tablewalk 0.0.1

package/dist/server/credentials.js

@@ -0,0 +1,230 @@
+/**
+ * Where connection secrets live, and — more importantly — where they do not.
+ *
+ * The rule this file exists to enforce: **tablewalk does not invent its own
+ * secret storage.** Rolling encryption for a local dev tool means inventing a
+ * key-management scheme, and a key sitting next to the ciphertext it protects
+ * is obfuscation with extra steps. Every option below either delegates to
+ * something that already solves the problem (the OS keychain, the
+ * environment) or is explicit about being plaintext-on-disk with the same
+ * permission discipline ssh and psql use.
+ *
+ * Four ways to supply a password, in the order they are tried:
+ *
+ *   1. `${VAR}` in the URL, expanded from the environment. Nothing is stored.
+ *   2. The OS keychain, addressed by connection name. The secret never
+ *      touches a tablewalk file.
+ *   3. A credentials file at 0600, refused if the mode is wider.
+ *   4. Inline in the URL — supported because it is what people paste, and
+ *      warned about because it ends up in shell history and config files.
+ *
+ * Whatever the source, the resolved URL stays in the server process. The
+ * browser is only ever sent a redacted form; `redact` in connections.ts is
+ * the single point that produces it and there are tests asserting no password
+ * survives the trip.
+ */
+import { readFile, writeFile, chmod, mkdir } from 'node:fs/promises';
+import { existsSync, statSync } from 'node:fs';
+import { homedir, platform } from 'node:os';
+import { dirname, join } from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const run = promisify(execFile);
+/** Where the credentials file lives when one is used at all. */
+export function credentialsPath() {
+    const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+    const current = join(xdg, 'tablewalk', 'credentials.json');
+    /* The former location is read when the current one does not exist, so a
+       rename does not look like the tool forgetting every password. New writes
+       always go to the new path. (The project has been datawalk in between;
+       the datawalk-era file is the one worth finding.) */
+    if (!existsSync(current) && existsSync(join(xdg, 'datawalk', 'credentials.json'))) {
+        return join(xdg, 'datawalk', 'credentials.json');
+    }
+    return current;
+}
+/** The keychain service name. One namespace, addressed by connection name. */
+const KEYCHAIN_SERVICE = 'tablewalk';
+/* The service the datawalk-era stored under. Read as a fallback so existing
+   passwords keep working; anything (re)saved goes to the current service. */
+const FORMER_SERVICE = 'datawalk';
+/* ---------- 1. environment expansion ---------- */
+/**
+ * Expand `${VAR}` and `$VAR` in a connection string.
+ *
+ * This is the recommended option, and the only one where the secret is never
+ * written anywhere tablewalk controls:
+ *
+ *   { "name": "prod", "url": "postgres://app:${PROD_DB_PASSWORD}@db/app" }
+ *
+ * An unset variable is an error rather than an empty expansion. Silently
+ * producing `postgres://app:@db/app` would send an empty password and fail
+ * with an authentication error that says nothing about the real cause.
+ */
+export function expandEnv(url, env = process.env) {
+    return url.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g, (_, braced, bare) => {
+        const name = braced ?? bare;
+        const value = env[name];
+        if (value === undefined) {
+            throw new Error(`Connection references $${name}, which is not set. Export it, or remove it from the connection.`);
+        }
+        return value;
+    });
+}
+/** True when a URL carries a literal password rather than a reference. */
+export function hasInlinePassword(url) {
+    try {
+        return Boolean(new URL(url).password);
+    }
+    catch {
+        return false;
+    }
+}
+/* ---------- 2. the OS keychain ---------- */
+/**
+ * Read a password from the platform keychain.
+ *
+ * macOS only for now, through the `security` binary that ships with the OS —
+ * no dependency, no native module, and the secret is protected by the same
+ * thing protecting everything else on the machine. Linux and Windows return
+ * undefined and fall through to the file, which is honest: claiming keychain
+ * support and quietly storing plaintext would be worse than not offering it.
+ */
+export async function keychainGet(account) {
+    if (platform() !== 'darwin')
+        return undefined;
+    for (const service of [KEYCHAIN_SERVICE, FORMER_SERVICE]) {
+        try {
+            const { stdout } = await run('security', [
+                'find-generic-password', '-s', service, '-a', account, '-w',
+            ]);
+            const secret = stdout.trim();
+            if (secret)
+                return secret;
+        }
+        catch {
+            // Not found under this name, or the user declined the prompt. The
+            // former service is tried before falling through to the file.
+        }
+    }
+    return undefined;
+}
+export async function keychainSet(account, secret) {
+    if (platform() !== 'darwin')
+        return false;
+    try {
+        // -U updates in place rather than erroring when the item already exists.
+        await run('security', [
+            'add-generic-password', '-U', '-s', KEYCHAIN_SERVICE, '-a', account, '-w', secret,
+        ]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function keychainDelete(account) {
+    if (platform() !== 'darwin')
+        return;
+    try {
+        await run('security', ['delete-generic-password', '-s', KEYCHAIN_SERVICE, '-a', account]);
+    }
+    catch {
+        /* Already gone. */
+    }
+}
+export const keychainAvailable = () => platform() === 'darwin';
+/**
+ * Read the credentials file, refusing it if anyone but the owner can read it.
+ *
+ * The permission check is the whole point. It is what `ssh` does to private
+ * keys and what `psql` does to `.pgpass`, and it catches the realistic
+ * mistake: a file created correctly, then committed, copied or synced with
+ * permissions that no longer match the intent. Refusing loudly is better than
+ * reading it and leaving the user believing it was safe.
+ */
+export async function readCredentials(path = credentialsPath()) {
+    let mode;
+    try {
+        mode = statSync(path).mode & 0o777;
+    }
+    catch {
+        return {}; // No file is the normal case, not an error.
+    }
+    if (mode & 0o077) {
+        throw new Error(`${path} is readable by others (mode ${mode.toString(8)}). ` +
+            `Run: chmod 600 ${path}`);
+    }
+    try {
+        const parsed = JSON.parse(await readFile(path, 'utf8'));
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+            return parsed;
+        throw new Error('expected an object of name → password');
+    }
+    catch (err) {
+        throw new Error(`${path} could not be read: ${err.message}`);
+    }
+}
+export async function writeCredential(name, secret, path = credentialsPath()) {
+    const existing = await readCredentials(path).catch(() => ({}));
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    /* Written with the restrictive mode from the start rather than chmod-ed
+       afterwards — between a default-mode write and the chmod there is a window
+       where the secret is world-readable. */
+    await writeFile(path, `${JSON.stringify({ ...existing, [name]: secret }, null, 2)}\n`, { mode: 0o600 });
+    await chmod(path, 0o600);
+}
+/**
+ * Turn a stored connection into a usable URL.
+ *
+ * Order matters and is deliberate: the environment wins because it is the
+ * most explicit, then the keychain because it is the best-protected, then the
+ * file. An inline password is used as-is but reported, so the UI can say what
+ * it is doing rather than leaving the user to guess.
+ */
+export async function resolveConnection(name, storedUrl, options = {}) {
+    // 1. Environment references, which may supply the whole URL or just part.
+    const expanded = expandEnv(storedUrl);
+    const usedEnv = expanded !== storedUrl;
+    /* Anything with a host has a credential to resolve; a bare file path does
+       not. This tested for Postgres specifically, so a MySQL connection skipped
+       the keychain and the credentials file entirely and never warned about a
+       password written into its URL — the checks were there and simply did not
+       run for it. Asking whether the target *has a host* is the question that
+       was always meant, and it does not need editing again for the next
+       adapter. */
+    if (!/^[a-z][\w+.-]*:\/\//i.test(expanded)) {
+        // SQLite is a file path; there is no credential to resolve.
+        return { url: expanded, source: usedEnv ? 'environment' : 'none' };
+    }
+    if (hasInlinePassword(expanded)) {
+        return {
+            url: expanded,
+            source: usedEnv ? 'environment' : 'inline',
+            warning: usedEnv
+                ? undefined
+                : 'This connection has its password written into the URL. Prefer ${ENV_VAR}, or store it in the keychain.',
+        };
+    }
+    // 2 and 3: a URL with a user but no password can have one supplied.
+    let parsed;
+    try {
+        parsed = new URL(expanded);
+    }
+    catch {
+        return { url: expanded, source: 'none' };
+    }
+    const fromKeychain = await keychainGet(name);
+    if (fromKeychain) {
+        parsed.password = encodeURIComponent(fromKeychain);
+        return { url: parsed.toString(), source: 'keychain' };
+    }
+    const file = await readCredentials(options.credentialsFile);
+    if (file[name]) {
+        parsed.password = encodeURIComponent(file[name]);
+        return { url: parsed.toString(), source: 'file' };
+    }
+    // No password anywhere. Postgres may still accept it — peer auth, trust,
+    // or a ~/.pgpass the driver reads itself — so this is not an error.
+    return { url: expanded, source: 'none' };
+}

package/dist/server/fixture.js

@@ -0,0 +1,199 @@
+import { findTable, primaryKey, referencesFrom, referencesTo, } from '../shared/schema.js';
+import { insertOrder } from '../shared/order.js';
+const DEFAULTS = { depth: 3, perChild: 5, max: 100 };
+export async function extractFixture(adapter, schema, tableId, key, options = {}) {
+    const depth = Math.max(0, Math.min(6, options.depth ?? DEFAULTS.depth));
+    const perChild = Math.max(1, Math.min(50, options.perChild ?? DEFAULTS.perChild));
+    const max = Math.max(1, Math.min(500, options.max ?? DEFAULTS.max));
+    const root = findTable(schema, tableId);
+    if (!root)
+        throw new Error(`Unknown table "${tableId}".`);
+    /** table id → row identity → row. The identity keeps a row from being taken twice. */
+    const collected = new Map();
+    const truncated = [];
+    let rowsRead = 0;
+    const identity = (table, row) => {
+        const pk = primaryKey(findTable(schema, table));
+        return pk.length
+            ? JSON.stringify(pk.map((c) => row[c]))
+            /* A keyless table cannot be deduped by key, so the whole row is its
+               own identity — which is right: two identical rows are one row as far
+               as a fixture is concerned. */
+            : JSON.stringify(row);
+    };
+    const total = () => [...collected.values()].reduce((n, rows) => n + rows.size, 0);
+    const take = (table, row) => {
+        const rows = collected.get(table) ?? new Map();
+        collected.set(table, rows);
+        const id = identity(table, row);
+        if (rows.has(id))
+            return false;
+        if (total() >= max) {
+            if (!truncated.includes(`the ${max}-row ceiling`))
+                truncated.push(`the ${max}-row ceiling`);
+            return false;
+        }
+        rows.set(id, row);
+        return true;
+    };
+    const fetch = async (table, filter, limit) => {
+        const found = await adapter.query({
+            table,
+            filter: { groups: [filter.map((c) => ({ column: c.column, op: '=', value: c.value }))] },
+            limit,
+            offset: 0,
+        });
+        rowsRead += found.rows.length;
+        return found.rows;
+    };
+    const rootRows = await fetch(root.id, primaryKey(root).map((c) => ({ column: c, value: key[c] })), 1);
+    if (!rootRows.length)
+        throw new Error(`No ${root.name} with that key.`);
+    take(root.id, rootRows[0]);
+    /* Children first, so that their parents are picked up by the same walk
+       that resolves the root's — a child pointing at an employee nobody
+       collected is a fixture that does not load. */
+    const queue = [
+        { table: root.id, row: rootRows[0], hop: 0 },
+    ];
+    if (options.children) {
+        for (const fk of referencesTo(schema, root.id)) {
+            if (total() >= max)
+                break;
+            const child = findTable(schema, fk.from.table);
+            if (!child)
+                continue;
+            const rows = await fetch(child.id, fk.from.columns.map((column, i) => ({
+                column,
+                value: rootRows[0][fk.to.columns[i]],
+            })), perChild);
+            if (rows.length === perChild)
+                truncated.push(`${child.name} at ${perChild} rows`);
+            for (const row of rows) {
+                if (take(child.id, row))
+                    queue.push({ table: child.id, row, hop: 0 });
+            }
+        }
+    }
+    /* Then upwards from everything collected: the rows each one points at. */
+    while (queue.length) {
+        const { table, row, hop } = queue.shift();
+        if (hop >= depth)
+            continue;
+        for (const fk of referencesFrom(schema, table)) {
+            const values = fk.from.columns.map((c) => row[c]);
+            if (values.some((v) => v === null || v === undefined))
+                continue;
+            const parent = findTable(schema, fk.to.table);
+            if (!parent)
+                continue;
+            const rows = await fetch(parent.id, fk.to.columns.map((column, i) => ({ column, value: values[i] })), 1);
+            for (const found of rows) {
+                if (take(parent.id, found))
+                    queue.push({ table: parent.id, row: found, hop: hop + 1 });
+            }
+        }
+    }
+    const plan = insertOrder(schema, [...collected.keys()]);
+    /* Anything the sort could not place still has to come out somewhere, and
+       the end is the honest place for it — the cycle is named in `order`. */
+    const ordered = [...plan.insert, ...plan.cycles.flat()];
+    const tables = ordered
+        .filter((id) => collected.has(id))
+        .map((id) => ({
+        table: id,
+        rows: sortWithin(schema, id, [...collected.get(id).values()]),
+    }));
+    if (plan.cycles.length) {
+        truncated.push(`a cycle between ${plan.cycles.flat().join(', ')} — those inserts need a nullable column set afterwards`);
+    }
+    return {
+        table: root.id,
+        key,
+        tables,
+        order: tables.map((t) => t.table),
+        sql: toSql(schema, tables),
+        truncated: truncated.length ? truncated : undefined,
+        rowsRead,
+    };
+}
+/**
+ * Rows of a self-referencing table, parents before children.
+ *
+ * `work_order.parent_id → work_order` orders the rows inside the table
+ * rather than the table against another one, and a fixture that inserts the
+ * child first fails on exactly the constraint this whole function exists to
+ * respect. Rows whose parent is not in the fixture are unconstrained and go
+ * first.
+ */
+function sortWithin(schema, tableId, rows) {
+    const self = referencesFrom(schema, tableId).filter((fk) => fk.to.table === tableId);
+    if (!self.length || rows.length < 2)
+        return rows;
+    const table = findTable(schema, tableId);
+    const pk = primaryKey(table);
+    if (!pk.length)
+        return rows;
+    const idOf = (row) => JSON.stringify(pk.map((c) => row[c]));
+    const present = new Map(rows.map((row) => [idOf(row), row]));
+    const placed = new Set();
+    const out = [];
+    const place = (row, seen) => {
+        const id = idOf(row);
+        if (placed.has(id) || seen.has(id))
+            return;
+        seen.add(id);
+        for (const fk of self) {
+            const parentId = JSON.stringify(fk.from.columns.map((c) => row[c]));
+            const parent = present.get(parentId);
+            if (parent)
+                place(parent, seen);
+        }
+        if (placed.has(id))
+            return;
+        placed.add(id);
+        out.push(row);
+    };
+    for (const row of rows)
+        place(row, new Set());
+    return out;
+}
+/**
+ * The fixture as SQL.
+ *
+ * Values are written as literals rather than bound, which is the one place
+ * in this codebase that happens — because this is a *document*, not a
+ * statement the server runs. Nothing here reaches a database; it reaches a
+ * file, a test, or a paste buffer, and a parameter list would make it
+ * useless for all three.
+ */
+function toSql(schema, tables) {
+    const lines = [];
+    for (const { table, rows } of tables) {
+        if (!rows.length)
+            continue;
+        const meta = findTable(schema, table);
+        const columns = meta?.columns.map((c) => c.name) ?? Object.keys(rows[0]);
+        lines.push(`-- ${table}`);
+        for (const row of rows) {
+            const present = columns.filter((c) => row[c] !== undefined);
+            lines.push(`INSERT INTO ${quoteName(meta?.name ?? table)} (${present.map(quoteName).join(', ')}) `
+                + `VALUES (${present.map((c) => literal(row[c])).join(', ')});`);
+        }
+        lines.push('');
+    }
+    return lines.join('\n').trim();
+}
+const quoteName = (id) => `"${id.replace(/"/g, '""')}"`;
+function literal(value) {
+    if (value === null || value === undefined)
+        return 'NULL';
+    if (typeof value === 'number')
+        return String(value);
+    if (typeof value === 'boolean')
+        return value ? 'TRUE' : 'FALSE';
+    /* Doubling the quote is the standard escape and the only one every dialect
+       here agrees on — a backslash is an escape in MySQL and a character in
+       Postgres. */
+    return `'${String(value).replace(/'/g, "''")}'`;
+}

package/dist/server/graph.js

@@ -0,0 +1,194 @@
+import { tableNamed } from '../shared/schema.js';
+/** A refusal that is about the request rather than about the database. */
+export class GraphError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GraphError';
+    }
+}
+const isRef = (v) => typeof v === 'object' && v !== null && typeof v.ref === 'string';
+/**
+ * `fixture`'s shape, flattened into this one.
+ *
+ * The extractor answers `[{ table, rows: [...] }]` — a whole table at a time,
+ * in insert order — because that is how it reads. Accepting it here is what
+ * makes the pair a loop: take a real row out of development, put it into a
+ * test database, without an agent hand-rewriting the shape in between.
+ */
+export function flattenTables(tables) {
+    return tables.flatMap(({ table, rows }) => rows.map((values) => ({ table, values })));
+}
+/**
+ * Check what can be checked before anything is written.
+ *
+ * Every one of these is a mistake in the request rather than a refusal from
+ * the database, and finding them here means the transaction is never opened —
+ * so the answer to "did anything happen" is a flat no rather than a rollback
+ * to reason about.
+ */
+function validate(schema, rows) {
+    if (!rows.length)
+        throw new GraphError('Nothing to insert. Give at least one row.');
+    const seen = new Map();
+    rows.forEach((row, i) => {
+        const at = `Row ${i + 1}`;
+        if (!row || typeof row !== 'object')
+            throw new GraphError(`${at} is not a row.`);
+        if (!row.table)
+            throw new GraphError(`${at} does not say which table it is for.`);
+        if (!tableNamed(schema, row.table)) {
+            /* Resolved the way `insert` resolves it, bare name included. A graph
+               that refused `customer` where a single `insert` accepted it would be
+               a difference an agent has to discover by wasting a call. */
+            throw new GraphError(`${at}: no table called "${row.table}". Ask \`tables\` for what exists.`);
+        }
+        if (!row.values || typeof row.values !== 'object' || !Object.keys(row.values).length) {
+            throw new GraphError(`${at} (${row.table}) has no values. Name at least one column.`);
+        }
+        if (row.as !== undefined) {
+            if (typeof row.as !== 'string' || !row.as.trim()) {
+                throw new GraphError(`${at} (${row.table}) has a label that is not a name.`);
+            }
+            if (seen.has(row.as)) {
+                throw new GraphError(`${at}: "${row.as}" is already the label of row ${seen.get(row.as) + 1}. Labels have to be unique to point at anything.`);
+            }
+            seen.set(row.as, i);
+        }
+        for (const [column, value] of Object.entries(row.values)) {
+            if (!isRef(value))
+                continue;
+            const target = seen.get(value.ref);
+            /* Earlier, strictly. A row can only point at a row that already exists,
+               and the alternative — resolving forwards — would mean deciding an
+               order the caller did not ask for. `order` is the tool that answers
+               "what has to exist first". */
+            if (target === undefined) {
+                throw new GraphError(seen.size
+                    ? `${at} (${row.table}.${column}) points at "${value.ref}", which is not the label of any earlier row. Known so far: ${[...seen.keys()].join(', ')}.`
+                    : `${at} (${row.table}.${column}) points at "${value.ref}", but no row before it has a label.`);
+            }
+        }
+    });
+}
+/** What a `{ ref }` resolves to, once the row it names has been inserted. */
+function resolveRef(ref, made, where) {
+    const source = made.get(ref.ref);
+    if (!source)
+        throw new GraphError(`${where} points at "${ref.ref}", which was not inserted.`);
+    if (ref.column) {
+        if (!source.row || !(ref.column in source.row)) {
+            throw new GraphError(`${where}: the row labelled "${ref.ref}" has no column "${ref.column}" to point at.`);
+        }
+        return source.row[ref.column];
+    }
+    const key = Object.entries(source.key);
+    if (key.length > 1) {
+        /* A composite key cannot stand in for one value. Named, because the fix
+           is to pick one of them. */
+        throw new GraphError(`${where}: "${ref.ref}" has a key of more than one column (${key.map(([c]) => c).join(', ')}), `
+            + `so it cannot be a single value. Say which: { ref: "${ref.ref}", column: "…" }.`);
+    }
+    if (!key.length) {
+        throw new GraphError(`${where}: the row labelled "${ref.ref}" came back without a key, so there is nothing to point at. `
+            + `Name a column instead: { ref: "${ref.ref}", column: "…" }.`);
+    }
+    return key[0][1];
+}
+/**
+ * Insert a graph of rows in one transaction.
+ *
+ * Every row goes through the adapter's ordinary `insert`, so every guard it
+ * carries — real columns, values coerced to their declared types, NOT NULL
+ * refused before the statement, the database's own words for everything else
+ * — applies here unchanged. What this adds is the transaction around them and
+ * the labels between them.
+ */
+export async function insertGraph(adapter, schema, rows) {
+    if (!adapter.insert) {
+        throw new GraphError(`${schema.dialect} connections are read-only in this build.`);
+    }
+    if (!adapter.transaction) {
+        /* Refused rather than degraded to a loop of independent inserts. Doing
+           the work without the guarantee, under a name that promises it, is how a
+           half-written fixture comes to look like a working one. */
+        throw new GraphError(`${schema.dialect} connections cannot group writes into one transaction in this build, and a graph is only worth inserting as one.`);
+    }
+    validate(schema, rows);
+    return adapter.transaction(async (tx) => {
+        const made = new Map();
+        const inserted = [];
+        for (const [i, row] of rows.entries()) {
+            const where = `Row ${i + 1} (${row.table})`;
+            /* Resolved to the schema's own id before the adapter sees it. On
+               Postgres a bare `country` means `public.country` to the adapter and
+               `tablewalk_pg_fixture.country` to the schema the caller is browsing —
+               so passing the name through would write to a different table than the
+               one that was validated. Every other write tool resolves first for the
+               same reason. */
+            const table = tableNamed(schema, row.table).id;
+            const values = {};
+            for (const [column, value] of Object.entries(row.values)) {
+                values[column] = (isRef(value)
+                    ? resolveRef(value, made, `${where}.${column}`)
+                    : value);
+            }
+            const result = await tx.insert({ table, values }).catch((err) => {
+                /* Named by position and table, because the message the database gives
+                   is about a statement and the caller is looking at a list. "Nothing
+                   was written" is the part worth being explicit about: the whole
+                   point of the transaction is that a failure here is not a mess to
+                   clean up. */
+                throw new Error(`${where}: ${err.message}\nNothing was written — the whole graph was rolled back.`);
+            });
+            if (row.as)
+                made.set(row.as, result);
+            inserted.push({ table, as: row.as, key: result.key, row: result.row });
+        }
+        return {
+            inserted,
+            teardown: [...inserted].reverse().map(({ table, key }) => ({ table, key })),
+            rowsWritten: inserted.length,
+        };
+    });
+}
+/**
+ * Remove a graph of rows in one transaction.
+ *
+ * The other half, and the half that decides whether a fixture is usable
+ * twice: a teardown that fails part way leaves exactly the mess the insert
+ * was careful not to. Rows are removed in the order given — `insertGraph`
+ * hands back that order already reversed — and each goes through the
+ * adapter's ordinary `remove`, so the whole primary key is still required and
+ * a key matching anything other than one row is still refused.
+ */
+export async function deleteGraph(adapter, schema, rows) {
+    if (!adapter.remove) {
+        throw new GraphError(`${schema.dialect} connections cannot delete in this build.`);
+    }
+    if (!adapter.transaction) {
+        throw new GraphError(`${schema.dialect} connections cannot group writes into one transaction in this build.`);
+    }
+    if (!rows.length)
+        throw new GraphError('Nothing to delete. Give at least one row.');
+    rows.forEach((row, i) => {
+        if (!row?.table)
+            throw new GraphError(`Row ${i + 1} does not say which table it is for.`);
+        if (!tableNamed(schema, row.table)) {
+            throw new GraphError(`Row ${i + 1}: no table called "${row.table}".`);
+        }
+        if (!row.key || !Object.keys(row.key).length) {
+            throw new GraphError(`Row ${i + 1} (${row.table}) has no key, and a delete needs one.`);
+        }
+    });
+    return adapter.transaction(async (tx) => {
+        const removed = [];
+        for (const [i, row] of rows.entries()) {
+            const table = tableNamed(schema, row.table).id;
+            const result = await tx.remove({ table, key: row.key }).catch((err) => {
+                throw new Error(`Row ${i + 1} (${row.table}): ${err.message}\nNothing was removed — the whole teardown was rolled back.`);
+            });
+            removed.push({ table, key: row.key, affected: result.affected });
+        }
+        return { removed, rowsDeleted: removed.reduce((n, r) => n + r.affected, 0) };
+    });
+}

package/dist/server/impact.js

@@ -0,0 +1,48 @@
+import { referencesTo } from '../shared/schema.js';
+/**
+ * Run `work` over `items`, at most `width` at a time, keeping input order.
+ *
+ * `Promise.all` over a map is the usual shape and is unbounded: it starts
+ * everything and hopes the pool underneath copes. For a handful of cheap
+ * queries that is right; for a dozen table scans it is a way to make one page
+ * load monopolise a connection.
+ */
+export async function inBatches(items, width, work) {
+    const out = [];
+    for (let i = 0; i < items.length; i += width) {
+        out.push(...(await Promise.all(items.slice(i, i + width).map(work))));
+    }
+    return out;
+}
+export async function deleteImpact(adapter, schema, tableId, key) {
+    const incoming = referencesTo(schema, tableId);
+    const found = await inBatches(incoming, 4, async (fk) => {
+        const conditions = fk.to.columns.map((toCol, i) => ({
+            column: fk.from.columns[i] ?? fk.from.columns[0],
+            op: '=',
+            value: key[toCol],
+        }));
+        if (conditions.some((c) => c.value === undefined || c.value === null))
+            return null;
+        const base = {
+            table: fk.from.table,
+            columns: fk.from.columns,
+            constraint: fk.name,
+            onDelete: fk.onDelete,
+            filter: { groups: [conditions] },
+        };
+        try {
+            return { ...base, count: await adapter.count(fk.from.table, base.filter) };
+        }
+        catch (err) {
+            // One unreadable table must not stop the report; a count nobody could
+            // take is more honest as an error than as a zero.
+            return { ...base, count: -1, error: err.message };
+        }
+    });
+    /* Constraints with nothing behind them are dropped: "0 rows point at this"
+       is noise in a list whose only job is to say what would be affected. */
+    return found
+        .filter((r) => r !== null)
+        .filter((r) => r.count !== 0);
+}