when this is not a foreign-key
+ * failure, when the write named no reference column, or when every reference
+ * it did name turns out to be satisfied — that last case matters, because a
+ * concurrent delete or a deferred constraint can produce a failure this
+ * cannot explain, and inventing an explanation for it would be worse than
+ * the bare message.
+ */
+export async function explainWriteFailure(adapter, schema, tableId, values, message) {
+    if (!FOREIGN_KEY.test(message))
+        return message;
+    const table = findTable(schema, tableId);
+    if (!table)
+        return message;
+    for (const fk of referencesFrom(schema, tableId)) {
+        const sent = fk.from.columns.map((c) => values[c]);
+        /* Only references this write actually set. A column left out is the
+           database's own default or null, and either way not what the caller
+           typed — pointing at it would send them to the wrong line. */
+        if (sent.some((v) => v === undefined || v === null))
+            continue;
+        const target = findTable(schema, fk.to.table);
+        if (!target)
+            continue;
+        let exists;
+        try {
+            const found = await adapter.query({
+                table: fk.to.table,
+                columns: fk.to.columns,
+                filter: {
+                    groups: [fk.to.columns.map((column, i) => ({
+                            column,
+                            op: '=',
+                            value: sent[i],
+                        }))],
+                },
+                limit: 1,
+                offset: 0,
+            });
+            exists = found.rows.length > 0;
+        }
+        catch {
+            /* A lookup that itself fails proves nothing about the write. */
+            continue;
+        }
+        if (exists)
+            continue;
+        const pairs = fk.from.columns.map((c, i) => `${c} = ${format(sent[i])}`).join(', ');
+        const targetName = fk.to.columns.map((c) => `${target.name}.${c}`).join(', ');
+        return `${message} — ${pairs} has no matching ${targetName}. `
+            + `Insert that ${target.name} first, or point at one that exists.`;
+    }
+    return message;
+}
+function format(value) {
+    return typeof value === 'number' || typeof value === 'boolean' ? String(value) : `"${String(value)}"`;
+}