mainsequence-metatable 0.1.8.dev14__tar.gz → 0.1.8.dev16__tar.gz

{mainsequence_metatable-0.1.8.dev14/src/mainsequence_metatable.egg-info → mainsequence_metatable-0.1.8.dev16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.8.dev14
+Version: 0.1.8.dev16
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/docs/adr/api/0001-unified-api-storage-and-local-sqlite.md

@@ -28,6 +28,8 @@ does not cache this API's runtime context or select its runtime mode or DataSour
 Updated 2026-09-28: application Environment policy and relationships are removed.
 Amended 2026-09-29: one enforced runtime binding and explicit bootstrap select one
 database for system and user tables.
+Amended 2026-10-02: each runtime mode lists and selects only its own DataSources,
+and inspection checks the login's prerequisites before setup.
 
 Companion decision: [Main Sequence SDK ADR 0035: Independent Git source and platform execution context](https://github.com/mainsequence-sdk/mainsequence-sdk/blob/metatables_removal/docs/adr/0035-independent-git-source-and-platform-context.md).
 The SDK prerequisite is implemented on `metatables_removal`; the current local
@@ -81,6 +83,55 @@ API requirement. The guides and examples describe the implemented shared path.
 
 ## Decision
 
+### Each runtime mode selects only its own DataSources (amended 2026-10-02)
+
+Implemented 2026-10-02 in the API and Admin; the PostgreSQL runtime-transition test
+was updated but not run.
+
+A DataSource belongs to the runtime mode that registered it. Data Sources and
+Settings show only the current mode's registrations:
+
+| Mode | Registrations | Credential references |
+| --- | --- | --- |
+| Local | The workspace SQLite catalog | Local CredentialStore |
+| Hosted | The Hosted registry until activation, then the hosted catalog | SDK Secrets |
+
+Neither mode lists, selects or copies the other mode's registrations. This applies
+ADR 0009's rule against automatic credential transfers to selection. A Hosted
+DataSource is registered and selected after switching to Hosted. Local mode offers
+**Switch to Hosted** without choosing a source; Hosted starts with its saved
+selection or uninitialized, as the supervised-selection amendment below requires.
+
+Gap observed 2026-10-02: in Local mode, the Settings Hosted picker listed the local
+catalog (`GET /data-sources/`). Selecting a TimescaleDB registered there made
+`POST /runtime-bootstrap/hosted/select/` copy the row, with its local password
+reference, into `.local/runtime-source-candidates.json`. SDK Secrets could not
+resolve that reference ("SDK Secret access failed"). Local mode also offered no
+way to register a Hosted source: **Add DataSource** writes the local catalog, and
+the Admin disables **Switch to Hosted** until a Hosted source is selected. The
+operations guide documents this cross-mode flow.
+
+Fix:
+
+1. API: remove Local-mode Hosted preselection: `POST /runtime-bootstrap/hosted/select/`,
+   the Local `hosted_bootstrap` and its runtime-context field. Remove the
+   local-catalog lookup and `remember()` from `registered_hosted_source`. Hosted
+   `POST /runtime-bootstrap/select/` resolves only the Hosted registry or the
+   active hosted catalog.
+2. Admin: in Local mode, Settings enables **Switch to Hosted** with no source
+   picker. The Hosted picker and its **Add DataSource** render only in Hosted
+   mode, where Data Sources is the Hosted registry.
+3. Docs: `docs/operations/local-runtime.md` describes the order Switch to Hosted,
+   register in Data Sources, select in Settings, then run MetaTables migrations
+   or use the existing catalog.
+4. Tests: the Local-mode selection route no longer exists; Hosted selection
+   rejects a local-catalog UID; a fresh Hosted runtime registers a source with an
+   SDK Secret reference and selects it; Settings in Local mode switches without a
+   selection.
+
+Hosted registry entries already copied from a local catalog carry unusable
+references; developers remove them. No data migration is provided.
+
 ### One local runtime across branches (amended 2026-09-30)
 
 MetaTables owns one persistent local SQLite runtime for a checkout. Git branches,
@@ -122,6 +173,14 @@ configuration inserted as the runtime DataSource in that database. Failed work
 never activates a partially initialized runtime. A database already initialized
 and compatible can be selected without running migrations.
 
+Amended 2026-10-02: before any runtime is registered, inspection also checks,
+read-only, that the login can secure the database under
+[ADR 0007](0007-database-enforced-table-access.md): it owns the database, has
+`CREATEROLE`, and owns every non-system object. Unmet prerequisites make the
+target incompatible, with each reason shown in Settings, so setup never leaves a
+database half-initialized. A registered runtime is not rechecked, because it may
+hold imported external objects.
+
 Settings, runtime context, mode selection and bootstrap actions do not depend on
 catalog sessions or catalog memberships. They retain the existing request admission.
 The caller who configures a pending target controls its initialization; an existing

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/docs/adr/index.md

@@ -23,7 +23,7 @@ decisions belong in the SDK repository and are linked as dependencies.
 
 | ADR | Status | Scope |
 | --- | --- | --- |
-| [0001: One API execution path with SQLite for local development](api/0001-unified-api-storage-and-local-sqlite.md) | Accepted and implemented | Shared execution, API-owned local storage, SDK context dependency, and DuckDB removal. |
+| [0001: One API execution path with SQLite for local development](api/0001-unified-api-storage-and-local-sqlite.md) | Accepted and implemented | Shared execution, API-owned local storage, SDK context dependency, and DuckDB removal; each runtime mode lists and selects only its own DataSources. |
 | [0002: Application administration and table ownership](api/0002-application-administration-and-table-ownership.md) | Accepted and implemented | Platform admin facts, table Reader/Writer ownership, User/Team grants, live namespace inheritance, and application-owned access management. |
 | [0004: Execute approved application migrations inside the API](api/0004-approved-application-migrations.md) | Superseded by ADR 0013 | Historical API-installed provider execution model. |
 | [0005: Shared run logs with local file capture](api/0005-run-logs-and-local-file-capture.md) | Accepted and implemented; live hosted verification pending | Shared run correlation and log API, runtime-bound local JSONL files, and hosted retrieval through the SDK. |

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/docs/api/data-sources.md

@@ -30,10 +30,10 @@ These operations do not reconcile runtime table grants. If database permissions
 need repair in Security, caller queries remain blocked while external DataSource
 management remains available.
 
-Settings lists eligible PostgreSQL, TimescaleDB, MySQL and MSSQL DataSources from
-that same registry and selects one by UID through `/runtime-bootstrap/hosted/select/`
-while Local is active or `/runtime-bootstrap/select/` in Hosted mode. Selection does
-not itself switch runtime mode. Registration preserves the UID when its catalog is
+Each runtime mode lists only its own registrations: Local the workspace catalog,
+Hosted its registry. In Hosted mode, Settings lists eligible PostgreSQL, TimescaleDB,
+MySQL and MSSQL DataSources and selects one by UID through `/runtime-bootstrap/select/`.
+Local mode cannot select a Hosted DataSource; switch to Hosted first. Registration preserves the UID when its catalog is
 initialized. The API's private pre-initialization storage is an implementation detail.
 
 The active runtime DataSource hosts the system catalog and default application
@@ -181,6 +181,25 @@ other caller sessions. SQL Server requires login/user/role administration,
 `VIEW DEFINITION` and grant management. Managed database services must provide
 these capabilities; missing permissions leave caller SQL disabled.
 
+Settings checks the PostgreSQL requirements as soon as you select a database
+without a MetaTables runtime, before any migration runs. The login must own the
+database, have `CREATEROLE`, and own, directly or through role membership, every
+schema, table, view, sequence and routine outside the system catalogs, because
+setup revokes `PUBLIC` access on each of them. Otherwise Settings shows
+**Needs attention** with each reason, for example
+`metatables_dev does not own database "development"` or
+`291 object(s) are owned by postgres (extension timescaledb)`, and
+**Run MetaTables migrations** stays unavailable. Nothing is written to that database.
+
+A database operator prepares a qualifying database for the login, for example
+`CREATE DATABASE metatables OWNER metatables_dev TEMPLATE template0;`. On
+PostgreSQL 14 and earlier the `public` schema belongs to the bootstrap superuser,
+so also run `ALTER SCHEMA public OWNER TO metatables_dev;` in that database.
+Extensions such as TimescaleDB and pgvector install their objects as the
+bootstrap superuser, so a database with those extensions cannot currently be
+secured by a non-superuser login. Do not select a database other applications
+share: setup would change their objects' `PUBLIC` access.
+
 Hosted sources require a password Secret to derive per-User database credentials.
 MySQL global mandatory roles are unsupported. Registration admits ordinary tables
 only; it does not transfer external ownership. Privileged routines and triggers

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/docs/api/openapi.json

@@ -3127,16 +3127,6 @@
             ],
             "title": "Git Source"
           },
-          "hosted_bootstrap": {
-            "anyOf": [
-              {
-                "$ref": "#/components/schemas/RuntimeBootstrapDescriptor"
-              },
-              {
-                "type": "null"
-              }
-            ]
-          },
           "hosted_environment": {
             "anyOf": [
               {
@@ -6510,48 +6500,6 @@
         ]
       }
     },
-    "/runtime-bootstrap/hosted/select/": {
-      "post": {
-        "description": "Select a registered hosted DataSource without changing the active local runtime.",
-        "operationId": "select_hosted_before_switch_runtime_bootstrap_hosted_select__post",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RuntimeSourceSelection"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/RuntimeBootstrapDescriptor"
-                }
-              }
-            },
-            "description": "Successful Response"
-          },
-          "422": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/HTTPValidationError"
-                }
-              }
-            },
-            "description": "Validation Error"
-          }
-        },
-        "summary": "Select Hosted Before Switch",
-        "tags": [
-          "Runtime bootstrap"
-        ]
-      }
-    },
     "/runtime-bootstrap/migrate/": {
       "post": {
         "operationId": "migrate_runtime_bootstrap_migrate__post",

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/docs/api/reference.md

@@ -51,7 +51,6 @@ These methods and paths are mounted by the current application. See the [OpenAPI
 | POST | `/runtime-bootstrap/activate/` | Activate | 200 |
 | POST | `/runtime-bootstrap/configure/` | Configure | 200 |
 | POST | `/runtime-bootstrap/destroy-local/` | Destroy Local | 200 |
-| POST | `/runtime-bootstrap/hosted/select/` | Select Hosted Before Switch | 200 |
 | POST | `/runtime-bootstrap/migrate/` | Migrate | 200 |
 | POST | `/runtime-bootstrap/select/` | Select Hosted Runtime Source | 200 |
 | GET | `/runtime-context/` | Runtime Context | 200 |

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/docs/operations/catalog-migrations.md

@@ -10,7 +10,7 @@ system tables, including `data_source`, alongside user tables. There is no separ
 catalog connection to configure. Local and hosted use the same initialization flow.
 
 1. For Hosted mode, register a PostgreSQL, TimescaleDB, MySQL or MSSQL connection under **MetaTables → Data Sources**. This registration is available before the hosted catalog is initialized.
-2. Open **Settings**, choose Hosted runtime mode, and select that registered DataSource from the list. Local mode prefills the single local SQLite runtime file, shared across Git branches, and uses **Check DataSource**. Choosing a hosted DataSource and switching modes are separate actions.
+2. Open **Settings**, choose Hosted runtime mode, and select that registered DataSource from the list. Local mode prefills the single local SQLite runtime file, shared across Git branches, and uses **Check DataSource**. Choosing a hosted DataSource and switching modes are separate actions. For a database without a MetaTables runtime, selection also checks that the login can secure it; **Needs attention** lists what is missing ([database privileges](../api/data-sources.md#database-privileges-and-sql-behavior)) and no migration can run until another database is selected.
 3. For an empty or outdated database, click **Run MetaTables migrations**. This
    explicitly runs the packaged Alembic history. After success, the API saves the
    proposal as the runtime DataSource inside the newly initialized registry.
@@ -31,7 +31,6 @@ The API owns these endpoints in both modes:
 | --- | --- |
 | `GET /runtime-context/` | Read runtime and bootstrap status, including before any catalog exists. |
 | `GET/POST /data-sources/` | List or register DataSources, including before hosted bootstrap. |
-| `POST /runtime-bootstrap/hosted/select/` | Select a registered hosted DataSource while Local remains active. |
 | `POST /runtime-bootstrap/select/` | Select a registered DataSource in Hosted mode. |
 | `POST /runtime-bootstrap/configure/` | Hold and inspect a proposed `{display_name, class_type, configuration}`. |
 | `POST /runtime-bootstrap/migrate/` | Explicitly migrate, register the runtime source, and activate. |

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/docs/operations/hosted-runtime.md

@@ -42,8 +42,8 @@ The injected SDKCredentialStore saves the password as a managed platform Secret
 and stores its UID. Hosted never provisions a local key or applies MetaTables AES
 encryption to that Secret. Then select it
 from the registered DataSources list in **Settings → Runtime → DataSource**. In the
-developer launcher, this selection can be saved while Local mode remains active;
-**Switch to Hosted** is a separate action.
+developer launcher, switch to Hosted first: Local mode lists only its workspace
+DataSources and cannot register or select Hosted ones.
 If MetaTables is absent or outdated, explicitly click **Run MetaTables migrations**.
 If its schema is already compatible, choose **Use this DataSource**. The selected
 database stores both the system catalog and user tables; the source registration is
@@ -55,9 +55,10 @@ returns HTTP 200 with a null active DataSource; application routes remain unavai
 This lets the Vite site show Settings even on the first launch. Once active, the descriptor
 supplies the source UID, dialect, parameter style and schema to both clients.
 
-DataSources are registered through `/data-sources/` in either runtime mode. Private
+Each runtime mode registers through `/data-sources/` into its own registry. Hosted
 pre-initialization persistence retains the legacy `.local/runtime-source-candidates.json`
-filename for compatibility; it is not a second resource. Selection saves
+filename for compatibility; it is not a second resource, and Local mode never reads
+or writes it. Selection saves
 public connection settings and Secret references to `.local/runtime-data-sources.json`.
 Persist that directory across restarts. Startup verifies
 the existing schema and reopens the selected source; it never upgrades. An incompatible

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/docs/operations/local-runtime.md

@@ -67,10 +67,18 @@ Apply application providers through the client with
 
 ## Switch modes in one Admin site
 
-Register a hosted connection under **MetaTables → Data Sources**, then choose Hosted under
-**Settings → Runtime mode** and select the registered DataSource. **Switch to Hosted**
-stops the old worker before starting the selected mode; it never copies data. A fresh
-Hosted runtime can start without a database, so Settings remains available.
+Each mode lists and selects only its own DataSources. Local shows the workspace
+catalog and keeps its passwords in the local CredentialStore; Hosted shows the
+Hosted registry and keeps passwords as managed Main Sequence Secrets. A DataSource
+registered in Local never appears in Hosted, and neither mode copies the other's
+registrations or credentials.
+
+To use a hosted database, choose Hosted under **Settings → Runtime mode** and click
+**Switch to Hosted**; no DataSource selection is needed first. The worker restarts in
+Hosted with its saved selection, or uninitialized with Settings available. Register
+the database under **MetaTables → Data Sources**, select it in **Settings → Runtime →
+DataSource**, then click **Run MetaTables migrations** or **Use this DataSource**.
+Switching stops the old worker before starting the selected mode; it never copies data.
 Failed worker startup restores the previous worker. Mode selection is recorded in
 `.local/runtime-selection.json`; successful DataSource selection is recorded separately
 in `.local/runtime-data-sources.json` using public settings and Secret references only.

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.8.dev14"
+version = "0.1.8.dev16"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16/src/mainsequence_metatable.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.8.dev14
+Version: 0.1.8.dev16
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/src/metatables/api/app/bootstrap.py

@@ -58,6 +58,14 @@ class BootstrapError(RuntimeError):
     pass
 
 
+def insufficient_privilege(exc):
+    """The database's own message for a missing privilege, never SQL text or parameters."""
+    orig = getattr(exc, "orig", None)
+    code = getattr(orig, "pgcode", None) or getattr(orig, "sqlstate", None)
+    message = getattr(getattr(orig, "diag", None), "message_primary", None)
+    return message if code == "42501" and message else None
+
+
 class DestroyLocalInput(BaseModel):
     model_config = ConfigDict(extra="forbid")
     path: str
@@ -254,6 +262,8 @@ class RuntimeBootstrap:
                     return
                 if set(self.current) != set(self.expected):
                     self.status = "migration_required"
+                    if not self.current:
+                        self.require_prerequisites(connection)
                     return
                 from metatables.api.backend.operations.catalog_schema import validate_system_schema
                 validate_system_schema(connection, self.backend.catalog)
@@ -261,6 +271,8 @@ class RuntimeBootstrap:
                 row = session.scalar(select(DataSource).where(DataSource.is_runtime.__eq__(True)))
                 if row is None:
                     self.status = "registration_required"
+                    with engine.connect() as connection:
+                        self.require_prerequisites(connection)
                 elif not self.matches(row):
                     self.status = "incompatible"
                     self.error = "The stored runtime DataSource does not match this connection."
@@ -286,6 +298,15 @@ class RuntimeBootstrap:
             self.status = "unavailable"
             self.error = "Cannot verify the selected database or its Alembic history. Check configuration, Secret access and the API's migration version."
 
+    def require_prerequisites(self, connection):
+        # Before any setup DDL: a database the login cannot secure must never be
+        # half-initialized. A registered runtime may hold external objects.
+        problems = self.backend.access.prerequisite_problems(connection)
+        if problems:
+            self.status = "incompatible"
+            self.error = ("MetaTables cannot secure this database: " + "; ".join(problems) + ". Select a database "
+                          "owned by the DataSource login, as described in DataSource database privileges.")
+
     def matches(self, row):
         return (row.class_type == self.candidate["class_type"]
                 and row.configuration == self.candidate["configuration"]
@@ -347,6 +368,10 @@ class RuntimeBootstrap:
             if isinstance(exc, SQLExecutionError):
                 self.error = f"Database access setup failed ({exc.code}). Check the DataSource password Secret and database permissions, then retry setup."
                 raise BootstrapError(self.error) from None
+            if privilege_error := insufficient_privilege(exc):
+                self.error = (f"Database setup failed: {privilege_error}. The DataSource login must own the runtime "
+                              "database and every object in it; see the DataSource database privileges.")
+                raise BootstrapError(self.error) from None
             self.error = "MetaTables migration or registration failed. The runtime was not activated; inspect the database before retrying."
             raise BootstrapError(self.error) from None
 
@@ -544,46 +569,12 @@ def persist_registered_selection(candidate):
         candidate.persist_selection()
 
 
-@router.post("/hosted/select/", response_model=RuntimeBootstrapDescriptor)
-def select_hosted_before_switch(body: RuntimeSourceSelection, request: Request,
-                                   caller: AdmittedCaller = Depends(require_admin)):
-    """Select a registered hosted DataSource without changing the active local runtime."""
-    state = request.app.state.runtime
-    current = state.hosted_bootstrap
-    if not state.config.local_mode or current is None:
-        raise HTTPException(403, "Hosted DataSource preparation is available only in Local mode.")
-    if not current.lock.acquire(blocking=False):
-        raise HTTPException(409, "Hosted DataSource configuration is already in progress.")
-    try:
-        if request.app.state.runtime.hosted_bootstrap is not current:
-            raise HTTPException(409, "Hosted DataSource configuration changed. Refresh Settings.")
-        source = registered_hosted_source(request, body.source_uid)
-        candidate = RuntimeBootstrap(replace(state.config, local_mode=False),
-                                     replace(state.identity, workspace=None))
-        try:
-            candidate.selected_source_uid = str(body.source_uid)
-            candidate.configure(source, caller.user_uid)
-            if candidate.status == "unavailable":
-                raise BootstrapError(candidate.error or "Cannot verify the hosted DataSource connection.")
-            persist_registered_selection(candidate)
-            request.app.state.runtime = replace(request.app.state.runtime, hosted_bootstrap=candidate)
-            current.close()
-            return candidate.descriptor(caller.user_uid, is_admin=caller.is_admin)
-        except BootstrapError as exc:
-            candidate.close()
-            raise HTTPException(409, str(exc)) from None
-        except Exception:
-            candidate.close()
-            raise HTTPException(503, "Unable to save the hosted DataSource configuration.") from None
-    finally:
-        current.lock.release()
-
-
 @router.post("/select/", response_model=RuntimeBootstrapDescriptor)
 def select_hosted_runtime_source(body: RuntimeSourceSelection, request: Request,
                                  caller: AdmittedCaller = Depends(require_admin)):
+    # Each mode selects only its own registrations; Local never prepares Hosted.
     if request.app.state.runtime.config.local_mode:
-        raise HTTPException(409, "Use hosted selection while Local mode is active.")
+        raise HTTPException(409, "Switch to Hosted before selecting its DataSource.")
     source = registered_hosted_source(request, body.source_uid)
     with mutation(request, caller) as current:
         state = request.app.state.runtime

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/src/metatables/api/app/main.py

@@ -115,9 +115,6 @@ def create_app(config: RuntimeConfig | None = None) -> FastAPI:
         finally:
             if bootstrap:
                 bootstrap.close()
-            hosted_bootstrap = _app.state.runtime.hosted_bootstrap
-            if hosted_bootstrap:
-                hosted_bootstrap.close()
 
     service = FastAPI(title="MetaTables API", version="0.1.0", lifespan=lifespan)
     from metatables.api.backend.backends.contracts import SQLExecutionError

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/src/metatables/api/app/routes/data_sources.py

@@ -54,8 +54,14 @@ def registrations():
     return source_registrations
 
 
+def hosted_registry(request):
+    # The saved registry holds Hosted registrations only; Local lists its catalog.
+    runtime = request.app.state.runtime
+    return runtime.bootstrap is not None and not runtime.config.local_mode
+
+
 def saved_rows(request):
-    if request.app.state.runtime.bootstrap is None:
+    if not hosted_registry(request):
         return {}
     store = registrations()
     return store.read_registry(store.registry_path(request))
@@ -67,7 +73,7 @@ def saved_source(uid, request, session):
 
 
 def remember_source(row, request):
-    if request.app.state.runtime.bootstrap is not None:
+    if hosted_registry(request):
         registrations().remember(row, request)
 
 class SourceRoute(APIRoute):
@@ -179,7 +185,7 @@ def payload(row, actor, binding, request=None):
 
 
 def selected_source(uid, request):
-    if request is None or request.app.state.runtime.bootstrap is None:
+    if request is None or not hosted_registry(request):
         return False
     return registrations().selected_uid(request) == str(uid)
 
@@ -372,7 +378,7 @@ def delete_source(uid: UUID, request: Request, actor: TrustedActorFacts = Depend
         raise HTTPException(409, "Default or referenced DataSources cannot be removed.")
     session.delete(row)
     session.commit()
-    if request.app.state.runtime.bootstrap is not None:
+    if hosted_registry(request):
         registrations().forget(uid, request)
     return Response(status_code=204)
 

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/src/metatables/api/app/routes/runtime_context.py

@@ -87,7 +87,6 @@ def runtime_context(
         "git_source": source_descriptor(workspace.source) if workspace else None,
         "data_source_selection": selection,
         "bootstrap": state.bootstrap.descriptor(caller.user_uid, is_admin=caller.is_admin) if state.bootstrap else None,
-        "hosted_bootstrap": state.hosted_bootstrap.descriptor(caller.user_uid, is_admin=caller.is_admin) if state.hosted_bootstrap else None,
         "data_source_error": None,
         "data_source": None, "dialect": None, "paramstyle": None,
         "default_schema": None,

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/src/metatables/api/app/runtime.py

@@ -211,7 +211,6 @@ class RuntimeState:
     credential_store: CredentialStore = field(default_factory=UnavailableCredentialStore, repr=False, compare=False)
     binding: RuntimeStorageBinding = field(default_factory=RuntimeStorageBinding)
     bootstrap: object | None = None
-    hosted_bootstrap: object | None = None
     actor_facts_cache: PlatformCache[tuple[bool, UUID], tuple[frozenset[UUID], bool]] = field(
         default_factory=PlatformCache, repr=False, compare=False)
     environment_cache: PlatformCache[UUID, HostedEnvironment] = field(
@@ -247,18 +246,7 @@ def initialize_runtime(config: RuntimeConfig) -> RuntimeState:
         except Exception:
             bootstrap.status = "unavailable"
             bootstrap.error = "Saved runtime configuration is invalid. Configure the DataSource again in Settings."
-    hosted_bootstrap = None
-    if config.local_mode:
-        hosted_bootstrap = RuntimeBootstrap(replace(config, local_mode=False), replace(identity, workspace=None))
-        hosted_candidate = hosted_bootstrap.initial_candidate()
-        if hosted_candidate:
-            try:
-                hosted_bootstrap.configure(hosted_candidate, None)
-            except Exception:
-                hosted_bootstrap.status = "unavailable"
-                hosted_bootstrap.error = "Saved hosted DataSource is invalid. Configure it again in Settings."
-    state = RuntimeState(config=config, identity=identity, bootstrap=bootstrap, hosted_bootstrap=hosted_bootstrap,
-                         credential_store=credentials)
+    state = RuntimeState(config=config, identity=identity, bootstrap=bootstrap, credential_store=credentials)
     if identity is not None and identity.actor_facts is not None:
         state.actor_facts_cache.seed((True, identity.user_uid), identity.actor_facts,
                                     expires_at=identity.facts_expires_at)

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/src/metatables/api/backend/backends/access.py

@@ -60,6 +60,10 @@ class DatabaseAccess:
             ).hexdigest()
         )
 
+    def prerequisite_problems(self, connection):
+        """Read-only reasons this login cannot secure the database; checked before setup."""
+        return []
+
     def initialize(self, session):
         raise NotImplementedError
 

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/src/metatables/api/backend/backends/postgresql_access.py

@@ -13,7 +13,53 @@ def quote(value):
     return '"' + str(value).replace('"', '""') + '"'
 
 
+# Objects outside the system catalogs that the login neither owns nor inherits.
+# Setup revokes PUBLIC access and changes default privileges on every one of
+# them, which PostgreSQL permits only to their owner.
+FOREIGN_OBJECTS = """
+WITH objects AS (
+    SELECT 'schema' AS kind, n.nspname AS name, n.nspowner AS owner,
+           'pg_namespace'::regclass AS classid, n.oid AS objid
+    FROM pg_namespace n
+    WHERE n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'
+    UNION ALL
+    SELECT 'table', n.nspname || '.' || c.relname, c.relowner, 'pg_class'::regclass, c.oid
+    FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'
+      AND c.relkind IN ('r', 'p', 'v', 'm', 'S', 'f')
+    UNION ALL
+    SELECT 'routine', n.nspname || '.' || p.proname, p.proowner, 'pg_proc'::regclass, p.oid
+    FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'
+)
+SELECT pg_get_userbyid(o.owner) AS owner, e.extname AS extension, count(*) AS objects,
+       min(o.kind || ' ' || o.name) AS example
+FROM objects o
+LEFT JOIN pg_depend d ON d.classid = o.classid AND d.objid = o.objid AND d.deptype = 'e'
+LEFT JOIN pg_extension e ON e.oid = d.refobjid
+WHERE NOT pg_has_role(current_user, o.owner, 'MEMBER')
+GROUP BY 1, 2
+ORDER BY 3 DESC, 1
+"""
+
+
 class PostgreSQLAccess(DatabaseAccess):
+    def prerequisite_problems(self, connection):
+        login, database, owns_database, creates_roles = connection.execute(text(
+            "SELECT current_user, current_database(), pg_has_role(current_user, d.datdba, 'MEMBER'), "
+            "r.rolcreaterole OR r.rolsuper FROM pg_database d JOIN pg_roles r ON r.rolname = current_user "
+            "WHERE d.datname = current_database()"
+        )).one()
+        problems = []
+        if not owns_database:
+            problems.append(f'{login} does not own database "{database}"')
+        if not creates_roles:
+            problems.append(f"{login} lacks CREATEROLE")
+        for owner, extension, count, example in connection.execute(text(FOREIGN_OBJECTS)).all()[:3]:
+            source = f" (extension {extension})" if extension else ""
+            problems.append(f"{count} object(s) are owned by {owner}{source}, e.g. {example}")
+        return problems
+
     def initialize(self, session):
         self.identity_secret()
         connection = session.connection()

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev16}/src/metatables/runtime_contract.py

@@ -61,7 +61,6 @@ class RuntimeContext(BaseModel):
     data_source_selection: Literal["local_workspace", "catalog_default", "runtime_override", "runtime_binding"] = "catalog_default"
     data_source_error: str | None = None
     bootstrap: RuntimeBootstrapDescriptor | None = None
-    hosted_bootstrap: RuntimeBootstrapDescriptor | None = None
     dialect: Literal["sqlite", "postgresql", "mysql", "mssql"] | None
     paramstyle: Literal["named", "pyformat", "qmark"] | None
     data_source: dict | None