chore(release): bump version to 0.0.9

- Only restyle bodies for plpgsql/sql; skip pl* (plpython3u, plperl, ...), c and internal
- Keep LANGUAGE clause on DO blocks
- Carry multi-line string and dollar-quoted literals verbatim in bodies and DML
- Format dollar-quoted literals that contain code (declare/begin/select/...), never format() templates
- Fix code joined onto -- comments, early flush after raise exception, dropped comment before BEGIN
- Regenerate test_mm_proc golden; document in README, plan, todo

.gitea/workflows/release.yml

@@ -55,6 +55,14 @@ jobs:
               -ldflags "-X main.version=${VERSION}" \
               -o "$NAME" ./cmd/pgtidy
             echo "Built $NAME ($(ls -lh "$NAME" | awk '{print $5}'))"
+            if [ "$GOOS" = "linux" ]; then
+              PKGVER="${VERSION#v}"
+              TARNAME="pgtidy_${PKGVER}_${GOOS}_${GOARCH}.tar.gz"
+              cp "$NAME" pgtidy
+              tar czf "$TARNAME" pgtidy LICENSE
+              rm pgtidy
+              echo "Packed $TARNAME"
+            fi
           done
 
       - name: Create release and upload binaries
@@ -64,12 +72,11 @@ jobs:
           API="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases"
 
           PREV_TAG=$(git tag --sort=-version:refname | { grep -v "^${TAG}$" || true; } | head -1)
-          if [ -n "$PREV_TAG" ]; then
-            RANGE="${PREV_TAG}..${TAG}"
+          if [ -n "$PREV_TAG" ] && git rev-parse --verify "${PREV_TAG}" >/dev/null 2>&1; then
+            NOTES=$(git log "${PREV_TAG}..${TAG}" --pretty=format:"- %s" --no-merges)
           else
-            RANGE="HEAD~20..HEAD"
+            NOTES=$(git log --pretty=format:"- %s" --no-merges)
           fi
-          NOTES=$(git log "$RANGE" --pretty=format:"- %s" --no-merges)
           BODY="## What's changed"$'\n'"${NOTES}"
           BODY_JSON=$(printf '%s' "$BODY" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))')
 
@@ -77,7 +84,7 @@ jobs:
           RELEASE=$(curl -s -X POST "$API" \
             -H "Authorization: token ${GITHUB_TOKEN}" \
             -H "Content-Type: application/json" \
-            -d "{\"tag_name\":\"${TAG}\",\"name\":\"${TAG}\",\"body\":${BODY_JSON},\"draft\":true}")
+            -d "{\"tag_name\":\"${TAG}\",\"name\":\"${TAG}\",\"body\":${BODY_JSON}}")
           echo "API response: $RELEASE"
 
           UPLOAD_URL=$(echo "$RELEASE" | grep -o '"upload_url":"[^"]*"' | cut -d'"' -f4 | sed 's/{[^}]*}//')
@@ -86,7 +93,7 @@ jobs:
             exit 1
           fi
 
-          for f in pgtidy-*; do
+          for f in pgtidy-* pgtidy_*.tar.gz; do
             echo "Uploading $f..."
             curl -sf -X POST "${UPLOAD_URL}?name=${f}" \
               -H "Authorization: token ${GITHUB_TOKEN}" \
@@ -152,47 +159,36 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
         with:
-          fetch-depth: 0
+          go-version-file: go.mod
 
       - name: Build RPM
         run: |
           set -euo pipefail
           VERSION="${{ github.event.inputs.tag || github.ref_name }}"
           PKGVER="${VERSION#v}"
-          GO_VER="$(awk '/^go / { print $2; exit }' go.mod)"
 
-          git archive --format=tar.gz --prefix=pgtidy-${PKGVER}/ HEAD \
-            > pgtidy-${PKGVER}.tar.gz
+          sudo apt-get update -y
+          sudo apt-get install -y rpm
+
+          CGO_ENABLED=0 go build \
+            -trimpath \
+            -ldflags "-X main.version=${PKGVER}" \
+            -o pgtidy \
+            ./cmd/pgtidy
 
           sed -i "s/^Version:.*/Version:        ${PKGVER}/" linux/centos/pgtidy.spec
 
-          CID=$(docker create \
-            -e GO_VER="${GO_VER}" \
-            -e PKGVER="${PKGVER}" \
-            -w /build \
-            rockylinux:9 \
-            bash -lc "
-              set -euo pipefail
-              dnf install -y rpm-build git &&
-              curl -fsSL https://go.dev/dl/go\${GO_VER}.linux-amd64.tar.gz | tar -C /usr/local -xz &&
-              export PATH=\$PATH:/usr/local/go/bin &&
-              mkdir -p ~/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS} &&
-              cp pgtidy-${PKGVER}.tar.gz ~/rpmbuild/SOURCES/ &&
-              cp linux/centos/pgtidy.spec ~/rpmbuild/SPECS/ &&
-              rpmbuild --nodeps -ba ~/rpmbuild/SPECS/pgtidy.spec
-            ")
+          mkdir -p ~/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}
+          cp pgtidy ~/rpmbuild/SOURCES/pgtidy
+          cp LICENSE ~/rpmbuild/SOURCES/LICENSE
+          cp linux/centos/pgtidy.spec ~/rpmbuild/SPECS/
+          rpmbuild --nodeps -bb ~/rpmbuild/SPECS/pgtidy.spec
 
-          cleanup() { docker rm -f "$CID" >/dev/null 2>&1 || true; }
-          trap cleanup EXIT
-
-          docker cp pgtidy-${PKGVER}.tar.gz "$CID:/build/"
-          docker cp linux "$CID:/build/linux"
-          docker start -a "$CID"
           mkdir -p rpm-out
-          docker cp "$CID:/root/rpmbuild/RPMS/." rpm-out/
-
-          trap - EXIT; cleanup
+          find ~/rpmbuild/RPMS/ -name '*.rpm' -exec cp {} rpm-out/ \;
 
       - name: Upload to release
         run: |
@@ -212,6 +208,52 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+  pkg-nsis:
+    name: Windows installer
+    needs: release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Build NSIS installer
+        run: |
+          set -euo pipefail
+          VERSION="${{ github.event.inputs.tag || github.ref_name }}"
+          PKGVER="${VERSION#v}"
+
+          sudo apt-get update -y
+          sudo apt-get install -y nsis
+
+          GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build \
+            -trimpath \
+            -ldflags "-X main.version=${PKGVER}" \
+            -o pgtidy-windows-amd64.exe \
+            ./cmd/pgtidy
+
+          makensis -DVERSION="${PKGVER}" -DEXE="$PWD/pgtidy-windows-amd64.exe" -DOUT="$PWD/pgtidy-setup-windows-amd64.exe" windows/installer.nsi
+
+      - name: Upload to release
+        run: |
+          set -euo pipefail
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          RELEASE=$(curl -s "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" \
+            -H "Authorization: token ${GITHUB_TOKEN}")
+          UPLOAD_URL=$(echo "$RELEASE" | grep -o '"upload_url":"[^"]*"' | cut -d'"' -f4 | sed 's/{[^}]*}//')
+          [ -z "$UPLOAD_URL" ] && { echo "upload_url not found: $RELEASE"; exit 1; }
+          for f in pgtidy-setup-windows-amd64.exe; do
+            echo "Uploading $(basename "$f")..."
+            curl -s -X POST "${UPLOAD_URL}?name=$(basename "$f")" \
+              -H "Authorization: token ${GITHUB_TOKEN}" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@${f}" > /dev/null
+          done
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   pkg-aur:
     name: AUR package
     needs: release
@@ -259,8 +301,13 @@ jobs:
           GIT_SSH_COMMAND="ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$AUR_KNOWN_HOSTS -i $AUR_KEY_PATH" \
             git clone ssh://aur@aur.archlinux.org/pgtidy-bin.git aur-repo
 
-          CURRENT_PKGVER=$(awk -F= '/^pkgver=/ {print $2; exit}' aur-repo/PKGBUILD | tr -d "[:space:]")
-          CURRENT_PKGREL=$(awk -F= '/^pkgrel=/ {print $2; exit}' aur-repo/PKGBUILD | tr -d "[:space:]")
+          if [ -f aur-repo/PKGBUILD ]; then
+            CURRENT_PKGVER=$(awk -F= '/^pkgver=/ {print $2; exit}' aur-repo/PKGBUILD | tr -d "[:space:]")
+            CURRENT_PKGREL=$(awk -F= '/^pkgrel=/ {print $2; exit}' aur-repo/PKGBUILD | tr -d "[:space:]")
+          else
+            CURRENT_PKGVER=""
+            CURRENT_PKGREL=0
+          fi
 
           if [ "$CURRENT_PKGVER" = "$PKGVER" ]; then
             PKGREL=$((CURRENT_PKGREL + 1))
@@ -270,8 +317,8 @@ jobs:
 
           echo "Publishing pgtidy-bin ${PKGVER}-${PKGREL} to AUR"
 
-          SHA_AMD64=$(curl -fsSL "https://git.warky.dev/wdevs/pgtidy/releases/download/v${PKGVER}/pgtidy-linux-amd64" | sha256sum | cut -d' ' -f1)
-          SHA_ARM64=$(curl -fsSL "https://git.warky.dev/wdevs/pgtidy/releases/download/v${PKGVER}/pgtidy-linux-arm64" | sha256sum | cut -d' ' -f1)
+          SHA_AMD64=$(curl -fsSL "https://git.warky.dev/wdevs/pgtidy/releases/download/v${PKGVER}/pgtidy_${PKGVER}_linux_amd64.tar.gz" | sha256sum | cut -d' ' -f1)
+          SHA_ARM64=$(curl -fsSL "https://git.warky.dev/wdevs/pgtidy/releases/download/v${PKGVER}/pgtidy_${PKGVER}_linux_arm64.tar.gz" | sha256sum | cut -d' ' -f1)
 
           sed -e "s/^pkgver=.*/pkgver=${PKGVER}/" \
               -e "s/^pkgrel=.*/pkgrel=${PKGREL}/" \
@@ -312,14 +359,24 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: latest
+
+      - name: Set version from tag
+        working-directory: editors/vscode
+        run: |
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          npm pkg set version="${TAG#v}"
 
       - name: Install and package
         working-directory: editors/vscode
         run: |
-          npm ci
-          npm run compile
-          npm run package
+          pnpm install --frozen-lockfile
+          pnpm run compile
+          pnpm run package
 
       - name: Upload to release
         run: |
@@ -351,6 +408,12 @@ jobs:
           distribution: temurin
           java-version: '21'
 
+      - name: Set version from tag
+        working-directory: editors/datagrip
+        run: |
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          sed -i "s/^pluginVersion=.*/pluginVersion=${TAG#v}/" gradle.properties
+
       - name: Build plugin
         working-directory: editors/datagrip
         run: ./gradlew buildPlugin

.github/workflows/ci.yml

@@ -1,62 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-jobs:
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - name: Vet
-        run: go vet ./...
-
-      - name: Test
-        run: go test ./...
-
-      - name: Format check
-        run: |
-          unformatted=$(gofmt -l .)
-          if [ -n "$unformatted" ]; then
-            echo "Files need gofmt:"
-            echo "$unformatted"
-            exit 1
-          fi
-
-  build-snapshot:
-    name: Build snapshot
-    runs-on: ubuntu-latest
-    needs: test
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - uses: goreleaser/goreleaser-action@v6
-        with:
-          version: latest
-          args: release --snapshot --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: dist-snapshot
-          path: dist/
-          retention-days: 7

.github/workflows/release.yml

@@ -1,83 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - uses: goreleaser/goreleaser-action@v6
-        with:
-          version: latest
-          args: release --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
-
-  vscode-package:
-    name: VSCode Extension
-    runs-on: ubuntu-latest
-    needs: release
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: npm
-          cache-dependency-path: editors/vscode/package-lock.json
-
-      - name: Install and package
-        working-directory: editors/vscode
-        run: |
-          npm ci
-          npm run compile
-          npm run package
-
-      - name: Upload to release
-        run: gh release upload ${{ github.ref_name }} editors/vscode/*.vsix
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  datagrip-package:
-    name: DataGrip Plugin
-    runs-on: ubuntu-latest
-    needs: release
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: '21'
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
-
-      - name: Build plugin
-        working-directory: editors/datagrip
-        run: ./gradlew buildPlugin
-
-      - name: Upload to release
-        run: gh release upload ${{ github.ref_name }} editors/datagrip/build/distributions/*.zip
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -164,4 +164,6 @@ dist
 .pnp.*
 
 temp/*
-dist/*
+dist/*
+# Local build of the CLI binary
+/pgtidy

.golangci.yml

@@ -0,0 +1,4 @@
+version: "2"
+
+linters:
+  default: standard

AGENTS.md

@@ -36,7 +36,7 @@ pkg/pgast/         — go-pgquery wrapper: SQL → real PG AST (lint, v2)
 pkg/lint/          — rule engine + rule packs (v2)
 pkg/lsp/           — LSP server (v3)
 editors/vscode/    — VSCode extension (v3)
-editors/datagrip/  — LSP4IJ integration (v4)
+editors/datagrip/  — native JetBrains plugin, shells out to the CLI (v4)
 testdata/corpus/   — real-world .pgsql procedures used as the safety/idempotence harness
 ```
 
@@ -59,6 +59,29 @@ testdata/corpus/   — real-world .pgsql procedures used as the safety/idempoten
 3. **Idempotence**: `fmt(fmt(x)) == fmt(x)`.
 4. **Graceful degradation**: any span the parser cannot handle is passed through verbatim
    rather than corrupted.
+5. **Runtime safety gate**: every frontend (CLI `fmt`, LSP `textDocument/formatting` and
+   `rangeFormatting`) calls `format.VerifySafe(src, out, style)` before writing or returning
+   formatted output. If it returns a non-nil error the formatter has a bug — the caller must
+   refuse to write/emit the result and keep the original source, never guess or best-effort
+   it. This is enforced at runtime, not just in `pkg/format/*_test.go`, so a formatter bug can
+   never silently drop or alter code. `VerifySafe` runs four checks:
+   - **Semantic equivalence** (`SemanticallyEqual`): re-lex both sides, compare the non-trivia
+     token streams — case-insensitive for identifiers/keywords, exact otherwise, recursing
+     into dollar-quoted bodies. Comments and whitespace are trivia and are ignored here.
+   - **Comment preservation** (`CommentsPreserved`): every `--` and `/* */` comment in `src`
+     reappears in `out`, in order, with the same content (line endings and indentation are
+     normalised away; dropping, merging, splitting, reordering, or rewording a comment is
+     not). Descends into dollar-quoted bodies.
+   - **Structural balance** (`StructurallyBalanced`): the `( ) [ ]` and BEGIN/CASE/IF/LOOP…END
+     nesting profile of `out` matches `src`, counting only real code tokens (comment and
+     string/dollar-quote contents are skipped).
+   - **Idempotence**: re-formatting `out` yields `out` unchanged.
+
+**Line endings**: the formatter re-emits all layout with `st.Newline` (default `\n`), so a
+CRLF input file is normalised to LF on write. This includes `\r\n` that sits *inside* a
+multi-line string literal — a line-ending change there is layout normalisation, not a change
+of code content, so `SemanticallyEqual` compares string tokens modulo `\r\n` ↔ `\n`
+(`normNL` in `pkg/format/safety.go`). Set `newline: "\r\n"` in `.pgtidy.yaml` to keep CRLF.
 
 ## Commands
 
@@ -111,8 +134,9 @@ go fmt ./...             # Format Go code
   Per-platform VSIX (`win32/linux/darwin × x64/arm64`) built in CI matrix.
 
 ### V4 — DataGrip
-- `editors/datagrip`: integrate via LSP4IJ (free, works across JetBrains editions incl.
-  DataGrip). No core changes expected.
+- `editors/datagrip`: native JetBrains plugin (no LSP4IJ dependency) that shells out to the
+  `pgtidy` binary directly. Formatting and version info run `pgtidy fmt`/`version`; lint
+  diagnostics and quick-fixes run via a native `ExternalAnnotator` calling `pgtidy lint --json`.
 
 ## Verification
 - **Formatter:** `go test ./...` runs golden-file tests + corpus harness asserting idempotence

Makefile

@@ -2,7 +2,7 @@ APP     := pgtidy
 CMD     := ./cmd/pgtidy
 DIST    := dist
 
-.PHONY: build test lint vet fmt clean release release-version snapshot vscode-compile vscode-package
+.PHONY: installer-windows build test lint vet fmt clean release release-version snapshot vscode-compile vscode-package
 
 ## build: compile binary for the current platform
 build:
@@ -20,9 +20,15 @@ vet:
 fmt:
 	go fmt ./...
 
-## lint: vet + format check
+## lint: vet + format check + golangci-lint
 lint: vet
 	test -z "$$(gofmt -l .)" || (echo "gofmt needed:"; gofmt -l .; exit 1)
+	golangci-lint run ./...
+
+## installer-windows: build the Windows binary and NSIS installer (requires makensis)
+installer-windows:
+	GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.version=$$(git describe --tags --abbrev=0 2>/dev/null || echo dev)" -o $(DIST)/pgtidy-windows-amd64.exe $(CMD)
+	makensis -DVERSION=$$(git describe --tags --abbrev=0 2>/dev/null | sed 's/^v//' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$$' || echo 0.0.0) -DEXE=$(CURDIR)/$(DIST)/pgtidy-windows-amd64.exe -DOUT=$(CURDIR)/$(DIST)/pgtidy-setup-windows-amd64.exe windows/installer.nsi
 
 ## clean: remove build artifacts
 clean:

README.md

@@ -18,6 +18,9 @@ go install git.warky.dev/wdevs/pgtidy/cmd/pgtidy@latest
 
 Or download a pre-built binary from [Releases](https://git.warky.dev/wdevs/pgtidy/releases).
 
+**Windows** — run `pgtidy-setup-windows-amd64.exe` from the release. It installs to
+`%ProgramFiles%\PgTidy` and adds it to the system `PATH`. Update later with `pgtidy update`.
+
 ---
 
 ## CLI
@@ -27,6 +30,7 @@ pgtidy fmt    [flags] [files...]   Format SQL/PL-pgSQL (stdin if no files)
 pgtidy lint   [flags] [files...]   Lint SQL
 pgtidy config                      Print effective configuration
 pgtidy lsp                         Start LSP server (stdio)
+pgtidy update [--check] [-y]       Check for a newer release (installs it on Windows)
 pgtidy version
 ```
 
@@ -76,6 +80,7 @@ pgtidy config   # print resolved config
 - Leading-comma lists (SELECT columns, function params)
 - Function params one-per-line; `LANGUAGE`, `SECURITY`, volatility each on own line
 - PL/pgSQL: `DECLARE` block vars 2-space indented; `BEGIN`/`END` at body level
+- Procedural languages: bodies in `pl*` languages other than `plpgsql` (e.g. `plpython3u`, `plperl`), `c` and `internal` are left verbatim; `plpgsql` and `sql` bodies are formatted, and the function header is always formatted
 - Spaces around binary operators (`=`, `<>`, `||`, `:=`); no space before `(` or around `::`, `->`, `->>`
 
 ---

cmd/pgtidy/config.go

@@ -11,7 +11,7 @@ import (
 func cmdConfig(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	for _, a := range args {
 		if a == "-h" || a == "--help" {
-			fmt.Fprintln(stdout, "pgtidy config — print effective configuration resolved from .pgtidy.yaml")
+			_, _ = fmt.Fprintln(stdout, "pgtidy config — print effective configuration resolved from .pgtidy.yaml")
 			return 0
 		}
 	}
@@ -21,14 +21,14 @@ func cmdConfig(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	}
 	st, err := config.Load(wd)
 	if err != nil {
-		fmt.Fprintf(stderr, "pgtidy: %v\n", err)
+		_, _ = fmt.Fprintf(stderr, "pgtidy: %v\n", err)
 		return 2
 	}
-	fmt.Fprintf(stdout, "indent:       %q\n", st.Indent)
-	fmt.Fprintf(stdout, "newline:      %q\n", st.Newline)
-	fmt.Fprintf(stdout, "keyword_case: %s\n", st.KeywordCase)
-	fmt.Fprintf(stdout, "ident_case:   %s\n", st.IdentCase)
-	fmt.Fprintf(stdout, "type_case:    %s\n", st.TypeCase)
-	fmt.Fprintf(stdout, "commas:       %s\n", st.Commas)
+	_, _ = fmt.Fprintf(stdout, "indent:       %q\n", st.Indent)
+	_, _ = fmt.Fprintf(stdout, "newline:      %q\n", st.Newline)
+	_, _ = fmt.Fprintf(stdout, "keyword_case: %s\n", st.KeywordCase)
+	_, _ = fmt.Fprintf(stdout, "ident_case:   %s\n", st.IdentCase)
+	_, _ = fmt.Fprintf(stdout, "type_case:    %s\n", st.TypeCase)
+	_, _ = fmt.Fprintf(stdout, "commas:       %s\n", st.Commas)
 	return 0
 }

cmd/pgtidy/fmt.go

@@ -37,7 +37,7 @@ func cmdFmt(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 			return 0
 		default:
 			if len(a) > 1 && a[0] == '-' {
-				fmt.Fprintf(stderr, "pgtidy fmt: unknown flag %q\n", a)
+				_, _ = fmt.Fprintf(stderr, "pgtidy fmt: unknown flag %q\n", a)
 				return 2
 			}
 			files = append(files, a)
@@ -51,7 +51,7 @@ func cmdFmt(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	}
 	st, err := config.Load(wd)
 	if err != nil {
-		fmt.Fprintf(stderr, "%v\n", err)
+		_, _ = fmt.Fprintf(stderr, "%v\n", err)
 		return 2
 	}
 
@@ -59,19 +59,23 @@ func cmdFmt(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	if len(files) == 0 {
 		src, err := io.ReadAll(stdin)
 		if err != nil {
-			fmt.Fprintf(stderr, "pgtidy: reading stdin: %v\n", err)
+			_, _ = fmt.Fprintf(stderr, "pgtidy: reading stdin: %v\n", err)
 			return 2
 		}
 		out := format.File(parser.Parse(string(src)), st)
+		if err := format.VerifySafe(string(src), out, st); err != nil {
+			_, _ = fmt.Fprintf(stderr, "pgtidy: refusing to format stdin: formatter safety check failed: %v\n", err)
+			return 2
+		}
 		switch {
 		case check:
 			if out != string(src) {
 				return 1
 			}
 		case diff:
-			io.WriteString(stdout, unifiedDiff(string(src), out, "stdin"))
+			_, _ = io.WriteString(stdout, unifiedDiff(string(src), out, "stdin"))
 		default:
-			io.WriteString(stdout, out)
+			_, _ = io.WriteString(stdout, out)
 		}
 		return 0
 	}
@@ -81,11 +85,16 @@ func cmdFmt(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	for _, path := range files {
 		src, err := os.ReadFile(path)
 		if err != nil {
-			fmt.Fprintf(stderr, "pgtidy: %v\n", err)
+			_, _ = fmt.Fprintf(stderr, "pgtidy: %v\n", err)
 			exit = 2
 			continue
 		}
 		out := format.File(parser.Parse(string(src)), st)
+		if err := format.VerifySafe(string(src), out, st); err != nil {
+			_, _ = fmt.Fprintf(stderr, "pgtidy: refusing to format %s: formatter safety check failed: %v\n", path, err)
+			exit = 2
+			continue
+		}
 		changed := out != string(src)
 		if changed {
 			anyDiff = true
@@ -94,22 +103,22 @@ func cmdFmt(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 		case write:
 			if changed {
 				if err := os.WriteFile(path, []byte(out), 0o644); err != nil {
-					fmt.Fprintf(stderr, "pgtidy: writing %s: %v\n", path, err)
+					_, _ = fmt.Fprintf(stderr, "pgtidy: writing %s: %v\n", path, err)
 					exit = 2
 				}
 			}
 		case list:
 			if changed {
-				fmt.Fprintln(stdout, path)
+				_, _ = fmt.Fprintln(stdout, path)
 			}
 		case diff:
 			if changed {
-				io.WriteString(stdout, unifiedDiff(string(src), out, path))
+				_, _ = io.WriteString(stdout, unifiedDiff(string(src), out, path))
 			}
 		case check:
 			// handled after loop via anyDiff
 		default:
-			io.WriteString(stdout, out)
+			_, _ = io.WriteString(stdout, out)
 		}
 	}
 	if check && anyDiff && exit == 0 {

cmd/pgtidy/lint.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"encoding/json"
 	"fmt"
 	"io"
 	"os"
@@ -18,9 +19,10 @@ import (
 //	file:line:col: [RULEID] severity: message
 func cmdLint(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	var (
-		only  []string // --only=ID,ID rule filter
-		fix   bool
-		files []string
+		only       []string // --only=ID,ID rule filter
+		fix        bool
+		jsonOutput bool
+		files      []string
 	)
 	for _, a := range args {
 		switch {
@@ -29,6 +31,8 @@ func cmdLint(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 			return 0
 		case a == "--fix":
 			fix = true
+		case a == "--json":
+			jsonOutput = true
 		case strings.HasPrefix(a, "--only="):
 			ids := strings.Split(strings.TrimPrefix(a, "--only="), ",")
 			for _, id := range ids {
@@ -37,7 +41,7 @@ func cmdLint(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 				}
 			}
 		case len(a) > 1 && a[0] == '-':
-			fmt.Fprintf(stderr, "pgtidy lint: unknown flag %q\n", a)
+			_, _ = fmt.Fprintf(stderr, "pgtidy lint: unknown flag %q\n", a)
 			return 2
 		default:
 			files = append(files, a)
@@ -66,7 +70,13 @@ func cmdLint(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 		return diags, nil
 	}
 
-	printDiags := func(diags []diagnostics.Diagnostic) {
+	var jsonDiags []diagnostics.Diagnostic
+
+	reportDiags := func(diags []diagnostics.Diagnostic) {
+		if jsonOutput {
+			jsonDiags = append(jsonDiags, diags...)
+			return
+		}
 		for _, d := range diags {
 			loc := d.File
 			if d.Line > 0 {
@@ -75,7 +85,7 @@ func cmdLint(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 			if loc == "" {
 				loc = "stdin"
 			}
-			fmt.Fprintf(stdout, "%s: [%s] %s: %s\n", loc, d.RuleID, d.Severity, d.Message)
+			_, _ = fmt.Fprintf(stdout, "%s: [%s] %s: %s\n", loc, d.RuleID, d.Severity, d.Message)
 		}
 	}
 
@@ -84,22 +94,22 @@ func cmdLint(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	if len(files) == 0 {
 		src, err := io.ReadAll(stdin)
 		if err != nil {
-			fmt.Fprintf(stderr, "pgtidy: reading stdin: %v\n", err)
+			_, _ = fmt.Fprintf(stderr, "pgtidy: reading stdin: %v\n", err)
 			return 2
 		}
 		diags, err := check(string(src), "")
 		if err != nil {
-			fmt.Fprintf(stderr, "pgtidy: %v\n", err)
+			_, _ = fmt.Fprintf(stderr, "pgtidy: %v\n", err)
 			return 2
 		}
-		if fix {
+		if fix && !jsonOutput {
 			fixed := lint.ApplyFixes(string(src), diags)
 			if fixed != string(src) {
-				io.WriteString(stdout, fixed)
+				_, _ = io.WriteString(stdout, fixed)
 				return 0
 			}
 		}
-		printDiags(diags)
+		reportDiags(diags)
 		if len(diags) > 0 {
 			found = true
 		}
@@ -107,36 +117,47 @@ func cmdLint(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 		for _, path := range files {
 			src, err := os.ReadFile(path)
 			if err != nil {
-				fmt.Fprintf(stderr, "pgtidy: %v\n", err)
+				_, _ = fmt.Fprintf(stderr, "pgtidy: %v\n", err)
 				return 2
 			}
 			diags, err := check(string(src), path)
 			if err != nil {
-				fmt.Fprintf(stderr, "pgtidy: %v\n", err)
+				_, _ = fmt.Fprintf(stderr, "pgtidy: %v\n", err)
 				return 2
 			}
-			if fix {
+			if fix && !jsonOutput {
 				fixed := lint.ApplyFixes(string(src), diags)
 				if fixed != string(src) {
 					if err := os.WriteFile(path, []byte(fixed), 0o644); err != nil {
-						fmt.Fprintf(stderr, "pgtidy: writing %s: %v\n", path, err)
+						_, _ = fmt.Fprintf(stderr, "pgtidy: writing %s: %v\n", path, err)
 						return 2
 					}
 					// Re-check to report any remaining unfixed diagnostics.
 					diags, err = check(fixed, path)
 					if err != nil {
-						fmt.Fprintf(stderr, "pgtidy: %v\n", err)
+						_, _ = fmt.Fprintf(stderr, "pgtidy: %v\n", err)
 						return 2
 					}
 				}
 			}
-			printDiags(diags)
+			reportDiags(diags)
 			if len(diags) > 0 {
 				found = true
 			}
 		}
 	}
 
+	if jsonOutput {
+		if jsonDiags == nil {
+			jsonDiags = []diagnostics.Diagnostic{}
+		}
+		enc := json.NewEncoder(stdout)
+		if err := enc.Encode(jsonDiags); err != nil {
+			_, _ = fmt.Fprintf(stderr, "pgtidy: encoding json: %v\n", err)
+			return 2
+		}
+	}
+
 	if found {
 		return 1
 	}
@@ -144,12 +165,13 @@ func cmdLint(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 }
 
 func lintUsage(w io.Writer) {
-	fmt.Fprint(w, `Usage: pgtidy lint [flags] [file ...]
+	_, _ = fmt.Fprint(w, `Usage: pgtidy lint [flags] [file ...]
 
 Read SQL from files (or stdin) and report lint findings.
 
 Flags:
   --fix           Apply autofixes for fixable rules (MIG001, MIG003) and rewrite files
+  --json          Emit findings as a JSON array instead of text (ignores --fix)
   --only=ID,...   comma-separated rule IDs to enable (default: all rules)
   -h, --help      show this help
 

cmd/pgtidy/lsp.go

@@ -12,7 +12,7 @@ import (
 func cmdLsp(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	for _, a := range args {
 		if a == "-h" || a == "--help" {
-			fmt.Fprintln(stdout, "pgtidy lsp — start the Language Server Protocol server (stdio transport)")
+			_, _ = fmt.Fprintln(stdout, "pgtidy lsp — start the Language Server Protocol server (stdio transport)")
 			return 0
 		}
 	}
@@ -21,7 +21,7 @@ func cmdLsp(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 		wd = "."
 	}
 	if err := lsp.Serve(context.Background(), stdin, stdout, wd); err != nil {
-		fmt.Fprintf(stderr, "pgtidy lsp: %v\n", err)
+		_, _ = fmt.Fprintf(stderr, "pgtidy lsp: %v\n", err)
 		return 1
 	}
 	return 0

cmd/pgtidy/main.go

@@ -28,27 +28,30 @@ func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 		return cmdLsp(args[1:], stdin, stdout, stderr)
 	case "config":
 		return cmdConfig(args[1:], stdin, stdout, stderr)
+	case "update":
+		return cmdUpdate(args[1:], stdin, stdout, stderr)
 	case "version", "--version", "-v":
-		fmt.Fprintf(stdout, "pgtidy %s\n", version)
+		_, _ = fmt.Fprintf(stdout, "pgtidy %s\n", version)
 		return 0
 	case "help", "-h", "--help":
 		usage(stdout)
 		return 0
 	default:
-		fmt.Fprintf(stderr, "pgtidy: unknown command %q\n", args[0])
+		_, _ = fmt.Fprintf(stderr, "pgtidy: unknown command %q\n", args[0])
 		usage(stderr)
 		return 2
 	}
 }
 
 func usage(w io.Writer) {
-	fmt.Fprint(w, `pgtidy — PostgreSQL formatter and linter
+	_, _ = fmt.Fprint(w, `pgtidy — PostgreSQL formatter and linter
 
 Usage:
   pgtidy fmt    [flags] [files...]  Format SQL/PL-pgSQL (stdin if no files)
   pgtidy lint   [flags] [files...]  Lint SQL (stdin if no files)
   pgtidy config                     Print effective configuration
   pgtidy lsp                        Start LSP server (stdio, for editors)
+  pgtidy update [--check] [-y]      Check for a newer release (installs on Windows)
   pgtidy version                    Print version
   pgtidy help                       Show this help
 

cmd/pgtidy/update.go

@@ -0,0 +1,158 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"git.warky.dev/wdevs/pgtidy/pkg/updatecheck"
+)
+
+// windowsInstallerAsset is the release asset built by the NSIS installer step.
+const windowsInstallerAsset = "pgtidy-setup-windows-amd64.exe"
+
+// cmdUpdate implements `pgtidy update`: check the latest release and, on
+// Windows, offer to download and run the installer.
+func cmdUpdate(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
+	var checkOnly, assumeYes bool
+	for _, a := range args {
+		switch a {
+		case "--check":
+			checkOnly = true
+		case "-y", "--yes":
+			assumeYes = true
+		case "-h", "--help":
+			_, _ = fmt.Fprint(stdout, `pgtidy update — check for a newer release
+
+Usage:
+  pgtidy update [--check] [-y|--yes]
+
+  --check    Only report whether an update is available
+  -y, --yes  Update without prompting
+
+On Windows the installer is downloaded and started; elsewhere the release
+page URL is shown.
+`)
+			return 0
+		default:
+			_, _ = fmt.Fprintf(stderr, "pgtidy update: unknown flag %q\n", a)
+			return 2
+		}
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	defer cancel()
+	err := runUpdate(ctx, updateOptions{
+		current:   version,
+		apiURL:    updatecheck.DefaultAPIURL,
+		goos:      runtime.GOOS,
+		checkOnly: checkOnly,
+		assumeYes: assumeYes,
+		in:        stdin,
+		out:       stdout,
+		install:   downloadAndRunInstaller,
+	})
+	if err != nil {
+		_, _ = fmt.Fprintf(stderr, "pgtidy update: %v\n", err)
+		return 1
+	}
+	return 0
+}
+
+type updateOptions struct {
+	current   string
+	apiURL    string
+	goos      string
+	checkOnly bool
+	assumeYes bool
+	in        io.Reader
+	out       io.Writer
+	// install downloads and starts the installer found at url.
+	install func(ctx context.Context, url string, out io.Writer) error
+}
+
+func runUpdate(ctx context.Context, o updateOptions) error {
+	rel, err := updatecheck.Latest(ctx, nil, o.apiURL)
+	if err != nil {
+		return err
+	}
+
+	if !updatecheck.IsNewer(o.current, rel.Tag) {
+		_, _ = fmt.Fprintf(o.out, "PgTidy %s is up to date (latest release: %s)\n", o.current, rel.Tag)
+		return nil
+	}
+
+	_, _ = fmt.Fprintf(o.out, "A newer PgTidy is available: %s (installed: %s)\n", rel.Tag, o.current)
+	if o.checkOnly {
+		_, _ = fmt.Fprintf(o.out, "Release: %s\n", rel.URL)
+		return nil
+	}
+
+	installer, canInstall := rel.FindAsset(windowsInstallerAsset)
+	if o.goos != "windows" || !canInstall {
+		_, _ = fmt.Fprintf(o.out, "Download it from: %s\n", rel.URL)
+		return nil
+	}
+
+	if !o.assumeYes && !confirm(o.in, o.out, "Download and run the installer now?") {
+		_, _ = fmt.Fprintf(o.out, "Skipped. Release: %s\n", rel.URL)
+		return nil
+	}
+	return o.install(ctx, installer.URL, o.out)
+}
+
+// confirm asks a yes/no question, defaulting to no.
+func confirm(in io.Reader, out io.Writer, question string) bool {
+	_, _ = fmt.Fprintf(out, "%s [y/N]: ", question)
+	line, _ := bufio.NewReader(in).ReadString('\n')
+	switch strings.ToLower(strings.TrimSpace(line)) {
+	case "y", "yes":
+		return true
+	}
+	return false
+}
+
+// downloadAndRunInstaller saves the installer to a temp directory and starts
+// it detached so this process can exit and release pgtidy.exe.
+func downloadAndRunInstaller(ctx context.Context, url string, out io.Writer) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("downloading installer: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("downloading installer: unexpected status %s", resp.Status)
+	}
+
+	dir, err := os.MkdirTemp("", "pgtidy-update-")
+	if err != nil {
+		return err
+	}
+	path := filepath.Join(dir, windowsInstallerAsset)
+	f, err := os.Create(path)
+	if err != nil {
+		return err
+	}
+	if _, err := io.Copy(f, resp.Body); err != nil {
+		_ = f.Close()
+		return fmt.Errorf("downloading installer: %w", err)
+	}
+	if err := f.Close(); err != nil {
+		return err
+	}
+
+	_, _ = fmt.Fprintf(out, "Starting installer: %s\n", path)
+	return exec.Command(path).Start()
+}

cmd/pgtidy/update_test.go

@@ -0,0 +1,110 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func releaseServer(t *testing.T, tag string, withInstaller bool) *httptest.Server {
+	t.Helper()
+	assets := ""
+	if withInstaller {
+		assets = fmt.Sprintf(`{"name":%q,"browser_download_url":"https://x/setup.exe"}`, windowsInstallerAsset)
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = fmt.Fprintf(w, `{"tag_name":%q,"html_url":"https://x/release","assets":[%s]}`, tag, assets)
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestRunUpdate(t *testing.T) {
+	tests := []struct {
+		name          string
+		current       string
+		latest        string
+		withInstaller bool
+		goos          string
+		checkOnly     bool
+		assumeYes     bool
+		stdin         string
+		wantOut       []string
+		wantInstall   bool
+	}{
+		{name: "up to date", current: "v1.0.5", latest: "v1.0.5", goos: "windows", withInstaller: true, wantOut: []string{"up to date"}},
+		{name: "dev build never prompts", current: "dev", latest: "v9.0.0", goos: "windows", withInstaller: true, wantOut: []string{"up to date"}},
+		{name: "check only", current: "v1.0.5", latest: "v1.0.6", goos: "windows", withInstaller: true, checkOnly: true, wantOut: []string{"v1.0.6", "https://x/release"}},
+		{name: "non-windows shows url", current: "v1.0.5", latest: "v1.0.6", goos: "linux", withInstaller: true, wantOut: []string{"Download it from: https://x/release"}},
+		{name: "windows without installer asset", current: "v1.0.5", latest: "v1.0.6", goos: "windows", wantOut: []string{"Download it from"}},
+		{name: "windows prompt yes", current: "v1.0.5", latest: "v1.0.6", goos: "windows", withInstaller: true, stdin: "y\n", wantOut: []string{"[y/N]"}, wantInstall: true},
+		{name: "windows prompt no", current: "v1.0.5", latest: "v1.0.6", goos: "windows", withInstaller: true, stdin: "n\n", wantOut: []string{"Skipped"}},
+		{name: "windows prompt empty", current: "v1.0.5", latest: "v1.0.6", goos: "windows", withInstaller: true, wantOut: []string{"Skipped"}},
+		{name: "windows --yes", current: "v1.0.5", latest: "v1.0.6", goos: "windows", withInstaller: true, assumeYes: true, wantInstall: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			srv := releaseServer(t, tt.latest, tt.withInstaller)
+			var out bytes.Buffer
+			var installedURL string
+			err := runUpdate(context.Background(), updateOptions{
+				current: tt.current, apiURL: srv.URL, goos: tt.goos,
+				checkOnly: tt.checkOnly, assumeYes: tt.assumeYes,
+				in: strings.NewReader(tt.stdin), out: &out,
+				install: func(_ context.Context, url string, _ io.Writer) error {
+					installedURL = url
+					return nil
+				},
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, want := range tt.wantOut {
+				if !strings.Contains(out.String(), want) {
+					t.Errorf("output missing %q:\n%s", want, out.String())
+				}
+			}
+			if (installedURL != "") != tt.wantInstall {
+				t.Errorf("installer called = %v, want %v", installedURL != "", tt.wantInstall)
+			}
+			if tt.wantInstall && installedURL != "https://x/setup.exe" {
+				t.Errorf("installer url = %q", installedURL)
+			}
+		})
+	}
+}
+
+func TestRunUpdate_Errors(t *testing.T) {
+	bad := httptest.NewServer(http.NotFoundHandler())
+	defer bad.Close()
+	if err := runUpdate(context.Background(), updateOptions{current: "v1.0.0", apiURL: bad.URL, out: io.Discard}); err == nil {
+		t.Error("expected lookup error")
+	}
+
+	srv := releaseServer(t, "v1.0.6", true)
+	want := errors.New("boom")
+	err := runUpdate(context.Background(), updateOptions{
+		current: "v1.0.5", apiURL: srv.URL, goos: "windows", assumeYes: true, out: io.Discard,
+		install: func(context.Context, string, io.Writer) error { return want },
+	})
+	if !errors.Is(err, want) {
+		t.Errorf("err = %v", err)
+	}
+}
+
+func TestDownloadAndRunInstaller_BadStatus(t *testing.T) {
+	srv := httptest.NewServer(http.NotFoundHandler())
+	defer srv.Close()
+	if err := downloadAndRunInstaller(context.Background(), srv.URL, io.Discard); err == nil {
+		t.Error("expected error for non-200")
+	}
+	if err := downloadAndRunInstaller(context.Background(), "://bad", io.Discard); err == nil {
+		t.Error("expected error for bad url")
+	}
+}

docs/config/default.pgtidy.yaml

@@ -1,26 +1,71 @@
-# PgTidy house style — all fields shown with their default values.
+# PgTidy house style — all fields with their default values.
 # Place as .pgtidy.yaml in your project root (or any parent directory).
 # Any field you omit keeps its default.
 
-# Indentation string for one level (two spaces).
-indent: "  "
+# --- Core ---
 
-# Line terminator written by the formatter.
-newline: "\n"
+indent: "  "      # One indentation level (two spaces).
+newline: "\n"     # Line terminator emitted by the formatter.
 
-# Casing for SQL keywords (SELECT, FROM, WHERE, …).
+# --- Casing ---
 # upper | lower | preserve
-keyword_case: upper
 
-# Casing for unquoted identifiers (column names, variable names, …).
-# upper | lower | preserve
-ident_case: lower
+keyword_case: upper       # SQL keywords (SELECT, FROM, WHERE, …)
+ident_case: lower         # Unquoted identifiers (column/variable names)
+type_case: lower          # Built-in type names (text, integer, boolean, …)
+alias_case: lower         # Token immediately following AS in SELECT / FROM
+builtin_case: lower       # Built-in function names (COALESCE, MAX, NOW, …)
+custom_type_case: lower   # User-defined / domain types not in the built-in set
 
-# Casing for built-in type names (text, integer, boolean, …).
-# upper | lower | preserve
-type_case: lower
+# --- Query layout ---
 
-# Comma placement in multi-line parameter / column lists.
-# leading  → comma at the start of the continuation line  (,col)
-# trailing → comma at the end of the preceding line       (col,)
-commas: leading
+commas: leading            # leading → ,col  |  trailing → col,
+
+align_columns: false       # Pad SELECT list items so values align vertically
+align_line_comments: false # Align trailing -- comments within a block
+select_align_as: false     # Pad between expression and AS keyword in SELECT list
+set_align_equal: false     # Align = in UPDATE SET list
+indent_join: false         # Extra indentation for JOIN … ON lines
+join_indent_size: 1        # Number of extra indent levels for JOINs
+
+# always | when_long | never
+where_wrap: always         # Each AND/OR condition on its own line (when_long: only if the clause exceeds line_width)
+select_wrap: always        # always | when_long | never — one SELECT/RETURNING column per line
+join_wrap: never           # always | when_long | never — ON (and AND/OR) on their own lines under the JOIN
+line_width: 120            # Target width for when_long wrapping; 0 = unlimited
+
+where_and_or_indent: true  # AND/OR indented one level under WHERE
+
+# --- Subqueries ---
+# same_line | new_line
+
+subquery_opening: same_line         # Opening ( placement
+subquery_content: new_line          # Content indentation inside parens
+subquery_closing: new_line          # Closing ) placement
+subquery_space_before_paren: false  # Space before ( in subqueries
+
+# --- INSERT ---
+
+insert_collapse_values: true  # Fold multiple VALUES rows onto fewer lines
+
+# --- Routines (functions / procedures) ---
+
+align_param_types: false # Pad param names so type column aligns across all params
+routine_as_wrap: true    # Newline before AS $$  (false = keep AS on same line)
+
+# --- PL/pgSQL body ---
+
+plpgsql_max_blank_lines: 1       # Max consecutive blank lines in body
+plpgsql_declare_align_type: true # Align type column in DECLARE block
+plpgsql_declare_align_eq: true   # Align := / = in DECLARE block (padded to the widest assigned declaration)
+plpgsql_if_then_newline: true     # THEN on its own line (false = same line as condition)
+plpgsql_loop_collapse: true       # Collapse empty loop bodies to one line
+
+# --- Expressions ---
+
+binary_op_align: false            # Align =, <>, || etc. vertically in WHERE/expression lists
+space_after_comma_in_calls: false # Space after , in function calls: func(a, b)
+case_when_wrap: false             # Each WHEN … THEN on its own line
+case_end: new_line                # END placement: same_line | new_line
+case_collapse: false              # Collapse a CASE to one line when it fits line_width
+record_space_before_paren: false  # Space before ( in ROW(…) / record constructors

docs/lsp-status.md

@@ -0,0 +1,97 @@
+# PgTidy LSP Status & Roadmap
+
+This document describes the current state of the PgTidy LSP server (`pkg/lsp`,
+`cmd/pgtidy/lsp.go`), what it actually provides today, and concrete next steps.
+It was written as part of issue #3 ("See what we can provide for LSP").
+
+> Note: The V3 milestone is already implemented and shipping (`docs/todo.md` marks
+> V3 done), so this is an inventory + gap analysis, not a greenfield proposal.
+
+## What the server provides today
+
+Verified by hand against the built binary (`pgtidy lsp`, JSON-RPC 2.0 over stdio,
+`Content-Length` framing) — no external LSP library, all wire types hand-rolled.
+
+### Advertised capabilities (`initialize` → `capabilities`)
+
+| Capability | Value | Where |
+|---|---|---|
+| `textDocumentSync` | `{openClose: true, change: 1 (full), willSaveWaitUntil: true}` | `serverCaps` |
+| `documentFormattingProvider` | `true` | `handle("initialize")` |
+| `documentRangeFormattingProvider` | `true` | `handle("initialize")` |
+| `codeActionProvider` | `true` | `handle("initialize")` |
+| `hoverProvider` | `true` | `handle("initialize")` |
+| `documentSymbolProvider` | `true` | `handle("initialize")` |
+
+### Supported methods
+
+| Method | Direction | Behavior |
+|---|---|---|
+| `initialize` / `shutdown` / `exit` / `initialized` | req/resp + notif | Lifecycle. `exit`/`shutdown` acknowledged with `null` result. |
+| `textDocument/didOpen` | notif | Stores document text; triggers `publishDiagnostics`. |
+| `textDocument/didChange` | notif | Stores latest content version; triggers `publishDiagnostics`. |
+| `textDocument/didClose` | notif | Drops text + fix cache; clears diagnostics with empty list. |
+| `textDocument/formatting` | req/resp | Full-doc format via `pkg/format`; returns one `fullReplace` `TextEdit`. |
+| `textDocument/rangeFormatting` | req/resp | Formats doc, returns minimal edit over the selected line range. |
+| `textDocument/codeAction` | req/resp | Returns quick-fix `WorkspaceEdit`s for fixable diagnostics overlapping the range. |
+| `textDocument/willSaveWaitUntil` | req/resp | Format-on-save: returns the same safety-gated edit as `formatting`. |
+| `textDocument/hover` | req/resp | Markdown with the rule ID + message of the diagnostic under the cursor; `null` elsewhere. |
+| `textDocument/documentSymbol` | req/resp | `CREATE FUNCTION`/`PROCEDURE` statements (name, kind Function, `function`/`procedure` detail, full range + name selection range). |
+| `textDocument/publishDiagnostics` | notif | Sent on every open/change; diagnostic code = `RuleID`, source = `pgtidy`; the range covers the offending token, not one character. |
+| `$/cancelRequest` | req | Ignored (per LSP, no response). |
+| unknown | req/resp | `-32601 method not found` (when the request has an `id`). |
+
+### Verified at runtime (e2e smoke test)
+
+- `initialize` returns the capability block above.
+- `didOpen` on `select * from t;` → `publishDiagnostics` with `COR001`
+  ("SELECT * is fragile…", severity 4 = hint, code `COR001`).
+- `textDocument/formatting` on that input → edit replacing with
+  `SELECT *\nFROM t;\n` (keyword casing + clause-per-line applied).
+- `textDocument/hover` → `-32601 method not found` (not implemented — correct).
+
+## What the server does NOT provide (gaps)
+
+Done since the first inventory: real diagnostic highlight range, `hover`, `documentSymbol`,
+`willSaveWaitUntil`. Still open:
+
+1. **No `completion`.** `textDocument/completion` is not implemented. Not urgent for a
+   formatter/linter.
+2. **No diagnostics debounce/coalescing beyond full-sync.** Every `didChange` re-runs the full
+   lint engine. Fine for now; matters on large files.
+3. **`initializationOptions` / workspace config.** `initialize` params are parsed nowhere — no
+   way to pass style overrides or a config path over the protocol.
+4. **No `prepareRename`, `rename`, `references`, `foldingRange`, `documentLink`.** Low priority;
+   `documentSymbol` now provides the symbol info they would build on.
+5. **Hover is diagnostics-only.** No keyword/type glossary for hover on plain identifiers.
+
+## Conventions to keep consistent
+
+- **One core, many frontends.** The LSP reuses `pkg/diagnostics.Diagnostic` and
+  `pkg/lint` directly — no parallel diagnostic model. New LSP features should reuse
+  these, not fork them.
+- **Safety gate is non-negotiable.** Both `formatting` and `rangeFormatting` call
+  `format.SemanticallyEqual(src, out)` before returning edits; on failure they return
+  an empty edit (keep original). Any new code path that formats must honor this
+  invariant (invariant #5 in `AGENTS.md`).
+- **No new external deps.** The wire layer is intentionally dependency-free. New
+  protocol types should be added as local structs, not pulled in from an LSP library.
+
+## Concrete next steps (recommended, smallest-first)
+
+1. **`initializationOptions`**: accept a config path / style overrides in `initialize`.
+2. **Debounce `didChange` diagnostics.**
+3. **Hover glossary** for keywords/types.
+
+> Do NOT: expand the LSP surface into a broad design (workspace features, incremental
+   parsing, custom `textDocument/*` extensions). Keep any change scoped and evidence-backed by
+   a `pkg/lsp` test (see `server_test.go` for the framed-request/response harness).
+
+## Verification
+
+- `go build ./cmd/pgtidy` succeeds.
+- `go test ./...` passes (LSP unit tests in `pkg/lsp/server_test.go` exercise
+  `initialize`, formatting, range formatting, `didClose` diagnostics clearing).
+- Runtime e2e smoke test (framed JSON-RPC over stdio) confirmed `initialize`
+  capabilities, `COR001` diagnostics, and a formatting edit. `hover`, `documentSymbol` and
+  `willSaveWaitUntil` are covered by tests in `pkg/lsp/server_test.go`.

docs/plan.md

@@ -67,10 +67,99 @@ to the intended style below.
   on own line; `AS` then `$$` on its own line; body; closing `$$;` on its own line.
 - PL/pgSQL: `DECLARE` alone, vars 2-space indented; `--Block--` comment markers preserved;
   `BEGIN`/`END` at body level; `IF/THEN/ELSIF/ELSE/END IF`, loops, `CASE` indent their bodies.
+- Procedural languages: bodies in any `pl*` language other than `plpgsql` (`plpython3u`,
+  `plperl`, `pltcl`, …) and in `c` / `internal` are emitted verbatim; `plpgsql`, `sql` and routines with no `LANGUAGE` clause (treated as `sql`) are formatted. The
+  function header is always formatted.
 - Spacing: spaces around binary operators (`=`,`<>`,`||`,…) and `:=`; **no** space around
   `::`, `->`, `->>`, array `[...]`, or before a call's `(`.
 - Dollar-quote tags preserved verbatim (`$$`, `$S$`, `$Z$`, …).
 
+## DataGrip settings mapping
+
+`PostgresCodeStyleSettings` (DataGrip / JetBrains) is the reference for all configurable
+style options. The table below maps every relevant DataGrip key to its `.pgtidy.yaml`
+counterpart so a user can reproduce their DataGrip style exactly in PgTidy.
+
+DataGrip enum conventions used below:
+- **Case**: 0=preserve, 1=upper, 2=lower
+- **Comma**: 1=leading (`,col`), 2=trailing (`col,`)
+- **Placement**: 1=same_line, 2=new_line
+- **Wrap**: 0=never, 1=when_long, 2=always
+
+### Casing
+
+| DataGrip key | PgTidy key | Default | Notes |
+|---|---|---|---|
+| `KEYWORD_CASE` | `keyword_case` | `upper` | SELECT, FROM, WHERE, … |
+| `IDENTIFIER_CASE` | `ident_case` | `lower` | unquoted column/variable names |
+| `TYPE_CASE` | `type_case` | `lower` | built-in type names (text, integer, …) |
+| `CUSTOM_TYPE_CASE` | `custom_type_case` | `lower` | user-defined / domain types |
+| `ALIAS_CASE` | `alias_case` | `lower` | column and table aliases |
+| `BUILT_IN_CASE` | `builtin_case` | `lower` | built-in functions (COALESCE, MAX, …) |
+
+### Query layout
+
+| DataGrip key | PgTidy key | Default | Notes |
+|---|---|---|---|
+| `QUERY_EL_COMMA` | `commas` | `leading` | applies to all clause element lists |
+| `QUERY_ALIGN_ELEMENTS` | `align_columns` | `false` | align SELECT list items to same column |
+| `QUERY_ALIGN_LINE_COMMENTS` | `align_line_comments` | `false` | align `--` inline comments in a block |
+| `SELECT_ALIGN_AS` | `select_align_as` | `false` | align `AS` keyword across SELECT list |
+| `FROM_INDENT_JOIN` | `indent_join` | `false` | indent JOIN relative to FROM |
+| `FROM_ONLY_JOIN_INDENT` | `join_indent_size` | `1` | extra indent levels for JOINs |
+| `SET_ALIGN_EQUAL_SIGN` | `set_align_equal` | `false` | align `=` in UPDATE SET list |
+| `WHERE_EL_WRAP` + `WHERE_EL_LINE` | `where_wrap` | `always` | always \| when_long \| never — each AND/OR condition on its own line |
+| _(new)_ | `select_wrap` | `always` | always \| when_long \| never — one SELECT/RETURNING column per line |
+| _(new)_ | `join_wrap` | `never` | always \| when_long \| never — `ON` and AND/OR conditions on their own lines under the JOIN |
+| _(new)_ | `line_width` | `120` | target width for every `when_long` decision and `case_collapse`; 0 = unlimited |
+| _(no DataGrip equivalent)_ | `where_and_or_indent` | `true` | when true, AND/OR are indented one level under WHERE, not at WHERE's column |
+
+### Subqueries
+
+| DataGrip key | PgTidy key | Default | Notes |
+|---|---|---|---|
+| `SUBQUERY_OPENING` | `subquery_opening` | `same_line` | opening `(` placement |
+| `SUBQUERY_CONTENT` | `subquery_content` | `new_line` | content indentation inside paren |
+| `SUBQUERY_CLOSING` | `subquery_closing` | `new_line` | closing `)` placement |
+| `SUBQUERY_PAR_SPACE_BEFORE` | `subquery_space_before_paren` | `false` | space before `(` |
+
+### INSERT
+
+| DataGrip key | PgTidy key | Default | Notes |
+|---|---|---|---|
+| `INSERT_COLLAPSE_MULTI_ROW_VALUES` | `insert_collapse_values` | `true` | fold VALUES rows into fewer lines |
+
+### Routine (function / procedure)
+
+| DataGrip key | PgTidy key | Default | Notes |
+|---|---|---|---|
+| `ROUTINE_ARG_COMMA` | uses `commas` | `leading` | same setting as query lists |
+| `ROUTINE_ARG_ALIGN_TYPES` | `align_param_types` | `false` | align type column in param list |
+| `ROUTINE_AS_WRAP` | `routine_as_wrap` | `true` | newline before `AS $$` |
+
+### PL/pgSQL body
+
+| DataGrip key | PgTidy key | Default | Notes |
+|---|---|---|---|
+| `IMP_COMMON_KEEP_BLANK_LINES_IN_CODE` | `plpgsql_max_blank_lines` | `1` | max consecutive blank lines in body |
+| `IMP_DECLARE_ALIGN_TYPE` | `plpgsql_declare_align_type` | `true` | align type column in DECLARE block |
+| `IMP_DECLARE_ALIGN_EQ` | `plpgsql_declare_align_eq` | `true` | align `:=` / `=` in DECLARE block |
+| `IMP_IF_THEN_WRAP_THEN` | `plpgsql_if_then_newline` | `true` | THEN on its own line |
+| `IMP_LOOP_COLLAPSE` | `plpgsql_loop_collapse` | `true` | collapse empty loop bodies |
+
+### Expressions
+
+| DataGrip key | PgTidy key | Default | Notes |
+|---|---|---|---|
+| `EXPR_BINARY_OP_ALIGN` | `binary_op_align` | `false` | align `=`, `<>`, `||`, … vertically in WHERE/expression lists; default false — must not be hardcoded |
+| `EXPR_CALL_SPACE_AFTER_COMMA` | `space_after_comma_in_calls` | `false` | space after `,` in function calls |
+| `EXPR_CASE_WHEN_WRAP` | `case_when_wrap` | `false` | each WHEN on its own line |
+| `EXPR_CASE_END` | `case_end` | `new_line` | same_line \| new_line |
+| `EXPR_CASE_COLLAPSE` | `case_collapse` | `false` | collapse short CASE to one line |
+| `CORTEGE_SPACE_BEFORE_L_PAREN` | `record_space_before_paren` | `false` | space before `(` in ROW/record constructors |
+
+---
+
 ## Milestones
 
 ### V1 — Formatter + CLI (priority)
@@ -88,6 +177,8 @@ to the intended style below.
 5. **CLI** (`cmd/pgtidy fmt`): `--check`, `--write`/`-w`, stdin→stdout, `--diff`; config
    discovery walking up to `.pgtidy.yaml`; CI-friendly exit codes.
 6. **Config** (`pkg/config`): load/merge style config; defaults = house style above.
+   Full field set defined in the DataGrip settings mapping section above — covers casing
+   (6 keys), query layout, subqueries, INSERT, routines, PL/pgSQL body, and expressions.
 
 **Safety guarantees (tested):** semantic equivalence (re-lex output, compare non-trivia token
 stream to input), and idempotence (`fmt(fmt(x)) == fmt(x)`). The corpus is the

docs/todo.md

@@ -36,9 +36,9 @@ Legend: ✅ done · 🚧 in progress · ⬜ not started
 - `parser_test.go`: small round-trips, CreateFunction shape assertions, Raw fallback, and
   **corpus round-trip** — reconstructs all 4 files byte-for-byte; structures all 4 functions.
 - **Status:** all tests pass.
-- _Still TODO (later): DML/other-DDL structuring (currently Raw) for full formatting._
+- _Note: DML/other-DDL still parse to `Raw`; they are formatted at token level by `pkg/format/dml.go`, not via structured CST nodes._
 
-### 🚧 PL/pgSQL body parser  ← NEXT (the remaining V1 piece)
+### ✅ PL/pgSQL body parser
 
 #### ✅ DECLARE section — `pkg/format/body.go`
 - `formatBody` splits the dollar-quote tag, calls `formatBodyInner`.
@@ -93,6 +93,14 @@ Legend: ✅ done · 🚧 in progress · ⬜ not started
 - `fmt_test.go`: stdin, --check (un/formatted), -w idempotence, unknown-command.
 - Safety invariants #2 (semantic equivalence), #3 (idempotence), #4 (graceful degradation)
   are tested in `pkg/format` over the corpus.
+- **Runtime safety gate** (`format.VerifySafe`, `pkg/format/safety.go`): every frontend runs
+  it before emitting. Bundles `SemanticallyEqual` (code token stream) + `CommentsPreserved`
+  (no comment dropped/merged/split/reworded, recursing into bodies) + `StructurallyBalanced`
+  (`()[]` / BEGIN·CASE·IF·LOOP…END profile, ignoring comment & string contents) + an
+  idempotence re-format. On failure the CLI prints the reason and keeps the original.
+  Caught two real bugs: multi-line `/* */` bodies were reindented as code, and col-0 `--`
+  lines were glued onto the previous line (merging consecutive comments) — both fixed in
+  `formatBodyStatements`.
 
 ---
 
@@ -108,6 +116,7 @@ Legend: ✅ done · 🚧 in progress · ⬜ not started
   - NAM001/2/3 table/column/function names not snake_case (quoted identifiers only)
 - `pgtidy lint [--only=ID,...] [files...]`; exits 1 on findings, 2 on error.
 - Fixture SQL in `testdata/lint/`; 6 tests covering violations + clean fixtures.
+- **Function bodies** (`pkg/lint/plpgsql.go`): Code-like dollar-quoted strings (SELECT/INSERT/UPDATE/DELETE/WITH, e.g. `EXECUTE $q$ … $q$` or a `LANGUAGE sql` body) are linted the same way, recursively; format() templates and bodies of other languages are skipped. `plpgsql` `CREATE FUNCTION/PROCEDURE` and `DO` bodies are parsed with the PL/pgSQL parser. Syntax errors are reported as `PLPGSQL` (located by the offending token, since libpg_query gives no position), and every embedded SQL statement is run through the normal rules with line/col mapped back to the file. Embedded findings carry no autofix. Non-plpgsql languages are skipped.
 - `--fix` rewrites files in place applying autofixes; for stdin, prints fixed SQL to stdout.
 - Autofixable: **MIG001** (insert `CONCURRENTLY` after `INDEX`) and **MIG003** (insert `NOT VALID` before `;`). MIG002, COR*, NAM* are intentionally not autofixable.
 - `pkg/diagnostics.TextFix{Offset, End, New, Title}` — byte-range replacement attached to `Diagnostic.Fix`.
@@ -119,6 +128,7 @@ Legend: ✅ done · 🚧 in progress · ⬜ not started
 - `cmd/pgtidy/lsp.go`: `pgtidy lsp` subcommand; config discovered from cwd.
 - `editors/vscode/`: TS extension using `vscode-languageclient`; launches `pgtidy lsp` via stdio; `.pgsql` mapped to `sql` language; `pgtidy.path` / `pgtidy.enable` settings.
 - _Range formatting: future._
+- Full capability inventory, runtime-verified gaps, and ranked next steps in `docs/lsp-status.md` (issue #3).
 
 ## ✅ V4 — DataGrip
 - `editors/datagrip/`: Gradle-based JetBrains plugin targeting DataGrip 2024.3+ via LSP4IJ.
@@ -158,9 +168,150 @@ Legend: ✅ done · 🚧 in progress · ⬜ not started
   function call at the token level — formatted without space (known limitation).
 - Note: SQL keywords inside PL/pgSQL function bodies remain lowercase (matching
   the corpus golden files); casing is applied only to top-level DML.
-- _Still TODO: Wadler Doc-IR printer for width-aware wrapping of long lines._
-- _Still TODO: LSP range formatting._
+- ✅ Doc-IR core (`pkg/format/doc.go`: Text/Line/SoftLine/Group/Indent/IfBreak + `Render`) and `line_width` (default 120, 0 = unlimited). First consumer: `where_wrap: when_long` (`dmlWhereWhenLong`). `select_wrap` (default `always`) and `join_wrap` (default `never`) also take `always|when_long|never`; `when_long` keeps the SELECT list / `JOIN … ON` on one line when it fits `line_width`, otherwise uses the existing one-column-per-line / ON-per-line layout. Items containing a subquery or wrapped CASE always use the broken layout. Subquery wrapping and multi-CTE lists are on the Doc-IR too (`HardLine`, `Lines`; CTE lists reuse `dmlCommaList`, which fixes dropped commas with `commas: trailing`). VALUES rows already share `dmlCommaList`.
+- ✅ LSP range formatting (already implemented; this note was stale). LSP also has hover (diagnostic rule + message), documentSymbol (functions/procedures), willSaveWaitUntil (format-on-save) and token-wide diagnostic ranges — see `docs/lsp-status.md`.
+
+## ✅ Config expansion — DataGrip settings parity
+
+Reference: `PostgresCodeStyleSettings` mapping in `docs/plan.md`.
+
+### ✅ Extended `pkg/config` fields
+
+Added to `Style` struct, `yamlFile`, and `Load()` in `pkg/config/config.go`:
+
+- New types: `WrapMode` (`always`|`when_long`|`never`), `Placement` (`same_line`|`new_line`)
+- **Casing**: `AliasCase`, `BuiltinCase`, `CustomTypeCase` — all default `lower`
+- **Query layout**: `AlignColumns`, `AlignLineComments`, `SelectAlignAs`, `SetAlignEqual`,
+  `IndentJoin`, `JoinIndentSize`, `WhereWrap`, `WhereAndOrIndent`
+- **Subqueries**: `SubqueryOpening`, `SubqueryContent`, `SubqueryClosing`, `SubquerySpaceBeforeParen`
+- **INSERT**: `InsertCollapseValues`
+- **Routines**: `AlignParamTypes`, `RoutineAsWrap`
+- **PL/pgSQL**: `PlpgsqlMaxBlankLines`, `PlpgsqlDeclareAlignType`, `PlpgsqlDeclareAlignEq`,
+  `PlpgsqlIfThenNewline`, `PlpgsqlLoopCollapse`
+- **Expressions**: `BinaryOpAlign`, `SpaceAfterCommaInCalls`, `CaseWhenWrap`, `CaseEnd`,
+  `CaseCollapse`, `RecordSpaceBeforeParen`
+- `docs/config/default.pgtidy.yaml` updated with all new keys and comments.
+
+### ✅ Casing engine — alias and built-in classification
+
+`pkg/format/keywords.go`: added `builtinFunctions` set (COALESCE, MAX, MIN, NOW, …).
+`pkg/format/format.go`: `caseTextCtx` uses context — `prev` token and `nextIsLParen` flag
+to route ident tokens through `AliasCase` (after AS) or `BuiltinCase` (before `(`).
+`inline()` and `dmlInline()` pass context to `caseTextCtx`.
+
+### ✅ Formatter — query layout settings (`pkg/format/dml.go`)
+
+- `indent_join` + `join_indent_size`: JOIN clause indented by `JoinIndentSize × Indent`.
+- `where_wrap` + `where_and_or_indent`: `dmlWhereClause` splits AND/OR conditions; `always`
+  puts each condition on its own line indented under WHERE; `never` keeps inline.
+- `set_align_equal`: `dmlColListSet` pads LHS of SET items so `=` signs align.
+- `align_columns` + `select_align_as`: `dmlColListSelect` + `alignSelectItems` pads
+  SELECT expressions so AS keywords and aliases align vertically.
+- `space_after_comma_in_calls` applied in `dmlInline`.
+- `binary_op_align` registered in config (enforcement in WHERE/expression context deferred).
+
+### ✅ Formatter — subquery formatting
+
+`pkg/format/dml.go`: `dmlIsSubqueryOpen` detects a `(` immediately followed by `SELECT`/
+`WITH` (derived tables, scalar subqueries, `IN`/`EXISTS`/`ARRAY(...)` subqueries — a plain
+value tuple like `IN (1, 2, 3)` is left alone). `dmlInline` splices these in via
+`dmlWrapSubquery`, which recursively formats the inner tokens with `formatDML` and wraps
+them per `subquery_content`/`subquery_closing`; `dmlWriteSubquerySep` handles
+`subquery_opening` (same_line/new_line) and additively applies `subquery_space_before_paren`
+(only adds a space where one wouldn't already be there — never removes the space `IN`/
+`EXISTS`/`AS` already get). `formatCTEDef` now calls the same `dmlWrapSubquery` helper
+instead of a hardcoded new_line-only layout, so CTE bodies honor the config too (the
+`AS (` space itself stays unconditional — that's fixed CTE syntax, not the subquery-space
+setting). Nested subqueries-in-CASE and CASE-in-subqueries recurse correctly. Not
+column/Doc-IR-aligned (documented "fixed-layout, not Wadler" limitation) — wrapped content
+is indented one level relative to its own local frame, which composes correctly under
+JOIN/WHERE/SELECT-list embedding but isn't perfectly column-aligned for deeply nested cases.
+Tests: `TestDMLSubquery*`, `TestDMLCTEUsesSubqueryConfig` in `pkg/format/dml_test.go`.
+
+### ✅ Formatter — INSERT VALUES collapse
+
+`dmlValuesClause` (`pkg/format/dml.go`): when `insert_collapse_values` is `true` (default)
+multi-row `VALUES` stays packed on one line (matches prior behavior); when `false`, each row
+gets its own line via the shared `dmlCommaList` helper (same leading/trailing-comma layout
+as SELECT/SET lists). Single-row VALUES is unaffected either way.
+Tests: `TestDMLInsertValues*`.
+
+### ✅ Formatter — routine param alignment (`pkg/format/format.go`)
+
+- `align_param_types`: `alignParamTypes()` pads param names so type columns align; default `false` (house style: no type-column alignment in param lists).
+- `routine_as_wrap`: when `false`, AS stays on the same line as the last option clause.
+- Golden file `testdata/corpus/test_a.pgsql` updated to reflect aligned params.
+
+### ✅ Formatter — PL/pgSQL body settings (`pkg/format/body.go`)
+
+- Language gate (`isPlpgsql` in `pkg/format/format.go`): bodies in a `pl*` language other than
+  `plpgsql` (`plpython3u`, `plperl`, …), `c` and `internal` are skipped and kept verbatim; `plpgsql`, `sql` and no
+  clause (treated as `sql`) are formatted. Header is always formatted. Test:
+  `TestNonPlpgsqlBodyVerbatim`.
+
+- `plpgsql_max_blank_lines`: blank-line runs capped at the configured limit; default `1`.
+- `plpgsql_declare_align_type` + `plpgsql_declare_align_eq`: two-pass declare formatter
+  measures name/type widths then pads for alignment; `writeDeclareAligned` helper. Both
+  default `true` (house style). The `=` column is padded only to the widest type among
+  declarations that actually carry an assignment, so a lone `x text = '…';` stays tight.
+- `plpgsql_if_then_newline`: when `false`, `joinThenToCondition` merges THEN onto the
+  preceding condition line.
+- `plpgsql_loop_collapse`: `tryCollapseLoop` detects empty FOR/WHILE loop bodies and
+  collapses them to one line.
+- CRLF normalization in trivia emission (comment text, body trivia before DECLARE).
+
+### ✅ Formatter — expression settings (case_when_wrap, case_end, case_collapse, record_space_before_paren)
+
+`pkg/format/dml.go`: `dmlInline` detects `CASE` tokens (`dmlIsCaseStart`/`dmlMatchCaseEnd`,
+tracking nested-CASE depth so an inner `CASE…END`'s own `WHEN`/`THEN`/`ELSE` don't get
+mistaken for the outer one's boundaries) and splices in `dmlFormatCase`. `dmlSplitCase`
+breaks the body into operand/WHEN/THEN/ELSE segments (each rendered via a recursive
+`dmlInline` call, so subqueries and nested CASEs inside a branch format correctly too).
+Both the simple (`CASE x WHEN ...`) and searched (`CASE WHEN ...`) forms are supported.
+- `case_when_wrap` (default `false`): `false` keeps everything on one line (unchanged
+  default behavior); `true` puts each `WHEN … THEN …` and `ELSE` on its own line, indented
+  one level.
+- `case_end` (default `new_line`): placement of the closing `END` when wrapped —
+  `new_line` on its own line, `same_line` glued to the last WHEN/ELSE line.
+- `case_collapse` (default `false`): when `true`, keeps the wrapped CASE on one line anyway if the
+  fully-inlined rendering fits in `line_width` (default 120), overriding `case_when_wrap`;
+  longer CASEs still wrap. Rendered through the Doc-IR (`Group(IfBreak(wrapped, inline))`).
+- `record_space_before_paren` (default `false`): scoped to the `ROW` keyword specifically
+  (`ROW(1, 2)` vs `ROW (1, 2)`) — bare `(a, b)` record literals are indistinguishable from
+  grouping parens at the token level, so this setting only fires on an explicit `ROW(`.
+Tests: `TestDMLCase*`, `TestDMLRecordSpaceBeforeParen`.
+
+### ⬜ DataGrip XML import/export (optional, V4+)
+
+`pgtidy config import --datagrip <settings.xml>` / `pgtidy config export --datagrip`
+not implemented.
+
+---
 
 ## Open risks
 - `go-pgquery` tracks PG17 (not PG18) — fine for lint; irrelevant to formatter path.
 - Leading-comma + one-per-line is a first-class style option, not an afterthought.
+
+### ✅ Literal & embedded-code safety (found via `temp/` corpus)
+
+- Multi-line quoted strings and dollar-quoted literals inside bodies are carried verbatim
+  (never re-indented); only the code outside them is scanned for parens / terminators / block
+  depth (`formatBodyStatements`, `cut`/`tail` handling). Same for top-level DML
+  (`litNL` sentinel in `dml.go`).
+- Dollar-quoted literals whose content starts like code (`declare`/`begin` → PL/pgSQL block;
+  `select`/`insert`/`update`/`delete`/`with` → DML) are formatted recursively
+  (`formatEmbedded`); anything else (fragments, prose, other languages) stays verbatim. Literals
+  containing `format()` placeholders (`%s`, `%I`, `%L`, `%1$s`) are never touched, and a result
+  that fails `SemanticallyEqual`/`CommentsPreserved` is discarded.
+- `DO LANGUAGE x $$…$$` keeps its `LANGUAGE` clause (it was being dropped).
+- Code is never joined onto a line that ends in a `--` comment.
+- A line ending in a literal or non-keyword no longer counts as ending in `EXCEPTION`/`THEN`/….
+- Comments between the last DECLARE variable and `BEGIN` are kept.
+- Golden `testdata/corpus/test_mm_proc.pgsql` regenerated: nested dollar-quoted dynamic SQL is no
+  longer re-flowed.
+
+## Local corpus (`temp/`)
+
+`temp/` holds real-world routines (plpgsql, plpython3u, triggers) used for local testing only
+(not committed). Run `pgtidy fmt` over it to find safety-gate failures. See "Language gate" above
+for how non-plpgsql bodies are handled.

editors/datagrip/README.md

@@ -1,37 +1,27 @@
 # PgTidy — DataGrip / JetBrains Plugin
 
-Formats and lints SQL files in DataGrip (and any JetBrains IDE) via the LSP4IJ plugin.
+Formats SQL files in DataGrip (and any JetBrains IDE) by shelling out to the `pgtidy` binary.
 
 ## Requirements
 
 - `pgtidy` binary on `PATH` — download from [releases](https://git.warky.dev/wdevs/PgTidy/releases) or build with `go install git.warky.dev/wdevs/pgtidy/cmd/pgtidy@latest`
-- [LSP4IJ](https://plugins.jetbrains.com/plugin/23257-lsp4ij) plugin installed (free, by Red Hat)
 - DataGrip 2024.3+ (or any JetBrains IDE 2024.3+)
 
 ## Install the plugin
 
-### Option A — Install from disk (`.zip`)
-
 1. Build: `./gradlew buildPlugin` (output in `build/distributions/`)
 2. In DataGrip: **Settings → Plugins → ⚙ → Install Plugin from Disk…** → select the `.zip`
 3. Restart the IDE
 
-### Option B — Install LSP4IJ and configure manually (no plugin build needed)
-
-1. Install **LSP4IJ** from the marketplace (**Settings → Plugins → Marketplace → search "LSP4IJ"**)
-2. Go to **Settings → Language Servers → + (Add)**
-3. Fill in:
-   - **Name:** `PgTidy`
-   - **Command:** `pgtidy lsp`
-4. Under **Mappings**, add file patterns: `*.sql`, `*.pgsql`
-5. Click **OK** and restart the IDE
-
 ## Features
 
-- **Formatting** — `Code → Reformat Code` (`Ctrl+Alt+L`) formats the current SQL file
-- **Diagnostics** — lint findings shown as inspections (MIG001–MIG003, COR001–003, NAM001–003)
+- **Formatting** — `Format with PgTidy` (`Ctrl+Alt+Shift+P` or right-click in the editor) formats the current SQL file via `pgtidy fmt`
+- **Version check** — `Tools → Show PgTidy Version` and the status bar widget show the installed `pgtidy` version
+- **Diagnostics** — lint findings (MIG001–MIG003, COR001–003, NAM001–003) are shown inline as editor annotations, via a native `ExternalAnnotator` that runs `pgtidy lint --json`
 - **Quick fixes** — intention actions for MIG001 (add `CONCURRENTLY`) and MIG003 (add `NOT VALID`)
 
 ## Troubleshooting
 
-**Server not starting:** Check **View → Tool Windows → LSP4IJ Consoles** for stderr output. Most common cause: `pgtidy` not found on `PATH` — update the command to the full path, e.g. `/usr/local/bin/pgtidy lsp`.
+**"Cannot start pgtidy" error:** the `pgtidy` binary isn't on `PATH` for the IDE process. Install it or restart the IDE after adding it to `PATH`.
+
+**No diagnostics showing:** diagnostics only run on files with a `.sql` or `.pgsql` extension; check `pgtidy lint --json` runs cleanly on the file from a terminal with the same `PATH` as the IDE.

editors/datagrip/build.gradle.kts

@@ -23,7 +23,6 @@ dependencies {
         val platformType    = providers.gradleProperty("platformType")
         create(platformType, platformVersion)
         bundledPlugin("com.intellij.database")
-        plugin("com.redhat.devtools.lsp4ij:${providers.gradleProperty("lsp4ijVersion").get()}")
     }
 }
 

editors/datagrip/gradle.properties

@@ -5,4 +5,3 @@ pluginSinceBuild=243
 # DataGrip 2024.3
 platformVersion=2024.3
 platformType=DB
-lsp4ijVersion=0.20.1

editors/datagrip/src/main/kotlin/com/pgtidy/datagrip/PgTidyDiagnostic.kt

@@ -0,0 +1,18 @@
+package com.pgtidy.datagrip
+
+data class PgTidyFix(
+    val offset: Int,
+    val end: Int,
+    val new: String,
+    val title: String,
+)
+
+data class PgTidyDiagnostic(
+    val ruleId: String,
+    val severity: String,
+    val message: String,
+    val file: String,
+    val line: Int,
+    val col: Int,
+    val fix: PgTidyFix?,
+)

editors/datagrip/src/main/kotlin/com/pgtidy/datagrip/PgTidyExternalAnnotator.kt

@@ -0,0 +1,50 @@
+package com.pgtidy.datagrip
+
+import com.intellij.lang.annotation.AnnotationHolder
+import com.intellij.lang.annotation.ExternalAnnotator
+import com.intellij.lang.annotation.HighlightSeverity
+import com.intellij.openapi.editor.Document
+import com.intellij.psi.PsiFile
+
+class PgTidyExternalAnnotator : ExternalAnnotator<String, List<PgTidyDiagnostic>>() {
+
+    override fun collectInformation(file: PsiFile): String? {
+        val ext = file.virtualFile?.extension?.lowercase()
+        if (ext != "sql" && ext != "pgsql") return null
+        return file.viewProvider.document?.text
+    }
+
+    override fun doAnnotate(source: String): List<PgTidyDiagnostic> = PgTidyLintRunner.run(source)
+
+    override fun apply(file: PsiFile, diagnostics: List<PgTidyDiagnostic>, holder: AnnotationHolder) {
+        val document = file.viewProvider.document ?: return
+        for (d in diagnostics) {
+            if (d.line <= 0 || d.line > document.lineCount) continue
+            val range = lineTailRange(document, d.line, d.col) ?: continue
+
+            val severity = when (d.severity) {
+                "error" -> HighlightSeverity.ERROR
+                "warning" -> HighlightSeverity.WARNING
+                else -> HighlightSeverity.WEAK_WARNING
+            }
+
+            val builder = holder.newAnnotation(severity, "[${d.ruleId}] ${d.message}").range(range)
+            if (d.fix != null) {
+                builder.withFix(PgTidyQuickFix(d.fix))
+            }
+            builder.create()
+        }
+    }
+
+    /** Byte column [col] (1-based) to end-of-line, converted to a document TextRange. */
+    private fun lineTailRange(document: Document, line1Based: Int, col1Based: Int): com.intellij.openapi.util.TextRange? {
+        val lineIdx = line1Based - 1
+        val lineStart = document.getLineStartOffset(lineIdx)
+        val lineEnd = document.getLineEndOffset(lineIdx)
+        val lineText = document.getText(com.intellij.openapi.util.TextRange(lineStart, lineEnd))
+        val charCol = PgTidyOffsets.byteOffsetToCharIndex(lineText, col1Based - 1)
+        val start = lineStart + charCol
+        if (start >= lineEnd) return null
+        return com.intellij.openapi.util.TextRange(start, lineEnd)
+    }
+}

editors/datagrip/src/main/kotlin/com/pgtidy/datagrip/PgTidyLintRunner.kt

@@ -0,0 +1,32 @@
+package com.pgtidy.datagrip
+
+import com.google.gson.Gson
+import com.google.gson.reflect.TypeToken
+
+object PgTidyLintRunner {
+    private val gson = Gson()
+    private val listType = TypeToken.getParameterized(List::class.java, PgTidyDiagnostic::class.java).type
+
+    /** Runs `pgtidy lint --json` over [source]. Returns an empty list if pgtidy is missing or output is unparseable. */
+    fun run(source: String): List<PgTidyDiagnostic> {
+        val proc = try {
+            ProcessBuilder("pgtidy", "lint", "--json")
+                .redirectErrorStream(false)
+                .start()
+        } catch (ex: Exception) {
+            return emptyList()
+        }
+
+        proc.outputStream.bufferedWriter().use { it.write(source) }
+        val output = proc.inputStream.bufferedReader().readText()
+        proc.errorStream.bufferedReader().readText()
+        proc.waitFor()
+
+        if (output.isBlank()) return emptyList()
+        return try {
+            gson.fromJson<List<PgTidyDiagnostic>>(output, listType) ?: emptyList()
+        } catch (ex: Exception) {
+            emptyList()
+        }
+    }
+}

editors/datagrip/src/main/kotlin/com/pgtidy/datagrip/PgTidyOffsets.kt

@@ -0,0 +1,28 @@
+package com.pgtidy.datagrip
+
+/**
+ * pgtidy reports positions as UTF-8 byte offsets (Go strings are byte slices);
+ * IntelliJ documents index text as UTF-16 chars. Converts one to the other.
+ */
+object PgTidyOffsets {
+    fun byteOffsetToCharIndex(text: String, byteOffset: Int): Int {
+        var bytes = 0
+        var i = 0
+        while (i < text.length) {
+            val cp = text.codePointAt(i)
+            val charCount = Character.charCount(cp)
+            val byteLen = utf8Length(cp)
+            if (bytes + byteLen > byteOffset) return i
+            bytes += byteLen
+            i += charCount
+        }
+        return text.length
+    }
+
+    private fun utf8Length(codePoint: Int): Int = when {
+        codePoint <= 0x7F -> 1
+        codePoint <= 0x7FF -> 2
+        codePoint <= 0xFFFF -> 3
+        else -> 4
+    }
+}

editors/datagrip/src/main/kotlin/com/pgtidy/datagrip/PgTidyQuickFix.kt

@@ -0,0 +1,25 @@
+package com.pgtidy.datagrip
+
+import com.intellij.codeInsight.intention.IntentionAction
+import com.intellij.openapi.editor.Editor
+import com.intellij.openapi.project.Project
+import com.intellij.psi.PsiFile
+import com.intellij.util.IncorrectOperationException
+
+class PgTidyQuickFix(private val fix: PgTidyFix) : IntentionAction {
+
+    override fun getText(): String = fix.title
+    override fun getFamilyName(): String = "PgTidy"
+    override fun startInWriteAction(): Boolean = true
+
+    override fun isAvailable(project: Project, editor: Editor?, file: PsiFile?): Boolean = editor != null
+
+    @Throws(IncorrectOperationException::class)
+    override fun invoke(project: Project, editor: Editor?, file: PsiFile?) {
+        val document = editor?.document ?: return
+        val text = document.text
+        val start = PgTidyOffsets.byteOffsetToCharIndex(text, fix.offset)
+        val end = PgTidyOffsets.byteOffsetToCharIndex(text, fix.end)
+        document.replaceString(start, end, fix.new)
+    }
+}

editors/datagrip/src/main/kotlin/com/pgtidy/datagrip/PgTidyServerConnection.kt

@@ -1,9 +0,0 @@
-package com.pgtidy.datagrip
-
-import com.intellij.openapi.project.Project
-import com.redhat.devtools.lsp4ij.server.ProcessStreamConnectionProvider
-
-class PgTidyServerConnection(project: Project) : ProcessStreamConnectionProvider(
-    listOf("pgtidy", "lsp"),
-    project.basePath ?: System.getProperty("user.home"),
-)

editors/datagrip/src/main/kotlin/com/pgtidy/datagrip/PgTidyServerFactory.kt

@@ -1,10 +0,0 @@
-package com.pgtidy.datagrip
-
-import com.intellij.openapi.project.Project
-import com.redhat.devtools.lsp4ij.LanguageServerFactory
-import com.redhat.devtools.lsp4ij.server.StreamConnectionProvider
-
-class PgTidyServerFactory : LanguageServerFactory {
-    override fun createConnectionProvider(project: Project): StreamConnectionProvider =
-        PgTidyServerConnection(project)
-}

editors/datagrip/src/main/kotlin/com/pgtidy/datagrip/PgTidyShowVersionAction.kt

@@ -0,0 +1,42 @@
+package com.pgtidy.datagrip
+
+import com.intellij.openapi.actionSystem.AnAction
+import com.intellij.openapi.actionSystem.AnActionEvent
+import com.intellij.openapi.application.ApplicationManager
+import com.intellij.openapi.progress.ProgressIndicator
+import com.intellij.openapi.progress.Task
+import com.intellij.openapi.ui.Messages
+
+class PgTidyShowVersionAction : AnAction() {
+
+    override fun actionPerformed(e: AnActionEvent) {
+        val project = e.project
+
+        object : Task.Backgroundable(project, "PgTidy: checking version…", false) {
+            override fun run(indicator: ProgressIndicator) {
+                val proc = try {
+                    ProcessBuilder("pgtidy", "version")
+                        .redirectErrorStream(false)
+                        .start()
+                } catch (ex: Exception) {
+                    ApplicationManager.getApplication().invokeLater {
+                        Messages.showErrorDialog(project, "Cannot start pgtidy: ${ex.message}", "PgTidy")
+                    }
+                    return
+                }
+
+                val output = proc.inputStream.bufferedReader().readText()
+                val stderr = proc.errorStream.bufferedReader().readText()
+                val exit = proc.waitFor()
+
+                ApplicationManager.getApplication().invokeLater {
+                    if (exit != 0) {
+                        Messages.showErrorDialog(project, stderr.ifBlank { "pgtidy exited with code $exit" }, "PgTidy")
+                        return@invokeLater
+                    }
+                    Messages.showInfoMessage(project, output.trim(), "PgTidy Version")
+                }
+            }
+        }.queue()
+    }
+}

editors/datagrip/src/main/kotlin/com/pgtidy/datagrip/PgTidyStatusBarWidget.kt

@@ -0,0 +1,72 @@
+package com.pgtidy.datagrip
+
+import com.intellij.openapi.application.ApplicationManager
+import com.intellij.openapi.project.Project
+import com.intellij.openapi.wm.StatusBar
+import com.intellij.openapi.wm.StatusBarWidget
+import com.intellij.openapi.wm.StatusBarWidgetFactory
+import com.intellij.util.Consumer
+import java.awt.event.MouseEvent
+
+private const val WIDGET_ID = "com.pgtidy.StatusBarWidget"
+
+class PgTidyStatusBarWidget(private val project: Project) : StatusBarWidget, StatusBarWidget.TextPresentation {
+
+    private var statusBar: StatusBar? = null
+    private var text: String = "pgtidy: …"
+
+    override fun ID(): String = WIDGET_ID
+
+    override fun install(statusBar: StatusBar) {
+        this.statusBar = statusBar
+        refresh()
+    }
+
+    override fun dispose() {
+        statusBar = null
+    }
+
+    override fun getPresentation(): StatusBarWidget.WidgetPresentation = this
+
+    override fun getText(): String = text
+
+    override fun getAlignment(): Float = java.awt.Component.CENTER_ALIGNMENT
+
+    override fun getTooltipText(): String = "PgTidy version — click to refresh"
+
+    override fun getClickConsumer(): Consumer<MouseEvent> = Consumer { refresh() }
+
+    fun refresh() {
+        ApplicationManager.getApplication().executeOnPooledThread {
+            text = try {
+                val proc = ProcessBuilder("pgtidy", "version")
+                    .redirectErrorStream(true)
+                    .start()
+                val output = proc.inputStream.bufferedReader().readText().trim()
+                val exit = proc.waitFor()
+                if (exit == 0 && output.isNotBlank()) output else "pgtidy: not found"
+            } catch (ex: Exception) {
+                "pgtidy: not found"
+            }
+            ApplicationManager.getApplication().invokeLater {
+                statusBar?.updateWidget(WIDGET_ID)
+            }
+        }
+    }
+}
+
+class PgTidyStatusBarWidgetFactory : StatusBarWidgetFactory {
+    override fun getId(): String = WIDGET_ID
+
+    override fun getDisplayName(): String = "PgTidy Version"
+
+    override fun isAvailable(project: Project): Boolean = true
+
+    override fun createWidget(project: Project): StatusBarWidget = PgTidyStatusBarWidget(project)
+
+    override fun disposeWidget(widget: StatusBarWidget) {
+        widget.dispose()
+    }
+
+    override fun canBeEnabledOn(statusBar: StatusBar): Boolean = true
+}

editors/datagrip/src/main/resources/META-INF/plugin.xml

@@ -5,13 +5,11 @@
     <vendor url="https://git.warky.dev/wdevs/PgTidy">Warky Devs</vendor>
     <description><![CDATA[
         PostgreSQL formatter and linter powered by <a href="https://github.com/hein/pgtidy">pgtidy</a>.<br/>
-        Requires the <code>pgtidy</code> binary on PATH and the
-        <a href="https://plugins.jetbrains.com/plugin/23257-lsp4ij">LSP4IJ</a> plugin.
+        Requires the <code>pgtidy</code> binary on PATH.
     ]]></description>
 
     <depends>com.intellij.modules.platform</depends>
     <depends>com.intellij.database</depends>
-    <depends>com.redhat.devtools.lsp4ij</depends>
 
     <actions>
         <action id="com.pgtidy.FormatDocument"
@@ -21,17 +19,19 @@
             <add-to-group group-id="EditorPopupMenu" anchor="first"/>
             <keyboard-shortcut keymap="$default" first-keystroke="ctrl alt shift P"/>
         </action>
+        <action id="com.pgtidy.ShowVersion"
+                class="com.pgtidy.datagrip.PgTidyShowVersionAction"
+                text="Show PgTidy Version"
+                description="Show the installed pgtidy binary version">
+            <add-to-group group-id="ToolsMenu" anchor="last"/>
+        </action>
     </actions>
 
-    <extensions defaultExtensionNs="com.redhat.devtools.lsp4ij">
-        <server id="com.pgtidy.lsp"
-                name="PgTidy"
-                factoryClass="com.pgtidy.datagrip.PgTidyServerFactory">
-            <description>PostgreSQL formatter and linter (pgtidy lsp)</description>
-        </server>
-
-        <fileNamePatternMapping patterns="*.sql;*.pgsql"
-                                serverId="com.pgtidy.lsp"
-                                languageId="SQL"/>
+    <extensions defaultExtensionNs="com.intellij">
+        <statusBarWidgetFactory id="com.pgtidy.StatusBarWidget"
+                                 implementation="com.pgtidy.datagrip.PgTidyStatusBarWidgetFactory"
+                                 order="last"/>
+        <externalAnnotator language="" implementationClass="com.pgtidy.datagrip.PgTidyExternalAnnotator"/>
     </extensions>
+
 </idea-plugin>

linux/arch/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Hein (Warky Devs) <hein@warky.dev>
 pkgname=pgtidy-bin
-pkgver=0.0.1
+pkgver=0.0.9
 pkgrel=1
 pkgdesc="PostgreSQL SQL formatter and linter"
 arch=('x86_64' 'aarch64')

linux/centos/pgtidy.spec

@@ -1,13 +1,13 @@
 Name:           pgtidy
-Version:        0.0.1
+Version:        0.0.9
 Release:        1%{?dist}
 Summary:        PostgreSQL SQL formatter and linter
 
 License:        MIT
 URL:            https://git.warky.dev/wdevs/pgtidy
-Source0:        %{name}-%{version}.tar.gz
-
-BuildRequires:  golang >= 1.26
+Source0:        pgtidy
+Source1:        LICENSE
+ExclusiveArch:  x86_64
 
 %global debug_package %{nil}
 %define _debugsource_packages 0
@@ -17,24 +17,15 @@ BuildRequires:  golang >= 1.26
 PgTidy formats and lints PostgreSQL SQL, enforcing a consistent style
 for migrations, schemas, functions, procedures, and triggers.
 
-%prep
-%autosetup
-
-%build
-export CGO_ENABLED=0
-go build \
-    -trimpath \
-    -ldflags "-X main.version=%{version}" \
-    -o %{name} ./cmd/pgtidy
-
 %install
-install -Dm755 %{name} %{buildroot}%{_bindir}/%{name}
-install -Dm644 LICENSE %{buildroot}%{_licensedir}/%{name}/LICENSE
+install -Dm755 %{SOURCE0} %{buildroot}%{_bindir}/%{name}
+mkdir -p %{buildroot}%{_datadir}/licenses/%{name}
+install -m644 %{SOURCE1} %{buildroot}%{_datadir}/licenses/%{name}/LICENSE
 
 %files
-%license LICENSE
 %{_bindir}/%{name}
+%{_datadir}/licenses/%{name}/LICENSE
 
 %changelog
-* Sun Jun 29 2026 Hein (Warky Devs) <hein@warky.dev> - 0.1.0-1
+* Sun Jun 29 2026 Hein (Warky Devs) <hein@warky.dev> - 0.0.1-1
 - Initial package

pkg/config/config.go

@@ -16,9 +16,8 @@ import (
 type Case string
 
 const (
-	CaseUpper Case = "upper"
-	CaseLower Case = "lower"
-	// CasePreserve leaves the token text unchanged.
+	CaseUpper    Case = "upper"
+	CaseLower    Case = "lower"
 	CasePreserve Case = "preserve"
 )
 
@@ -26,51 +25,183 @@ const (
 type CommaStyle string
 
 const (
-	// CommaLeading puts the comma at the start of the continuation line
-	// (",col"), the house style.
-	CommaLeading CommaStyle = "leading"
-	// CommaTrailing puts the comma at the end of the preceding line ("col,").
+	CommaLeading  CommaStyle = "leading"
 	CommaTrailing CommaStyle = "trailing"
 )
 
+// WrapMode controls whether a construct wraps to multiple lines.
+type WrapMode string
+
+const (
+	WrapAlways   WrapMode = "always"
+	WrapWhenLong WrapMode = "when_long"
+	WrapNever    WrapMode = "never"
+)
+
+// Placement controls where a token or block is placed relative to surrounding content.
+type Placement string
+
+const (
+	PlacementSameLine Placement = "same_line"
+	PlacementNewLine  Placement = "new_line"
+)
+
 // Style is the formatter configuration.
 type Style struct {
-	// Indent is one indentation level (default two spaces).
-	Indent string
-	// Newline is the line terminator emitted by the formatter.
+	// --- Core ---
+	Indent  string
 	Newline string
-	// KeywordCase controls SQL keyword casing (types excluded — see TypeCase).
-	KeywordCase Case
-	// IdentCase controls unquoted identifier casing (quoted identifiers are
-	// never touched).
-	IdentCase Case
-	// TypeCase controls built-in type-name casing.
-	TypeCase Case
-	// Commas controls list separator placement.
-	Commas CommaStyle
+
+	// --- Casing ---
+	KeywordCase    Case
+	IdentCase      Case
+	TypeCase       Case
+	AliasCase      Case // token immediately following AS in SELECT/FROM
+	BuiltinCase    Case // built-in function names (COALESCE, MAX, NOW, …)
+	CustomTypeCase Case // user-defined / domain types not in the built-in set
+
+	// --- Query layout ---
+	Commas            CommaStyle
+	AlignColumns      bool     // pad SELECT list so values align
+	AlignLineComments bool     // align trailing -- comments in a block
+	SelectAlignAs     bool     // pad between expression and AS in SELECT list
+	SetAlignEqual     bool     // align = in UPDATE SET list
+	IndentJoin        bool     // extra indentation for JOIN … ON lines
+	JoinIndentSize    int      // extra indent levels for JOINs (default 1)
+	WhereWrap         WrapMode // always|when_long|never — each AND/OR on its own line
+	LineWidth         int      // target width for when_long wrapping (0 = unlimited)
+	SelectWrap        WrapMode // always|when_long|never — one SELECT/RETURNING column per line
+	JoinWrap          WrapMode // always|when_long|never — break JOIN … ON onto its own lines
+	WhereAndOrIndent  bool     // AND/OR indented one level under WHERE
+
+	// --- Subqueries ---
+	SubqueryOpening          Placement // opening ( placement: same_line|new_line
+	SubqueryContent          Placement // content indentation: same_line|new_line
+	SubqueryClosing          Placement // closing ) placement: same_line|new_line
+	SubquerySpaceBeforeParen bool      // space before ( in subqueries
+
+	// --- INSERT ---
+	InsertCollapseValues bool // fold multiple VALUES rows onto fewer lines
+
+	// --- Routines ---
+	AlignParamTypes bool // pad param names so type column aligns
+	RoutineAsWrap   bool // newline before AS $$
+
+	// --- PL/pgSQL body ---
+	PlpgsqlMaxBlankLines    int  // max consecutive blank lines in body
+	PlpgsqlDeclareAlignType bool // align type column in DECLARE block
+	PlpgsqlDeclareAlignEq   bool // align := / = in DECLARE block
+	PlpgsqlIfThenNewline    bool // THEN on its own line
+	PlpgsqlLoopCollapse     bool // collapse empty loop bodies to one line
+
+	// --- Expressions ---
+	BinaryOpAlign          bool      // align =, <>, || etc. vertically in WHERE/expr lists
+	SpaceAfterCommaInCalls bool      // space after , in function calls: func(a, b)
+	CaseWhenWrap           bool      // each WHEN … THEN on its own line
+	CaseEnd                Placement // END placement: same_line|new_line
+	CaseCollapse           bool      // collapse short CASE to one line
+	RecordSpaceBeforeParen bool      // space before ( in ROW(…) / record constructors
 }
 
 // Default returns the house-style configuration.
 func Default() Style {
 	return Style{
-		Indent:      "  ",
-		Newline:     "\n",
-		KeywordCase: CaseUpper,
-		IdentCase:   CaseLower,
-		TypeCase:    CaseLower,
-		Commas:      CommaLeading,
+		Indent:  "  ",
+		Newline: "\n",
+
+		KeywordCase:    CaseUpper,
+		IdentCase:      CaseLower,
+		TypeCase:       CaseLower,
+		AliasCase:      CaseLower,
+		BuiltinCase:    CaseLower,
+		CustomTypeCase: CaseLower,
+
+		Commas:            CommaLeading,
+		AlignColumns:      false,
+		AlignLineComments: false,
+		SelectAlignAs:     false,
+		SetAlignEqual:     false,
+		IndentJoin:        false,
+		JoinIndentSize:    1,
+		LineWidth:         120,
+		SelectWrap:        WrapAlways,
+		JoinWrap:          WrapNever,
+		WhereWrap:         WrapAlways,
+		WhereAndOrIndent:  true,
+
+		SubqueryOpening:          PlacementSameLine,
+		SubqueryContent:          PlacementNewLine,
+		SubqueryClosing:          PlacementNewLine,
+		SubquerySpaceBeforeParen: false,
+
+		InsertCollapseValues: true,
+
+		AlignParamTypes: false,
+		RoutineAsWrap:   true,
+
+		PlpgsqlMaxBlankLines:    1,
+		PlpgsqlDeclareAlignType: true,
+		PlpgsqlDeclareAlignEq:   true,
+		PlpgsqlIfThenNewline:    true,
+		PlpgsqlLoopCollapse:     true,
+
+		BinaryOpAlign:          false,
+		SpaceAfterCommaInCalls: false,
+		CaseWhenWrap:           false,
+		CaseEnd:                PlacementNewLine,
+		CaseCollapse:           false,
+		RecordSpaceBeforeParen: false,
 	}
 }
 
 // yamlFile is the on-disk representation of .pgtidy.yaml.
 // All fields are pointers so we can distinguish "not set" from "set to zero value".
 type yamlFile struct {
-	Indent      *string `yaml:"indent"`
-	Newline     *string `yaml:"newline"`
-	KeywordCase *string `yaml:"keyword_case"`
-	IdentCase   *string `yaml:"ident_case"`
-	TypeCase    *string `yaml:"type_case"`
-	Commas      *string `yaml:"commas"`
+	Indent  *string `yaml:"indent"`
+	Newline *string `yaml:"newline"`
+
+	KeywordCase    *string `yaml:"keyword_case"`
+	IdentCase      *string `yaml:"ident_case"`
+	TypeCase       *string `yaml:"type_case"`
+	AliasCase      *string `yaml:"alias_case"`
+	BuiltinCase    *string `yaml:"builtin_case"`
+	CustomTypeCase *string `yaml:"custom_type_case"`
+
+	Commas            *string `yaml:"commas"`
+	AlignColumns      *bool   `yaml:"align_columns"`
+	AlignLineComments *bool   `yaml:"align_line_comments"`
+	SelectAlignAs     *bool   `yaml:"select_align_as"`
+	SetAlignEqual     *bool   `yaml:"set_align_equal"`
+	IndentJoin        *bool   `yaml:"indent_join"`
+	JoinIndentSize    *int    `yaml:"join_indent_size"`
+	WhereWrap         *string `yaml:"where_wrap"`
+	LineWidth         *int    `yaml:"line_width"`
+	SelectWrap        *string `yaml:"select_wrap"`
+	JoinWrap          *string `yaml:"join_wrap"`
+	WhereAndOrIndent  *bool   `yaml:"where_and_or_indent"`
+
+	SubqueryOpening          *string `yaml:"subquery_opening"`
+	SubqueryContent          *string `yaml:"subquery_content"`
+	SubqueryClosing          *string `yaml:"subquery_closing"`
+	SubquerySpaceBeforeParen *bool   `yaml:"subquery_space_before_paren"`
+
+	InsertCollapseValues *bool `yaml:"insert_collapse_values"`
+
+	AlignParamTypes *bool `yaml:"align_param_types"`
+	RoutineAsWrap   *bool `yaml:"routine_as_wrap"`
+
+	PlpgsqlMaxBlankLines    *int  `yaml:"plpgsql_max_blank_lines"`
+	PlpgsqlDeclareAlignType *bool `yaml:"plpgsql_declare_align_type"`
+	PlpgsqlDeclareAlignEq   *bool `yaml:"plpgsql_declare_align_eq"`
+	PlpgsqlIfThenNewline    *bool `yaml:"plpgsql_if_then_newline"`
+	PlpgsqlLoopCollapse     *bool `yaml:"plpgsql_loop_collapse"`
+
+	BinaryOpAlign          *bool   `yaml:"binary_op_align"`
+	SpaceAfterCommaInCalls *bool   `yaml:"space_after_comma_in_calls"`
+	CaseWhenWrap           *bool   `yaml:"case_when_wrap"`
+	CaseEnd                *string `yaml:"case_end"`
+	CaseCollapse           *bool   `yaml:"case_collapse"`
+	RecordSpaceBeforeParen *bool   `yaml:"record_space_before_paren"`
 }
 
 // Load discovers and parses the nearest .pgtidy.yaml by walking up from
@@ -100,27 +231,26 @@ func Load(startDir string) (Style, error) {
 	if yf.Newline != nil {
 		st.Newline = *yf.Newline
 	}
-	if yf.KeywordCase != nil {
-		c := Case(*yf.KeywordCase)
-		if err := validCase(c); err != nil {
-			return st, fmt.Errorf("pgtidy: %s: keyword_case: %w", path, err)
-		}
-		st.KeywordCase = c
+
+	if err := loadCase(yf.KeywordCase, &st.KeywordCase, path, "keyword_case"); err != nil {
+		return st, err
 	}
-	if yf.IdentCase != nil {
-		c := Case(*yf.IdentCase)
-		if err := validCase(c); err != nil {
-			return st, fmt.Errorf("pgtidy: %s: ident_case: %w", path, err)
-		}
-		st.IdentCase = c
+	if err := loadCase(yf.IdentCase, &st.IdentCase, path, "ident_case"); err != nil {
+		return st, err
 	}
-	if yf.TypeCase != nil {
-		c := Case(*yf.TypeCase)
-		if err := validCase(c); err != nil {
-			return st, fmt.Errorf("pgtidy: %s: type_case: %w", path, err)
-		}
-		st.TypeCase = c
+	if err := loadCase(yf.TypeCase, &st.TypeCase, path, "type_case"); err != nil {
+		return st, err
 	}
+	if err := loadCase(yf.AliasCase, &st.AliasCase, path, "alias_case"); err != nil {
+		return st, err
+	}
+	if err := loadCase(yf.BuiltinCase, &st.BuiltinCase, path, "builtin_case"); err != nil {
+		return st, err
+	}
+	if err := loadCase(yf.CustomTypeCase, &st.CustomTypeCase, path, "custom_type_case"); err != nil {
+		return st, err
+	}
+
 	if yf.Commas != nil {
 		cs := CommaStyle(*yf.Commas)
 		if cs != CommaLeading && cs != CommaTrailing {
@@ -129,9 +259,113 @@ func Load(startDir string) (Style, error) {
 		st.Commas = cs
 	}
 
+	loadBool(yf.AlignColumns, &st.AlignColumns)
+	loadBool(yf.AlignLineComments, &st.AlignLineComments)
+	loadBool(yf.SelectAlignAs, &st.SelectAlignAs)
+	loadBool(yf.SetAlignEqual, &st.SetAlignEqual)
+	loadBool(yf.IndentJoin, &st.IndentJoin)
+	if yf.JoinIndentSize != nil {
+		st.JoinIndentSize = *yf.JoinIndentSize
+	}
+	if yf.LineWidth != nil {
+		if *yf.LineWidth < 0 {
+			return st, fmt.Errorf("pgtidy: %s: line_width: must be >= 0", path)
+		}
+		st.LineWidth = *yf.LineWidth
+	}
+	if yf.SelectWrap != nil {
+		wm := WrapMode(*yf.SelectWrap)
+		if err := validWrap(wm); err != nil {
+			return st, fmt.Errorf("pgtidy: %s: select_wrap: %w", path, err)
+		}
+		st.SelectWrap = wm
+	}
+	if yf.JoinWrap != nil {
+		wm := WrapMode(*yf.JoinWrap)
+		if err := validWrap(wm); err != nil {
+			return st, fmt.Errorf("pgtidy: %s: join_wrap: %w", path, err)
+		}
+		st.JoinWrap = wm
+	}
+	if yf.WhereWrap != nil {
+		wm := WrapMode(*yf.WhereWrap)
+		if err := validWrap(wm); err != nil {
+			return st, fmt.Errorf("pgtidy: %s: where_wrap: %w", path, err)
+		}
+		st.WhereWrap = wm
+	}
+	loadBool(yf.WhereAndOrIndent, &st.WhereAndOrIndent)
+
+	if yf.SubqueryOpening != nil {
+		pl := Placement(*yf.SubqueryOpening)
+		if err := validPlacement(pl); err != nil {
+			return st, fmt.Errorf("pgtidy: %s: subquery_opening: %w", path, err)
+		}
+		st.SubqueryOpening = pl
+	}
+	if yf.SubqueryContent != nil {
+		pl := Placement(*yf.SubqueryContent)
+		if err := validPlacement(pl); err != nil {
+			return st, fmt.Errorf("pgtidy: %s: subquery_content: %w", path, err)
+		}
+		st.SubqueryContent = pl
+	}
+	if yf.SubqueryClosing != nil {
+		pl := Placement(*yf.SubqueryClosing)
+		if err := validPlacement(pl); err != nil {
+			return st, fmt.Errorf("pgtidy: %s: subquery_closing: %w", path, err)
+		}
+		st.SubqueryClosing = pl
+	}
+	loadBool(yf.SubquerySpaceBeforeParen, &st.SubquerySpaceBeforeParen)
+
+	loadBool(yf.InsertCollapseValues, &st.InsertCollapseValues)
+
+	loadBool(yf.AlignParamTypes, &st.AlignParamTypes)
+	loadBool(yf.RoutineAsWrap, &st.RoutineAsWrap)
+
+	if yf.PlpgsqlMaxBlankLines != nil {
+		st.PlpgsqlMaxBlankLines = *yf.PlpgsqlMaxBlankLines
+	}
+	loadBool(yf.PlpgsqlDeclareAlignType, &st.PlpgsqlDeclareAlignType)
+	loadBool(yf.PlpgsqlDeclareAlignEq, &st.PlpgsqlDeclareAlignEq)
+	loadBool(yf.PlpgsqlIfThenNewline, &st.PlpgsqlIfThenNewline)
+	loadBool(yf.PlpgsqlLoopCollapse, &st.PlpgsqlLoopCollapse)
+
+	loadBool(yf.BinaryOpAlign, &st.BinaryOpAlign)
+	loadBool(yf.SpaceAfterCommaInCalls, &st.SpaceAfterCommaInCalls)
+	loadBool(yf.CaseWhenWrap, &st.CaseWhenWrap)
+	if yf.CaseEnd != nil {
+		pl := Placement(*yf.CaseEnd)
+		if err := validPlacement(pl); err != nil {
+			return st, fmt.Errorf("pgtidy: %s: case_end: %w", path, err)
+		}
+		st.CaseEnd = pl
+	}
+	loadBool(yf.CaseCollapse, &st.CaseCollapse)
+	loadBool(yf.RecordSpaceBeforeParen, &st.RecordSpaceBeforeParen)
+
 	return st, nil
 }
 
+func loadCase(src *string, dst *Case, path, key string) error {
+	if src == nil {
+		return nil
+	}
+	c := Case(*src)
+	if err := validCase(c); err != nil {
+		return fmt.Errorf("pgtidy: %s: %s: %w", path, key, err)
+	}
+	*dst = c
+	return nil
+}
+
+func loadBool(src *bool, dst *bool) {
+	if src != nil {
+		*dst = *src
+	}
+}
+
 // findConfig walks parent directories from startDir looking for .pgtidy.yaml.
 // Returns ("", nil) when no file is found before reaching the filesystem root.
 func findConfig(startDir string) (string, error) {
@@ -159,3 +393,19 @@ func validCase(c Case) error {
 	}
 	return fmt.Errorf("must be \"upper\", \"lower\", or \"preserve\"")
 }
+
+func validWrap(w WrapMode) error {
+	switch w {
+	case WrapAlways, WrapWhenLong, WrapNever:
+		return nil
+	}
+	return fmt.Errorf("must be \"always\", \"when_long\", or \"never\"")
+}
+
+func validPlacement(p Placement) error {
+	switch p {
+	case PlacementSameLine, PlacementNewLine:
+		return nil
+	}
+	return fmt.Errorf("must be \"same_line\" or \"new_line\"")
+}

pkg/diagnostics/diagnostics.go

@@ -15,27 +15,27 @@ const (
 // TextFix is a byte-range replacement that can be applied to the source SQL.
 // Replace src[Offset:End] with New. An insertion has Offset == End.
 type TextFix struct {
-	Offset int    // byte offset in source (inclusive)
-	End    int    // byte offset in source (exclusive)
-	New    string // replacement text
-	Title  string // short description shown in editor UI
+	Offset int    `json:"offset"` // byte offset in source (inclusive)
+	End    int    `json:"end"`    // byte offset in source (exclusive)
+	New    string `json:"new"`    // replacement text
+	Title  string `json:"title"`  // short description shown in editor UI
 }
 
 // Diagnostic is a single lint finding.
 type Diagnostic struct {
 	// RuleID is the stable identifier for the rule that produced this finding
 	// (e.g. "MIG001").
-	RuleID string
+	RuleID string `json:"ruleId"`
 	// Severity is the urgency level.
-	Severity Severity
+	Severity Severity `json:"severity"`
 	// Message is a human-readable description of the finding.
-	Message string
+	Message string `json:"message"`
 	// File is the path to the source file, or "" for stdin.
-	File string
+	File string `json:"file"`
 	// Line is the 1-based line number of the finding.
-	Line int
+	Line int `json:"line"`
 	// Col is the 1-based column number of the finding.
-	Col int
+	Col int `json:"col"`
 	// Fix is non-nil when an autofix is available for this diagnostic.
-	Fix *TextFix
+	Fix *TextFix `json:"fix,omitempty"`
 }

pkg/format/body.go

@@ -1,6 +1,9 @@
 package format
 
 import (
+	"git.warky.dev/wdevs/pgtidy/pkg/parser"
+	"regexp"
+	"sort"
 	"strings"
 
 	"git.warky.dev/wdevs/pgtidy/pkg/config"
@@ -92,10 +95,11 @@ func formatBodyInner(inner string, st config.Style) string {
 	var b strings.Builder
 
 	// Emit verbatim up to and including DECLARE (keyword-cased).
+	// Normalize CRLF in trivia so the output always uses st.Newline.
 	for i := 0; i <= declareIdx; i++ {
 		t := sig[i]
 		for _, tr := range t.Lead {
-			b.WriteString(tr.Text)
+			b.WriteString(strings.ReplaceAll(tr.Text, "\r\n", nl))
 		}
 		if i == declareIdx {
 			b.WriteString(applyCase(t.Tok.Text, st.KeywordCase))
@@ -108,6 +112,16 @@ func formatBodyInner(inner string, st config.Style) string {
 	// Format each variable declaration in the DECLARE section.
 	formatDeclareVars(&b, sig[declareIdx+1:beginIdx], st)
 
+	// Comments between the last declaration and BEGIN live in BEGIN's leading
+	// trivia; keep them, one per line, at declaration indent.
+	for _, tr := range sig[beginIdx].Lead {
+		if tr.Kind == lexer.LineComment || tr.Kind == lexer.BlockComment {
+			b.WriteString(st.Indent)
+			b.WriteString(strings.TrimRight(strings.ReplaceAll(tr.Text, "\r", ""), " \t"))
+			b.WriteString(nl)
+		}
+	}
+
 	// Format the BEGIN…END block.
 	b.WriteString(formatBodyStatements(inner[sig[beginIdx].Tok.Off:], st))
 
@@ -122,57 +136,30 @@ func formatDeclareVars(b *strings.Builder, toks []cst.Tok, st config.Style) {
 	nl := st.Newline
 	indent := st.Indent
 	depth := 0
+	var decls [][]cst.Tok
 	var cur []cst.Tok
-	var preComments []string
+	var preCommentSets [][]string
+	var curPreComments []string
 
-	emit := func() {
+	collect := func() {
 		if len(cur) == 0 {
 			return
 		}
-		for _, c := range preComments {
-			b.WriteString(indent)
-			b.WriteString(c)
-			b.WriteString(nl)
-		}
-		preComments = nil
-
-		// Graceful degradation: mid-declaration comments stay verbatim.
-		if anyComment(cur[1:]) {
-			b.WriteString(indent)
-			b.WriteString(verbatimSpan(cur))
-			b.WriteString(nl)
-			cur = nil
-			return
-		}
-
-		body := cur
-		hasSemi := len(body) > 0 && body[len(body)-1].Tok.Kind == lexer.Semicolon
-		if hasSemi {
-			body = body[:len(body)-1]
-		}
-		b.WriteString(indent)
-		for i, t := range body {
-			if i > 0 && needSpace(body[i-1].Tok, t.Tok) {
-				b.WriteByte(' ')
-			}
-			b.WriteString(caseText(t.Tok, st))
-		}
-		if hasSemi {
-			b.WriteString(";")
-		}
-		b.WriteString(nl)
+		decls = append(decls, cur)
+		preCommentSets = append(preCommentSets, curPreComments)
 		cur = nil
+		curPreComments = nil
 	}
 
 	for _, t := range toks {
 		if len(cur) == 0 {
 			for _, tr := range t.Lead {
 				if tr.Kind == lexer.LineComment || tr.Kind == lexer.BlockComment {
-					preComments = append(preComments, strings.TrimRight(tr.Text, " \t"))
+					text := strings.TrimRight(strings.ReplaceAll(tr.Text, "\r", ""), " \t")
+					curPreComments = append(curPreComments, text)
 				}
 			}
 		}
-
 		switch t.Tok.Kind {
 		case lexer.LParen, lexer.LBracket:
 			depth++
@@ -181,14 +168,224 @@ func formatDeclareVars(b *strings.Builder, toks []cst.Tok, st config.Style) {
 				depth--
 			}
 		}
-
 		cur = append(cur, t)
-
 		if t.Tok.Kind == lexer.Semicolon && depth == 0 {
-			emit()
+			collect()
+		}
+	}
+	collect()
+
+	// Compute alignment widths when requested.
+	var nameColW, typeColW int
+	if st.PlpgsqlDeclareAlignType || st.PlpgsqlDeclareAlignEq {
+		for _, decl := range decls {
+			if anyComment(decl[1:]) {
+				continue
+			}
+			body := decl
+			if len(body) > 0 && body[len(body)-1].Tok.Kind == lexer.Semicolon {
+				body = body[:len(body)-1]
+			}
+			nw, tw := declareNameTypeWidth(body, st)
+			if nw > nameColW {
+				nameColW = nw
+			}
+			// typeColW drives the '='/':='/DEFAULT column (align_eq only), so
+			// only declarations that actually carry an assignment participate —
+			// a bare "name type;" must not widen it.
+			if tw > typeColW && declHasAssignment(body) {
+				typeColW = tw
+			}
+		}
+	}
+
+	for i, cur := range decls {
+		for _, c := range preCommentSets[i] {
+			b.WriteString(indent)
+			b.WriteString(c)
+			b.WriteString(nl)
+		}
+		// Graceful degradation: mid-declaration comments stay verbatim.
+		if anyComment(cur[1:]) {
+			b.WriteString(indent)
+			b.WriteString(verbatimSpan(cur))
+			b.WriteString(nl)
+			continue
+		}
+
+		body := cur
+		hasSemi := len(body) > 0 && body[len(body)-1].Tok.Kind == lexer.Semicolon
+		if hasSemi {
+			body = body[:len(body)-1]
+		}
+		b.WriteString(indent)
+		if (st.PlpgsqlDeclareAlignType || st.PlpgsqlDeclareAlignEq) && nameColW > 0 {
+			writeDeclareAligned(b, body, st, nameColW, typeColW)
+		} else {
+			for j, t := range body {
+				if j > 0 && needSpace(body[j-1].Tok, t.Tok) && !isPctTypeBoundary(body, j) {
+					b.WriteByte(' ')
+				}
+				b.WriteString(caseText(t.Tok, st))
+			}
+		}
+		if hasSemi {
+			b.WriteString(";")
+		}
+		b.WriteString(nl)
+	}
+}
+
+// declHasAssignment reports whether a DECLARE variable body (name type … ) has
+// a default assignment ( := / = / DEFAULT ) at paren depth 0.
+func declHasAssignment(body []cst.Tok) bool {
+	depth := 0
+	for _, t := range body {
+		switch t.Tok.Kind {
+		case lexer.LParen, lexer.LBracket:
+			depth++
+		case lexer.RParen, lexer.RBracket:
+			if depth > 0 {
+				depth--
+			}
+		}
+		if depth != 0 {
+			continue
+		}
+		if t.Tok.Kind == lexer.Operator && (t.Tok.Text == ":=" || t.Tok.Text == "=") {
+			return true
+		}
+		if t.Tok.Kind == lexer.Ident && lowerASCII(t.Tok.Text) == "default" {
+			return true
+		}
+	}
+	return false
+}
+
+// declareNameTypeWidth returns the rendered width of the name and type portions
+// of a DECLARE variable declaration (without the default assignment).
+// Format is: [name type [:= default]] or [name type [DEFAULT default]].
+func declareNameTypeWidth(body []cst.Tok, st config.Style) (nameW, typeW int) {
+	if len(body) < 2 {
+		return 0, 0
+	}
+	// name is always the first token.
+	name := caseText(body[0].Tok, st)
+	nameW = len(name)
+
+	// type runs from body[1] until we hit := / DEFAULT / = at depth 0.
+	var typeTokens []cst.Tok
+	depth := 0
+	for _, t := range body[1:] {
+		switch t.Tok.Kind {
+		case lexer.LParen, lexer.LBracket:
+			depth++
+		case lexer.RParen, lexer.RBracket:
+			if depth > 0 {
+				depth--
+			}
+		}
+		if depth == 0 {
+			low := lowerASCII(t.Tok.Text)
+			if t.Tok.Kind == lexer.Operator && (t.Tok.Text == ":=" || t.Tok.Text == "=") {
+				break
+			}
+			if t.Tok.Kind == lexer.Ident && low == "default" {
+				break
+			}
+		}
+		typeTokens = append(typeTokens, t)
+	}
+	var tb strings.Builder
+	for j, t := range typeTokens {
+		if j > 0 && needSpace(typeTokens[j-1].Tok, t.Tok) && !isPctTypeBoundary(typeTokens, j) {
+			tb.WriteByte(' ')
+		}
+		tb.WriteString(caseText(t.Tok, st))
+	}
+	typeW = len(tb.String())
+	return nameW, typeW
+}
+
+// writeDeclareAligned writes a single DECLARE variable with aligned columns.
+func writeDeclareAligned(b *strings.Builder, body []cst.Tok, st config.Style, nameColW, typeColW int) {
+	if len(body) == 0 {
+		return
+	}
+	name := caseText(body[0].Tok, st)
+	b.WriteString(name)
+	if len(body) == 1 {
+		return
+	}
+
+	// Pad name to nameColW if align_type is requested.
+	if st.PlpgsqlDeclareAlignType {
+		pad := nameColW - len(name)
+		for k := 0; k < pad; k++ {
+			b.WriteByte(' ')
+		}
+	}
+
+	// Collect type tokens.
+	var typeTokens, restTokens []cst.Tok
+	depth := 0
+	pastType := false
+	for _, t := range body[1:] {
+		switch t.Tok.Kind {
+		case lexer.LParen, lexer.LBracket:
+			depth++
+		case lexer.RParen, lexer.RBracket:
+			if depth > 0 {
+				depth--
+			}
+		}
+		if !pastType && depth == 0 {
+			low := lowerASCII(t.Tok.Text)
+			if (t.Tok.Kind == lexer.Operator && (t.Tok.Text == ":=" || t.Tok.Text == "=")) ||
+				(t.Tok.Kind == lexer.Ident && low == "default") {
+				pastType = true
+				restTokens = append(restTokens, t)
+				continue
+			}
+		}
+		if pastType {
+			restTokens = append(restTokens, t)
+		} else {
+			typeTokens = append(typeTokens, t)
+		}
+	}
+
+	var typeStr strings.Builder
+	for j, t := range typeTokens {
+		if j > 0 && needSpace(typeTokens[j-1].Tok, t.Tok) && !isPctTypeBoundary(typeTokens, j) {
+			typeStr.WriteByte(' ')
+		}
+		typeStr.WriteString(caseText(t.Tok, st))
+	}
+	typeRendered := typeStr.String()
+
+	b.WriteByte(' ')
+	b.WriteString(typeRendered)
+
+	if len(restTokens) > 0 {
+		// Pad type to typeColW if align_eq is requested.
+		if st.PlpgsqlDeclareAlignEq {
+			pad := typeColW - len(typeRendered)
+			for k := 0; k < pad; k++ {
+				b.WriteByte(' ')
+			}
+		}
+		for j, t := range restTokens {
+			prev := restTokens[0].Tok
+			if j > 0 {
+				prev = restTokens[j-1].Tok
+			}
+			if j == 0 || needSpace(prev, t.Tok) {
+				b.WriteByte(' ')
+			}
+			b.WriteString(caseText(t.Tok, st))
 		}
 	}
-	emit()
 }
 
 // bline is one logical line within an accumulated statement.
@@ -208,17 +405,74 @@ type bline struct {
 //  3. After EXCEPTION the formatter switches to verbatim-indent mode (original
 //     leading whitespace is preserved) to avoid conflicts between styles that
 //     put WHEN at col-0 vs indented.
-//  4. Blank-line counts from the original are preserved.
+//  4. Blank-line counts from the original are preserved (capped by PlpgsqlMaxBlankLines).
 func formatBodyStatements(text string, st config.Style) string {
 	nl := st.Newline
+	text = formatEmbeddedLiterals(text, st)
 	normalised := strings.ReplaceAll(text, "\r\n", "\n")
 	rawLines := strings.Split(normalised, "\n")
 
+	// Mark the continuation lines of every multi-line token whose interior is
+	// not code: /* … */ block comments and every kind of string literal,
+	// including dollar-quoted ones (a dollar quote is just another way of
+	// quoting a string, whatever its tag, and its content may be any language).
+	// Those lines are token content, not statements: they must be carried
+	// verbatim with the token's opening line, never split off and reindented.
+	// On the line where such a token ends, tail holds the code that follows it
+	// so paren depth and statement terminators are still tracked.
+	inVerbatim := make([]bool, len(rawLines))
+	tail := make([]string, len(rawLines))
+	tailCol := make([]int, len(rawLines)) // column where tail[i] starts
+	cut := make([]int, len(rawLines))     // column where a multi-line token opens on this line, or -1
+	for i := range cut {
+		cut[i] = -1
+	}
+	lineStart := make([]int, len(rawLines))
+	for i, off := 0, 0; i < len(rawLines); i++ {
+		lineStart[i] = off
+		off += len(rawLines[i]) + 1
+	}
+	lineOf := func(off int) int {
+		return sort.Search(len(lineStart), func(i int) bool { return lineStart[i] > off }) - 1
+	}
+	for _, t := range lexer.Lex(normalised) {
+		switch t.Kind {
+		case lexer.BlockComment, lexer.String, lexer.EscapeString, lexer.BitString, lexer.DollarString:
+		default:
+			continue
+		}
+		n := strings.Count(t.Text, "\n")
+		if n == 0 || !literalTerminated(t) {
+			continue
+		}
+		start := lineOf(t.Off)
+		if cut[start] < 0 {
+			cut[start] = t.Off - lineStart[start]
+		}
+		for k := 1; k <= n && start+k < len(inVerbatim); k++ {
+			inVerbatim[start+k] = true
+		}
+		if start+n < len(tail) {
+			rest := normalised[t.Off+len(t.Text):]
+			if i := strings.IndexByte(rest, '\n'); i >= 0 {
+				rest = rest[:i]
+			}
+			tail[start+n] = rest
+			tailCol[start+n] = t.Off + len(t.Text) - lineStart[start+n]
+		}
+	}
+
+	maxBlanks := st.PlpgsqlMaxBlankLines
+	if maxBlanks < 0 {
+		maxBlanks = 0
+	}
+
 	var (
 		result        strings.Builder
 		stmt          []bline
 		parenDepth    int
 		blockDepth    int // 0=col-0 (BEGIN/END/EXCEPTION), 1=body, 2=nested…
+		caseDepth     int // depth of open CASE…END expressions (WHEN…THEN is not a block opener)
 		inException   bool
 		pendingBlanks int
 		depthInc      bool // increment blockDepth after next flush
@@ -228,7 +482,11 @@ func formatBodyStatements(text string, st config.Style) string {
 		if len(stmt) == 0 {
 			return
 		}
-		for i := 0; i < pendingBlanks; i++ {
+		blanks := pendingBlanks
+		if blanks > maxBlanks {
+			blanks = maxBlanks
+		}
+		for i := 0; i < blanks; i++ {
 			result.WriteString(nl)
 		}
 		pendingBlanks = 0
@@ -259,25 +517,31 @@ func formatBodyStatements(text string, st config.Style) string {
 			}
 			effectiveDepth = blockDepth
 		case "else", "elsif", "elseif":
-			// Emit at one level up; blockDepth unchanged so the body continues
-			// at the same depth (THEN will re-apply depthInc for elsif).
 			if blockDepth > 0 {
 				effectiveDepth = blockDepth - 1
 			}
 		case "exception":
 			inException = true
-			effectiveDepth = 0
+			// EXCEPTION belongs to its nearest enclosing BEGIN, so align it one
+			// level in from the current block body (col 0 for the outermost).
+			effectiveDepth = blockDepth - 1
+			if effectiveDepth < 0 {
+				effectiveDepth = 0
+			}
 		}
 
 		baseIndent := strings.Repeat(st.Indent, effectiveDepth)
 
-		for i, ll := range stmt {
-			if i == 0 || ll.indent == "" {
-				result.WriteString(baseIndent)
-			} else {
-				result.WriteString(ll.indent)
-			}
-			result.WriteString(ll.text)
+		// plpgsql_if_then_newline: when false, THEN stays on the same line as
+		// the condition. When true (default) it's already on its own logical line.
+		stmtLines := stmt
+		if !st.PlpgsqlIfThenNewline && fw == "if" {
+			stmtLines = joinThenToCondition(stmt)
+		}
+
+		formattedLines := formatBodyStmtLines(stmtLines, baseIndent, st)
+		for _, line := range formattedLines {
+			result.WriteString(line)
 			result.WriteString(nl)
 		}
 
@@ -288,33 +552,9 @@ func formatBodyStatements(text string, st config.Style) string {
 		stmt = nil
 	}
 
-	for _, rawLine := range rawLines {
-		line := strings.TrimRight(rawLine, "\r")
-		indent := leadingWhitespace(line)
-		stripped := line[len(indent):]
-
-		if stripped == "" {
-			flush()
-			pendingBlanks++
-			continue
-		}
-
-		fw := lowerASCII(firstBodyKeyword(stripped))
-		isColZero := indent == ""
-		// Only join when we are at paren-depth 0; content inside parens (e.g.
-		// inside a CTE subquery) should not be merged across lines.
-		joinToPrev := isColZero && parenDepth == 0 && len(stmt) > 0 && !sqlClauseKw[fw]
-
-		if joinToPrev {
-			last := &stmt[len(stmt)-1]
-			last.text = strings.TrimRight(last.text, " \t") + " " + stripped
-		} else {
-			stmt = append(stmt, bline{text: stripped, indent: indent})
-		}
-
-		// Scan tokens to track paren depth and detect flush triggers.
+	scanLine := func(text string, openLit bool) {
 		var lastD0Kw string
-		for _, tok := range lexer.Lex(stripped) {
+		for _, tok := range lexer.Lex(text) {
 			if tok.IsTrivia() || tok.Kind == lexer.EOF {
 				continue
 			}
@@ -327,36 +567,344 @@ func formatBodyStatements(text string, st config.Style) string {
 				}
 			case lexer.Semicolon:
 				if parenDepth == 0 {
+					// plpgsql_loop_collapse: fold empty FOR … LOOP END LOOP; to one line.
+					if st.PlpgsqlLoopCollapse && len(stmt) > 0 {
+						collapsed, ok := tryCollapseLoop(stmt, st)
+						if ok {
+							stmt = []bline{{text: collapsed, indent: ""}}
+						}
+					}
 					flush()
 				}
 			}
 			if parenDepth == 0 && tok.Kind == lexer.Ident {
 				lastD0Kw = lowerASCII(tok.Text)
+				switch lastD0Kw {
+				case "case":
+					caseDepth++
+				case "end":
+					if caseDepth > 0 {
+						caseDepth--
+					}
+				}
+			} else if parenDepth == 0 {
+				// A non-keyword token (string, operator, …) ends the run of
+				// keywords, so a line like `raise exception 'x'` does not end
+				// in the keyword EXCEPTION.
+				lastD0Kw = ""
 			}
 		}
 
-		// Structural keywords at the end of a line (paren depth 0) trigger a
-		// flush and possibly a block-depth change.
+		if openLit {
+			lastD0Kw = "" // the line ends inside a literal, not on a keyword
+		}
 		if parenDepth == 0 && len(stmt) > 0 {
 			switch lastD0Kw {
-			case "then", "loop", "begin":
-				// ELSIF/ELSEIF headers end with THEN but must NOT increment depth
-				// (blockDepth is already at the right level for the body).
+			case "then":
+				// A THEN ending a CASE…WHEN branch is not a PL/pgSQL block
+				// opener; only one matching END closes the whole CASE, so
+				// treating each WHEN…THEN as a block open would permanently
+				// inflate blockDepth.
+				if caseDepth == 0 {
+					fw0 := lowerASCII(firstBodyKeyword(stmt[0].text))
+					if fw0 != "elsif" && fw0 != "elseif" {
+						depthInc = true
+					}
+					flush()
+				}
+			case "loop", "begin":
 				fw0 := lowerASCII(firstBodyKeyword(stmt[0].text))
 				if fw0 != "elsif" && fw0 != "elseif" {
 					depthInc = true
 				}
 				flush()
 			case "else", "exception":
+				if caseDepth > 0 {
+					break
+				}
 				flush()
 			}
 		}
 	}
 
+	for j, rawLine := range rawLines {
+		line := strings.TrimRight(rawLine, "\r")
+
+		if inVerbatim[j] {
+			// Verbatim continuation of a multi-line comment or literal: glue it
+			// to the bline holding the token's opening line.
+			if len(stmt) > 0 {
+				last := &stmt[len(stmt)-1]
+				last.text += "\n" + line
+			} else {
+				stmt = append(stmt, bline{text: line})
+			}
+			if tail[j] != "" {
+				// A second literal may open later on this same line; scan only
+				// the code between the two.
+				tt, openLit := tail[j], false
+				if c := cut[j] - tailCol[j]; cut[j] >= 0 && c < len(tt) {
+					if c < 0 {
+						c = 0
+					}
+					tt, openLit = tt[:c], true
+				}
+				scanLine(tt, openLit)
+			}
+			continue
+		}
+
+		indent := leadingWhitespace(line)
+		stripped := line[len(indent):]
+
+		if stripped == "" {
+			flush()
+			pendingBlanks++
+			continue
+		}
+
+		fw := lowerASCII(firstBodyKeyword(stripped))
+		isColZero := indent == ""
+		joinToPrev := isColZero && parenDepth == 0 && len(stmt) > 0 && !sqlClauseKw[fw]
+		// A col-0 comment-only line is its own thing: never glue it onto the
+		// previous line — doing so buries a code line's trailing text in a
+		// comment and collapses consecutive -- comment lines into one.
+		if joinToPrev && len(significantBodyTokens(stripped)) == 0 {
+			joinToPrev = false
+		}
+		// Don't join a col-0 continuation to a comment-only preceding bline:
+		// the comment has no structural keyword so `continue ;` at col-0 would
+		// disappear into the comment text and be invisible to the lexer.
+		if joinToPrev {
+			if lowerASCII(firstBodyKeyword(stmt[len(stmt)-1].text)) == "" {
+				joinToPrev = false
+			}
+		}
+		// Pre-flush pending comment-only blines before adding a new non-comment
+		// non-joined bline. Without this, a comment + `end if;` end up in the
+		// same stmt, `fw` comes from the comment (empty string), depth is never
+		// decremented, and the formatter diverges on the second pass.
+		if !joinToPrev && fw != "" && len(stmt) > 0 {
+			allComments := true
+			for _, ll := range stmt {
+				if lowerASCII(firstBodyKeyword(ll.text)) != "" {
+					allComments = false
+					break
+				}
+			}
+			if allComments {
+				flush()
+			}
+		}
+
+		// Likewise never join onto a line that ends in a -- comment: the joined
+		// code would become part of the comment text.
+		if joinToPrev && endsInLineComment(stmt[len(stmt)-1].text) {
+			joinToPrev = false
+		}
+
+		if joinToPrev {
+			last := &stmt[len(stmt)-1]
+			last.text = strings.TrimRight(last.text, " \t") + " " + stripped
+		} else {
+			stmt = append(stmt, bline{text: stripped, indent: indent})
+		}
+
+		// A multi-line literal that opens on this line is scanned only up to
+		// its opening quote; the rest is token content, not code.
+		scanText, openLit := stripped, false
+		if c := cut[j] - len(indent); cut[j] >= 0 && c < len(scanText) {
+			if c < 0 {
+				c = 0
+			}
+			scanText, openLit = scanText[:c], true
+		}
+		scanLine(scanText, openLit)
+	}
+
 	flush()
 	return result.String()
 }
 
+// formatBodyStmtLines formats one flushed PL/pgSQL statement at its contextual
+// base indent. Multi-line UPDATE/DELETE statements inside PL/pgSQL get their
+// top-level SET/WHERE/AND/OR clauses realigned under the statement while nested
+// subqueries keep their original indentation. Non-DML statements keep
+// continuation indentation, except that standalone structural keywords such as
+// THEN are aligned with the block opener.
+func formatBodyStmtLines(lines []bline, baseIndent string, st config.Style) []string {
+	if len(lines) == 0 {
+		return nil
+	}
+
+	if looksLikeMultiLineBodyDML(lines) {
+		return reindentBodyDML(lines, baseIndent, st)
+	}
+
+	out := make([]string, 0, len(lines))
+	for i, ll := range lines {
+		text := ll.text
+		indent := baseIndent
+		switch {
+		case i > 0 && ll.indent == "" && len(significantBodyTokens(text)) == 0:
+			// A column-0 comment line trailing a multi-line (commented-out)
+			// statement is a continuation the author left flush-left — keep it
+			// there rather than re-indenting it to block depth.
+			indent = ""
+		case i > 0 && ll.indent != "" && !isStandaloneBodyKeyword(ll.text, "then", "else", "elsif", "elseif"):
+			indent = ll.indent
+		}
+		out = append(out, indent+text)
+	}
+	return out
+}
+
+func looksLikeMultiLineBodyDML(lines []bline) bool {
+	if len(lines) < 2 {
+		return false
+	}
+	kw := lowerASCII(firstBodyKeyword(lines[0].text))
+	return kw == "update" || kw == "delete"
+}
+
+func reindentBodyDML(lines []bline, baseIndent string, st config.Style) []string {
+	out := make([]string, 0, len(lines)+1)
+	afterWhere := false
+	parenDepth := 0
+	for i, ll := range lines {
+		text := strings.TrimRight(ll.text, " 	")
+		lineDepth := parenDepth
+		kw := lowerASCII(firstBodyKeyword(text))
+		if afterWhere && lineDepth == 0 && kw != "and" && kw != "or" {
+			out = append(out, baseIndent+st.Indent+st.Indent+strings.TrimSpace(text))
+			afterWhere = false
+			updateBodyParenDepth(text, &parenDepth)
+			continue
+		}
+		if lineDepth == 0 && (kw == "set" || kw == "where" || kw == "values" || kw == "returning") {
+			if kw == "where" {
+				whereText := strings.TrimSpace(text)
+				fields := strings.Fields(whereText)
+				nextKw := ""
+				if i+1 < len(lines) {
+					nextKw = lowerASCII(firstBodyKeyword(lines[i+1].text))
+				}
+				if len(fields) > 1 && (nextKw == "and" || nextKw == "or") {
+					out = append(out, baseIndent+fields[0])
+					out = append(out, baseIndent+st.Indent+st.Indent+strings.TrimSpace(whereText[len(fields[0]):]))
+					afterWhere = false
+					continue
+				}
+				afterWhere = len(fields) == 1
+			}
+			out = append(out, baseIndent+strings.TrimSpace(text))
+			continue
+		}
+		if lineDepth == 0 && (kw == "and" || kw == "or") {
+			// House style: AND/OR line up with the WHERE keyword; the first
+			// predicate is indented two levels under it.
+			out = append(out, baseIndent+strings.TrimSpace(text))
+			afterWhere = false
+			updateBodyParenDepth(text, &parenDepth)
+			continue
+		}
+		if i == 0 {
+			out = append(out, baseIndent+strings.TrimSpace(text))
+		} else if ll.indent != "" {
+			out = append(out, ll.indent+strings.TrimSpace(text))
+		} else {
+			out = append(out, baseIndent+strings.TrimSpace(text))
+		}
+		afterWhere = false
+		updateBodyParenDepth(text, &parenDepth)
+	}
+	return out
+}
+
+func updateBodyParenDepth(s string, depth *int) {
+	for _, tok := range lexer.Lex(s) {
+		switch tok.Kind {
+		case lexer.LParen, lexer.LBracket:
+			(*depth)++
+		case lexer.RParen, lexer.RBracket:
+			if *depth > 0 {
+				(*depth)--
+			}
+		}
+	}
+}
+
+func significantBodyTokens(s string) []cst.Tok {
+	var toks []cst.Tok
+	for _, tok := range lexer.Lex(s) {
+		if tok.IsTrivia() || tok.Kind == lexer.EOF {
+			continue
+		}
+		toks = append(toks, cst.Tok{Tok: tok})
+	}
+	return toks
+}
+
+func isStandaloneBodyKeyword(s string, kws ...string) bool {
+	toks := significantBodyTokens(s)
+	if len(toks) != 1 || toks[0].Tok.Kind != lexer.Ident {
+		return false
+	}
+	low := lowerASCII(toks[0].Tok.Text)
+	for _, kw := range kws {
+		if low == kw {
+			return true
+		}
+	}
+	return false
+}
+
+// joinThenToCondition merges a THEN line (on its own bline) into the preceding
+// condition line when plpgsql_if_then_newline is false.
+func joinThenToCondition(lines []bline) []bline {
+	out := make([]bline, 0, len(lines))
+	for i, ll := range lines {
+		if i > 0 && strings.EqualFold(strings.TrimSpace(ll.text), "then") {
+			out[len(out)-1].text = strings.TrimRight(out[len(out)-1].text, " \t") + " THEN"
+		} else {
+			out = append(out, ll)
+		}
+	}
+	return out
+}
+
+// tryCollapseLoop tries to collapse an empty loop body to one line.
+// Detects: FOR … LOOP\n  (empty or only blanks)\nEND LOOP;
+// Returns the collapsed line and true on success.
+func tryCollapseLoop(lines []bline, st config.Style) (string, bool) {
+	if len(lines) < 2 {
+		return "", false
+	}
+	first := strings.TrimSpace(lines[0].text)
+	last := strings.TrimSpace(lines[len(lines)-1].text)
+	firstLow := lowerASCII(first)
+	lastLow := lowerASCII(last)
+
+	// Check last line is END LOOP; or LOOP (for WHILE/FOR empty bodies that end with LOOP).
+	if !strings.HasPrefix(lastLow, "end loop") && lastLow != "end loop;" {
+		return "", false
+	}
+	// Check middle lines are all empty.
+	for _, mid := range lines[1 : len(lines)-1] {
+		if strings.TrimSpace(mid.text) != "" {
+			return "", false
+		}
+	}
+	// Check first line ends with LOOP.
+	if !strings.HasSuffix(firstLow, "loop") {
+		return "", false
+	}
+	_ = st
+	_ = firstLow
+	// Collapse to: <header> END LOOP;
+	return strings.TrimRight(first, " \t") + " " + strings.ToUpper(last), true
+}
+
 // firstBodyKeyword returns the text of the first identifier token in s
 // (lowercased), or "" if the first significant token is not an identifier.
 func firstBodyKeyword(s string) string {
@@ -380,3 +928,91 @@ func leadingWhitespace(s string) string {
 	}
 	return s[:i]
 }
+
+// endsInLineComment reports whether s ends with a -- line comment.
+func endsInLineComment(s string) bool {
+	toks := lexer.Lex(s)
+	for i := len(toks) - 1; i >= 0; i-- {
+		switch toks[i].Kind {
+		case lexer.EOF, lexer.Whitespace:
+			continue
+		}
+		return toks[i].Kind == lexer.LineComment
+	}
+	return false
+}
+
+// literalTerminated reports whether a string or block-comment token is closed.
+// Slices of nested dollar-quoted text can end mid-literal; an unterminated
+// token there is a lexing artefact, not real literal content.
+func literalTerminated(t lexer.Token) bool {
+	if t.Kind == lexer.BlockComment {
+		return strings.HasSuffix(t.Text, "*/") && len(t.Text) >= 4
+	}
+	if t.Kind == lexer.DollarString {
+		_, _, _, ok := splitDollarQuote(t.Text)
+		return ok
+	}
+	return len(t.Text) >= 2 && strings.HasSuffix(t.Text, "'")
+}
+
+// formatEmbeddedLiterals restyles every dollar-quoted literal in text whose
+// content looks like code (see formatEmbedded). Everything else is untouched.
+func formatEmbeddedLiterals(text string, st config.Style) string {
+	if !strings.Contains(text, "$") {
+		return text
+	}
+	var b strings.Builder
+	for _, t := range lexer.Lex(text) {
+		if t.Kind == lexer.DollarString {
+			b.WriteString(formatEmbedded(t.Text, st))
+		} else {
+			b.WriteString(t.Text)
+		}
+	}
+	return b.String()
+}
+
+// formatEmbedded formats a dollar-quoted literal as code when its content
+// starts like code: DECLARE/BEGIN is formatted as a PL/pgSQL block and
+// SELECT/INSERT/UPDATE/DELETE/WITH as DML. Any other content (SQL fragments,
+// prose, other languages) is left exactly as written, as is the literal if the
+// formatted result is not provably equivalent.
+func formatEmbedded(lit string, st config.Style) string {
+	open, inner, close, ok := splitDollarQuote(lit)
+	if !ok {
+		return lit
+	}
+	// format()-style templates (%s, %I, %L, %1$s) are text, not SQL: restyling
+	// would split the placeholders, and the token-level safety gate can't see it.
+	if formatPlaceholder.MatchString(inner) {
+		return lit
+	}
+	var first string
+	for _, t := range lexer.Lex(inner) {
+		if t.IsTrivia() || t.Kind == lexer.EOF {
+			continue
+		}
+		if t.Kind == lexer.Ident {
+			first = lowerASCII(t.Text)
+		}
+		break
+	}
+	var res string
+	switch first {
+	case "declare", "begin":
+		res = formatBodyInner(inner, st)
+	case "select", "insert", "update", "delete", "with":
+		lead := inner[:len(inner)-len(strings.TrimLeft(inner, " \t\r\n"))]
+		trail := inner[len(strings.TrimRight(inner, " \t\r\n")):]
+		res = lead + strings.TrimSpace(File(parser.Parse(inner), st)) + trail
+	default:
+		return lit
+	}
+	if res == inner || !SemanticallyEqual(inner, res) || CommentsPreserved(inner, res) != nil {
+		return lit
+	}
+	return open + res + close
+}
+
+var formatPlaceholder = regexp.MustCompile(`%(\d+\$)?-?\d*[sILlx]`)

pkg/format/dml.go

@@ -10,16 +10,13 @@ import (
 
 // isDMLStart reports whether toks begins with a DML statement keyword.
 func isDMLStart(toks []cst.Tok) bool {
-	for _, t := range toks {
-		if t.Tok.Kind == lexer.Ident {
-			switch lowerASCII(t.Tok.Text) {
-			case "select", "insert", "update", "delete", "with":
-				return true
-			}
-			return false
-		}
+	if len(toks) == 0 || toks[0].Tok.Kind != lexer.Ident {
 		return false
 	}
+	switch lowerASCII(toks[0].Tok.Text) {
+	case "select", "insert", "update", "delete", "with":
+		return true
+	}
 	return false
 }
 
@@ -179,9 +176,18 @@ func dmlSegText(seg dmlSeg, st config.Style) string {
 	}
 
 	switch kw {
-	case "select", "set", "returning":
+	case "select", "returning":
 		items := dmlSplitCommas(seg.body)
-		return dmlColList(kwText, items, st)
+		return dmlColListSelect(kwText, items, st)
+	case "set":
+		items := dmlSplitCommas(seg.body)
+		return dmlColListSet(kwText, items, st)
+	case "values":
+		return dmlValuesClause(kwText, seg.body, st)
+	case "where":
+		return dmlWhereClause(kwText, seg.body, st)
+	case "join", "left", "right", "inner", "full", "cross", "natural":
+		return dmlJoinClause(kwText, seg.body, st)
 	case "with":
 		return formatWithBody(kwText, seg.body, st)
 	default:
@@ -193,10 +199,145 @@ func dmlSegText(seg dmlSeg, st config.Style) string {
 	}
 }
 
+// dmlJoinClause formats a JOIN clause, applying indent_join when configured.
+func dmlJoinClause(kwText string, body []cst.Tok, st config.Style) string {
+	text := dmlInline(body, st)
+	line := kwText
+	if text != "" {
+		line += " " + text
+	}
+	if onIdx := dmlKeywordIdx(body, 0, "on"); onIdx >= 0 && st.JoinWrap != config.WrapNever {
+		nl := st.Newline
+		var b strings.Builder
+		b.WriteString(kwText)
+		if head := dmlInline(body[:onIdx], st); head != "" {
+			b.WriteString(" " + head)
+		}
+		for i, cond := range dmlSplitAndOr(body[onIdx+1:]) {
+			b.WriteString(nl + st.Indent)
+			if i == 0 {
+				b.WriteString(caseText(body[onIdx].Tok, st) + " ")
+			}
+			b.WriteString(strings.ReplaceAll(dmlInline(cond, st), nl, nl+st.Indent))
+		}
+		broken := b.String()
+		if st.JoinWrap == config.WrapAlways || strings.Contains(line, nl) {
+			line = broken
+		} else {
+			line = Render(Group(IfBreak(Text(broken), Text(line))), st.LineWidth, st.Indent, nl)
+		}
+	}
+	if !st.IndentJoin {
+		return line
+	}
+	indent := strings.Repeat(st.Indent, st.JoinIndentSize)
+	nl := st.Newline
+	var b strings.Builder
+	for i, part := range strings.Split(line, nl) {
+		if i > 0 {
+			b.WriteString(nl)
+		}
+		b.WriteString(indent)
+		b.WriteString(part)
+	}
+	return b.String()
+}
+
+// dmlWhereClause formats a WHERE clause, splitting AND/OR conditions per
+// the where_wrap and where_and_or_indent settings.
+func dmlWhereClause(kwText string, body []cst.Tok, st config.Style) string {
+	if st.WhereWrap == config.WrapNever {
+		text := dmlInline(body, st)
+		if text == "" {
+			return kwText
+		}
+		return kwText + " " + text
+	}
+
+	// Split at depth-0 AND/OR.
+	conditions := dmlSplitAndOr(body)
+	if len(conditions) <= 1 {
+		text := dmlInline(body, st)
+		if text == "" {
+			return kwText
+		}
+		return kwText + " " + text
+	}
+
+	nl := st.Newline
+	if st.WhereWrap == config.WrapWhenLong {
+		return dmlWhereWhenLong(kwText, conditions, st)
+	}
+	var b strings.Builder
+	b.WriteString(kwText)
+	for i, cond := range conditions {
+		b.WriteString(nl)
+		text := dmlInline(cond, st)
+		prefix := ""
+		if st.WhereAndOrIndent {
+			prefix = st.Indent
+		}
+		if i == 0 {
+			prefix += "  " // align with AND/OR token width
+		}
+		writeListItem(&b, prefix, prefix, text, false, nl)
+	}
+	return b.String()
+}
+
+// dmlWhereWhenLong is the where_wrap: when_long layout: the whole clause stays
+// on one line when it fits in line_width, otherwise it breaks exactly as
+// where_wrap: always would.
+func dmlWhereWhenLong(kwText string, conditions [][]cst.Tok, st config.Style) string {
+	prefix := ""
+	if st.WhereAndOrIndent {
+		prefix = st.Indent
+	}
+	parts := []Doc{Text(kwText)}
+	for i, cond := range conditions {
+		text := dmlInline(cond, st)
+		pfx := prefix
+		if i == 0 {
+			pfx += "  " // align with AND/OR token width
+		}
+		// Continuation lines of a multi-line condition (subquery) keep the
+		// same prefix writeListItem would give them.
+		text = strings.ReplaceAll(text, st.Newline, st.Newline+pfx)
+		parts = append(parts, IfBreak(Concat(Text(st.Newline), Text(pfx)), Text(" ")), Text(text))
+	}
+	return Render(Group(Concat(parts...)), st.LineWidth, st.Indent, st.Newline)
+}
+
+// dmlSplitAndOr splits toks at depth-0 AND/OR tokens, keeping the AND/OR with
+// the following condition.
+func dmlSplitAndOr(toks []cst.Tok) [][]cst.Tok {
+	var result [][]cst.Tok
+	depth := 0
+	start := 0
+	for i, t := range toks {
+		switch t.Tok.Kind {
+		case lexer.LParen, lexer.LBracket:
+			depth++
+		case lexer.RParen, lexer.RBracket:
+			if depth > 0 {
+				depth--
+			}
+		}
+		if depth == 0 && t.Tok.Kind == lexer.Ident {
+			low := lowerASCII(t.Tok.Text)
+			if (low == "and" || low == "or") && i > start {
+				result = append(result, toks[start:i])
+				start = i
+			}
+		}
+	}
+	result = append(result, toks[start:])
+	return result
+}
+
 // formatWithBody formats the body of a WITH clause by splitting CTE definitions
 // at depth-0 commas and formatting the subquery inside each AS (...) block.
 func formatWithBody(kwText string, body []cst.Tok, st config.Style) string {
-	nl := st.Newline
 
 	cteDefs := dmlSplitCommas(body)
 	// Filter spurious empty items.
@@ -215,37 +356,11 @@ func formatWithBody(kwText string, body []cst.Tok, st config.Style) string {
 		return kwText + " " + formatCTEDef(cteDefs[0], st)
 	default:
 		// Multiple CTEs: one per line with the configured comma style.
-		first := st.Indent + " "
-		cont := st.Indent + ","
-		contPad := strings.Repeat(" ", len(cont)) // same width as cont, no comma
-
-		var b strings.Builder
-		b.WriteString(kwText)
+		texts := make([]string, len(cteDefs))
 		for i, cteDef := range cteDefs {
-			b.WriteString(nl)
-
-			var headPfx, tailPfx string
-			if i == 0 || st.Commas != config.CommaLeading {
-				headPfx = first
-				tailPfx = first
-			} else {
-				headPfx = cont
-				tailPfx = contPad
-			}
-
-			cteText := formatCTEDef(cteDef, st)
-			cteLines := strings.Split(cteText, nl)
-			for j, line := range cteLines {
-				if j > 0 {
-					b.WriteString(nl)
-					b.WriteString(tailPfx)
-				} else {
-					b.WriteString(headPfx)
-				}
-				b.WriteString(line)
-			}
+			texts[i] = formatCTEDef(cteDef, st)
 		}
-		return b.String()
+		return dmlCommaList(kwText, texts, st)
 	}
 }
 
@@ -289,28 +404,16 @@ func formatCTEDef(toks []cst.Tok, st config.Style) string {
 	// Format the header (name, optional column list, AS, optional MATERIALIZED).
 	header := dmlInline(toks[:parenOpen], st)
 
-	// Format the subquery as DML.
+	// Format and wrap the subquery per subquery_content/subquery_closing.
+	// The "AS (" space is standard CTE syntax and independent of
+	// subquery_space_before_paren; only subquery_opening's newline choice
+	// applies here.
 	subToks := toks[parenOpen+1 : parenClose]
-	subFormatted := strings.TrimRight(formatDML(subToks, st), nl)
-
-	if subFormatted == "" {
-		return header + " ()"
+	sep := " "
+	if st.SubqueryOpening == config.PlacementNewLine {
+		sep = nl
 	}
-
-	// Indent every non-empty line of the subquery by st.Indent.
-	indent := st.Indent
-	var indented strings.Builder
-	for i, line := range strings.Split(subFormatted, nl) {
-		if i > 0 {
-			indented.WriteString(nl)
-		}
-		if line != "" {
-			indented.WriteString(indent)
-		}
-		indented.WriteString(line)
-	}
-
-	return header + " (" + nl + indented.String() + nl + ")"
+	return header + sep + dmlWrapSubquery(subToks, st)
 }
 
 // dmlKeywordIdx returns the index of the first token equal to kw at paren depth 0,
@@ -355,9 +458,63 @@ func dmlMatchParen(toks []cst.Tok, open int) int {
 	return -1
 }
 
+// dmlIsSubqueryOpen reports whether toks[i] is a '(' immediately followed by
+// SELECT or WITH — i.e. it opens a subquery (derived table, scalar subquery,
+// or an IN/EXISTS/ANY/ALL/ARRAY(...) subquery), as opposed to a function-call
+// argument list, a value tuple, or a grouping paren.
+func dmlIsSubqueryOpen(toks []cst.Tok, i int) bool {
+	if toks[i].Tok.Kind != lexer.LParen {
+		return false
+	}
+	j := i + 1
+	if j >= len(toks) || toks[j].Tok.Kind != lexer.Ident {
+		return false
+	}
+	switch lowerASCII(toks[j].Tok.Text) {
+	case "select", "with":
+		return true
+	}
+	return false
+}
+
+// dmlWrapSubquery formats a subquery's inner tokens (excluding the enclosing
+// parens) as DML and wraps them in "(" … ")" per the subquery_content and
+// subquery_closing settings. The result is rendered relative to column 0;
+// callers that splice it mid-line are responsible for re-indenting any
+// continuation lines to the surrounding context.
+func dmlWrapSubquery(inner []cst.Tok, st config.Style) string {
+	nl := st.Newline
+	sub := strings.TrimRight(formatDML(inner, st), nl)
+	if sub == "" {
+		return "()"
+	}
+	// The first line stays on the "(" line unless subquery_content says
+	// new_line; every later line is indented one level.
+	var body []Doc
+	for i, line := range strings.Split(sub, nl) {
+		if i > 0 || st.SubqueryContent == config.PlacementNewLine {
+			body = append(body, HardLine())
+		}
+		body = append(body, Text(line))
+	}
+	doc := []Doc{Text("("), Indent(Concat(body...))}
+	if st.SubqueryClosing == config.PlacementNewLine {
+		doc = append(doc, HardLine())
+	}
+	doc = append(doc, Text(")"))
+	return Render(Concat(doc...), 0, st.Indent, nl)
+}
+
+// litNL stands in for a newline inside a multi-line string literal while DML
+// text is assembled; formatDML's caller restores it (see restoreLiteralNewlines).
+const litNL = "\x00\x01"
+
+func restoreLiteralNewlines(s string) string { return strings.ReplaceAll(s, litNL, "\n") }
+
 // dmlInline renders toks on one line with keyword casing and proper spacing.
 // If toks[1:] contains comment trivia the function falls back to verbatimSpan
-// so no comment is lost.
+// so no comment is lost. Subquery parens and CASE…END expressions embedded
+// anywhere in toks are recursively formatted and spliced in.
 func dmlInline(toks []cst.Tok, st config.Style) string {
 	if len(toks) == 0 {
 		return ""
@@ -365,16 +522,89 @@ func dmlInline(toks []cst.Tok, st config.Style) string {
 	if anyComment(toks[1:]) {
 		return verbatimSpan(toks)
 	}
+	nl := st.Newline
 	var b strings.Builder
-	for i, t := range toks {
-		if i > 0 && needSpace(toks[i-1].Tok, t.Tok) {
+	i := 0
+	for i < len(toks) {
+		t := toks[i]
+
+		if dmlIsSubqueryOpen(toks, i) {
+			if closeIdx := dmlMatchParen(toks, i); closeIdx > i {
+				dmlWriteSubquerySep(&b, toks, i, st, nl)
+				b.WriteString(dmlWrapSubquery(toks[i+1:closeIdx], st))
+				i = closeIdx + 1
+				continue
+			}
+		}
+
+		if dmlIsCaseStart(t) {
+			if endIdx := dmlMatchCaseEnd(toks, i); endIdx > i {
+				if i > 0 && needSpace(toks[i-1].Tok, t.Tok) {
+					b.WriteByte(' ')
+				}
+				b.WriteString(dmlFormatCase(toks[i:endIdx+1], st))
+				i = endIdx + 1
+				continue
+			}
+		}
+
+		if i > 0 {
+			space := needSpace(toks[i-1].Tok, t.Tok) && !isPctTypeBoundary(toks, i)
+			if !space && st.RecordSpaceBeforeParen && t.Tok.Kind == lexer.LParen &&
+				toks[i-1].Tok.Kind == lexer.Ident && lowerASCII(toks[i-1].Tok.Text) == "row" {
+				space = true
+			}
+			if space {
+				b.WriteByte(' ')
+			}
+		}
+		// Space after comma in calls: func(a, b) vs func(a,b).
+		if st.SpaceAfterCommaInCalls && i > 0 && toks[i-1].Tok.Kind == lexer.Comma {
+			// Only inside parens (caller manages this at depth > 0, but we add space
+			// when the comma is not a clause-level comma — heuristic: always add).
 			b.WriteByte(' ')
 		}
-		b.WriteString(caseText(t.Tok, st))
+		var prev lexer.Token
+		if i > 0 {
+			prev = toks[i-1].Tok
+		}
+		nextIsLParen := i+1 < len(toks) && toks[i+1].Tok.Kind == lexer.LParen
+		txt := caseTextCtx(t.Tok, prev, nextIsLParen, st)
+		if t.Tok.Kind == lexer.DollarString {
+			txt = formatEmbedded(txt, st)
+		}
+		switch t.Tok.Kind {
+		case lexer.String, lexer.EscapeString, lexer.BitString, lexer.DollarString:
+			// Line breaks inside a literal are content: hide them from the
+			// line-based indent helpers that post-process this text.
+			txt = strings.ReplaceAll(txt, "\n", litNL)
+		}
+		b.WriteString(txt)
+		i++
 	}
 	return b.String()
 }
 
+// dmlWriteSubquerySep writes the separator between the token preceding a
+// subquery-opening '(' at toks[i] and the '(' itself, honoring
+// subquery_opening (same_line|new_line) and subquery_space_before_paren.
+func dmlWriteSubquerySep(b *strings.Builder, toks []cst.Tok, i int, st config.Style, nl string) {
+	if i == 0 {
+		return
+	}
+	if st.SubqueryOpening == config.PlacementNewLine {
+		b.WriteString(nl)
+		return
+	}
+	space := needSpace(toks[i-1].Tok, toks[i].Tok) && !isPctTypeBoundary(toks, i)
+	if !space && st.SubquerySpaceBeforeParen {
+		space = true
+	}
+	if space {
+		b.WriteByte(' ')
+	}
+}
+
 // dmlSplitCommas splits toks at depth-0 commas and returns the items between
 // them (the comma tokens themselves are discarded).
 func dmlSplitCommas(toks []cst.Tok) [][]cst.Tok {
@@ -401,24 +631,76 @@ func dmlSplitCommas(toks []cst.Tok) [][]cst.Tok {
 	return items
 }
 
-// dmlColList formats kwText followed by a comma-separated body.
-// One item: kept on the same line as the keyword.
-// Multiple items: each on its own line with the configured comma style.
-func dmlColList(kwText string, items [][]cst.Tok, st config.Style) string {
-	// Filter out spurious empty items (e.g. trailing comma in source).
+// filterEmpty drops empty token slices (spurious items from a trailing
+// comma or similar).
+func filterEmpty(items [][]cst.Tok) [][]cst.Tok {
 	var kept [][]cst.Tok
 	for _, item := range items {
 		if len(item) > 0 {
 			kept = append(kept, item)
 		}
 	}
-	items = kept
+	return kept
+}
 
-	nl := st.Newline
-	switch len(items) {
+// dmlCommaList renders texts as a one-item-per-line list under kwText, using
+// leading or trailing commas per st.Commas. Items whose rendered text spans
+// multiple lines (e.g. an embedded subquery or wrapped CASE) have their
+// continuation lines re-indented to align under the item's first line.
+func dmlCommaList(kwText string, texts []string, st config.Style) string {
+	switch len(texts) {
 	case 0:
 		return kwText
 	case 1:
+		if texts[0] == "" {
+			return kwText
+		}
+		return kwText + " " + texts[0]
+	}
+
+	nl := st.Newline
+	first := st.Indent + " "
+	cont := st.Indent + ","
+	contPad := strings.Repeat(" ", len(cont))
+
+	var b strings.Builder
+	b.WriteString(kwText)
+	for i, text := range texts {
+		b.WriteString(nl)
+		trailingComma := st.Commas == config.CommaTrailing && i < len(texts)-1
+		if i == 0 || st.Commas != config.CommaLeading {
+			writeListItem(&b, first, first, text, trailingComma, nl)
+		} else {
+			writeListItem(&b, cont, contPad, text, false, nl)
+		}
+	}
+	return b.String()
+}
+
+// writeListItem writes text prefixed with headPfx (its first line) and
+// tailPfx (any continuation lines), optionally followed by a trailing comma.
+func writeListItem(b *strings.Builder, headPfx, tailPfx, text string, trailingComma bool, nl string) {
+	for j, line := range strings.Split(text, nl) {
+		if j > 0 {
+			b.WriteString(nl)
+			if line != "" {
+				b.WriteString(tailPfx)
+			}
+		} else {
+			b.WriteString(headPfx)
+		}
+		b.WriteString(line)
+	}
+	if trailingComma {
+		b.WriteString(",")
+	}
+}
+
+// dmlColListSelect formats a SELECT / RETURNING column list with optional
+// align_columns and select_align_as settings.
+func dmlColListSelect(kwText string, items [][]cst.Tok, st config.Style) string {
+	items = filterEmpty(items)
+	if len(items) == 1 {
 		body := dmlInline(items[0], st)
 		if body == "" {
 			return kwText
@@ -426,24 +708,384 @@ func dmlColList(kwText string, items [][]cst.Tok, st config.Style) string {
 		return kwText + " " + body
 	}
 
-	// Multiple items: one per line.
-	first := st.Indent + " " // aligns item text one column past the comma
-	cont := st.Indent + ","
-	var b strings.Builder
-	b.WriteString(kwText)
+	texts := make([]string, len(items))
+	multiline := false
 	for i, item := range items {
-		b.WriteString(nl)
-		text := dmlInline(item, st)
-		if i == 0 || st.Commas != config.CommaLeading {
-			b.WriteString(first)
-			b.WriteString(text)
-			if st.Commas == config.CommaTrailing && i < len(items)-1 {
-				b.WriteString(",")
+		texts[i] = dmlInline(item, st)
+		if strings.Contains(texts[i], st.Newline) {
+			multiline = true
+		}
+	}
+	flat := kwText + " " + strings.Join(texts, ", ")
+
+	// align_columns / select_align_as: pad expressions so AS and aliases align.
+	if (st.AlignColumns || st.SelectAlignAs) && len(texts) > 1 {
+		texts = alignSelectItems(texts, st)
+	}
+
+	broken := dmlCommaList(kwText, texts, st)
+	if multiline {
+		return broken // an embedded subquery / wrapped CASE can't sit on one line
+	}
+	switch st.SelectWrap {
+	case config.WrapNever:
+		return flat
+	case config.WrapWhenLong:
+		return Render(Group(IfBreak(Text(broken), Text(flat))), st.LineWidth, st.Indent, st.Newline)
+	}
+	return broken
+}
+
+// dmlColListSet formats an UPDATE SET column list with optional set_align_equal.
+func dmlColListSet(kwText string, items [][]cst.Tok, st config.Style) string {
+	items = filterEmpty(items)
+	if len(items) == 1 {
+		body := dmlInline(items[0], st)
+		if body == "" {
+			return kwText
+		}
+		return kwText + " " + body
+	}
+
+	texts := make([]string, len(items))
+	for i, item := range items {
+		texts[i] = dmlInline(item, st)
+	}
+
+	// set_align_equal: pad lhs so = signs align.
+	if st.SetAlignEqual && len(texts) > 1 {
+		texts = alignSetItems(texts)
+	}
+
+	return dmlCommaList(kwText, texts, st)
+}
+
+// dmlValuesClause formats a VALUES clause. When insert_collapse_values is
+// true (the default), multiple rows stay packed onto one line, matching the
+// pre-existing flat rendering. When false, each row gets its own line.
+func dmlValuesClause(kwText string, body []cst.Tok, st config.Style) string {
+	rows := filterEmpty(dmlSplitCommas(body))
+
+	if len(rows) <= 1 || st.InsertCollapseValues {
+		text := dmlInline(body, st)
+		if text == "" {
+			return kwText
+		}
+		return kwText + " " + text
+	}
+
+	texts := make([]string, len(rows))
+	for i, row := range rows {
+		texts[i] = dmlInline(row, st)
+	}
+	return dmlCommaList(kwText, texts, st)
+}
+
+// alignSelectItems pads SELECT list item expressions so that AS keywords and
+// alias names align vertically.
+func alignSelectItems(texts []string, st config.Style) []string {
+	// Split each text into (expr, " AS ", alias) or keep as-is.
+	type part struct {
+		expr, alias string
+		hasAs       bool
+	}
+	parts := make([]part, len(texts))
+	maxExpr := 0
+	for i, t := range texts {
+		// Find " AS " or " as " (case-insensitive).
+		if idx := findAsIndex(t); idx >= 0 {
+			parts[i] = part{expr: t[:idx], alias: t[idx:], hasAs: true}
+			if l := len(t[:idx]); l > maxExpr {
+				maxExpr = l
 			}
 		} else {
-			b.WriteString(cont)
-			b.WriteString(text)
+			parts[i] = part{expr: t}
+			if st.AlignColumns {
+				if l := len(t); l > maxExpr {
+					maxExpr = l
+				}
+			}
 		}
 	}
+
+	out := make([]string, len(texts))
+	for i, p := range parts {
+		if !p.hasAs || maxExpr == 0 {
+			out[i] = texts[i]
+			continue
+		}
+		pad := strings.Repeat(" ", maxExpr-len(p.expr))
+		out[i] = p.expr + pad + p.alias
+	}
+	return out
+}
+
+// findAsIndex returns the byte index of " AS " (case-insensitive) in s,
+// or -1 if not present at depth 0.
+func findAsIndex(s string) int {
+	low := lowerASCII(s)
+	// Look for " as " boundary.
+	for i := 0; i < len(low)-3; i++ {
+		if low[i] == ' ' && low[i+1] == 'a' && low[i+2] == 's' && low[i+3] == ' ' {
+			return i + 1 // index of 'a'
+		}
+	}
+	return -1
+}
+
+// alignSetItems pads SET assignment lhs values so that = signs align.
+func alignSetItems(texts []string) []string {
+	maxLhs := 0
+	lhsWidths := make([]int, len(texts))
+	for i, t := range texts {
+		idx := strings.Index(t, " = ")
+		if idx < 0 {
+			idx = strings.Index(t, "=")
+		}
+		if idx >= 0 {
+			lhsWidths[i] = idx
+			if idx > maxLhs {
+				maxLhs = idx
+			}
+		}
+	}
+	if maxLhs == 0 {
+		return texts
+	}
+	out := make([]string, len(texts))
+	for i, t := range texts {
+		if lhsWidths[i] == 0 || lhsWidths[i] == maxLhs {
+			out[i] = t
+			continue
+		}
+		idx := lhsWidths[i]
+		pad := strings.Repeat(" ", maxLhs-idx)
+		out[i] = t[:idx] + pad + t[idx:]
+	}
+	return out
+}
+
+// dmlIsCaseStart reports whether t is a CASE keyword token.
+func dmlIsCaseStart(t cst.Tok) bool {
+	return t.Tok.Kind == lexer.Ident && lowerASCII(t.Tok.Text) == "case"
+}
+
+// dmlMatchCaseEnd returns the index of the END token that closes the CASE
+// token at toks[start], accounting for nested CASE…END and paren depth.
+// Returns -1 if no matching END is found.
+func dmlMatchCaseEnd(toks []cst.Tok, start int) int {
+	depth := 0
+	caseDepth := 1
+	for i := start + 1; i < len(toks); i++ {
+		switch toks[i].Tok.Kind {
+		case lexer.LParen, lexer.LBracket:
+			depth++
+			continue
+		case lexer.RParen, lexer.RBracket:
+			if depth > 0 {
+				depth--
+			}
+			continue
+		}
+		if depth != 0 || toks[i].Tok.Kind != lexer.Ident {
+			continue
+		}
+		switch lowerASCII(toks[i].Tok.Text) {
+		case "case":
+			caseDepth++
+		case "end":
+			caseDepth--
+			if caseDepth == 0 {
+				return i
+			}
+		}
+	}
+	return -1
+}
+
+// caseSeg is one part of a CASE expression's body: the optional leading
+// operand (kw == nil), or a WHEN/THEN/ELSE-led span.
+type caseSeg struct {
+	kw   *cst.Tok
+	toks []cst.Tok
+}
+
+// dmlSplitCase splits a CASE expression's body (the tokens strictly between
+// CASE and its matching END) into operand/when/then/else segments at
+// depth-0 boundaries, skipping over any nested CASE…END.
+func dmlSplitCase(body []cst.Tok) []caseSeg {
+	var segs []caseSeg
+	depth := 0
+	caseDepth := 0
+	start := 0
+	var curKw *cst.Tok
+	flush := func(end int) {
+		if end > start {
+			segs = append(segs, caseSeg{kw: curKw, toks: body[start:end]})
+		}
+	}
+	for i := range body {
+		t := body[i]
+		switch t.Tok.Kind {
+		case lexer.LParen, lexer.LBracket:
+			depth++
+			continue
+		case lexer.RParen, lexer.RBracket:
+			if depth > 0 {
+				depth--
+			}
+			continue
+		}
+		if depth != 0 || t.Tok.Kind != lexer.Ident {
+			continue
+		}
+		switch lowerASCII(t.Tok.Text) {
+		case "case":
+			caseDepth++
+		case "end":
+			if caseDepth > 0 {
+				caseDepth--
+			}
+		case "when", "then", "else":
+			if caseDepth == 0 {
+				flush(i)
+				start = i + 1
+				kw := body[i]
+				curKw = &kw
+			}
+		}
+	}
+	flush(len(body))
+	return segs
+}
+
+// whenThen is one rendered WHEN … THEN … branch of a CASE expression.
+type whenThen struct {
+	whenKw, cond, thenKw, then string
+}
+
+// dmlFormatCase renders a CASE…END expression honoring case_when_wrap,
+// case_end, and case_collapse. toks[0] must be CASE and toks[len(toks)-1]
+// its matching END.
+func dmlFormatCase(toks []cst.Tok, st config.Style) string {
+	body := toks[1 : len(toks)-1]
+	segs := dmlSplitCase(body)
+
+	operand := ""
+	var whens []whenThen
+	elseKw, elseText := "", ""
+	haveElse := false
+	pendingWhenKw, pendingCond := "", ""
+
+	for _, s := range segs {
+		text := dmlInline(s.toks, st)
+		if s.kw == nil {
+			operand = text
+			continue
+		}
+		kwText := caseText(s.kw.Tok, st)
+		switch lowerASCII(s.kw.Tok.Text) {
+		case "when":
+			pendingWhenKw, pendingCond = kwText, text
+		case "then":
+			whens = append(whens, whenThen{whenKw: pendingWhenKw, cond: pendingCond, thenKw: kwText, then: text})
+		case "else":
+			elseKw, elseText, haveElse = kwText, text, true
+		}
+	}
+
+	caseKw := caseText(toks[0].Tok, st)
+	endKw := caseText(toks[len(toks)-1].Tok, st)
+
+	inline := dmlCaseInline(caseKw, operand, whens, elseKw, elseText, haveElse, endKw)
+	if !st.CaseWhenWrap {
+		return inline
+	}
+	wrapped := dmlCaseWrapped(caseKw, operand, whens, elseKw, elseText, haveElse, endKw, st)
+	if st.CaseCollapse {
+		// Collapse when the one-line form fits in line_width.
+		return Render(Group(IfBreak(Text(wrapped), Text(inline))), st.LineWidth, st.Indent, st.Newline)
+	}
+	return wrapped
+}
+
+// dmlCaseInline renders a CASE expression on a single line.
+func dmlCaseInline(caseKw, operand string, whens []whenThen, elseKw, elseText string, haveElse bool, endKw string) string {
+	var b strings.Builder
+	b.WriteString(caseKw)
+	if operand != "" {
+		b.WriteByte(' ')
+		b.WriteString(operand)
+	}
+	for _, w := range whens {
+		b.WriteByte(' ')
+		b.WriteString(w.whenKw)
+		if w.cond != "" {
+			b.WriteByte(' ')
+			b.WriteString(w.cond)
+		}
+		b.WriteByte(' ')
+		b.WriteString(w.thenKw)
+		if w.then != "" {
+			b.WriteByte(' ')
+			b.WriteString(w.then)
+		}
+	}
+	if haveElse {
+		b.WriteByte(' ')
+		b.WriteString(elseKw)
+		if elseText != "" {
+			b.WriteByte(' ')
+			b.WriteString(elseText)
+		}
+	}
+	b.WriteByte(' ')
+	b.WriteString(endKw)
+	return b.String()
+}
+
+// dmlCaseWrapped renders a CASE expression with each WHEN … THEN branch (and
+// ELSE) on its own line, per case_end for the closing END's placement.
+func dmlCaseWrapped(caseKw, operand string, whens []whenThen, elseKw, elseText string, haveElse bool, endKw string, st config.Style) string {
+	nl := st.Newline
+	indent := st.Indent
+
+	var b strings.Builder
+	b.WriteString(caseKw)
+	if operand != "" {
+		b.WriteByte(' ')
+		b.WriteString(operand)
+	}
+	for _, w := range whens {
+		b.WriteString(nl)
+		b.WriteString(indent)
+		b.WriteString(w.whenKw)
+		if w.cond != "" {
+			b.WriteByte(' ')
+			b.WriteString(w.cond)
+		}
+		b.WriteByte(' ')
+		b.WriteString(w.thenKw)
+		if w.then != "" {
+			b.WriteByte(' ')
+			b.WriteString(w.then)
+		}
+	}
+	if haveElse {
+		b.WriteString(nl)
+		b.WriteString(indent)
+		b.WriteString(elseKw)
+		if elseText != "" {
+			b.WriteByte(' ')
+			b.WriteString(elseText)
+		}
+	}
+	if st.CaseEnd == config.PlacementNewLine {
+		b.WriteString(nl)
+		b.WriteString(endKw)
+	} else {
+		b.WriteByte(' ')
+		b.WriteString(endKw)
+	}
 	return b.String()
 }

pkg/format/dml_test.go

@@ -1,6 +1,7 @@
 package format
 
 import (
+	"strings"
 	"testing"
 
 	"git.warky.dev/wdevs/pgtidy/pkg/config"
@@ -226,6 +227,62 @@ func TestDMLIdempotent(t *testing.T) {
 	}
 }
 
+func TestDMLWhereAndOr(t *testing.T) {
+	// where_wrap=always should split AND/OR conditions onto separate lines.
+	src := "select a from t where x = 1 and y = 2 or z = 3;"
+	got := format(src)
+	want := "SELECT a\nFROM t\nWHERE\n    x = 1\n  AND y = 2\n  OR z = 3;\n"
+	if got != want {
+		t.Errorf("where and/or\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	checkDML(t, "where and/or", got)
+}
+
+func TestDMLIndentJoin(t *testing.T) {
+	st := config.Default()
+	st.IndentJoin = true
+	src := "select a from t join s on t.id = s.id;"
+	got := File(parser.Parse(src), st)
+	want := "SELECT a\nFROM t\n  JOIN s ON t.id = s.id;\n"
+	if got != want {
+		t.Errorf("indent join\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	// Idempotence with same config.
+	twice := File(parser.Parse(got), st)
+	if twice != got {
+		t.Errorf("indent join not idempotent:\n--- once ---\n%s\n--- twice ---\n%s", got, twice)
+	}
+}
+
+func TestDMLSetAlignEqual(t *testing.T) {
+	st := config.Default()
+	st.SetAlignEqual = true
+	src := "update t set a = 1, bb = 2, ccc = 3 where id = 1;"
+	got := File(parser.Parse(src), st)
+	// All = signs should align.
+	if got == "" {
+		t.Error("empty output")
+	}
+	// Idempotence.
+	twice := File(parser.Parse(got), st)
+	if twice != got {
+		t.Errorf("set_align_equal not idempotent:\n--- once ---\n%s\n--- twice ---\n%s", got, twice)
+	}
+}
+
+func TestDMLAlignParamTypes(t *testing.T) {
+	src := "create function f(in p_name text, in p_long_name integer, out p_result boolean) returns void language sql as $$ select 1 $$;"
+	got := format(src)
+	// p_name and p_long_name should have aligned types.
+	if got == "" {
+		t.Error("empty output")
+	}
+	twice := format(got)
+	if twice != got {
+		t.Errorf("align_param_types not idempotent:\n--- once ---\n%s\n--- twice ---\n%s", got, twice)
+	}
+}
+
 func TestCorpusUnaffectedByDML(t *testing.T) {
 	// Verify the corpus (which contains only CREATE FUNCTION) is not affected
 	// by the new DML formatting path.
@@ -239,3 +296,435 @@ func TestCorpusUnaffectedByDML(t *testing.T) {
 		t.Errorf("create function: DML formatter changed semantics")
 	}
 }
+
+// --- Subquery formatting ---
+
+func TestDMLSubqueryDerivedTable(t *testing.T) {
+	src := "select a from (select x, y from t) s where s.x = 1;"
+	want := "SELECT a\n" +
+		"FROM (\n" +
+		"  SELECT\n" +
+		"     x\n" +
+		"    ,y\n" +
+		"  FROM t\n" +
+		") s\n" +
+		"WHERE s.x = 1;\n"
+	got := format(src)
+	if got != want {
+		t.Errorf("derived table\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	checkDML(t, "derived table", got)
+	if !semanticallyEqual(src, got) {
+		t.Errorf("derived table: formatting changed semantics")
+	}
+}
+
+func TestDMLSubqueryScalarInSelect(t *testing.T) {
+	src := "select a, (select max(x) from t2) as m from t1;"
+	got := format(src)
+	if got == "" {
+		t.Error("empty output")
+	}
+	checkDML(t, "scalar subquery", got)
+	if !semanticallyEqual(src, got) {
+		t.Errorf("scalar subquery: formatting changed semantics")
+	}
+}
+
+func TestDMLSubqueryIn(t *testing.T) {
+	src := "select a from t where a in (select b from t2);"
+	want := "SELECT a\n" +
+		"FROM t\n" +
+		"WHERE a IN (\n" +
+		"  SELECT b\n" +
+		"  FROM t2\n" +
+		");\n"
+	got := format(src)
+	if got != want {
+		t.Errorf("in subquery\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	checkDML(t, "in subquery", got)
+}
+
+func TestDMLSubqueryExists(t *testing.T) {
+	src := "select a from t where exists (select 1 from t2 where t2.a = t.a);"
+	got := format(src)
+	if got == "" {
+		t.Error("empty output")
+	}
+	checkDML(t, "exists subquery", got)
+	if !semanticallyEqual(src, got) {
+		t.Errorf("exists subquery: formatting changed semantics")
+	}
+}
+
+func TestDMLSubqueryInValueList(t *testing.T) {
+	// A plain value list must not be mistaken for a subquery.
+	src := "select a from t where a in (1, 2, 3);"
+	want := "SELECT a\nFROM t\nWHERE a IN (1, 2, 3);\n"
+	got := format(src)
+	if got != want {
+		t.Errorf("value list in()\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	checkDML(t, "value list in()", got)
+}
+
+func TestDMLSubqueryPlacementConfig(t *testing.T) {
+	st := config.Default()
+	st.SubqueryContent = config.PlacementSameLine
+	st.SubqueryClosing = config.PlacementSameLine
+	src := "select a from t where a in (select b from t2);"
+	got := File(parser.Parse(src), st)
+	if got == "" {
+		t.Error("empty output")
+	}
+	twice := File(parser.Parse(got), st)
+	if twice != got {
+		t.Errorf("subquery placement config not idempotent:\n--- once ---\n%s\n--- twice ---\n%s", got, twice)
+	}
+}
+
+func TestDMLSubquerySpaceBeforeParen(t *testing.T) {
+	st := config.Default()
+	st.SubquerySpaceBeforeParen = true
+	src := "select array(select x from t) from t2;"
+	got := File(parser.Parse(src), st)
+	want := "SELECT ARRAY (\n  SELECT x\n  FROM t\n)\nFROM t2;\n"
+	if got != want {
+		t.Errorf("subquery_space_before_paren\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	twice := File(parser.Parse(got), st)
+	if twice != got {
+		t.Errorf("subquery_space_before_paren not idempotent:\n--- once ---\n%s\n--- twice ---\n%s", got, twice)
+	}
+}
+
+func TestDMLCTEUsesSubqueryConfig(t *testing.T) {
+	// CTE bodies should honor the same subquery_* settings, not a hardcoded layout.
+	st := config.Default()
+	st.SubqueryOpening = config.PlacementNewLine
+	src := "with cte as (select x from y) select x from cte;"
+	got := File(parser.Parse(src), st)
+	want := "WITH cte AS\n(\n  SELECT x\n  FROM y\n)\nSELECT x\nFROM cte;\n"
+	if got != want {
+		t.Errorf("cte subquery_opening=new_line\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	twice := File(parser.Parse(got), st)
+	if twice != got {
+		t.Errorf("cte subquery_opening not idempotent:\n--- once ---\n%s\n--- twice ---\n%s", got, twice)
+	}
+}
+
+// --- INSERT VALUES collapse ---
+
+func TestDMLInsertValuesCollapseDefault(t *testing.T) {
+	// insert_collapse_values defaults to true: multiple rows stay on one line.
+	src := "insert into t (a, b) values (1, 2), (3, 4), (5, 6);"
+	want := "INSERT INTO t(a, b)\nVALUES (1, 2), (3, 4), (5, 6);\n"
+	got := format(src)
+	if got != want {
+		t.Errorf("values collapse default\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	checkDML(t, "values collapse default", got)
+}
+
+func TestDMLInsertValuesNoCollapse(t *testing.T) {
+	st := config.Default()
+	st.InsertCollapseValues = false
+	src := "insert into t (a, b) values (1, 2), (3, 4), (5, 6);"
+	want := "INSERT INTO t(a, b)\n" +
+		"VALUES\n" +
+		"   (1, 2)\n" +
+		"  ,(3, 4)\n" +
+		"  ,(5, 6);\n"
+	got := File(parser.Parse(src), st)
+	if got != want {
+		t.Errorf("values no collapse\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	twice := File(parser.Parse(got), st)
+	if twice != got {
+		t.Errorf("values no collapse not idempotent:\n--- once ---\n%s\n--- twice ---\n%s", got, twice)
+	}
+	if !semanticallyEqual(src, got) {
+		t.Errorf("values no collapse: formatting changed semantics")
+	}
+}
+
+func TestDMLInsertValuesSingleRowUnaffected(t *testing.T) {
+	// A single-row VALUES is unaffected by insert_collapse_values either way.
+	st := config.Default()
+	st.InsertCollapseValues = false
+	src := "insert into t (a, b) values (1, 2);"
+	want := "INSERT INTO t(a, b)\nVALUES (1, 2);\n"
+	got := File(parser.Parse(src), st)
+	if got != want {
+		t.Errorf("single row values\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+}
+
+// --- CASE expression formatting ---
+
+func TestDMLCaseInlineDefault(t *testing.T) {
+	src := "select case when a = 1 then 'one' when a = 2 then 'two' else 'other' end as label from t;"
+	want := "SELECT CASE WHEN a = 1 THEN 'one' WHEN a = 2 THEN 'two' ELSE 'other' END AS label\nFROM t;\n"
+	got := format(src)
+	if got != want {
+		t.Errorf("case inline default\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	checkDML(t, "case inline default", got)
+	if !semanticallyEqual(src, got) {
+		t.Errorf("case inline default: formatting changed semantics")
+	}
+}
+
+func TestDMLCaseWhenWrap(t *testing.T) {
+	st := config.Default()
+	st.CaseWhenWrap = true
+	src := "select case when a = 1 then 'one' when a = 2 then 'two' else 'other' end as label from t;"
+	want := "SELECT CASE\n" +
+		"  WHEN a = 1 THEN 'one'\n" +
+		"  WHEN a = 2 THEN 'two'\n" +
+		"  ELSE 'other'\n" +
+		"END AS label\n" +
+		"FROM t;\n"
+	got := File(parser.Parse(src), st)
+	if got != want {
+		t.Errorf("case when_wrap\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	twice := File(parser.Parse(got), st)
+	if twice != got {
+		t.Errorf("case when_wrap not idempotent:\n--- once ---\n%s\n--- twice ---\n%s", got, twice)
+	}
+	if !semanticallyEqual(src, got) {
+		t.Errorf("case when_wrap: formatting changed semantics")
+	}
+}
+
+func TestDMLCaseEndSameLine(t *testing.T) {
+	st := config.Default()
+	st.CaseWhenWrap = true
+	st.CaseEnd = config.PlacementSameLine
+	src := "select case when a = 1 then 'one' else 'other' end as label from t;"
+	want := "SELECT CASE\n" +
+		"  WHEN a = 1 THEN 'one'\n" +
+		"  ELSE 'other' END AS label\n" +
+		"FROM t;\n"
+	got := File(parser.Parse(src), st)
+	if got != want {
+		t.Errorf("case_end same_line\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	twice := File(parser.Parse(got), st)
+	if twice != got {
+		t.Errorf("case_end same_line not idempotent:\n--- once ---\n%s\n--- twice ---\n%s", got, twice)
+	}
+}
+
+func TestDMLCaseCollapseShort(t *testing.T) {
+	// case_collapse keeps a short CASE on one line even with case_when_wrap set.
+	st := config.Default()
+	st.CaseWhenWrap = true
+	st.CaseCollapse = true
+	src := "select case when a = 1 then 'x' else 'y' end from t;"
+	want := "SELECT CASE WHEN a = 1 THEN 'x' ELSE 'y' END\nFROM t;\n"
+	got := File(parser.Parse(src), st)
+	if got != want {
+		t.Errorf("case_collapse short\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	twice := File(parser.Parse(got), st)
+	if twice != got {
+		t.Errorf("case_collapse short not idempotent:\n--- once ---\n%s\n--- twice ---\n%s", got, twice)
+	}
+}
+
+func TestDMLCaseCollapseLongStillWraps(t *testing.T) {
+	// case_collapse only keeps CASE inline when it is short; a long CASE still wraps.
+	st := config.Default()
+	st.CaseWhenWrap = true
+	st.CaseCollapse = true
+	src := "select case when a = 1 then 'a fairly long result value one' " +
+		"when a = 2 then 'a fairly long result value two' else 'a fairly long default value' end from t;"
+	got := File(parser.Parse(src), st)
+	if !strings.Contains(got, "\n  WHEN a = 1") {
+		t.Errorf("case_collapse long: expected wrapped WHEN branches, got:\n%s", got)
+	}
+	twice := File(parser.Parse(got), st)
+	if twice != got {
+		t.Errorf("case_collapse long not idempotent:\n--- once ---\n%s\n--- twice ---\n%s", got, twice)
+	}
+}
+
+func TestDMLCaseNestedInSubquery(t *testing.T) {
+	src := "select a from (select case when x = 1 then 'y' else 'n' end as c from t) s;"
+	got := format(src)
+	if got == "" {
+		t.Error("empty output")
+	}
+	checkDML(t, "case nested in subquery", got)
+	if !semanticallyEqual(src, got) {
+		t.Errorf("case nested in subquery: formatting changed semantics")
+	}
+}
+
+func TestDMLSubqueryNestedInCase(t *testing.T) {
+	src := "select case when exists (select 1 from t2 where t2.a = t1.a) then 'y' else 'n' end from t1;"
+	got := format(src)
+	if got == "" {
+		t.Error("empty output")
+	}
+	checkDML(t, "subquery nested in case", got)
+	if !semanticallyEqual(src, got) {
+		t.Errorf("subquery nested in case: formatting changed semantics")
+	}
+}
+
+func TestDMLCaseSimpleForm(t *testing.T) {
+	// Simple CASE (with an operand) must round-trip too.
+	src := "select case a when 1 then 'one' when 2 then 'two' else 'other' end from t;"
+	want := "SELECT CASE a WHEN 1 THEN 'one' WHEN 2 THEN 'two' ELSE 'other' END\nFROM t;\n"
+	got := format(src)
+	if got != want {
+		t.Errorf("simple case\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	checkDML(t, "simple case", got)
+}
+
+// --- record_space_before_paren ---
+
+func TestDMLRecordSpaceBeforeParen(t *testing.T) {
+	src := "select row(1, 2) from t;"
+
+	got := format(src)
+	want := "SELECT ROW(1, 2)\nFROM t;\n"
+	if got != want {
+		t.Errorf("row() default\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+
+	st := config.Default()
+	st.RecordSpaceBeforeParen = true
+	gotSpaced := File(parser.Parse(src), st)
+	wantSpaced := "SELECT ROW (1, 2)\nFROM t;\n"
+	if gotSpaced != wantSpaced {
+		t.Errorf("row() space_before_paren\n--- got ---\n%s\n--- want ---\n%s", gotSpaced, wantSpaced)
+	}
+	twice := File(parser.Parse(gotSpaced), st)
+	if twice != gotSpaced {
+		t.Errorf("row() space_before_paren not idempotent:\n--- once ---\n%s\n--- twice ---\n%s", gotSpaced, twice)
+	}
+}
+
+func TestWhereWhenLong(t *testing.T) {
+	src := "select a from t where a = 1 and b = 2"
+	st := config.Default()
+	st.WhereWrap = config.WrapWhenLong
+	st.LineWidth = 80
+	short := File(parser.Parse(src), st)
+	if !strings.Contains(short, "WHERE a = 1 AND b = 2") {
+		t.Errorf("short clause should stay on one line:\n%s", short)
+	}
+	st.LineWidth = 12
+	long := File(parser.Parse(src), st)
+	if strings.Contains(long, "WHERE a = 1") || !strings.Contains(long, "AND b = 2") {
+		t.Errorf("long clause should break per condition:\n%s", long)
+	}
+	st.WhereWrap = config.WrapAlways
+	want := File(parser.Parse(src), st)
+	if long != want {
+		t.Errorf("broken when_long should equal always:\n%s\n---\n%s", long, want)
+	}
+}
+
+func TestDMLCaseCollapseUsesLineWidth(t *testing.T) {
+	st := config.Default()
+	st.CaseWhenWrap = true
+	st.CaseCollapse = true
+	src := "select case when a = 1 then 'one' when a = 2 then 'two' else 'other' end from t;"
+	st.LineWidth = 120
+	if got := File(parser.Parse(src), st); strings.Contains(got, "\n  WHEN") {
+		t.Errorf("fits in 120, should collapse:\n%s", got)
+	}
+	st.LineWidth = 30
+	if got := File(parser.Parse(src), st); !strings.Contains(got, "\n  WHEN") {
+		t.Errorf("exceeds 30, should wrap:\n%s", got)
+	}
+}
+
+func TestSelectWrap(t *testing.T) {
+	src := "select a, b, c from t"
+	st := config.Default()
+	if got := File(parser.Parse(src), st); !strings.Contains(got, "\n  ,b") {
+		t.Errorf("default select_wrap=always should list one per line:\n%s", got)
+	}
+	st.SelectWrap = config.WrapNever
+	if got := File(parser.Parse(src), st); !strings.Contains(got, "SELECT a, b, c") {
+		t.Errorf("never:\n%s", got)
+	}
+	st.SelectWrap = config.WrapWhenLong
+	st.LineWidth = 120
+	if got := File(parser.Parse(src), st); !strings.Contains(got, "SELECT a, b, c") {
+		t.Errorf("when_long, short:\n%s", got)
+	}
+	st.LineWidth = 8
+	if got := File(parser.Parse(src), st); !strings.Contains(got, "\n  ,b") {
+		t.Errorf("when_long, long:\n%s", got)
+	}
+}
+
+func TestJoinWrap(t *testing.T) {
+	src := "select a from t join u on t.id = u.id and t.x = u.x"
+	st := config.Default()
+	base := File(parser.Parse(src), st)
+	if !strings.Contains(base, "JOIN u ON t.id = u.id AND t.x = u.x") {
+		t.Fatalf("default join_wrap=never should stay inline:\n%s", base)
+	}
+	st.JoinWrap = config.WrapAlways
+	got := File(parser.Parse(src), st)
+	if !strings.Contains(got, "JOIN u\n  ON t.id = u.id\n  AND t.x = u.x") {
+		t.Errorf("always:\n%s", got)
+	}
+	if twice := File(parser.Parse(got), st); twice != got {
+		t.Errorf("not idempotent:\n%s\n---\n%s", got, twice)
+	}
+	st.JoinWrap = config.WrapWhenLong
+	st.LineWidth = 120
+	if File(parser.Parse(src), st) != base {
+		t.Errorf("when_long short should equal inline")
+	}
+	st.LineWidth = 20
+	if File(parser.Parse(src), st) != got {
+		t.Errorf("when_long long should equal always")
+	}
+}
+
+func TestSelectWrapBrokenHonoursCommaStyle(t *testing.T) {
+	src := "select a, b, c from t"
+	st := config.Default()
+	st.SelectWrap = config.WrapWhenLong
+	st.LineWidth = 8
+	st.Commas = config.CommaTrailing
+	got := File(parser.Parse(src), st)
+	if !strings.Contains(got, " a,\n") || strings.Contains(got, "\n  ,b") {
+		t.Errorf("trailing commas expected when broken:\n%s", got)
+	}
+	st.Commas = config.CommaLeading
+	if got := File(parser.Parse(src), st); !strings.Contains(got, "\n  ,b") {
+		t.Errorf("leading commas expected when broken:\n%s", got)
+	}
+}
+
+func TestMultiCTETrailingCommas(t *testing.T) {
+	src := "with a as (select 1), b as (select 2) select * from a, b"
+	st := config.Default()
+	st.Commas = config.CommaTrailing
+	got := File(parser.Parse(src), st)
+	if !strings.Contains(got, "a AS (") || !strings.Contains(got, "),\n") {
+		t.Errorf("trailing comma between CTEs expected:\n%s", got)
+	}
+	if err := VerifySafe(src, got, st); err != nil {
+		t.Errorf("safety gate: %v\n%s", err, got)
+	}
+	st.Commas = config.CommaLeading
+	got = File(parser.Parse(src), st)
+	if !strings.Contains(got, ",b AS (") {
+		t.Errorf("leading comma expected:\n%s", got)
+	}
+}

pkg/format/doc.go

@@ -0,0 +1,184 @@
+package format
+
+import "strings"
+
+// Doc is a Wadler/Prettier-style layout document. Build one from Text, Line,
+// SoftLine, Group, Indent, IfBreak and Concat, then Render it at a line width:
+// a Group is printed flat (Lines become spaces, SoftLines vanish) when it fits
+// in the remaining width, otherwise broken (Lines become newlines).
+//
+// Rendering is relative to column 0; callers that splice the result mid-line
+// re-indent continuation lines themselves, so width checks ignore that offset.
+type Doc interface{ isDoc() }
+
+type (
+	docText   string
+	docLine   struct{ soft, hard bool }
+	docConcat []Doc
+	docIndent struct{ d Doc }
+	docGroup  struct{ d Doc }
+	docBreak  struct{ broken, flat Doc }
+)
+
+func (docText) isDoc()   {}
+func (docLine) isDoc()   {}
+func (docConcat) isDoc() {}
+func (docIndent) isDoc() {}
+func (docGroup) isDoc()  {}
+func (docBreak) isDoc()  {}
+
+// Text is literal text. If it contains a newline the enclosing group can never
+// be printed flat.
+func Text(s string) Doc { return docText(s) }
+
+// Line is a space when flat and a newline (plus indentation) when broken.
+func Line() Doc { return docLine{} }
+
+// SoftLine is nothing when flat and a newline (plus indentation) when broken.
+func SoftLine() Doc { return docLine{soft: true} }
+
+// HardLine is always a newline (plus indentation), even inside a flat group; a
+// group containing one can never be printed flat.
+func HardLine() Doc { return docLine{hard: true} }
+
+// Lines turns multi-line text into Text pieces joined by HardLines so that each
+// line picks up the surrounding Indent. Empty lines carry no indentation.
+func Lines(s, nl string) Doc {
+	parts := strings.Split(s, nl)
+	ds := make([]Doc, 0, 2*len(parts))
+	for i, p := range parts {
+		if i > 0 {
+			ds = append(ds, HardLine())
+		}
+		ds = append(ds, Text(p))
+	}
+	return Concat(ds...)
+}
+
+// Concat joins docs in order.
+func Concat(ds ...Doc) Doc { return docConcat(ds) }
+
+// Indent indents every line break inside d by one indent unit.
+func Indent(d Doc) Doc { return docIndent{d} }
+
+// Group lays d out flat if it fits on the current line, otherwise broken.
+func Group(d Doc) Doc { return docGroup{d} }
+
+// IfBreak renders broken when the enclosing group is broken, flat otherwise.
+func IfBreak(broken, flat Doc) Doc { return docBreak{broken, flat} }
+
+type docCmd struct {
+	indent string
+	flat   bool
+	d      Doc
+}
+
+// Render lays out d. width <= 0 means unlimited (every group stays flat).
+func Render(d Doc, width int, unit, nl string) string {
+	var b strings.Builder
+	col := 0
+	pending := "" // indentation owed to the next non-empty text
+	stack := []docCmd{{"", false, d}}
+	for len(stack) > 0 {
+		c := stack[len(stack)-1]
+		stack = stack[:len(stack)-1]
+		switch v := c.d.(type) {
+		case docText:
+			if len(v) > 0 {
+				b.WriteString(pending)
+				pending = ""
+			}
+			b.WriteString(string(v))
+			if i := strings.LastIndexByte(string(v), '\n'); i >= 0 {
+				col = len(v) - i - 1
+			} else {
+				col += len(v)
+			}
+		case docConcat:
+			for i := len(v) - 1; i >= 0; i-- {
+				stack = append(stack, docCmd{c.indent, c.flat, v[i]})
+			}
+		case docIndent:
+			stack = append(stack, docCmd{c.indent + unit, c.flat, v.d})
+		case docBreak:
+			if c.flat {
+				stack = append(stack, docCmd{c.indent, c.flat, v.flat})
+			} else {
+				stack = append(stack, docCmd{c.indent, c.flat, v.broken})
+			}
+		case docLine:
+			if c.flat && !v.hard {
+				if !v.soft {
+					b.WriteByte(' ')
+					col++
+				}
+				break
+			}
+			b.WriteString(nl)
+			pending = c.indent
+			col = len(c.indent)
+		case docGroup:
+			flat := c.flat || width <= 0 || fitsFlat(v.d, width-col, c.indent, unit, stack)
+			stack = append(stack, docCmd{c.indent, flat, v.d})
+		}
+	}
+	return b.String()
+}
+
+// fitsFlat reports whether d, printed flat, plus whatever follows it up to the
+// next possible line break, fits in rem columns.
+func fitsFlat(d Doc, rem int, indent, unit string, rest []docCmd) bool {
+	if rem < 0 {
+		return false
+	}
+	type item struct {
+		d    Doc
+		flat bool
+	}
+	work := []item{{d, true}}
+	ri := len(rest) - 1
+	for rem >= 0 {
+		if len(work) == 0 {
+			if ri < 0 {
+				return true
+			}
+			work = append(work, item{rest[ri].d, rest[ri].flat})
+			ri--
+			continue
+		}
+		it := work[len(work)-1]
+		work = work[:len(work)-1]
+		switch v := it.d.(type) {
+		case docText:
+			if strings.ContainsRune(string(v), '\n') {
+				return false
+			}
+			rem -= len(v)
+		case docConcat:
+			for i := len(v) - 1; i >= 0; i-- {
+				work = append(work, item{v[i], it.flat})
+			}
+		case docIndent:
+			work = append(work, item{v.d, it.flat})
+		case docGroup:
+			work = append(work, item{v.d, it.flat})
+		case docBreak:
+			if it.flat {
+				work = append(work, item{v.flat, it.flat})
+			} else {
+				work = append(work, item{v.broken, it.flat})
+			}
+		case docLine:
+			if v.hard {
+				return false
+			}
+			if !it.flat {
+				return true // a real line break ends the measured run
+			}
+			if !v.soft {
+				rem--
+			}
+		}
+	}
+	return false
+}

pkg/format/doc_test.go

@@ -0,0 +1,47 @@
+package format
+
+import "testing"
+
+func TestDocGroupFlatWhenFits(t *testing.T) {
+	d := Group(Concat(Text("WHERE"), Indent(Concat(Line(), Text("a = 1"), Line(), Text("AND b = 2")))))
+	if got, want := Render(d, 80, "  ", "\n"), "WHERE a = 1 AND b = 2"; got != want {
+		t.Errorf("flat: got %q want %q", got, want)
+	}
+	if got, want := Render(d, 10, "  ", "\n"), "WHERE\n  a = 1\n  AND b = 2"; got != want {
+		t.Errorf("broken: got %q want %q", got, want)
+	}
+	if got, want := Render(d, 0, "  ", "\n"), "WHERE a = 1 AND b = 2"; got != want {
+		t.Errorf("unlimited: got %q want %q", got, want)
+	}
+}
+
+func TestDocNewlineInTextForcesBreak(t *testing.T) {
+	d := Group(Concat(Text("x"), Line(), Text("(\n  y)")))
+	if got, want := Render(d, 80, "  ", "\n"), "x\n(\n  y)"; got != want {
+		t.Errorf("got %q want %q", got, want)
+	}
+}
+
+func TestDocIfBreakAndSoftLine(t *testing.T) {
+	d := Group(Concat(Text("f("), Indent(Concat(SoftLine(), Text("a, b"))), SoftLine(), IfBreak(Text(" -- long"), Text(""))))
+	if got, want := Render(d, 80, "  ", "\n"), "f(a, b"; got != want {
+		t.Errorf("flat: got %q want %q", got, want)
+	}
+	if got, want := Render(d, 3, "  ", "\n"), "f(\n  a, b\n -- long"; got != want {
+		t.Errorf("broken: got %q want %q", got, want)
+	}
+}
+
+func TestDocTrailingTextCountsTowardFit(t *testing.T) {
+	d := Concat(Group(Concat(Text("aaa"), Line(), Text("bbb"))), Text(";;;;"))
+	if got, want := Render(d, 10, "  ", "\n"), "aaa\nbbb;;;;"; got != want {
+		t.Errorf("got %q want %q", got, want)
+	}
+}
+
+func TestDocHardLineForcesBreakAndSkipsBlankIndent(t *testing.T) {
+	d := Group(Concat(Text("("), Indent(Concat(HardLine(), Lines("a\n\nb", "\n"))), HardLine(), Text(")")))
+	if got, want := Render(d, 0, "  ", "\n"), "(\n  a\n\n  b\n)"; got != want {
+		t.Errorf("got %q want %q", got, want)
+	}
+}

pkg/format/format.go

@@ -53,9 +53,12 @@ func (p *printer) writeItem(n cst.Node) {
 	case *cst.CreateFunction:
 		p.writeCreateFunction(v)
 	case *cst.Raw:
-		if isDMLStart(v.Toks) {
-			p.b.WriteString(formatDML(v.Toks, p.st))
-		} else {
+		switch {
+		case isDMLStart(v.Toks):
+			p.b.WriteString(restoreLiteralNewlines(formatDML(v.Toks, p.st)))
+		case isDoBlock(v.Toks):
+			p.b.WriteString(formatDoBlock(v.Toks, p.st))
+		default:
 			p.b.WriteString(verbatimSpan(v.Toks))
 		}
 	default:
@@ -63,11 +66,93 @@ func (p *printer) writeItem(n cst.Node) {
 	}
 }
 
+// isDoBlock reports whether toks is a DO $$ ... $$ statement.
+func isDoBlock(toks []cst.Tok) bool {
+	for _, t := range toks {
+		if t.Tok.Kind == lexer.Ident {
+			return lowerASCII(t.Tok.Text) == "do"
+		}
+		if !t.Tok.IsTrivia() {
+			return false
+		}
+	}
+	return false
+}
+
+// formatDoBlock formats a DO $$ ... $$ block by applying formatBody to the
+// dollar-quoted string and emitting DO + newline + formatted body.
+func formatDoBlock(toks []cst.Tok, st config.Style) string {
+	// Find the DO keyword, the dollar-string body, any other clause tokens
+	// (LANGUAGE x, before or after the body), and the optional semicolon.
+	var doTok, bodyTok *cst.Tok
+	var pre, post []string
+	hasSemi := false
+	for i := range toks {
+		t := &toks[i]
+		if t.Tok.IsTrivia() || t.Tok.Kind == lexer.EOF {
+			continue
+		}
+		low := lowerASCII(t.Tok.Text)
+		if t.Tok.Kind == lexer.Ident && low == "do" && doTok == nil {
+			doTok = t
+			continue
+		}
+		if doTok != nil && t.Tok.Kind == lexer.DollarString && bodyTok == nil {
+			bodyTok = t
+			continue
+		}
+		if t.Tok.Kind == lexer.Semicolon {
+			hasSemi = true
+			continue
+		}
+		// Clause tokens other than DO / body / ';' (e.g. LANGUAGE plpython3u).
+		// Any comment attached to one means we cannot safely relocate it.
+		if len(t.Comments()) > 0 {
+			return verbatimSpanFormatBody(toks, bodyTok, st)
+		}
+		txt := t.Tok.Text
+		if low == "language" {
+			txt = applyCase(txt, st.KeywordCase)
+		}
+		if bodyTok == nil {
+			pre = append(pre, txt)
+		} else {
+			post = append(post, txt)
+		}
+	}
+	if doTok == nil || bodyTok == nil {
+		return verbatimSpan(toks)
+	}
+
+	nl := st.Newline
+	var b strings.Builder
+	b.WriteString(applyCase(doTok.Tok.Text, st.KeywordCase))
+	if len(pre) > 0 {
+		b.WriteString(" ")
+		b.WriteString(strings.Join(pre, " "))
+	}
+	b.WriteString(nl)
+	if isPlpgsql(toks) {
+		b.WriteString(formatBody(bodyTok.Tok.Text, st))
+	} else {
+		b.WriteString(bodyTok.Tok.Text)
+	}
+	if len(post) > 0 {
+		b.WriteString(nl)
+		b.WriteString(strings.Join(post, " "))
+	}
+	if hasSemi {
+		b.WriteString(";")
+	}
+	return b.String()
+}
+
 func (p *printer) writeCreateFunction(cf *cst.CreateFunction) {
 	// Safety: if the header carries comments we cannot confidently relocate,
 	// emit the whole statement verbatim rather than risk dropping them.
+	// We still format the body dollar-string independently since it is self-contained.
 	if headerHasComments(cf) {
-		p.b.WriteString(verbatimSpan(cst.Tokens(cf)))
+		p.b.WriteString(verbatimSpanFormatBody(cst.Tokens(cf), cf.Body, p.st))
 		return
 	}
 
@@ -80,11 +165,23 @@ func (p *printer) writeCreateFunction(cf *cst.CreateFunction) {
 	}
 	p.b.WriteString("(")
 
-	first := p.st.Indent + " " // align item text one column past the comma
-	cont := p.st.Indent
+	// Build formatted param texts first so we can measure widths.
+	paramTexts := make([]string, len(cf.Params))
 	for i, param := range cf.Params {
+		paramTexts[i] = p.inline(param.Toks)
+	}
+
+	// align_param_types: pad param names so type columns align.
+	if p.st.AlignParamTypes && len(cf.Params) > 1 {
+		paramTexts = alignParamTypes(paramTexts)
+	}
+
+	// House style: first parameter indented one level; leading-comma
+	// continuation lines carry the comma at column 0 followed by one space.
+	first := p.st.Indent
+	for i, text := range paramTexts {
+		param := cf.Params[i]
 		p.nl()
-		text := p.inline(param.Toks)
 		if i == 0 || p.st.Commas != config.CommaLeading {
 			p.b.WriteString(first)
 			p.b.WriteString(text)
@@ -92,25 +189,44 @@ func (p *printer) writeCreateFunction(cf *cst.CreateFunction) {
 				p.b.WriteString(",")
 			}
 		} else {
-			p.b.WriteString(cont)
-			p.b.WriteString(",")
+			p.b.WriteString(", ")
 			p.b.WriteString(text)
 		}
+		// Emit trailing inline comment from the separator (e.g. --description after param).
+		if param.Sep != nil {
+			for _, tr := range param.Sep.Lead {
+				if tr.Kind == lexer.LineComment || tr.Kind == lexer.BlockComment {
+					p.b.WriteByte(' ')
+					p.b.WriteString(strings.TrimRight(tr.Text, " \t"))
+					break
+				}
+			}
+		}
 	}
 	p.nl()
 	p.b.WriteString(")")
 
 	for _, clause := range cf.Options {
 		p.nl()
+		p.b.WriteString(p.st.Indent)
 		p.b.WriteString(p.inline(clause))
 	}
 	if cf.As != nil {
-		p.nl()
+		// routine_as_wrap: when false, AS stays on the same line as the last option.
+		if p.st.RoutineAsWrap {
+			p.nl()
+		} else {
+			p.b.WriteByte(' ')
+		}
 		p.b.WriteString(p.inline([]cst.Tok{{Tok: cf.As.Tok}}))
 	}
 	if cf.Body != nil {
 		p.nl()
-		p.b.WriteString(formatBody(cf.Body.Tok.Text, p.st))
+		if isPlpgsql(cst.Tokens(cf)) {
+			p.b.WriteString(formatBody(cf.Body.Tok.Text, p.st))
+		} else {
+			p.b.WriteString(cf.Body.Tok.Text)
+		}
 	}
 	for _, clause := range cf.Tail {
 		p.nl()
@@ -136,10 +252,15 @@ func (p *printer) inline(toks []cst.Tok) string {
 	}
 	var b strings.Builder
 	for i, t := range toks {
-		if i > 0 && needSpace(toks[i-1].Tok, t.Tok) {
+		if i > 0 && needSpace(toks[i-1].Tok, t.Tok) && !isPctTypeBoundary(toks, i) {
 			b.WriteByte(' ')
 		}
-		b.WriteString(caseText(t.Tok, p.st))
+		var prev lexer.Token
+		if i > 0 {
+			prev = toks[i-1].Tok
+		}
+		nextIsLParen := i+1 < len(toks) && toks[i+1].Tok.Kind == lexer.LParen
+		b.WriteString(caseTextCtx(t.Tok, prev, nextIsLParen, p.st))
 	}
 	return b.String()
 }
@@ -147,7 +268,8 @@ func (p *printer) inline(toks []cst.Tok) string {
 func (p *printer) leadingComments(lead cst.Trivia) {
 	for _, tr := range lead {
 		if tr.Kind == lexer.LineComment || tr.Kind == lexer.BlockComment {
-			p.b.WriteString(strings.TrimRight(tr.Text, " \t"))
+			text := strings.TrimRight(strings.ReplaceAll(tr.Text, "\r", ""), " \t")
+			p.b.WriteString(text)
 			p.nl()
 		}
 	}
@@ -157,7 +279,7 @@ func (p *printer) trailingComments(lead cst.Trivia) {
 	cs := commentsOf(lead)
 	for _, c := range cs {
 		p.nl()
-		p.b.WriteString(strings.TrimRight(c.Text, " \t"))
+		p.b.WriteString(strings.TrimRight(strings.ReplaceAll(c.Text, "\r", ""), " \t"))
 	}
 }
 
@@ -166,6 +288,31 @@ func (p *printer) trailingComments(lead cst.Trivia) {
 // tightOps are operators printed without surrounding spaces.
 var tightOps = map[string]bool{"::": true, ":": true, "->": true, "->>": true}
 
+// isPctTypeBoundary reports whether the gap between toks[i-1] and toks[i] sits
+// inside a %TYPE / %ROWTYPE modifier (e.g. core.tbl%rowtype), which is printed
+// tight like "::" rather than as the modulo operator.
+func isPctTypeBoundary(toks []cst.Tok, i int) bool {
+	if i <= 0 || i >= len(toks) {
+		return false
+	}
+	isPct := func(t lexer.Token) bool { return t.Kind == lexer.Operator && t.Text == "%" }
+	isTypeWord := func(t lexer.Token) bool {
+		if t.Kind != lexer.Ident {
+			return false
+		}
+		l := lowerASCII(t.Text)
+		return l == "type" || l == "rowtype"
+	}
+	prev, cur := toks[i-1].Tok, toks[i].Tok
+	if isPct(prev) && isTypeWord(cur) {
+		return true // space after %
+	}
+	if isPct(cur) && i+1 < len(toks) && isTypeWord(toks[i+1].Tok) {
+		return true // space before %
+	}
+	return false
+}
+
 // parenKws are keywords that always take a space before '(' because they
 // introduce a subquery or a bracketed clause, not a function-call argument list.
 var parenKws = map[string]bool{
@@ -211,8 +358,14 @@ func needSpace(a, b lexer.Token) bool {
 }
 
 func caseText(t lexer.Token, st config.Style) string {
+	return caseTextCtx(t, lexer.Token{}, false, st)
+}
+
+// caseTextCtx applies casing with context: prev is the preceding significant
+// token, nextIsLParen indicates the next significant token is '('.
+func caseTextCtx(t lexer.Token, prev lexer.Token, nextIsLParen bool, st config.Style) string {
 	if t.Kind != lexer.Ident {
-		return t.Text // only unquoted words are re-cased
+		return t.Text
 	}
 	low := lowerASCII(t.Text)
 	switch {
@@ -220,6 +373,10 @@ func caseText(t lexer.Token, st config.Style) string {
 		return applyCase(t.Text, st.TypeCase)
 	case isKeyword(low):
 		return applyCase(t.Text, st.KeywordCase)
+	case nextIsLParen && isBuiltinFunc(low):
+		return applyCase(t.Text, st.BuiltinCase)
+	case prev.Kind == lexer.Ident && lowerASCII(prev.Text) == "as":
+		return applyCase(t.Text, st.AliasCase)
 	default:
 		return applyCase(t.Text, st.IdentCase)
 	}
@@ -239,18 +396,25 @@ func applyCase(s string, c config.Case) string {
 // --- helpers ---
 
 // headerHasComments reports whether the function header carries comment trivia
-// the formatter cannot confidently relocate. The first token's leading trivia
-// is excluded: that is the statement's leading comment, which File() emits
-// separately. The body token's own text is excluded too (it is emitted
-// verbatim), but a comment in front of the body is caught.
+// the formatter cannot confidently relocate. Param separator (Sep) comments
+// are excluded — those are trailing inline comments on param lines that the
+// formatter emits explicitly after each param text. The first token's leading
+// trivia and the body token are also excluded.
 func headerHasComments(cf *cst.CreateFunction) bool {
+	// Build a set of Sep token offsets so we can skip them.
+	sepOffsets := make(map[int]bool, len(cf.Params))
+	for _, p := range cf.Params {
+		if p.Sep != nil {
+			sepOffsets[p.Sep.Tok.Off] = true
+		}
+	}
 	all := cst.Tokens(cf)
 	for i, t := range all {
-		if i == 0 {
+		if i == 0 || t.Tok.Kind == lexer.Semicolon {
 			continue
 		}
-		if t.Tok.Kind == lexer.Semicolon {
-			continue
+		if sepOffsets[t.Tok.Off] {
+			continue // Sep comments handled separately
 		}
 		if hasComment(t) {
 			return true
@@ -302,6 +466,27 @@ func verbatimSpan(toks []cst.Tok) string {
 	return b.String()
 }
 
+// verbatimSpanFormatBody emits toks verbatim but replaces bodyTok's text with
+// formatBody output. Used when the function header has comments we cannot
+// safely relocate but the body can still be independently formatted.
+// If bodyTok is nil the function is identical to verbatimSpan.
+func verbatimSpanFormatBody(toks []cst.Tok, bodyTok *cst.Tok, st config.Style) string {
+	var b strings.Builder
+	for i, t := range toks {
+		if i > 0 {
+			for _, tr := range t.Lead {
+				b.WriteString(tr.Text)
+			}
+		}
+		if bodyTok != nil && t.Tok.Kind == lexer.DollarString && t.Tok.Off == bodyTok.Tok.Off && isPlpgsql(toks) {
+			b.WriteString(formatBody(t.Tok.Text, st))
+		} else {
+			b.WriteString(t.Tok.Text)
+		}
+	}
+	return b.String()
+}
+
 // hasBlankLine reports whether leading whitespace trivia contains a blank line
 // (two or more newlines), indicating the author wanted statements separated.
 func hasBlankLine(lead cst.Trivia) bool {
@@ -331,3 +516,90 @@ func lowerASCII(s string) string {
 	}
 	return string(b)
 }
+
+// alignParamTypes pads param names so the type column aligns across all params.
+// Expected format per param: "[mode] name type [DEFAULT expr]".
+// Mode keywords (IN/OUT/INOUT/VARIADIC) are detected and skipped.
+// Params without a type are passed through unchanged.
+func alignParamTypes(params []string) []string {
+	type pp struct{ mode, name, rest string }
+	parsed := make([]pp, len(params))
+	maxNameW := 0
+
+	modeKws := map[string]bool{"in": true, "out": true, "inout": true, "variadic": true}
+
+	for i, s := range params {
+		fields := strings.Fields(s)
+		if len(fields) < 2 {
+			parsed[i].rest = s
+			continue
+		}
+		nameIdx := 0
+		if modeKws[lowerASCII(fields[0])] {
+			nameIdx = 1
+		}
+		if nameIdx >= len(fields) || nameIdx+1 >= len(fields) {
+			// No type field — keep verbatim.
+			parsed[i].rest = s
+			continue
+		}
+		if nameIdx > 0 {
+			parsed[i].mode = fields[0]
+		}
+		parsed[i].name = fields[nameIdx]
+		parsed[i].rest = strings.Join(fields[nameIdx+1:], " ")
+		if len(parsed[i].name) > maxNameW {
+			maxNameW = len(parsed[i].name)
+		}
+	}
+
+	if maxNameW == 0 {
+		return params
+	}
+
+	out := make([]string, len(params))
+	for i, p := range parsed {
+		if p.name == "" {
+			out[i] = params[i]
+			continue
+		}
+		var b strings.Builder
+		if p.mode != "" {
+			b.WriteString(p.mode)
+			b.WriteByte(' ')
+		}
+		b.WriteString(p.name)
+		// Pad name to (maxNameW+1) so the type column starts at a consistent offset.
+		pad := maxNameW + 1 - len(p.name)
+		for k := 0; k < pad; k++ {
+			b.WriteByte(' ')
+		}
+		b.WriteString(p.rest)
+		out[i] = b.String()
+	}
+	return out
+}
+
+// isPlpgsql reports whether the routine's body should be restyled. Bodies in
+// any pl* language other than plpgsql (plpython3u, plperl, pltcl, ...), and in
+// c or internal, are emitted verbatim; plpgsql, sql and everything else are
+// formatted. A routine
+// with no LANGUAGE clause is treated as sql and formatted.
+func isPlpgsql(toks []cst.Tok) bool {
+	var sig []cst.Tok
+	for _, t := range toks {
+		if !t.Tok.IsTrivia() && t.Tok.Kind != lexer.EOF {
+			sig = append(sig, t)
+		}
+	}
+	for i := 0; i+1 < len(sig); i++ {
+		if sig[i].Is("language") {
+			name := strings.ToLower(strings.Trim(sig[i+1].Tok.Text, "'\""))
+			if name == "c" || name == "internal" {
+				return false
+			}
+			return !strings.HasPrefix(name, "pl") || name == "plpgsql"
+		}
+	}
+	return true
+}

pkg/format/format_test.go

@@ -7,7 +7,6 @@ import (
 	"testing"
 
 	"git.warky.dev/wdevs/pgtidy/pkg/config"
-	"git.warky.dev/wdevs/pgtidy/pkg/lexer"
 	"git.warky.dev/wdevs/pgtidy/pkg/parser"
 )
 
@@ -24,13 +23,13 @@ func TestFormatHeaderGolden(t *testing.T) {
 
 	want := "--select * from dropall('resolvespec_login');\n" +
 		"CREATE OR REPLACE FUNCTION resolvespec_login(\n" +
-		"   INOUT p_data jsonb\n" +
-		"  ,OUT p_success boolean\n" +
-		"  ,OUT p_error text\n" +
+		"  INOUT p_data jsonb\n" +
+		", OUT p_success boolean\n" +
+		", OUT p_error text\n" +
 		")\n" +
-		"LANGUAGE plpgsql\n" +
-		"VOLATILE\n" +
-		"SECURITY DEFINER\n" +
+		"  LANGUAGE plpgsql\n" +
+		"  VOLATILE\n" +
+		"  SECURITY DEFINER\n" +
 		"AS\n" +
 		"$$\nbegin end;\n$$;\n"
 
@@ -71,6 +70,102 @@ func TestFormatBodyBroken(t *testing.T) {
 	}
 }
 
+func TestFormatMmProcBroken(t *testing.T) {
+	dir := filepath.Join("..", "..", "testdata", "corpus")
+	brokenData, err := os.ReadFile(filepath.Join(dir, "test_mm_proc_broken.pgsql"))
+	if err != nil {
+		t.Skipf("no test_mm_proc_broken.pgsql: %v", err)
+	}
+	goldenData, err := os.ReadFile(filepath.Join(dir, "test_mm_proc.pgsql"))
+	if err != nil {
+		t.Skipf("no test_mm_proc.pgsql: %v", err)
+	}
+
+	got := format(string(brokenData))
+	want := string(goldenData)
+	if got != want {
+		// Find and report the first differing line.
+		gotLines := strings.Split(got, "\n")
+		wantLines := strings.Split(want, "\n")
+		for i := 0; i < len(gotLines) && i < len(wantLines); i++ {
+			if gotLines[i] != wantLines[i] {
+				t.Errorf("format(test_mm_proc_broken) != test_mm_proc.pgsql at line %d\n  got:  %q\n  want: %q", i+1, gotLines[i], wantLines[i])
+				break
+			}
+		}
+		if len(gotLines) != len(wantLines) {
+			t.Errorf("format(test_mm_proc_broken): got %d lines, want %d lines", len(gotLines), len(wantLines))
+		}
+	}
+	twice := format(got)
+	if twice != got {
+		t.Errorf("format(test_mm_proc_broken) is not idempotent")
+	}
+	if !semanticallyEqual(string(brokenData), got) {
+		t.Errorf("format(test_mm_proc_broken) changed semantics")
+	}
+}
+
+func TestFormatIssue1PLpgSQLIndenting(t *testing.T) {
+	src := "CREATE FUNCTION f() RETURNS void LANGUAGE plpgsql AS $$\n" +
+		"DECLARE\n" +
+		"  r_lp record;\n" +
+		"BEGIN\n" +
+		"   if r_lp.total > 0\n" +
+		"      and r_lp.totaldone >= r_lp.total\n" +
+		"    then\n" +
+		"    update core.process u\n" +
+		"      set status = 'done'\n" +
+		"      where u.rid_process = r_lp.rid_process\n" +
+		"        and nv(u.status) <> 'done';\n" +
+		"  elsif r_lp.total > 0\n" +
+		"    then\n" +
+		"    update core.process u\n" +
+		"      set status = 'open'\n" +
+		"      where u.rid_process = r_lp.rid_process\n" +
+		"        and nv(u.status) <> 'open';\n" +
+		"\n" +
+		"  end if;\n" +
+		"$$;\n"
+
+	want := "CREATE FUNCTION f(\n" +
+		")\n" +
+		"  RETURNS void\n" +
+		"  LANGUAGE plpgsql\n" +
+		"AS\n" +
+		"$$\n" +
+		"DECLARE\n" +
+		"  r_lp record;\n" +
+		"BEGIN\n" +
+		"  if r_lp.total > 0\n" +
+		"      and r_lp.totaldone >= r_lp.total\n" +
+		"  then\n" +
+		"    update core.process u\n" +
+		"    set status = 'done'\n" +
+		"    where\n" +
+		"        u.rid_process = r_lp.rid_process\n" +
+		"    and nv(u.status) <> 'done';\n" +
+		"  elsif r_lp.total > 0\n" +
+		"  then\n" +
+		"    update core.process u\n" +
+		"    set status = 'open'\n" +
+		"    where\n" +
+		"        u.rid_process = r_lp.rid_process\n" +
+		"    and nv(u.status) <> 'open';\n" +
+		"\n" +
+		"  end if;\n" +
+		"$$;\n"
+
+	got := format(src)
+	if got != want {
+		t.Errorf("issue #1 PL/pgSQL indenting\n--- got ---\n%s\n--- want ---\n%s", got, want)
+	}
+	checkDML(t, "issue #1 PL/pgSQL indenting", got)
+	if !semanticallyEqual(src, got) {
+		t.Errorf("issue #1 PL/pgSQL indenting changed semantics")
+	}
+}
+
 func TestCorpusIdempotentAndSafe(t *testing.T) {
 	dir := filepath.Join("..", "..", "testdata", "corpus")
 	entries, err := os.ReadDir(dir)
@@ -79,7 +174,7 @@ func TestCorpusIdempotentAndSafe(t *testing.T) {
 	}
 	var seen int
 	for _, e := range entries {
-		if e.IsDir() || !strings.HasSuffix(e.Name(), ".pgsql") {
+		if e.IsDir() || !strings.HasSuffix(e.Name(), ".pgsql") || strings.HasSuffix(e.Name(), "_broken.pgsql") {
 			continue
 		}
 		seen++
@@ -89,62 +184,101 @@ func TestCorpusIdempotentAndSafe(t *testing.T) {
 		}
 		src := string(data)
 		once := format(src)
-		twice := format(once)
-		if once != twice {
-			t.Errorf("%s: not idempotent", e.Name())
-		}
-		if !semanticallyEqual(src, once) {
-			t.Errorf("%s: formatting changed semantics", e.Name())
+		// VerifySafe bundles every runtime gate: semantic equivalence, comment
+		// preservation, structural balance, and idempotence.
+		if err := VerifySafe(src, once, config.Default()); err != nil {
+			t.Errorf("%s: %v", e.Name(), err)
 		}
 	}
 	if seen == 0 {
 		t.Skip("no corpus files")
 	}
-	t.Logf("formatted %d corpus files (idempotent + semantically equal)", seen)
+	t.Logf("verified %d corpus files (semantic + comments + structure + idempotence)", seen)
 }
 
-// semanticallyEqual compares the non-trivia token streams of two sources,
-// treating unquoted identifiers/keywords case-insensitively and everything
-// else (strings, numbers, operators, punctuation) exactly. Dollar-quoted body
-// tokens are compared recursively so body whitespace normalization does not
-// trigger a false failure.
+// semanticallyEqual is a test-local alias for the exported safety check.
 func semanticallyEqual(a, b string) bool {
-	ta := significant(a)
-	tb := significant(b)
-	if len(ta) != len(tb) {
-		return false
-	}
-	for i := range ta {
-		if ta[i].Kind != tb[i].Kind {
-			return false
-		}
-		switch ta[i].Kind {
-		case lexer.Ident:
-			if !strings.EqualFold(ta[i].Text, tb[i].Text) {
-				return false
-			}
-		case lexer.DollarString:
-			_, innerA, _, okA := splitDollarQuote(ta[i].Text)
-			_, innerB, _, okB := splitDollarQuote(tb[i].Text)
-			if okA != okB || (okA && !semanticallyEqual(innerA, innerB)) {
-				return false
-			}
-		default:
-			if ta[i].Text != tb[i].Text {
-				return false
-			}
-		}
-	}
-	return true
+	return SemanticallyEqual(a, b)
 }
 
-func significant(src string) []lexer.Token {
-	var out []lexer.Token
-	for _, t := range lexer.Lex(src) {
-		if t.Kind == lexer.EOF || t.IsTrivia() {
-			continue
+func TestNonPlpgsqlBodyVerbatim(t *testing.T) {
+	body := "$$\ndeclare x = 1\nbegin = 2\n$$"
+	src := "create function f() returns void as " + body + " language plpython3u;"
+	if out := format(src); !strings.Contains(out, body) {
+		t.Fatalf("plpython3u body was modified:\n%s", out)
+	}
+}
+
+func TestLanguageBodyGate(t *testing.T) {
+	body := "$$\ndeclare x int:=1;\nbegin\nnull;\nend\n$$"
+	for lang, verbatim := range map[string]bool{"plpgsql": false, "sql": false, "plpython3u": true, "plperl": true, "pltcl": true, "c": true, "internal": true} {
+		out := format("create function f() returns void as " + body + " language " + lang + ";")
+		if got := strings.Contains(out, body); got != verbatim {
+			t.Errorf("language %s: verbatim=%v, want %v\n%s", lang, got, verbatim, out)
 		}
-		out = append(out, t)
+	}
+}
+
+func TestDoBlockLanguageGate(t *testing.T) {
+	body := "$$\ndeclare x int:=1;\nbegin\nnull;\nend\n$$"
+	for src, verbatim := range map[string]bool{
+		"do " + body + ";":                     false,
+		"do language plpgsql " + body + ";":    false,
+		"do " + body + " language plpgsql;":    false,
+		"do language plpython3u " + body + ";": true,
+		"do " + body + " language plperl;":     true,
+	} {
+		if out := format(src); strings.Contains(out, body) != verbatim {
+			t.Errorf("%q: verbatim=%v, want %v\n%s", src, !verbatim, verbatim, out)
+		}
+	}
+}
+
+func TestDoBlockKeepsLanguageClause(t *testing.T) {
+	for _, src := range []string{
+		"do language plpython3u $$\nx = 1\n$$;",
+		"do $$\nx = 1\n$$ language plpython3u;",
+	} {
+		if out := format(src); !strings.Contains(strings.ToLower(out), "language plpython3u") {
+			t.Errorf("LANGUAGE clause lost:\n%s", out)
+		}
+	}
+}
+
+func TestMultiLineStringLiteralVerbatim(t *testing.T) {
+	src := "create function f() returns void language plpgsql as $$\nDECLARE\n  x int;\nBEGIN\n  if x = 1 then\n    raise exception E'A client\nTo resolve this', NEW.id;\n  end if;\nEND\n$$;"
+	if out := format(src); !strings.Contains(out, "E'A client\nTo resolve this'") {
+		t.Errorf("multi-line string was reindented:\n%s", out)
+	}
+}
+
+func TestCommentBeforeBeginKept(t *testing.T) {
+	src := "create function f() returns void language plpgsql as $$\nDECLARE\n  x int = 1;  --0=old, 1=new\nBEGIN\n  null;\nEND\n$$;"
+	out := format(src)
+	if !strings.Contains(out, "--0=old, 1=new") {
+		t.Fatalf("comment before BEGIN lost:\n%s", out)
+	}
+	if again := format(out); again != out {
+		t.Fatalf("not idempotent:\n%s\n---\n%s", out, again)
+	}
+}
+
+func TestEmbeddedDollarLiterals(t *testing.T) {
+	body := func(lit string) string {
+		return "create function f() returns void language plpgsql as $$\nDECLARE\n  x text;\nBEGIN\n  x = " + lit + ";\nEND\n$$;"
+	}
+	// format() template: must be untouched.
+	tmpl := "format($Q$select %s, %3$s from t$Q$, a)"
+	if out := format(body(tmpl)); !strings.Contains(out, "$Q$select %s, %3$s from t$Q$") {
+		t.Errorf("placeholder template modified:\n%s", out)
+	}
+	// SQL fragment (not a statement): untouched.
+	frag := "$s$ and (a=1)  or b=2 $s$"
+	if out := format(body(frag)); !strings.Contains(out, frag) {
+		t.Errorf("fragment modified:\n%s", out)
+	}
+	// Statement: formatted as code.
+	if out := format(body("$q$select a,b from t where x=1$q$")); strings.Contains(out, "$q$select a,b from t where x=1$q$") {
+		t.Errorf("embedded select was not formatted:\n%s", out)
 	}
-	return out
 }

pkg/format/keywords.go

@@ -51,5 +51,23 @@ func words(s string) map[string]bool {
 	return m
 }
 
-func isKeyword(lower string) bool  { return keywords[lower] }
-func isTypeName(lower string) bool { return typeNames[lower] }
+// builtinFunctions are built-in function names controlled by BuiltinCase.
+var builtinFunctions = words(`
+abs age array_agg array_length array_lower array_ndims array_upper
+bit_length btrim cardinality ceil ceiling char_length character_length
+chr clock_timestamp coalesce concat concat_ws count
+currval decode div encode exp extract floor
+generate_series greatest initcap jsonb_agg jsonb_object_agg
+justify_days justify_hours justify_interval
+lastval least length lower lpad ltrim
+max md5 min mod now nullif
+overlay pg_sleep position power quote_ident quote_literal
+random regexp_match regexp_matches regexp_replace replace reverse round rpad rtrim
+setval split_part sqrt string_agg strpos substr substring sum
+to_char to_date to_json to_jsonb to_number to_timestamp to_tsvector
+translate trim trunc unnest upper width_bucket
+`)
+
+func isKeyword(lower string) bool     { return keywords[lower] }
+func isTypeName(lower string) bool    { return typeNames[lower] }
+func isBuiltinFunc(lower string) bool { return builtinFunctions[lower] }

pkg/format/safety.go

@@ -0,0 +1,259 @@
+package format
+
+import (
+	"fmt"
+	"strings"
+
+	"git.warky.dev/wdevs/pgtidy/pkg/config"
+	"git.warky.dev/wdevs/pgtidy/pkg/lexer"
+	"git.warky.dev/wdevs/pgtidy/pkg/parser"
+)
+
+// VerifySafe runs every safety invariant against a formatting result before it
+// is written to disk or returned to an editor. src is the original input, out
+// the formatted output, and st the style out was produced with. It returns nil
+// when out is safe to emit, otherwise an error naming the invariant that failed.
+//
+// The checks, in order of cost:
+//
+//  1. Semantic equivalence — the non-trivia (code) token stream is unchanged:
+//     identifiers/keywords compare case-insensitively, everything else exactly,
+//     recursing into dollar-quoted bodies. Comments and whitespace are trivia
+//     and are deliberately ignored here.
+//  2. Comment preservation — every -- and /* */ comment in src reappears in out,
+//     in the same order, with the same content (ignoring only trailing
+//     whitespace and CRLF/LF). The formatter may move or re-indent a comment but
+//     must never drop, merge, split, or reword one.
+//  3. Structural balance — the ( ) [ ] and BEGIN/CASE/IF/LOOP…END nesting
+//     profile of out matches src's, counting only real code tokens (anything
+//     inside a comment or a string/dollar-quoted literal is ignored).
+//  4. Idempotence — formatting out again yields out unchanged.
+//
+// Any failure means the formatter has a bug: the caller must keep the original
+// source and never emit out.
+func VerifySafe(src, out string, st config.Style) error {
+	if !SemanticallyEqual(src, out) {
+		return fmt.Errorf("code token stream changed")
+	}
+	if err := CommentsPreserved(src, out); err != nil {
+		return err
+	}
+	if err := StructurallyBalanced(src, out); err != nil {
+		return err
+	}
+	if reformatted := File(parser.Parse(out), st); reformatted != out {
+		return fmt.Errorf("output is not idempotent (a second format pass would change it)")
+	}
+	return nil
+}
+
+// SemanticallyEqual reports whether a and b have the same non-trivia token
+// stream, i.e. formatting may only ever change whitespace/comment trivia and
+// layout — it must never add, remove, or alter a token of actual code.
+// Unquoted identifiers/keywords compare case-insensitively (casing is a
+// style choice); everything else (strings, numbers, operators, punctuation)
+// must match exactly. Dollar-quoted body tokens are compared recursively so
+// that independent body reformatting doesn't trigger a false failure.
+//
+// The CLI and LSP must call this (via VerifySafe) before ever writing or
+// emitting formatted output: if it returns false, the formatter has a bug and
+// the original source must be kept, never the (corrupting) formatted output.
+func SemanticallyEqual(a, b string) bool {
+	ta := significantTokens(a)
+	tb := significantTokens(b)
+	if len(ta) != len(tb) {
+		return false
+	}
+	for i := range ta {
+		if ta[i].Kind != tb[i].Kind {
+			return false
+		}
+		switch ta[i].Kind {
+		case lexer.Ident:
+			if !strings.EqualFold(ta[i].Text, tb[i].Text) {
+				return false
+			}
+		case lexer.String, lexer.EscapeString, lexer.BitString, lexer.HexString, lexer.UnicodeString:
+			// A CRLF vs LF difference inside a multi-line string literal is a
+			// line-ending normalisation, not a change of code content — the
+			// formatter always re-emits layout with st.Newline. Compare the
+			// literal modulo \r\n ↔ \n.
+			if normNL(ta[i].Text) != normNL(tb[i].Text) {
+				return false
+			}
+		case lexer.DollarString:
+			_, innerA, _, okA := splitDollarQuote(ta[i].Text)
+			_, innerB, _, okB := splitDollarQuote(tb[i].Text)
+			if okA != okB || (okA && !SemanticallyEqual(innerA, innerB)) {
+				return false
+			}
+		default:
+			if ta[i].Text != tb[i].Text {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+// CommentsPreserved reports whether every comment in a survives into b with its
+// text intact. Comments are compared in document order; each is reduced to its
+// sequence of non-blank text lines (line endings normalised, every line trimmed
+// of surrounding whitespace, blank lines dropped) so that the formatter is free
+// to move or re-indent a comment but can never drop, merge, split, reorder, or
+// reword one. Comments inside dollar-quoted bodies are included (the bodies are
+// lexed recursively). A non-nil error describes the first divergence.
+func CommentsPreserved(a, b string) error {
+	ca := comments(a)
+	cb := comments(b)
+	if len(ca) != len(cb) {
+		return fmt.Errorf("comment count changed: input has %d, output has %d", len(ca), len(cb))
+	}
+	for i := range ca {
+		if ca[i] != cb[i] {
+			return fmt.Errorf("comment %d/%d changed:\n  input:  %q\n  output: %q", i+1, len(ca), ca[i], cb[i])
+		}
+	}
+	return nil
+}
+
+// comments returns the normalised text of every -- and /* */ comment in src, in
+// order, descending into dollar-quoted bodies.
+func comments(src string) []string {
+	var out []string
+	for _, t := range lexer.Lex(src) {
+		switch t.Kind {
+		case lexer.LineComment, lexer.BlockComment:
+			out = append(out, normComment(t.Text))
+		case lexer.DollarString:
+			if _, inner, _, ok := splitDollarQuote(t.Text); ok {
+				out = append(out, comments(inner)...)
+			}
+		}
+	}
+	return out
+}
+
+// normComment canonicalises a comment token to its content — the ordered list of
+// non-blank text lines, each stripped of surrounding whitespace, joined with LF.
+// Line endings and indentation are layout, not content, so they are discarded;
+// dropping or rewording an actual line of comment text still shows up.
+func normComment(s string) string {
+	s = strings.ReplaceAll(s, "\r\n", "\n")
+	s = strings.ReplaceAll(s, "\r", "\n")
+	var lines []string
+	for _, ln := range strings.Split(s, "\n") {
+		if ln = strings.TrimSpace(ln); ln != "" {
+			lines = append(lines, ln)
+		}
+	}
+	return strings.Join(lines, "\n")
+}
+
+// StructurallyBalanced reports whether a and b have the same delimiter and block
+// nesting profile: identical counts of ( ) [ ] and of the PL/pgSQL block
+// keywords BEGIN / CASE / IF / LOOP / END (and the compound END IF / END LOOP /
+// END CASE), plus an identical running paren/bracket depth trace. Only real code
+// tokens are counted — anything inside a -- or /* */ comment is trivia and is
+// skipped, and string / dollar-quoted literals are opaque single tokens whose
+// contents never register (dollar-quoted bodies are recursed into separately).
+//
+// Given SemanticallyEqual, this is defence in depth: an independent re-count
+// with different code that catches a structural token slipping through a bug in
+// the token-stream comparison (e.g. its dollar-quote or CRLF handling), and it
+// pins down *where* the structure broke.
+func StructurallyBalanced(a, b string) error {
+	pa := structureProfile(a)
+	pb := structureProfile(b)
+	if pa.parenDepthTrace != pb.parenDepthTrace {
+		return fmt.Errorf("parenthesis/bracket nesting changed")
+	}
+	for _, k := range structureKeys {
+		if pa.counts[k] != pb.counts[k] {
+			return fmt.Errorf("structural token %q count changed: input %d, output %d", k, pa.counts[k], pb.counts[k])
+		}
+	}
+	return nil
+}
+
+var structureKeys = []string{"(", ")", "[", "]", "begin", "case", "if", "loop", "end", "end if", "end loop", "end case"}
+
+type structProfile struct {
+	counts map[string]int
+	// parenDepthTrace is the sequence of running ( ) [ ] depths after each
+	// bracket token, joined with commas — a compact fingerprint of the nesting
+	// shape that diverges as soon as an open/close is added, dropped, or moved.
+	parenDepthTrace string
+}
+
+func structureProfile(src string) structProfile {
+	p := structProfile{counts: map[string]int{}}
+	var trace strings.Builder
+	depth := 0
+	toks := significantTokens(src) // trivia (comments/whitespace) already excluded
+	for i := 0; i < len(toks); i++ {
+		t := toks[i]
+		switch t.Kind {
+		case lexer.LParen:
+			p.counts["("]++
+			depth++
+			fmt.Fprintf(&trace, "%d,", depth)
+		case lexer.RParen:
+			p.counts[")"]++
+			depth--
+			fmt.Fprintf(&trace, "%d,", depth)
+		case lexer.LBracket:
+			p.counts["["]++
+			depth++
+			fmt.Fprintf(&trace, "%d,", depth)
+		case lexer.RBracket:
+			p.counts["]"]++
+			depth--
+			fmt.Fprintf(&trace, "%d,", depth)
+		case lexer.Ident:
+			switch lowerASCII(t.Text) {
+			case "begin", "case", "if", "loop":
+				p.counts[lowerASCII(t.Text)]++
+			case "end":
+				p.counts["end"]++
+				if i+1 < len(toks) && toks[i+1].Kind == lexer.Ident {
+					switch lowerASCII(toks[i+1].Text) {
+					case "if":
+						p.counts["end if"]++
+					case "loop":
+						p.counts["end loop"]++
+					case "case":
+						p.counts["end case"]++
+					}
+				}
+			}
+		case lexer.DollarString:
+			if _, inner, _, ok := splitDollarQuote(t.Text); ok {
+				sub := structureProfile(inner)
+				for _, k := range structureKeys {
+					p.counts[k] += sub.counts[k]
+				}
+				trace.WriteString("[" + sub.parenDepthTrace + "]")
+			}
+		}
+	}
+	p.parenDepthTrace = trace.String()
+	return p
+}
+
+// normNL collapses CRLF to LF so string literals compare independent of the
+// source file's line-ending convention.
+func normNL(s string) string { return strings.ReplaceAll(s, "\r\n", "\n") }
+
+// significantTokens lexes src and returns its tokens excluding EOF and trivia
+// (whitespace/comments).
+func significantTokens(src string) []lexer.Token {
+	var out []lexer.Token
+	for _, t := range lexer.Lex(src) {
+		if t.Kind == lexer.EOF || t.IsTrivia() {
+			continue
+		}
+		out = append(out, t)
+	}
+	return out
+}

pkg/format/safety_test.go

@@ -0,0 +1,91 @@
+package format
+
+import (
+	"strings"
+	"testing"
+
+	"git.warky.dev/wdevs/pgtidy/pkg/config"
+)
+
+func TestCommentsPreserved(t *testing.T) {
+	cases := []struct {
+		name    string
+		a, b    string
+		wantErr bool
+	}{
+		{"identical", "select 1; -- note", "select 1;\n-- note", false},
+		{"reindented block comment", "/* a\n   b */ select 1", "  /* a\nb */\nselect 1", false},
+		{"crlf line comment", "-- note\r\nselect 1", "-- note\nselect 1", false},
+		{"dropped comment", "select 1; -- keep me\nselect 2;", "select 1;\nselect 2;", true},
+		{"merged comments", "-- one\n-- two\nselect 1", "-- one -- two\nselect 1", true},
+		{"reworded comment", "-- alpha\nselect 1", "-- beta\nselect 1", true},
+		{"comment inside body preserved", // -- inside a dollar-quoted body
+			"do $$ begin\n-- inner\nperform 1;\nend $$;",
+			"DO\n$$\nbegin\n  -- inner\n  perform 1;\nend\n$$;", false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			err := CommentsPreserved(c.a, c.b)
+			if (err != nil) != c.wantErr {
+				t.Fatalf("CommentsPreserved(%q, %q) err = %v, wantErr %v", c.a, c.b, err, c.wantErr)
+			}
+		})
+	}
+}
+
+func TestCommentsPreservedIgnoresCodeText(t *testing.T) {
+	// A ( ; keyword etc. inside a comment must not be read as code by the check.
+	a := "select 1; -- ( begin case end ) ;\nselect 2;"
+	b := "select 1;\nselect 2;\n-- ( begin case end ) ;"
+	if err := CommentsPreserved(a, b); err != nil {
+		t.Fatalf("comment content that looks like code tripped the check: %v", err)
+	}
+}
+
+func TestStructurallyBalanced(t *testing.T) {
+	if err := StructurallyBalanced("select f((a+b)*c) from t", "select f( ( a + b ) * c )\nfrom t"); err != nil {
+		t.Errorf("whitespace-only reformat flagged: %v", err)
+	}
+	// Delimiters that live inside a comment or a string must not count.
+	if err := StructurallyBalanced("select ')(' as x -- ((((\nfrom t", "select ')('  as x\n-- ((((\nfrom t"); err != nil {
+		t.Errorf("comment/string delimiters counted: %v", err)
+	}
+	if err := StructurallyBalanced("select (a) from t", "select (a from t"); err == nil {
+		t.Errorf("dropped ')' not detected")
+	}
+}
+
+func TestVerifySafeCatchesNonIdempotent(t *testing.T) {
+	src := "create function f() returns void language sql as $$ select 1 $$;"
+	out := format(src)
+	if err := VerifySafe(src, out, config.Default()); err != nil {
+		t.Fatalf("clean format rejected: %v", err)
+	}
+	// A hand-mangled "output" that differs from what the formatter would produce
+	// must be rejected (idempotence gate).
+	if err := VerifySafe(src, out+"\n\n\n", config.Default()); err == nil {
+		t.Errorf("non-idempotent output accepted")
+	}
+}
+
+func TestVerifySafeBlockCommentInBody(t *testing.T) {
+	// Regression: a multi-line /* */ comment inside a PL/pgSQL body was being
+	// re-split and reindented as if its lines were statements.
+	src := "CREATE FUNCTION f() RETURNS void LANGUAGE plpgsql AS $$\n" +
+		"BEGIN\n" +
+		"  /*\n" +
+		"  update t u\n" +
+		"  set x = 1\n" +
+		"  where u.id = 2\n" +
+		"  and u.y = 3;\n" +
+		"  */\n" +
+		"  perform 1;\n" +
+		"END $$;\n"
+	out := format(src)
+	if err := VerifySafe(src, out, config.Default()); err != nil {
+		t.Fatalf("block comment in body mangled: %v", err)
+	}
+	if !strings.Contains(out, "where u.id = 2") {
+		t.Errorf("block comment interior lost a line:\n%s", out)
+	}
+}

pkg/lint/lint.go

@@ -93,6 +93,13 @@ func (e *Engine) Check(sql, file string) ([]diagnostics.Diagnostic, error) {
 		all = append(all, found...)
 	}
 
+	bodies := e.checkBodies(sql, result.Stmts)
+	bodies = append(bodies, e.checkEmbeddedLiterals(sql, result.Stmts)...)
+	for i := range bodies {
+		bodies[i].File = file
+	}
+	all = append(all, bodies...)
+
 	sort.Slice(all, func(i, j int) bool {
 		if all[i].Line != all[j].Line {
 			return all[i].Line < all[j].Line

pkg/lint/lint_test.go

@@ -123,3 +123,54 @@ func TestCustomEngine(t *testing.T) {
 	}
 	_ = diags
 }
+
+func TestPlpgsqlBodyLint(t *testing.T) {
+	src := "create function f() returns void language plpgsql as $$\nbegin\n  perform 1;\n  select * from t;\nend;\n$$;\n" +
+		"create function g() returns void language plpgsql as $$\nbegin\n  selec 1;\nend;\n$$;\n" +
+		"create function p() returns void language plpython3u as $$\nselect * from nothing\n$$;\n" +
+		"do $$ begin select * from t; end $$;\n"
+	diags, err := lint.New().Check(src, "x.sql")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var cor001, pl []diagnostics.Diagnostic
+	for _, d := range diags {
+		switch d.RuleID {
+		case "COR001":
+			cor001 = append(cor001, d)
+		case "PLPGSQL":
+			pl = append(pl, d)
+		}
+	}
+	if len(cor001) != 2 || cor001[0].Line != 4 || cor001[0].Col != 10 || cor001[1].Line != 15 {
+		t.Errorf("COR001 in bodies: %+v", cor001)
+	}
+	for _, d := range cor001 {
+		if d.Fix != nil {
+			t.Errorf("embedded diagnostic must not carry fixes: %+v", d)
+		}
+	}
+	if len(pl) != 1 || pl[0].Line != 9 || pl[0].Col != 3 {
+		t.Errorf("PLPGSQL syntax error: %+v", pl)
+	}
+}
+
+func TestEmbeddedDollarSQLLint(t *testing.T) {
+	src := "create function f() returns void language plpgsql as $$\nbegin\n  execute $q$\n    select * from t\n  $q$;\nend;\n$$;\n" +
+		"create function s() returns int language sql as $$ select * from u $$;\n" +
+		"create function p() returns void language plpython3u as $$\nselect * from nothing\n$$;\n" +
+		"select format($f$select %I from t$f$, 'a');\n"
+	diags, err := lint.New().Check(src, "x.sql")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var got [][2]int
+	for _, d := range diags {
+		if d.RuleID == "COR001" {
+			got = append(got, [2]int{d.Line, d.Col})
+		}
+	}
+	if len(got) != 2 || got[0] != [2]int{4, 12} || got[1] != [2]int{8, 59} {
+		t.Errorf("COR001 positions: %v", got)
+	}
+}

pkg/lint/plpgsql.go

@@ -0,0 +1,332 @@
+package lint
+
+import (
+	"encoding/json"
+	"regexp"
+	"strings"
+
+	pg_query "github.com/pganalyze/pg_query_go/v6"
+	waspg "github.com/wasilibs/go-pgquery"
+
+	"git.warky.dev/wdevs/pgtidy/pkg/diagnostics"
+	"git.warky.dev/wdevs/pgtidy/pkg/lexer"
+	"git.warky.dev/wdevs/pgtidy/pkg/pgast"
+)
+
+// checkBodies lints the PL/pgSQL bodies of CREATE FUNCTION/PROCEDURE and DO
+// statements. The top-level parse only sees a body as an opaque string, so
+// each plpgsql routine is parsed with libpg_query's PL/pgSQL parser: syntax
+// errors are reported as PLPGSQL, and every embedded SQL statement is run
+// through the same rules as top-level SQL, with locations mapped back to the
+// original file. Autofixes are dropped for embedded statements because their
+// byte offsets do not map back reliably.
+func (e *Engine) checkBodies(sql string, stmts []*pg_query.RawStmt) []diagnostics.Diagnostic {
+	var out []diagnostics.Diagnostic
+	for _, raw := range stmts {
+		text, startOff, ok := plpgsqlRoutineText(sql, raw)
+		if !ok {
+			continue
+		}
+		startLine, _ := pgast.LocationToLineCol(sql, startOff)
+		js, err := waspg.ParsePlPgSqlToJSON(text)
+		if err != nil {
+			line, col := startLine, 1
+			// The PL/pgSQL parser gives no usable error position, so locate the
+			// offending token ("syntax error at or near "x"") inside the body.
+			if m := nearTokenRe.FindStringSubmatch(err.Error()); m != nil {
+				if loc := dollarOpenRe.FindStringIndex(text); loc != nil {
+					re := regexp.MustCompile(`(?:^|[^A-Za-z0-9_$])(` + regexp.QuoteMeta(m[1]) + `)(?:[^A-Za-z0-9_$]|$)`)
+					if g := re.FindStringSubmatchIndex(text[loc[1]:]); g != nil {
+						l, c := pgast.LocationToLineCol(text, loc[1]+g[2])
+						line, col = startLine+l-1, c
+						if l == 1 {
+							_, c0 := pgast.LocationToLineCol(sql, startOff)
+							col = c0 + c - 1
+						}
+					}
+				}
+			}
+			out = append(out, diagnostics.Diagnostic{
+				RuleID:   "PLPGSQL",
+				Severity: diagnostics.SeverityError,
+				Message:  err.Error(),
+				Line:     line,
+				Col:      col,
+			})
+			continue
+		}
+		var tree any
+		if json.Unmarshal([]byte(js), &tree) != nil {
+			continue
+		}
+		fileLines := strings.Split(sql, "\n")
+		for _, q := range collectBodyQueries(tree, 0, nil) {
+			out = append(out, e.checkEmbedded(q, startLine, fileLines)...)
+		}
+	}
+	return out
+}
+
+var (
+	nearTokenRe  = regexp.MustCompile(`at or near "([^"]+)"`)
+	dollarOpenRe = regexp.MustCompile(`\$[A-Za-z_0-9]*\$`)
+)
+
+// plpgsqlRoutineText returns the text to hand to the PL/pgSQL parser for a
+// plpgsql CREATE FUNCTION/PROCEDURE or DO statement, and the byte offset in sql
+// that text starts at (so line numbers in the parse result are relative to it).
+func plpgsqlRoutineText(sql string, raw *pg_query.RawStmt) (text string, off int, ok bool) {
+	if raw.Stmt == nil {
+		return "", 0, false
+	}
+	start := int(raw.StmtLocation)
+	end := len(sql)
+	if raw.StmtLen > 0 {
+		end = start + int(raw.StmtLen)
+	}
+	if start < 0 || end > len(sql) || start > end {
+		return "", 0, false
+	}
+	switch n := raw.Stmt.GetNode().(type) {
+	case *pg_query.Node_CreateFunctionStmt:
+		lang := "plpgsql"
+		sawLang := false
+		for _, o := range n.CreateFunctionStmt.Options {
+			d := o.GetDefElem()
+			if d != nil && d.Defname == "language" {
+				lang, sawLang = strings.ToLower(d.Arg.GetString_().GetSval()), true
+			}
+		}
+		if sawLang && lang != "plpgsql" {
+			return "", 0, false
+		}
+		for start < end && strings.ContainsRune(" \t\r\n", rune(sql[start])) {
+			start++
+		}
+		return sql[start:end], start, true
+	case *pg_query.Node_DoStmt:
+		lang, body := "plpgsql", ""
+		for _, a := range n.DoStmt.Args {
+			d := a.GetDefElem()
+			if d == nil {
+				continue
+			}
+			switch d.Defname {
+			case "language":
+				lang = strings.ToLower(d.Arg.GetString_().GetSval())
+			case "as":
+				body = d.Arg.GetString_().GetSval()
+			}
+		}
+		if lang != "plpgsql" || body == "" || strings.Contains(body, "$pgtidy$") {
+			return "", 0, false
+		}
+		// Locate the body text in the source so line numbers map back.
+		i := strings.Index(sql[start:end], body)
+		if i < 0 {
+			return "", 0, false
+		}
+		return "CREATE FUNCTION pgtidy_do() RETURNS void LANGUAGE plpgsql AS $pgtidy$" + body + "$pgtidy$", start + i, true
+	}
+	return "", 0, false
+}
+
+// bodyQuery is one embedded SQL statement found in a PL/pgSQL parse tree.
+type bodyQuery struct {
+	query string
+	line  int // 1-based line, relative to the routine text, of the owning statement
+}
+
+// collectBodyQueries walks the PL/pgSQL JSON tree and returns every embedded
+// full SQL statement (PLpgSQL_expr with parseMode 0), tagged with the line of
+// the nearest enclosing PL/pgSQL statement.
+func collectBodyQueries(n any, line int, acc []bodyQuery) []bodyQuery {
+	switch v := n.(type) {
+	case map[string]any:
+		if ln, ok := v["lineno"].(float64); ok && ln > 0 {
+			line = int(ln)
+		}
+		if ex, ok := v["PLpgSQL_expr"].(map[string]any); ok {
+			if pm, _ := ex["parseMode"].(float64); pm == 0 {
+				if q, ok := ex["query"].(string); ok && strings.TrimSpace(q) != "" {
+					acc = append(acc, bodyQuery{query: q, line: line})
+				}
+			}
+		}
+		for _, c := range v {
+			acc = collectBodyQueries(c, line, acc)
+		}
+	case []any:
+		for _, c := range v {
+			acc = collectBodyQueries(c, line, acc)
+		}
+	}
+	return acc
+}
+
+// checkEmbedded runs the rules over one embedded statement and maps the
+// findings back to file positions.
+func (e *Engine) checkEmbedded(q bodyQuery, routineStartLine int, fileLines []string) []diagnostics.Diagnostic {
+	res, err := pgast.Parse(q.query)
+	if err != nil {
+		return nil // PL/pgSQL already accepted it; variables etc. can trip the SQL parser
+	}
+	fileLine := routineStartLine + q.line - 1
+	// Column of the statement's first token on its file line.
+	base := 0
+	if fileLine-1 < len(fileLines) {
+		first := strings.Fields(q.query)
+		if len(first) > 0 {
+			if i := strings.Index(strings.ToLower(fileLines[fileLine-1]), strings.ToLower(first[0])); i >= 0 {
+				base = i
+			}
+		}
+	}
+	// The query keeps the statement's own leading whitespace out; count it so
+	// columns on its first line line up.
+	lead := len(q.query) - len(strings.TrimLeft(q.query, " \t\r\n"))
+	var out []diagnostics.Diagnostic
+	for _, r := range e.rules {
+		for _, d := range r.Check(res.Stmts, q.query) {
+			d.Fix = nil
+			if d.Line <= 1 {
+				d.Col = base + d.Col - lead
+				if d.Col < 1 {
+					d.Col = 1
+				}
+			}
+			d.Line = fileLine + d.Line - 1
+			out = append(out, d)
+		}
+	}
+	return out
+}
+
+// checkEmbeddedLiterals lints SQL held in dollar-quoted strings: anything whose
+// content starts with SELECT/INSERT/UPDATE/DELETE/WITH (the same "looks like
+// code" test the formatter uses), e.g. EXECUTE $q$ select … $q$ or a
+// LANGUAGE sql function body. Literals are searched recursively, including
+// inside PL/pgSQL bodies. Bodies of non-sql, non-plpgsql routines are opaque
+// and skipped, as are format()-style templates.
+func (e *Engine) checkEmbeddedLiterals(sql string, stmts []*pg_query.RawStmt) []diagnostics.Diagnostic {
+	if !strings.Contains(sql, "$") {
+		return nil
+	}
+	var opaque [][2]int
+	for _, raw := range stmts {
+		if raw.Stmt == nil {
+			continue
+		}
+		lang, has := "", false
+		switch n := raw.Stmt.GetNode().(type) {
+		case *pg_query.Node_CreateFunctionStmt:
+			for _, o := range n.CreateFunctionStmt.Options {
+				if d := o.GetDefElem(); d != nil && d.Defname == "language" {
+					lang, has = strings.ToLower(d.Arg.GetString_().GetSval()), true
+				}
+			}
+		case *pg_query.Node_DoStmt:
+			for _, a := range n.DoStmt.Args {
+				if d := a.GetDefElem(); d != nil && d.Defname == "language" {
+					lang, has = strings.ToLower(d.Arg.GetString_().GetSval()), true
+				}
+			}
+		default:
+			continue
+		}
+		if has && lang != "sql" && lang != "plpgsql" {
+			s := int(raw.StmtLocation)
+			end := len(sql)
+			if raw.StmtLen > 0 {
+				end = s + int(raw.StmtLen)
+			}
+			opaque = append(opaque, [2]int{s, end})
+		}
+	}
+	var out []diagnostics.Diagnostic
+	var walk func(text string, base int)
+	walk = func(text string, base int) {
+		for _, t := range lexer.Lex(text) {
+			if t.Kind != lexer.DollarString {
+				continue
+			}
+			abs := base + t.Off
+			skip := false
+			for _, r := range opaque {
+				if abs >= r[0] && abs < r[1] {
+					skip = true
+				}
+			}
+			if skip {
+				continue
+			}
+			inner, innerOff, ok := dollarInner(t.Text)
+			if !ok {
+				continue
+			}
+			if looksLikeSQL(inner) && !formatPlaceholderRe.MatchString(inner) {
+				out = append(out, e.checkLiteral(sql, inner, abs+innerOff)...)
+			}
+			walk(inner, abs+innerOff)
+		}
+	}
+	walk(sql, 0)
+	return out
+}
+
+var formatPlaceholderRe = regexp.MustCompile(`%(\d+\$)?-?\d*[sILlx]`)
+
+// dollarInner splits a dollar-quoted literal into its content and the content's
+// offset within the literal.
+func dollarInner(lit string) (inner string, off int, ok bool) {
+	if len(lit) < 4 || lit[0] != '$' {
+		return "", 0, false
+	}
+	e := strings.IndexByte(lit[1:], '$')
+	if e < 0 {
+		return "", 0, false
+	}
+	tag := lit[:e+2]
+	if !strings.HasSuffix(lit, tag) || len(lit) < 2*len(tag) {
+		return "", 0, false
+	}
+	return lit[len(tag) : len(lit)-len(tag)], len(tag), true
+}
+
+func looksLikeSQL(inner string) bool {
+	for _, t := range lexer.Lex(inner) {
+		if t.IsTrivia() || t.Kind == lexer.EOF {
+			continue
+		}
+		if t.Kind != lexer.Ident {
+			return false
+		}
+		switch strings.ToLower(t.Text) {
+		case "select", "insert", "update", "delete", "with":
+			return true
+		}
+		return false
+	}
+	return false
+}
+
+// checkLiteral lints one SQL string whose first byte sits at file offset off.
+func (e *Engine) checkLiteral(sql, inner string, off int) []diagnostics.Diagnostic {
+	res, err := pgast.Parse(inner)
+	if err != nil {
+		return nil
+	}
+	startLine, startCol := pgast.LocationToLineCol(sql, off)
+	var out []diagnostics.Diagnostic
+	for _, r := range e.rules {
+		for _, d := range r.Check(res.Stmts, inner) {
+			d.Fix = nil
+			if d.Line <= 1 {
+				d.Col = startCol + d.Col - 1
+			}
+			d.Line = startLine + d.Line - 1
+			out = append(out, d)
+		}
+	}
+	return out
+}

pkg/lsp/server.go

@@ -2,7 +2,9 @@
 //
 // The server communicates over stdio using JSON-RPC 2.0 with Content-Length
 // framing. It provides:
-//   - textDocument/formatting — full-document formatting via pkg/format
+//   - textDocument/formatting, rangeFormatting, willSaveWaitUntil — formatting via pkg/format
+//   - textDocument/hover — rule ID + message of the diagnostic under the cursor
+//   - textDocument/documentSymbol — CREATE FUNCTION / PROCEDURE outline
 //   - textDocument/publishDiagnostics — lint findings via pkg/lint, sent on
 //     every didOpen/didChange notification
 package lsp
@@ -17,8 +19,10 @@ import (
 	"strings"
 
 	"git.warky.dev/wdevs/pgtidy/pkg/config"
+	"git.warky.dev/wdevs/pgtidy/pkg/cst"
 	"git.warky.dev/wdevs/pgtidy/pkg/diagnostics"
 	"git.warky.dev/wdevs/pgtidy/pkg/format"
+	"git.warky.dev/wdevs/pgtidy/pkg/lexer"
 	"git.warky.dev/wdevs/pgtidy/pkg/lint"
 	"git.warky.dev/wdevs/pgtidy/pkg/parser"
 )
@@ -30,6 +34,7 @@ func Serve(ctx context.Context, r io.Reader, w io.Writer, startDir string) error
 	cfg, _ := config.Load(startDir)
 	srv := &server{
 		docs:  make(map[string]string),
+		diags: make(map[string][]lspDiagnostic),
 		fixes: make(map[string][]diagnostics.Diagnostic),
 		cfg:   cfg,
 		w:     w,
@@ -39,6 +44,7 @@ func Serve(ctx context.Context, r io.Reader, w io.Writer, startDir string) error
 
 type server struct {
 	docs  map[string]string                   // URI → current text
+	diags map[string][]lspDiagnostic          // URI → last published diagnostics
 	fixes map[string][]diagnostics.Diagnostic // URI → diagnostics that have fixes
 	cfg   config.Style
 	w     io.Writer
@@ -76,10 +82,12 @@ func (s *server) handle(raw []byte) bool {
 	case "initialize":
 		s.reply(req.ID, initResult{
 			Capabilities: serverCaps{
-				TextDocumentSync:                1, // full sync
+				TextDocumentSync:                syncOptions{OpenClose: true, Change: 1, WillSaveWaitUntil: true}, // full sync
 				DocumentFormattingProvider:      true,
 				DocumentRangeFormattingProvider: true,
 				CodeActionProvider:              true,
+				HoverProvider:                   true,
+				DocumentSymbolProvider:          true,
 			},
 		})
 	case "initialized": // no-op notification
@@ -89,12 +97,12 @@ func (s *server) handle(raw []byte) bool {
 		return true
 	case "textDocument/didOpen":
 		var p didOpenParams
-		json.Unmarshal(req.Params, &p)
+		_ = json.Unmarshal(req.Params, &p)
 		s.docs[p.TextDocument.URI] = p.TextDocument.Text
 		s.pushDiagnostics(p.TextDocument.URI, p.TextDocument.Text)
 	case "textDocument/didChange":
 		var p didChangeParams
-		json.Unmarshal(req.Params, &p)
+		_ = json.Unmarshal(req.Params, &p)
 		if len(p.ContentChanges) > 0 {
 			text := p.ContentChanges[len(p.ContentChanges)-1].Text
 			s.docs[p.TextDocument.URI] = text
@@ -104,16 +112,28 @@ func (s *server) handle(raw []byte) bool {
 		var p struct {
 			TextDocument textDocID `json:"textDocument"`
 		}
-		json.Unmarshal(req.Params, &p)
+		_ = json.Unmarshal(req.Params, &p)
 		delete(s.docs, p.TextDocument.URI)
 		delete(s.fixes, p.TextDocument.URI)
 		s.notify("textDocument/publishDiagnostics", publishDiagnosticsParams{
 			URI:         p.TextDocument.URI,
 			Diagnostics: []lspDiagnostic{},
 		})
+	case "textDocument/willSaveWaitUntil":
+		var p formattingParams // only textDocument is used
+		_ = json.Unmarshal(req.Params, &p)
+		s.reply(req.ID, s.fullFormatEdits(p.TextDocument.URI))
+	case "textDocument/hover":
+		var p positionParams
+		_ = json.Unmarshal(req.Params, &p)
+		s.reply(req.ID, s.hover(p.TextDocument.URI, p.Position))
+	case "textDocument/documentSymbol":
+		var p formattingParams
+		_ = json.Unmarshal(req.Params, &p)
+		s.reply(req.ID, s.documentSymbols(p.TextDocument.URI))
 	case "textDocument/formatting":
 		var p formattingParams
-		json.Unmarshal(req.Params, &p)
+		_ = json.Unmarshal(req.Params, &p)
 		text, ok := s.docs[p.TextDocument.URI]
 		if !ok {
 			s.reply(req.ID, []textEdit{})
@@ -124,10 +144,14 @@ func (s *server) handle(raw []byte) bool {
 			s.reply(req.ID, []textEdit{})
 			return false
 		}
+		if err := format.VerifySafe(text, formatted, s.cfg); err != nil {
+			s.reply(req.ID, []textEdit{})
+			return false
+		}
 		s.reply(req.ID, []textEdit{fullReplace(text, formatted)})
 	case "textDocument/rangeFormatting":
 		var p rangeFormattingParams
-		json.Unmarshal(req.Params, &p)
+		_ = json.Unmarshal(req.Params, &p)
 		text, ok := s.docs[p.TextDocument.URI]
 		if !ok {
 			s.reply(req.ID, []textEdit{})
@@ -136,7 +160,7 @@ func (s *server) handle(raw []byte) bool {
 		s.reply(req.ID, s.rangeFormat(text, p.Range))
 	case "textDocument/codeAction":
 		var p codeActionParams
-		json.Unmarshal(req.Params, &p)
+		_ = json.Unmarshal(req.Params, &p)
 		s.handleCodeAction(req.ID, p)
 	case "$/cancelRequest": // ignore
 	default:
@@ -163,7 +187,7 @@ func (s *server) pushDiagnostics(uri, text string) {
 			col--
 		}
 		lspD := lspDiagnostic{
-			Range:    lspRange{Start: position{line, col}, End: position{line, col + 1}},
+			Range:    lspRange{Start: position{line, col}, End: position{line, col + diagSpan(text, line, col)}},
 			Severity: severityCode(d.Severity),
 			Code:     d.RuleID,
 			Source:   "pgtidy",
@@ -175,6 +199,7 @@ func (s *server) pushDiagnostics(uri, text string) {
 		}
 	}
 	s.fixes[uri] = fixable
+	s.diags[uri] = out
 	s.notify("textDocument/publishDiagnostics", publishDiagnosticsParams{
 		URI:         uri,
 		Diagnostics: out,
@@ -224,6 +249,9 @@ func (s *server) rangeFormat(text string, r lspRange) []textEdit {
 	if formatted == text {
 		return nil
 	}
+	if err := format.VerifySafe(text, formatted, s.cfg); err != nil {
+		return nil
+	}
 
 	// Split both versions into lines, keeping the trailing newline attached to
 	// each element so that joining them reconstructs the original string.
@@ -360,7 +388,7 @@ func (s *server) send(v interface{}) {
 	if err != nil {
 		return
 	}
-	fmt.Fprintf(s.w, "Content-Length: %d\r\n\r\n", len(data))
+	_, _ = fmt.Fprintf(s.w, "Content-Length: %d\r\n\r\n", len(data))
 	s.w.Write(data) //nolint:errcheck
 }
 
@@ -425,10 +453,18 @@ type initResult struct {
 }
 
 type serverCaps struct {
-	TextDocumentSync                int  `json:"textDocumentSync"`
-	DocumentFormattingProvider      bool `json:"documentFormattingProvider"`
-	DocumentRangeFormattingProvider bool `json:"documentRangeFormattingProvider"`
-	CodeActionProvider              bool `json:"codeActionProvider"`
+	TextDocumentSync                syncOptions `json:"textDocumentSync"`
+	DocumentFormattingProvider      bool        `json:"documentFormattingProvider"`
+	DocumentRangeFormattingProvider bool        `json:"documentRangeFormattingProvider"`
+	CodeActionProvider              bool        `json:"codeActionProvider"`
+	HoverProvider                   bool        `json:"hoverProvider"`
+	DocumentSymbolProvider          bool        `json:"documentSymbolProvider"`
+}
+
+type syncOptions struct {
+	OpenClose         bool `json:"openClose"`
+	Change            int  `json:"change"` // 1 = full
+	WillSaveWaitUntil bool `json:"willSaveWaitUntil"`
 }
 
 type textDocItem struct {
@@ -502,3 +538,130 @@ type codeAction struct {
 	Kind  string         `json:"kind,omitempty"`
 	Edit  *workspaceEdit `json:"edit,omitempty"`
 }
+
+type positionParams struct {
+	TextDocument textDocID `json:"textDocument"`
+	Position     position  `json:"position"`
+}
+
+type hoverResult struct {
+	Contents markupContent `json:"contents"`
+	Range    lspRange      `json:"range"`
+}
+
+type markupContent struct {
+	Kind  string `json:"kind"`
+	Value string `json:"value"`
+}
+
+type documentSymbol struct {
+	Name           string   `json:"name"`
+	Detail         string   `json:"detail,omitempty"`
+	Kind           int      `json:"kind"`
+	Range          lspRange `json:"range"`
+	SelectionRange lspRange `json:"selectionRange"`
+}
+
+const symbolKindFunction = 12
+
+// fullFormatEdits returns the whole-document formatting edit for uri, or an
+// empty list when the document is unknown, already formatted, or the result
+// fails the safety gate.
+func (s *server) fullFormatEdits(uri string) []textEdit {
+	text, ok := s.docs[uri]
+	if !ok {
+		return []textEdit{}
+	}
+	formatted := format.File(parser.Parse(text), s.cfg)
+	if formatted == text || format.VerifySafe(text, formatted, s.cfg) != nil {
+		return []textEdit{}
+	}
+	return []textEdit{fullReplace(text, formatted)}
+}
+
+// diagSpan returns the width in characters of the token starting at the given
+// (0-based) line/col, so a diagnostic highlights the offending token rather
+// than a single caret. Falls back to 1.
+func diagSpan(text string, line, col uint32) uint32 {
+	off := positionToOffset(text, position{line, col})
+	for _, t := range lexer.Lex(text) {
+		if t.Off == off && !t.IsTrivia() && t.Kind != lexer.EOF && !strings.Contains(t.Text, "\n") && len(t.Text) > 0 {
+			return uint32(len(t.Text))
+		}
+		if t.Off > off {
+			break
+		}
+	}
+	return 1
+}
+
+// positionToOffset converts an LSP position to a byte offset in text.
+func positionToOffset(text string, p position) int {
+	off := 0
+	for line := uint32(0); line < p.Line; line++ {
+		i := strings.IndexByte(text[off:], '\n')
+		if i < 0 {
+			return len(text)
+		}
+		off += i + 1
+	}
+	off += int(p.Character)
+	if off > len(text) {
+		off = len(text)
+	}
+	return off
+}
+
+// hover describes the diagnostic under the cursor, if any.
+func (s *server) hover(uri string, p position) *hoverResult {
+	for _, d := range s.diags[uri] {
+		if !rangesOverlap(d.Range.Start, d.Range.End, p, p) || p == d.Range.End {
+			continue
+		}
+		return &hoverResult{
+			Contents: markupContent{Kind: "markdown", Value: "**" + d.Code + "**\n\n" + d.Message},
+			Range:    d.Range,
+		}
+	}
+	return nil
+}
+
+// documentSymbols lists the CREATE FUNCTION / PROCEDURE statements in the document.
+func (s *server) documentSymbols(uri string) []documentSymbol {
+	text, ok := s.docs[uri]
+	if !ok {
+		return []documentSymbol{}
+	}
+	out := []documentSymbol{}
+	for _, item := range parser.Parse(text).Items {
+		cf, ok := item.(*cst.CreateFunction)
+		if !ok || len(cf.Name) == 0 {
+			continue
+		}
+		all := cst.Tokens(cf)
+		last := all[len(all)-1].Tok
+		nameFirst, nameLast := cf.Name[0].Tok, cf.Name[len(cf.Name)-1].Tok
+		var name strings.Builder
+		for _, t := range cf.Name {
+			name.WriteString(t.Tok.Text)
+		}
+		detail := "function"
+		if cf.IsProcedure() {
+			detail = "procedure"
+		}
+		out = append(out, documentSymbol{
+			Name:   name.String(),
+			Detail: detail,
+			Kind:   symbolKindFunction,
+			Range: lspRange{
+				Start: offsetToPosition(text, all[0].Tok.Off),
+				End:   offsetToPosition(text, last.Off+len(last.Text)),
+			},
+			SelectionRange: lspRange{
+				Start: offsetToPosition(text, nameFirst.Off),
+				End:   offsetToPosition(text, nameLast.Off+len(nameLast.Text)),
+			},
+		})
+	}
+	return out
+}

pkg/lsp/server_test.go

@@ -51,7 +51,7 @@ func readResp(t *testing.T, buf *bytes.Buffer) map[string]interface{} {
 		}
 		lenStr := string(data[idx+16 : idx+eol])
 		var n int
-		fmt.Sscanf(lenStr, "%d", &n)
+		_, _ = fmt.Sscanf(lenStr, "%d", &n)
 		sep := bytes.Index(data, []byte("\r\n\r\n"))
 		if sep < 0 || len(data) < sep+4+n {
 			time.Sleep(5 * time.Millisecond)
@@ -60,7 +60,7 @@ func readResp(t *testing.T, buf *bytes.Buffer) map[string]interface{} {
 		body := data[sep+4 : sep+4+n]
 		buf.Next(sep + 4 + n)
 		var result map[string]interface{}
-		json.Unmarshal(body, &result)
+		_ = json.Unmarshal(body, &result)
 		return result
 	}
 	t.Fatal("timeout waiting for response")
@@ -268,3 +268,90 @@ func TestDidClose_ClearsDiagnostics(t *testing.T) {
 		t.Errorf("expected empty diagnostics after didClose, got %d", len(lastDiags))
 	}
 }
+
+// request opens text at uri, sends one request, and returns its response
+// (skipping the initialize response and any notifications).
+func request(t *testing.T, text, method string, params map[string]interface{}) map[string]interface{} {
+	t.Helper()
+	uri := "file:///t.sql"
+	params["textDocument"] = map[string]interface{}{"uri": uri}
+	var input []byte
+	input = append(input, frame(1, "initialize", map[string]interface{}{})...)
+	input = append(input, notifFrame("initialized", nil)...)
+	input = append(input, notifFrame("textDocument/didOpen", map[string]interface{}{
+		"textDocument": map[string]interface{}{"uri": uri, "languageId": "sql", "version": 1, "text": text},
+	})...)
+	input = append(input, frame(2, method, params)...)
+	input = append(input, frame(3, "shutdown", nil)...)
+	input = append(input, notifFrame("exit", nil)...)
+	out := runServer(t, input)
+	for i := 0; i < 10; i++ {
+		resp := readResp(t, out)
+		if id, ok := resp["id"]; ok && id.(float64) == 2 {
+			return resp
+		}
+	}
+	t.Fatalf("no response to %s", method)
+	return nil
+}
+
+func TestDocumentSymbol(t *testing.T) {
+	src := "create function public.foo(a int) returns void language plpgsql as $$ begin end $$;\n\ncreate procedure bar() language plpgsql as $$ begin end $$;\n"
+	resp := request(t, src, "textDocument/documentSymbol", map[string]interface{}{})
+	syms := resp["result"].([]interface{})
+	if len(syms) != 2 {
+		t.Fatalf("want 2 symbols, got %v", syms)
+	}
+	first := syms[0].(map[string]interface{})
+	if first["name"] != "public.foo" || first["detail"] != "function" {
+		t.Errorf("first symbol: %v", first)
+	}
+	second := syms[1].(map[string]interface{})
+	if second["name"] != "bar" || second["detail"] != "procedure" {
+		t.Errorf("second symbol: %v", second)
+	}
+	line := second["range"].(map[string]interface{})["start"].(map[string]interface{})["line"].(float64)
+	if line != 2 {
+		t.Errorf("bar should start on line 2, got %v", line)
+	}
+}
+
+func TestHoverShowsDiagnostic(t *testing.T) {
+	resp := request(t, "select * from t;", "textDocument/hover", map[string]interface{}{
+		"position": map[string]interface{}{"line": 0, "character": 7},
+	})
+	res, ok := resp["result"].(map[string]interface{})
+	if !ok {
+		t.Fatalf("expected hover result, got %v", resp["result"])
+	}
+	val := res["contents"].(map[string]interface{})["value"].(string)
+	if !strings.Contains(val, "COR001") {
+		t.Errorf("hover should name the rule, got %q", val)
+	}
+	resp = request(t, "select * from t;", "textDocument/hover", map[string]interface{}{
+		"position": map[string]interface{}{"line": 0, "character": 14},
+	})
+	if resp["result"] != nil {
+		t.Errorf("no diagnostic at col 14, want null, got %v", resp["result"])
+	}
+}
+
+func TestWillSaveWaitUntilFormats(t *testing.T) {
+	resp := request(t, "select a from t", "textDocument/willSaveWaitUntil", map[string]interface{}{"reason": 1})
+	edits := resp["result"].([]interface{})
+	if len(edits) != 1 || !strings.Contains(edits[0].(map[string]interface{})["newText"].(string), "SELECT a") {
+		t.Errorf("expected a formatting edit, got %v", edits)
+	}
+}
+
+func TestDiagSpanCoversToken(t *testing.T) {
+	if got := diagSpan("select * from t;", 0, 7); got != 1 {
+		t.Errorf("'*' span = %d, want 1", got)
+	}
+	if got := diagSpan("select foo from t;", 0, 7); got != 3 {
+		t.Errorf("'foo' span = %d, want 3", got)
+	}
+	if got := diagSpan("select foo from t;", 0, 40); got != 1 {
+		t.Errorf("out-of-range span = %d, want 1", got)
+	}
+}

pkg/parser/parser.go

@@ -88,7 +88,7 @@ func parseCreateFunction(stmt []cst.Tok) (*cst.CreateFunction, bool) {
 	if i+1 < len(stmt) && stmt[i].Is("or") && stmt[i+1].Is("replace") {
 		i += 2
 	}
-	if i >= len(stmt) || !(stmt[i].Is("function") || stmt[i].Is("procedure")) {
+	if i >= len(stmt) || (!stmt[i].Is("function") && !stmt[i].Is("procedure")) {
 		return nil, false
 	}
 	i++

pkg/pgast/pgast.go

@@ -41,7 +41,7 @@ func FirstTokenOffset(sql string, start int) int {
 			}
 		case i+1 < n && sql[i] == '/' && sql[i+1] == '*':
 			i += 2
-			for i+1 < n && !(sql[i] == '*' && sql[i+1] == '/') {
+			for i+1 < n && (sql[i] != '*' || sql[i+1] != '/') {
 				i++
 			}
 			if i+1 < n {

pkg/updatecheck/updatecheck.go

@@ -0,0 +1,115 @@
+// Package updatecheck looks up the latest PgTidy release on the project's
+// Gitea instance and compares it against the running version.
+package updatecheck
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// DefaultAPIURL is the Gitea endpoint that returns the latest release.
+const DefaultAPIURL = "https://git.warky.dev/api/v1/repos/wdevs/pgtidy/releases/latest"
+
+// Asset is a downloadable file attached to a release.
+type Asset struct {
+	Name string `json:"name"`
+	URL  string `json:"browser_download_url"`
+}
+
+// Release is the subset of the Gitea release payload that is needed.
+type Release struct {
+	Tag    string  `json:"tag_name"`
+	URL    string  `json:"html_url"`
+	Assets []Asset `json:"assets"`
+}
+
+// Latest fetches the latest release from apiURL. A nil client uses a client
+// with a 10 second timeout.
+func Latest(ctx context.Context, client *http.Client, apiURL string) (*Release, error) {
+	if client == nil {
+		client = &http.Client{Timeout: 10 * time.Second}
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, apiURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("checking for updates: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("checking for updates: unexpected status %s", resp.Status)
+	}
+
+	var rel Release
+	if err := json.NewDecoder(resp.Body).Decode(&rel); err != nil {
+		return nil, fmt.Errorf("decoding release: %w", err)
+	}
+	if rel.Tag == "" {
+		return nil, fmt.Errorf("release has no tag")
+	}
+	return &rel, nil
+}
+
+// FindAsset returns the first asset with the given name.
+func (r *Release) FindAsset(name string) (Asset, bool) {
+	for _, a := range r.Assets {
+		if a.Name == name {
+			return a, true
+		}
+	}
+	return Asset{}, false
+}
+
+// IsNewer reports whether latest is a higher version than current. Versions
+// that are not dotted numbers (for example "dev" or a commit hash) are never
+// considered outdated, so development builds are not nagged.
+func IsNewer(current, latest string) bool {
+	cur, ok := parseVersion(current)
+	if !ok {
+		return false
+	}
+	lat, ok := parseVersion(latest)
+	if !ok {
+		return false
+	}
+	for i := range cur {
+		if lat[i] != cur[i] {
+			return lat[i] > cur[i]
+		}
+	}
+	return false
+}
+
+// parseVersion parses "v1.2.3" style versions into three numeric parts.
+// Missing parts are zero; any pre-release or build suffix is ignored.
+func parseVersion(v string) ([3]int, bool) {
+	var out [3]int
+	v = strings.TrimPrefix(strings.TrimSpace(v), "v")
+	if i := strings.IndexAny(v, "-+ "); i >= 0 {
+		v = v[:i]
+	}
+	if v == "" {
+		return out, false
+	}
+	parts := strings.Split(v, ".")
+	if len(parts) > 3 {
+		return out, false
+	}
+	for i, p := range parts {
+		n, err := strconv.Atoi(p)
+		if err != nil || n < 0 {
+			return out, false
+		}
+		out[i] = n
+	}
+	return out, true
+}

pkg/updatecheck/updatecheck_test.go

@@ -0,0 +1,94 @@
+package updatecheck
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestIsNewer(t *testing.T) {
+	tests := []struct {
+		name            string
+		current, latest string
+		want            bool
+	}{
+		{"patch bump", "v1.0.85", "v1.0.86", true},
+		{"minor beats patch", "v1.0.99", "v1.1.0", true},
+		{"major bump", "v1.9.9", "v2.0.0", true},
+		{"numeric not lexical", "v1.0.9", "v1.0.10", true},
+		{"same", "v1.0.85", "v1.0.85", false},
+		{"older latest", "v1.0.86", "v1.0.85", false},
+		{"no v prefix", "1.0.1", "v1.0.2", true},
+		{"short version", "v1.0", "v1.0.1", true},
+		{"prerelease suffix ignored", "v1.0.1-rc1", "v1.0.2", true},
+		{"dev build", "dev", "v9.9.9", false},
+		{"commit hash", "abc1234", "v9.9.9", false},
+		{"empty current", "", "v1.0.0", false},
+		{"bad latest", "v1.0.0", "latest", false},
+		{"too many parts", "v1.0.0.0", "v1.0.1", false},
+		{"negative", "v1.-1.0", "v1.0.0", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := IsNewer(tt.current, tt.latest); got != tt.want {
+				t.Errorf("IsNewer(%q,%q) = %v, want %v", tt.current, tt.latest, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestLatest(t *testing.T) {
+	tests := []struct {
+		name    string
+		status  int
+		body    string
+		wantTag string
+		wantErr bool
+	}{
+		{"ok", 200, `{"tag_name":"v1.2.3","html_url":"https://x/r","assets":[{"name":"a.exe","browser_download_url":"https://x/a.exe"}]}`, "v1.2.3", false},
+		{"not found", 404, `{}`, "", true},
+		{"bad json", 200, `{`, "", true},
+		{"missing tag", 200, `{"html_url":"u"}`, "", true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(tt.status)
+				_, _ = w.Write([]byte(tt.body))
+			}))
+			defer srv.Close()
+
+			rel, err := Latest(context.Background(), nil, srv.URL)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("err = %v, wantErr %v", err, tt.wantErr)
+			}
+			if err == nil {
+				if rel.Tag != tt.wantTag {
+					t.Errorf("tag = %q", rel.Tag)
+				}
+				if a, ok := rel.FindAsset("a.exe"); !ok || a.URL != "https://x/a.exe" {
+					t.Errorf("asset = %+v %v", a, ok)
+				}
+				if _, ok := rel.FindAsset("missing"); ok {
+					t.Error("unexpected asset")
+				}
+			}
+		})
+	}
+}
+
+func TestLatestUnreachable(t *testing.T) {
+	srv := httptest.NewServer(http.NotFoundHandler())
+	url := srv.URL
+	srv.Close()
+	if _, err := Latest(context.Background(), nil, url); err == nil {
+		t.Error("expected error for unreachable server")
+	}
+}
+
+func TestLatestBadURL(t *testing.T) {
+	if _, err := Latest(context.Background(), nil, "://bad"); err == nil {
+		t.Error("expected error for bad URL")
+	}
+}

testdata/corpus/5791089_create_core.action_init.pgsql

@@ -0,0 +1,797 @@
+--select * from dropall('action_init','core');
+CREATE OR REPLACE FUNCTION core.action_init(
+  p_table text
+, p_rid integer
+, INOUT p_parms jsonb default json_build_object()
+, OUT p_retval integer
+, OUT p_errmsg text
+)
+  LANGUAGE plpgsql
+  VOLATILE
+  SECURITY DEFINER
+AS
+$$
+DECLARE
+  --Error Handling--
+  m_funcname             text = 'core.action_init';
+  m_errmsg               text;
+  m_errcontext           text;
+  m_errdetail            text;
+  m_errhint              text;
+  m_errstate             text;
+  m_retval               integer;
+  --Error Handling--
+  --r_workflow core.workflowitem%rowtype;
+  r_tasklist             core.tasklist%rowtype;
+  r_taskitem             core.taskitem%rowtype;
+  r_taskitem_prev        core.taskitem%rowtype;
+  r_taskitem_parent      core.taskitem%rowtype;
+  r_mastertaskitem       core.mastertaskitem%rowtype;
+  r_mastertaskitemevent  core.mastertaskitemevent%rowtype;
+  r_taskitemevent        core.taskitemevent%rowtype;
+  r_taskitemevent_parent core.taskitemevent%rowtype;
+  m_rid_hub_user         integer;
+  m_rid_hub_payload      integer;
+  m_temp_rid             integer;
+  m_temp_rid_list        integer[];
+  j_results              jsonb;
+BEGIN
+  p_retval = 0;
+  p_errmsg = '';
+  m_rid_hub_user = _bv(core.f_get_user_hub_rid(), (
+    select hub.rid_hub
+    from core.hub
+    where hub.hubtype = 'program'
+    limit 1
+    ));
+  m_rid_hub_payload = _try_integers(p_parms ->> 'rid_hub', p_parms ->> 'rid_hub_payload');
+
+  if nv(p_rid) = 0
+  then
+    raise 'Invalid or no p_rid';
+  end if;
+
+  ---select * from meta.table_prefix t where t.tablename = 'mastertaskitemevent'
+  if p_table::citext in ('taskitemevent', 'tiv')
+  then
+    raise exception 'Action Init is not allowed on task item events. Please use the mastertaskitemevent or taskitem as entry point.';
+
+  elsif p_table::citext in ('mastertaskitemevent', 'mtev')
+  then
+    select *
+    from core.mastertaskitemevent mtev
+    where mtev.rid_mastertaskitemevent = p_rid
+    into r_mastertaskitemevent;
+
+    if r_mastertaskitemevent.inactive > 0
+    then
+      raise exception 'The template task item event is inactive. rid_mastertaskitemevent = %',r_mastertaskitemevent.rid_mastertaskitemevent;
+    end if;
+
+    select ttie.*
+    from core.taskitemevent ttie
+    where ttie.rid_taskitemevent = _try_integer(p_parms ->> 'parent_rid_taskitemevent', 0)
+    into r_taskitemevent_parent;
+
+    -- try to get the given task item
+    select *
+    from core.taskitem ti
+    where
+        ti.rid_taskitem = _try_integer(p_parms ->> 'rid_taskitem', -1)
+    and ti.rid_mastertaskitem = r_mastertaskitemevent.rid_mastertaskitem
+    into r_taskitem;
+
+    if _try_integer(p_parms ->> 'parent_rid_taskitem', 0) > 0
+    then
+      select *
+      from core.taskitem ti
+      where ti.rid_taskitem = _try_integer(p_parms ->> 'parent_rid_taskitem', 0)
+      into r_taskitem_parent;
+    end if;
+
+    select *
+    from core.tasklist tl
+    where tl.rid_tasklist = r_taskitem.rid_tasklist
+    into r_tasklist;
+
+    --     perform log_event(m_funcname,format(E'Action Init via %s=%s Item:%s(%s rid_taskitem:%s[%s] < %s %s[%s]) Event:%s(%s[%s],parent_rid_taskitemevent:%s[%s])
+--     p_parms:%s',p_table,p_rid
+--       , r_mastertaskitem.description, r_mastertaskitem.rid_mastertaskitem,r_taskitem.rid_taskitem
+--       ,r_taskitem.status, r_taskitem_parent.description
+--       ,r_taskitem_parent.rid_taskitem,r_taskitem_parent.status
+--       , r_mastertaskitemevent.description,r_mastertaskitemevent.status, r_mastertaskitemevent.rid_mastertaskitemevent
+--       , r_taskitemevent_parent.rid_taskitemevent, r_taskitemevent_parent.status
+--       , p_parms),bt_enum('eventlog','local notice'));
+
+--    raise 'p_rid=%=% r_taskitem.status =% r_taskitem_parent.status=%,% r_mastertaskitemevent.status=% pps=%'
+--      ,p_table,p_rid, r_taskitem.status,r_taskitem_parent.description,r_taskitem_parent.status, r_mastertaskitemevent.status
+--     ,(select ti.status
+--       from core.taskitem ti
+--       where ti.rid_taskitem = r_taskitem_parent.rid_taskitem_parentaction);
+
+--     if  r_mastertaskitemevent.status =  core._enumi('eventstatus','complete')
+--       and r_taskitem_parent.rid_taskitem > 0
+--       and exists (
+--         select 1
+--         from core.taskitem ti
+--         where ti.rid_taskitem = r_taskitem_parent.rid_taskitem_parentaction
+--           and ti.status in (core._enumi('eventstatus','complete')
+--           ,core._enumi('eventstatus','error')
+--           ,core._enumi('eventstatus','retry'))
+--         )
+--     then
+--       r_taskitem = null;
+--
+--     end if;
+
+    --If there is no action, try getting the same open one of this type for this hub
+    if nv(r_taskitem.rid_taskitem) = 0
+    then
+      --Create item linked to task for this hub if not found
+
+      select r.p_retval, r.p_errmsg, r.p_a_rid_taskitem, r.p_parameters
+      from core.taskitem_get_or_prime(_jsonb_object_cat(
+          _jsonb_object_cat(r_taskitem_parent.jsonvalue
+            , jsonb_build_object('AOP', null, 'controls', null, 'rid_taskitem', null, 'message', null, 'subject', null,
+                                 'alerttype', null)
+          )
+        , p_parms
+        , jsonb_build_object(
+              'rid_mastertaskitem', r_mastertaskitemevent.rid_mastertaskitem
+            , 'rid_mastertaskitemevent', r_mastertaskitemevent.rid_mastertaskitemevent
+            , 'parent_rid_taskitemevent', r_taskitemevent_parent.rid_taskitemevent
+            , 'parent_rid_taskitem', _bv(r_taskitem_parent.rid_taskitem
+                , _try_integer(p_parms ->> 'parent_rid_taskitem', 0)
+                                     )
+            , 'rid_tasklist_prev', _try_integers(p_parms ->> 'rid_tasklist_prev', p_parms ->> 'rid_tasklist'
+                , r_tasklist.rid_tasklist::text, r_taskitem.rid_tasklist::text)
+            , 'rid_taskitem_parentaction', p_parms -> 'rid_taskitem_parentaction'
+            --,'rid_tasklist', r_tasklist.rid_tasklist
+          )
+                                      )) r
+      into m_retval,m_errmsg,m_temp_rid_list,j_results;
+
+      if m_retval > 0
+      then
+        raise exception '%',m_errmsg using hint = 'in taskitem_get_or_prime 2';
+      end if;
+
+    else
+      m_temp_rid_list = array [r_taskitem.rid_taskitem]::integer[];
+    end if;
+
+
+    p_parms = jsonb_build_object();
+
+    for m_temp_rid in (
+      select u.n
+      from unnest(m_temp_rid_list) u(n)
+      )
+      loop
+        select *
+        from core.taskitem ti
+        where ti.rid_taskitem = m_temp_rid
+        into r_taskitem;
+
+        select *
+        from core.tasklist tl
+        where tl.rid_tasklist = r_taskitem.rid_tasklist
+        into r_tasklist;
+
+        if nv(r_tasklist.rid_tasklist) = 0
+        then
+          select *
+          from core.tasklist tl
+          where
+             tl.rid_tasklist = r_taskitem.rid_tasklist
+          or nv(r_taskitem.rid_tasklist) = 0
+               and
+             (tl.rid_hub = m_rid_hub_payload
+               or tl.rid_hub = r_taskitem_parent.rid_hub
+               )
+               and tl.rid_mastertask in (
+              select mti.rid_mastertask
+              from core.mastertaskitem mti
+              where
+                  mti.rid_mastertaskitem = r_mastertaskitemevent.rid_mastertaskitem
+              and coalesce(mti.inactive, 0) = 0
+              )
+
+          order by tl.rid_tasklist desc
+          limit 1
+          into r_tasklist;
+
+        end if;
+
+        select tie.*
+        from core.taskitemevent tie
+        where
+            tie.rid_taskitem = r_taskitem.rid_taskitem
+        and tie.rid_mastertaskitemevent = r_mastertaskitemevent.rid_mastertaskitemevent
+        --and tie.status = r_mastertaskitemevent.status
+        order by tie.rid_taskitemevent desc
+        limit 1
+        into r_taskitemevent;
+
+        perform log_event(m_funcname, format(E'__Processing task item %s(%s, status=%s) for event %s(%s) status=%s'
+          , r_taskitem.description, r_taskitem.rid_taskitem, r_taskitem.status
+          , r_taskitemevent.description, r_mastertaskitemevent.rid_mastertaskitemevent, r_taskitemevent.status
+                                      ), bt_enum('eventlog', 'local notice'));
+
+        if nv(r_taskitem.status) in (4, 5, 6, 11) --11 Resolved
+             and r_mastertaskitemevent.status is distinct from r_taskitem.status
+             and existS (
+            select 1
+            from core.taskitemevent e
+            where
+                e.rid_taskitem = r_taskitem.rid_taskitem
+            and e.status = r_taskitem.status
+            )
+          --Or errors to errors
+--           or nv(r_taskitem.status) in (10, 11)
+--               and nv(r_taskitemevent.status) in (1, 2, 11, 10)
+--               and not exists (
+--                 select 1 
+--                 from core.taskitem ti2
+--                 where ti2.rid_parenttaskitem = r_taskitem.rid_taskitem
+--                 and ti2.status in (1,2,10,11)
+--               )
+--           ) 
+--           and nv(r_mastertaskitem.jsonvalue->'AOP'->>'errorcode') = ''
+          or p_parms ->> 'new_task' in ('1', 'true')
+        then
+          select r.p_retval, r.p_errmsg, r.p_a_rid_taskitem, r.p_parameters
+          from core.taskitem_get_or_prime(_jsonb_object_cat(
+              _jsonb_object_cat(r_taskitem.jsonvalue, jsonb_build_object('AOP', null, 'controls', null)),
+              p_parms
+            , jsonb_build_object(
+                  'rid_mastertaskitem', r_mastertaskitemevent.rid_mastertaskitem
+                , 'rid_mastertaskitemevent', r_mastertaskitemevent.rid_mastertaskitemevent
+                , 'parent_rid_taskitemevent', r_taskitemevent.rid_taskitemevent
+                , 'rid_tasklist', r_tasklist.rid_tasklist
+                , 'parent_rid_taskitem'
+                , _bv(r_taskitem.rid_taskitem
+                    , _try_integer(p_parms ->> 'parent_rid_taskitem', 0)
+                    , r_taskitem_parent.rid_taskitem)
+                , 'new_item', false
+                , 'status', 1
+                , 'rid_tasklist_prev', _try_integers(p_parms ->> 'rid_tasklist_prev', p_parms ->> 'rid_tasklist',
+                                                     r_taskitem.rid_tasklist::text)
+                , 'rid_taskitem_parentaction', p_parms -> 'rid_taskitem_parentaction'
+              )
+                                          )) r
+          into m_retval,m_errmsg,m_temp_rid_list,j_results;
+
+          if m_retval > 0
+          then
+            raise exception '%',m_errmsg using hint = 'in taskitem_get_or_prime 2';
+          end if;
+
+          --raise notice 'Re-evaluated task item % for event % m_temp_rid_list=%',r_taskitem.rid_taskitem,r_mastertaskitemevent.rid_mastertaskitemevent, m_temp_rid_list;
+
+          if array_length(m_temp_rid_list, 1) > 1
+               and r_taskitem.rid_taskitem <> any (m_temp_rid_list)
+            or (p_parms ->> 'new_task' in ('1', 'true')
+              and r_taskitem.status in (4, 11)
+               )
+
+          then
+            perform log_event(m_funcname, format(E'*.* Fired event %s(%s) for completed action : %s New Actions: %s'
+              , r_mastertaskitemevent.description, r_mastertaskitemevent.rid_mastertaskitemevent, r_taskitem.description
+              , m_temp_rid_list), bt_enum('eventlog', 'debug'));
+
+            r_taskitem_prev = r_taskitem;
+
+            select ti.rid_taskitem
+            from core.taskitem ti
+            where
+                ti.rid_taskitem = any (m_temp_rid_list)
+            and ti.rid_mastertaskitem = r_taskitem.rid_mastertaskitem
+            into r_taskitem;
+
+            select *
+            from core.mastertaskitem mti
+            where mti.rid_mastertaskitem = r_taskitem.rid_mastertaskitem
+            into r_mastertaskitem;
+
+            r_taskitemevent = null;
+
+            --           else
+--
+--               perform log_event(m_funcname,format(E'Cannot fire event (Already Done,Cancelled,Error) (%s,%s,%s), on %s(%s) status = %s'
+--                 ,r_mastertaskitemevent.description
+--                 ,r_mastertaskitemevent.rid_mastertaskitemevent
+--                 ,r_mastertaskitemevent.status
+--                 ,r_taskitem.rid_taskitem
+--                 ,r_taskitem.description
+--                 ,r_taskitem.status
+--               ),bt_enum('eventlog','debug'));
+--
+--               continue;
+
+          end if;
+        end if;
+
+        ---Allow firing events again.
+        if nv(r_taskitemevent.rid_taskitemevent) > 0
+        then
+          --           if nv(r_taskitemevent.retval) < 2
+--           then
+
+          perform log_event(m_funcname, format(E'**Updating event %s(%s) for action : %s'
+            , r_mastertaskitemevent.description, r_mastertaskitemevent.rid_mastertaskitemevent, r_taskitem.description
+                                        ), bt_enum('eventlog', 'debug'));
+
+          --SET session_replication_role = DEFAULT;
+
+          update core.taskitemevent u
+          set
+            retval = 0
+          , createddatetime = now()
+          , jsonvalue = _jsonb_object_cat(u.jsonvalue, p_parms -> '_event_jsonvalue',
+                                          jsonb_build_object('rid_mastertaskitem_complete', case
+                                                                                              when
+                                                                                                _try_integer(
+                                                                                                    r_taskitemevent_parent.jsonvalue ->>
+                                                                                                    'rid_mastertaskitem_complete',
+                                                                                                    0) <>
+                                                                                                r_mastertaskitemevent.rid_mastertaskitem
+                                                                                                then r_taskitemevent_parent.jsonvalue ->> 'rid_mastertaskitem_complete'
+                                                                                              else null
+                                                                                            end
+                                          ))
+          where u.rid_taskitemevent = r_taskitemevent.rid_taskitemevent
+          returning u.*
+            into r_taskitemevent;
+
+
+          select r.p_retval, r.p_errmsg
+          from core.event_created(r_taskitemevent.rid_taskitemevent) r
+          into m_retval,m_errmsg;
+
+          if m_retval > 0
+          then
+            raise exception '%',m_errmsg;
+          end if;
+
+
+          update core.taskitemevent u
+          set
+            jsonvalue = _jsonb_object_cat(u.jsonvalue, jsonb_build_object('rid_taskitemevent_retries',
+                                                                          _jsonb_object_cat(u.jsonvalue ->
+                                                                                            'rid_taskitemevent_retries',
+                                                                                            jsonb_build_array(r_taskitemevent.rid_taskitemevent))))
+          where u.rid_taskitemevent = r_taskitemevent_parent.rid_taskitemevent;
+
+--           end if;
+        else
+          --SET session_replication_role = DEFAULT;
+
+          insert
+          into core.taskitemevent( createddatetime
+                                 , description
+                                 , guid
+                                 , rid_mastertaskitemevent
+                                 , rid_taskitem
+                                 , duedatetime
+                                 , errmsg
+                                 , escalated
+                                 , outcome
+                                 , status
+                                 , jsonvalue)
+          select now()
+               , format('%s %s', evt.description, nv((
+            select count(1)
+            from core.taskitemevent ev2
+            where
+                ev2.rid_taskitem = r_taskitem.rid_taskitem
+            and ev2.rid_mastertaskitemevent = r_mastertaskitemevent.rid_mastertaskitemevent
+            )) + 1
+                 )
+               , newid()
+               , r_mastertaskitemevent.rid_mastertaskitemevent
+               , r_taskitem.rid_taskitem
+               , (
+            select eri.p_timestamp
+            from core.interval_fetch('mastertaskitemevent', r_mastertaskitemevent.rid_mastertaskitemevent
+              , r_taskitem.rid_hub, 'duedatetime',
+                                     jsonb_build_object('rid_taskitem', r_taskitem.rid_taskitem)) eri
+            limit 1
+            )
+               , null
+               , _try_integer(p_parms ->> 'escalated', 0)
+               , evt.outcome
+               , evt.status
+               , _jsonb_object_cat(p_parms -> '_event_jsonvalue', case
+                                                                    when nv(r_taskitem.rid_taskitem) = 0
+                                                                      then jsonb_build_object('rid_hub', m_rid_hub_payload)
+                                                                    else jsonb_build_object()
+                                                                  end
+            , jsonb_build_object('parent_rid_taskitem',
+                                 _try_integer(p_parms ->> 'parent_rid_taskitem', r_taskitem.rid_taskitem)
+                                     , 'parent_rid_taskitemevent', r_taskitemevent_parent.rid_taskitemevent
+                                     , 'rid_mastertaskitem_complete', case
+                                                                        when _try_integer(
+                                                                                 r_taskitemevent_parent.jsonvalue ->>
+                                                                                 'rid_mastertaskitem_complete', 0) <>
+                                                                             evt.rid_mastertaskitem
+                                                                          then r_taskitemevent_parent.jsonvalue ->> 'rid_mastertaskitem_complete'
+                                                                        else null
+                                                                      end)
+                 )
+          from core.mastertaskitemevent evt
+          where evt.rid_mastertaskitemevent = r_mastertaskitemevent.rid_mastertaskitemevent
+          returning taskitemevent.*
+            into r_taskitemevent;
+
+          if r_taskitemevent.rid_taskitemevent > 0
+          then
+            perform log_event(m_funcname, format(E'**Created event %s(%s) for action : %s'
+              , r_mastertaskitemevent.description, r_mastertaskitemevent.rid_mastertaskitemevent, r_taskitem.description
+                                          ), bt_enum('eventlog', 'debug'));
+
+
+            update core.taskitemevent u
+            set
+              jsonvalue = _jsonb_object_cat(u.jsonvalue, jsonb_build_object('rid_taskitemevent_spawned',
+                                                                            _jsonb_object_cat(u.jsonvalue ->
+                                                                                              'rid_taskitemevent_spawned',
+                                                                                              jsonb_build_array(r_taskitemevent.rid_taskitemevent))))
+            where u.rid_taskitemevent = r_taskitemevent_parent.rid_taskitemevent;
+
+
+          end if;
+
+        end if;
+
+        /*
+        if nv(r_taskitemevent.rid_taskitemevent) > 0
+        then
+--           if nv(r_taskitemevent.retval) < 2
+--           then
+
+          perform log_event(m_funcname,format(E'Updating event %s(%s) for action : %s'
+            ,r_mastertaskitemevent.description,r_mastertaskitemevent.rid_mastertaskitemevent, r_taskitem.description
+            ),bt_enum('eventlog','debug'));
+
+
+
+          perform meta.add_transaction_event(txid_current(), 'core.action_init'
+            ,replace(replace(replace(replace(replace($CC$
+            DO $ICC$
+            DECLARE
+              m_retval integer;
+              m_errmsg text;
+              r_taskitemevent core.taskitemevent%rowtype;
+              r_taskitemevent_parent  core.taskitemevent%rowtype;
+              r_mastertaskitemevent core.mastertaskitemevent%rowtype;
+            BEGIN
+
+            select *
+            from core.taskitemevent tie
+            where tie.rid_taskitemevent = [rid_taskitemevent]
+            into r_taskitemevent;
+
+            select *
+            from core.taskitemevent tie
+            where tie.rid_taskitemevent = [rid_taskitemevent_parent]
+            into r_taskitemevent_parent;
+
+            select *
+            from core.mastertaskitemevent t
+            where t.rid_mastertaskitemevent = [rid_mastertaskitemevent]
+            into r_mastertaskitemevent;
+
+
+            update core.taskitemevent u
+            set
+              retval = 0
+            , createddatetime = now()
+            , jsonvalue = _jsonb_object_cat(u.jsonvalue,$JJA$[event_json_value]$JJA$::jsonb, jsonb_build_object('rid_mastertaskitem_complete', case
+                   when
+                     _try_integer(
+                         r_taskitemevent_parent.jsonvalue ->>
+                         'rid_mastertaskitem_complete',
+                         0) <>
+                     r_mastertaskitemevent.rid_mastertaskitem
+                     then r_taskitemevent_parent.jsonvalue ->> 'rid_mastertaskitem_complete'
+                   else null
+                 end
+                                                         ))
+            where u.rid_taskitemevent = r_taskitemevent.rid_taskitemevent
+            returning u.*
+            into r_taskitemevent;
+
+
+
+            select r.p_retval,r.p_errmsg
+            from core.event_created(r_taskitemevent.rid_taskitemevent) r
+            into m_retval,m_errmsg;
+
+            if m_retval > 0
+            then
+              raise exception '%',m_errmsg;
+            end if;
+
+
+            update core.taskitemevent u
+            set
+              jsonvalue = _jsonb_object_cat(u.jsonvalue, jsonb_build_object('rid_taskitemevent_retries',
+                                            _jsonb_object_cat(u.jsonvalue -> 'rid_taskitemevent_retries',
+                                                              jsonb_build_array(r_taskitemevent.rid_taskitemevent))))
+            where u.rid_taskitemevent = r_taskitemevent_parent.rid_taskitemevent;
+
+
+            END;
+            $ICC$;
+            $CC$,'[rid_taskitemevent_parent]', nv(r_taskitemevent_parent.rid_taskitemevent)::text)
+                     ,'[rid_taskitemevent]', nv(r_taskitemevent.rid_taskitemevent)::text)
+                     ,'[rid_mastertaskitemevent]', nv(r_mastertaskitemevent.rid_mastertaskitemevent)::text)
+                       ,'[rid_taskitem]', nv(r_taskitem.rid_taskitem)::text)
+                      ,'[event_json_value]' ,coalesce((p_parms->'_event_jsonvalue')::text,'{}'))
+             )
+            ,30, format('action_init_%s',r_taskitemevent.rid_taskitemevent);
+
+            SET session_replication_role = DEFAULT;
+
+        */
+
+        -------------------------------------------__Recursive Rules__---------------------------------------------------
+--         --activate rule
+--         if r_taskitemevent_parent.rid_taskitemevent > 0
+--           and r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_activate' is not null
+--           and  _try_integer(r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_activate',-1) > 0
+--           and not exists (
+--             select 1
+--             from core.taskitem ti
+--             where ti.rid_mastertaskitem = _try_integer(r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_activate',-1)
+--             and ti.rid_hub = m_rid_hub_payload
+--             )
+--         then
+--           if   _try_integer(r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_activate',-1) <> r_taskitem.rid_mastertaskitem
+--             and _try_integer(r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_activate',-1) <> nv(r_mastertaskitem.rid_parentmastertaskitem)
+--           then
+--             insert into core.taskitemevent(rid_taskitem,rid_mastertaskitemevent,description,status,createddatetime,guid,jsonvalue)
+--             select r_taskitem.rid_taskitem
+--                  , mtev.rid_mastertaskitemevent
+--                  , mtev.description
+--                  , mtev.status
+--                  , now()
+--                  , newid()
+--                  , _jsonb_object_cat(mtev.jsonvalue,p_parms->'_event_jsonvalue', jsonb_build_object('rid_mastertaskitem_activate',r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_activate',  'simulated', true
+--               , 'parent_rid_taskitem',_try_integer(p_parms ->> 'parent_rid_taskitem',0)
+--                                                      ))
+--             from core.mastertaskitemevent mtev
+--             where mtev.rid_mastertaskitem = r_taskitem.rid_mastertaskitem
+--             and coalesce(mtev.inactive,0) = 0
+--             and mtev.status = 2
+--             and not exists (
+--               select 1
+--               from core.taskitemevent tie
+--               where tie.rid_taskitem = r_taskitem.rid_taskitem
+--               and tie.rid_mastertaskitemevent = mtev.rid_mastertaskitemevent
+--               )
+--             ;
+--           elseif  _try_integer(r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_activate',-1) = r_taskitem.rid_mastertaskitem
+--           then
+--             --We reached the target taskitem, so we can mark it activate
+--             insert into core.taskitemevent(rid_taskitem,rid_mastertaskitemevent,description,status,createddatetime,guid,jsonvalue)
+--             select r_taskitem.rid_taskitem
+--                  , mtev.rid_mastertaskitemevent
+--                  , mtev.description
+--                  , mtev.status
+--                  , now()
+--                  , newid()
+--                  , _jsonb_object_cat( mtev.jsonvalue,p_parms->'_event_jsonvalue',jsonb_build_object('parent_rid_taskitem',_try_integer(p_parms ->> 'parent_rid_taskitem',0)))
+--             from core.mastertaskitemevent mtev
+--             where mtev.rid_mastertaskitem = r_taskitem.rid_mastertaskitem
+--             and coalesce(mtev.inactive,0) = 0
+--             and mtev.status = 2
+--             and not exists (
+--               select 1
+--               from core.taskitemevent tie
+--               where tie.rid_taskitem = r_taskitem.rid_taskitem
+--               and tie.rid_mastertaskitemevent = mtev.rid_mastertaskitemevent
+--               )
+--             ;
+--           end if;
+--
+--         end if;
+--
+--         --complete rule
+--         if r_taskitemevent_parent.rid_taskitemevent > 0
+--           and r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_complete' is not null
+--           and  _try_integer(r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_complete',-1) > 0
+--           and not exists (
+--             select 1
+--             from core.taskitem ti
+--             where ti.rid_mastertaskitem = _try_integer(r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_complete',-1)
+--             and ti.rid_hub = m_rid_hub_payload
+--             )
+--         then
+--           if   _try_integer(r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_complete',-1) <> r_taskitem.rid_mastertaskitem
+--           and _try_integer(r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_complete',-1) <> nv(r_mastertaskitem.rid_parentmastertaskitem)
+--           then
+--             insert into core.taskitemevent(rid_taskitem,rid_mastertaskitemevent,description,status,createddatetime,guid,jsonvalue)
+--             select r_taskitem.rid_taskitem
+--                  , mtev.rid_mastertaskitemevent
+--                  , mtev.description
+--                  , mtev.status
+--                  , now()
+--                  , newid()
+--                  , _jsonb_object_cat(mtev.jsonvalue,p_parms->'_event_jsonvalue', jsonb_build_object('rid_mastertaskitem_complete',r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_complete',  'simulated', true, 'parent_rid_taskitem',_try_integer(p_parms ->> 'parent_rid_taskitem',0)))
+--             from core.mastertaskitemevent mtev
+--             where mtev.rid_mastertaskitem = r_taskitem.rid_mastertaskitem
+--             and coalesce(mtev.inactive,0) = 0
+--             and mtev.status = 4
+--             and not exists (
+--               select 1
+--               from core.taskitemevent tie
+--               where tie.rid_taskitem = r_taskitem.rid_taskitem
+--               and tie.rid_mastertaskitemevent = mtev.rid_mastertaskitemevent
+--               )
+--             ;
+--           elseif  _try_integer(r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_complete',-1) = r_taskitem.rid_mastertaskitem
+--           then
+--             --We reached the target taskitem, so we can mark it activate
+--             insert into core.taskitemevent(rid_taskitem,rid_mastertaskitemevent,description,status,createddatetime,guid,jsonvalue)
+--             select r_taskitem.rid_taskitem
+--                  , mtev.rid_mastertaskitemevent
+--                  , mtev.description
+--                  , mtev.status
+--                  , now()
+--                  , newid()
+--                  , _jsonb_object_cat(mtev.jsonvalue,p_parms->'_event_jsonvalue',jsonb_build_object('parent_rid_taskitem',_try_integer(p_parms ->> 'parent_rid_taskitem',0)))
+--             from core.mastertaskitemevent mtev
+--             where mtev.rid_mastertaskitem = r_taskitem.rid_mastertaskitem
+--             and coalesce(mtev.inactive,0) = 0
+--             and mtev.status = 2
+--             and not exists (
+--               select 1
+--               from core.taskitemevent tie
+--               where tie.rid_taskitem = r_taskitem.rid_taskitem
+--               and tie.rid_mastertaskitemevent = mtev.rid_mastertaskitemevent
+--             )
+--             ;
+--           end if;
+--         end if;
+
+        p_parms := _jsonb_object_cat(p_parms, to_jsonb(r_taskitemevent));
+
+      end loop;
+
+    --       perform log_event(m_funcname
+--         ,format('Post event insert: rid_taskitemevent=%s rid_mastertaskitem_complete=%s rid_mastertaskitem=%s'
+--                           ,r_taskitemevent_parent.rid_taskitemevent
+--                           ,r_taskitemevent_parent.jsonvalue->>'rid_mastertaskitem_complete'
+--                           ,r_taskitem.rid_mastertaskitem
+--       ),bt_enum('eventlog','local notice'));
+
+  elsif p_table::citext in ('taskitem', 'wfl')
+  then
+    select ti.*
+    from core.taskitem ti
+    where ti.rid_taskitem = p_rid
+    into r_taskitem;
+
+    select ti.*
+    from core.mastertaskitem ti
+    where ti.rid_mastertaskitem = r_taskitem.rid_mastertaskitem
+    into r_mastertaskitem;
+
+    select tl.*
+    from core.tasklist tl
+    where tl.rid_tasklist = r_taskitem.rid_tasklist
+    into r_tasklist;
+
+    --Create item linked to task for this hub if not found
+
+    perform log_event(m_funcname, format(E'Action Init via %s=%s Item:%s(%s rid_taskitem:%s)
+    p_parms:%s', p_table, p_rid
+      , r_mastertaskitem.description, r_mastertaskitem.rid_mastertaskitem, r_taskitem.rid_taskitem
+      , p_parms), bt_enum('eventlog', 'local notice'));
+
+    select r.p_retval, r.p_errmsg, r.p_a_rid_taskitem
+    from core.taskitem_get_or_prime(_jsonb_object_cat(
+        jsonb_build_object('rid_tasklist', r_tasklist.rid_tasklist
+          , 'rid_mastertaskitemevent',
+                           r_mastertaskitemevent.rid_mastertaskitemevent
+          , 'rid_taskitem_parentaction', p_parms -> 'rid_taskitem_parentaction'
+        ), to_jsonb(r_taskitem), p_parms)) r
+    into m_retval,m_errmsg,m_temp_rid_list;
+
+    if m_retval > 0
+    then
+      raise exception '%',m_errmsg using hint = 'in taskitem_get_or_prime 3';
+    end if;
+
+    if array_length(m_temp_rid_list, 1) > 1
+    then
+      select array_agg(to_jsonb(ti))
+      from core.taskitem ti
+      where ti.rid_taskitem = any (m_temp_rid_list)
+      into p_parms;
+
+    else
+      m_temp_rid = m_temp_rid_list[1];
+      select *
+      from core.taskitem ti
+      where ti.rid_taskitem = m_temp_rid
+      into r_taskitem;
+
+      p_parms = to_jsonb(r_taskitem);
+    end if;
+
+
+  elsif p_table::citext in ('mastertaskitem', 'mal')
+  then
+    select ti.*
+    from core.mastertaskitem ti
+    where ti.rid_mastertaskitem = p_rid
+    into r_mastertaskitem;
+
+    if r_mastertaskitem.inactive > 0
+    then
+      raise exception 'The template task item is inactive. rid_mastertaskitem = %',r_mastertaskitem.rid_mastertaskitem;
+    end if;
+
+    perform log_event(m_funcname, format(E'Action Init via %s=%s Item:%s(%s)
+    p_parms:%s', p_table, p_rid
+      , r_mastertaskitem.description, r_mastertaskitem.rid_mastertaskitem
+      , p_parms), bt_enum('eventlog', 'local notice'));
+
+    select r.p_retval, r.p_errmsg, r.p_a_rid_taskitem
+    from core.taskitem_get_or_prime(_jsonb_object_cat(to_jsonb(r_mastertaskitem)
+      , p_parms
+      , jsonb_build_object('rid_mastertaskitemevent', r_mastertaskitemevent.rid_mastertaskitemevent
+                                                        , 'rid_taskitem_parentaction',
+                           p_parms -> 'rid_taskitem_parentaction'
+        ))
+         ) r
+    into m_retval,m_errmsg,m_temp_rid_list;
+
+    if m_retval > 0
+    then
+      raise exception '%',m_errmsg using hint = 'in taskitem_get_or_prime 4';
+    end if;
+
+    if array_length(m_temp_rid_list, 1) > 1
+    then
+      select array_agg(to_jsonb(ti))
+      from core.taskitem ti
+      where ti.rid_taskitem = any (m_temp_rid_list)
+      into p_parms;
+
+    else
+      m_temp_rid = m_temp_rid_list[1];
+      select *
+      from core.taskitem ti
+      where ti.rid_taskitem = m_temp_rid
+      into r_taskitem;
+
+      p_parms = to_jsonb(r_taskitem);
+    end if;
+  end if;
+
+  if nv(r_taskitem.rid_mastertaskitem) = 0
+  then
+    raise warning 'No template for the task item. rid_mastertaskitem = %',r_taskitem.rid_mastertaskitem;
+
+  end if;
+
+
+EXCEPTION
+  WHEN others THEN
+    GET STACKED DIAGNOSTICS
+      m_errmsg = MESSAGE_TEXT
+      ,m_errcontext = PG_EXCEPTION_CONTEXT
+      ,m_errdetail = PG_EXCEPTION_DETAIL
+      ,m_errhint = PG_EXCEPTION_HINT
+      ,m_errstate = RETURNED_SQLSTATE;
+
+    p_errmsg := format('%s table:%s rid:%s',
+                       get_err_msg(m_funcname, m_errmsg, m_errcontext, m_errdetail, m_errhint, m_errstate), p_table,
+                       p_rid);
+    p_retval = 1;
+END;
+$$;

testdata/corpus/5795535_create_core.event_exec_func.pgsql

@@ -0,0 +1,988 @@
+--select * from dropall('event_exec_func','core');
+CREATE OR REPLACE FUNCTION core.event_exec_func(
+  p_event_parameters jsonb
+, p_item_parameters jsonb
+, OUT p_retval integer
+, OUT p_errorcode text
+, OUT p_errmsg text
+, OUT p_output jsonb
+)
+  LANGUAGE plpgsql
+  VOLATILE
+  SECURITY DEFINER
+AS
+$$
+DECLARE
+  --Error Handling--
+  m_funcname        text = 'core.event_exec_func';
+  m_errmsg          text;
+  m_errcode         text;
+  m_errcontext      text;
+  m_errdetail       text;
+  m_errhint         text;
+  m_errstate        text;
+  m_retval          integer;
+  --Error Handling--
+  r_taskitem        core.taskitem%rowtype;
+  r_taskitem_parent core.taskitem%rowtype;
+  r_mastertaskitem  core.mastertaskitem%rowtype;
+  r_taskitemevent   core.taskitemevent%rowtype;
+  m_rid             integer;
+  j_output          jsonb;
+  j_all_parms       jsonb;
+  j_controls        jsonb;
+  j_tmp             jsonb;
+  m_exec_funcname   citext;
+  m_exec_schema     citext;
+  m_sql             citext;
+  r_lp              record;
+  r_hub             core.hub%rowtype;
+  a_async_procs     citext[];
+  a_broker_procs    citext[];
+  a_noerror_procs   citext[];
+BEGIN
+  j_controls = jsonb_build_array();
+  p_retval = 0;
+  p_errmsg = '';
+  m_exec_schema = 'public';
+  a_async_procs = array ['']; --hsync_upload_clienttohyphen
+  a_broker_procs = array ['']; --hsync_upload_clienttohyphen
+  a_noerror_procs = array ['ui_clientscenario_commit'];
+
+  --   if p_event_parameters -> 'AFN_RID_ACTIONFUNCTION_CODE' is null
+--   then
+--     p_retval = 1;
+--     p_errmsg = '[ECR0001] No AFN_RID_ACTIONFUNCTION_CODE inside the AOP pack.';
+--
+--     select m.v[1]
+--     from regexp_matches(p_errmsg, '\[([^\]]+)\]','ig') m(v)
+--     where length(m.v[1]) between 2 and 10
+--     order by m.v[1]
+--     into p_errorcode;
+--
+--     return;
+--   end if;
+
+  select *
+  from core.taskitemevent tie
+  where tie.rid_taskitemevent = _try_integer(p_item_parameters ->> 'rid_taskitemevent', 0)
+  into r_taskitemevent;
+
+  select *
+  from core.taskitem ti
+  where ti.rid_taskitem = _try_integer(p_item_parameters ->> 'rid_taskitem', r_taskitemevent.rid_taskitem)
+  into r_taskitem;
+
+  select *
+  from core.mastertaskitem mti
+  where
+     mti.rid_mastertaskitem = _try_integer(p_item_parameters ->> 'rid_mastertaskitem', 0)
+  or r_taskitem.rid_mastertaskitem > 0 and mti.rid_mastertaskitem = r_taskitem.rid_mastertaskitem
+  order by mti.rid_mastertaskitem desc
+  limit 1
+  into r_mastertaskitem;
+
+  m_exec_funcname = r_mastertaskitem.functionname_code;
+
+  if m_exec_funcname ilike '%.%'
+  then
+    m_exec_schema = split_part(m_exec_funcname, '.', 1);
+    m_exec_funcname = split_part(m_exec_funcname, '.', 2);
+  end if;
+
+
+  if nv(m_exec_funcname) = ''
+  then
+    perform log_event(m_funcname, format(
+        E'No function to execute for MasterTaskItem %s (rid_mastertaskitem=%s) and TaskItem %s (rid_taskitem=%s)',
+        r_mastertaskitem.description, r_mastertaskitem.rid_mastertaskitem, r_taskitem.description,
+        r_taskitem.rid_taskitem), bt_enum('eventlog', 'local notice'));
+    return;
+  end if;
+
+  --   if m_exec_funcname ilike '%payment%plan%'
+--   then
+--     raise exception 'Payment Plan Test Error % [RTY0001]', m_exec_funcname;
+--   end if;
+
+
+  j_all_parms = _jsonb_object_cat(r_taskitem.jsonvalue,
+                                  j_all_parms
+    , (
+                                    select jsonb_object_agg(k, p_event_parameters -> k)
+                                    from jsonb_object_keys(p_event_parameters) keys(k)
+                                    where jsonb_typeof(p_event_parameters -> keys.k) not in ('object', 'array', 'null')
+                                    ), (
+                                    select jsonb_object_agg(k, p_item_parameters -> k)
+                                    from jsonb_object_keys(p_item_parameters) keys(k)
+                                    where jsonb_typeof(p_item_parameters -> keys.k) not in ('object', 'array', 'null')
+                                    )
+                );
+
+
+  if r_taskitem.rid_taskitem > 0 and r_taskitem.rid_taskitem_parentaction > 0
+  then
+    select ti.*
+    from core.taskitem ti
+    where ti.rid_taskitem = r_taskitem.rid_taskitem_parentaction
+    into r_taskitem_parent;
+  end if;
+
+  select af.jsonvalue -> 'controls'
+  from core.actionfunction af
+  where
+      (
+        af.functionname = m_exec_funcname
+          or af.functionname = r_mastertaskitem.functionname_code
+        )
+  and af.fntype = 'pgsql-function'::citext
+  into j_controls;
+
+
+  if jsonb_typeof(p_item_parameters -> 'AOP' -> 'jsonvalue' -> 'controls_code') = 'array'
+  then
+    j_controls = _jsonb_object_cat(j_controls, p_item_parameters -> 'AOP' -> 'jsonvalue' -> 'controls');
+  end if;
+
+  if jsonb_typeof(p_event_parameters -> 'jsonvalue' -> 'controls_code') = 'array'
+  then
+    j_controls = _jsonb_object_cat(j_controls, p_event_parameters -> 'jsonvalue' -> 'controls');
+  end if;
+
+  if jsonb_typeof(j_all_parms -> 'controls_code') = 'array'
+  then
+    j_controls = _jsonb_object_cat(j_controls, j_all_parms -> 'controls_code');
+  end if;
+
+  if jsonb_typeof(r_mastertaskitem.jsonvalue -> 'controls_code') = 'array'
+  then
+    j_controls = _jsonb_object_cat(j_controls, r_mastertaskitem.jsonvalue -> 'controls_code');
+  end if;
+
+  raise notice 'Controls: %', j_controls::text;
+
+  j_all_parms = _jsonb_object_cat(j_all_parms,
+                                  (
+                                    select jsonb_object_agg(ctr.j ->> 'name'
+                                             , case
+                                                 when nv(j_all_parms ->> (ctr.j ->> 'name')) = ''
+                                                   then ctr.j -> 'props' ->> 'value'
+                                                 else j_all_parms ->> (ctr.j ->> 'name')
+                                               end
+                                                            order by i
+                                           )
+                                    from jsonb_array_elements(j_controls) with ordinality ctr(j, i)
+                                    where nv(ctr.j -> 'props' ->> 'value') <> ''
+                                    )
+                );
+
+
+  if nv(j_all_parms ->> 'rid_hub_user') = ''
+  then
+    j_all_parms = _jsonb_object_cat(j_all_parms, jsonb_build_object(
+        'rid_hub_user', _bv(core.f_get_user_hub_rid(), (
+          select hub.rid_hub
+          from core.hub
+          where hub.hubtype = 'program'
+          limit 1
+          )),
+        'login', f_getuser()
+                                                 ));
+
+  end if;
+
+  if nv(j_all_parms ->> 'login') = ''
+  then
+    j_all_parms = _jsonb_object_cat(j_all_parms, jsonb_build_object(
+        'login', f_getuser()
+                                                 ));
+  end if;
+
+  if _try_integer(j_all_parms ->> 'rid_hub', 0) > 0
+  then
+    select *
+    from core.hub
+    where rid_hub = _try_integer(j_all_parms ->> 'rid_hub', 0)
+    into r_hub;
+
+    if r_hub.hubtype in ('client', 'lead')
+    then
+      j_all_parms = _jsonb_object_cat(j_all_parms, (
+        select jsonb_build_object(
+                   'rid_adproclient', cli.rid_adproclient
+                 , 'rid_client', cli.rid_adproclient
+               )
+        from t_adproclient cli
+        where cli.rid_hub = r_hub.rid_hub
+        limit 1
+        ));
+    elsif r_hub.hubtype in ('trader')
+    then
+      j_all_parms = _jsonb_object_cat(j_all_parms, (
+        select jsonb_build_object(
+                   'rid_trader', tdr.rid_trader
+                 , 'rid_adprocreditor', tdr.rid_trader
+               )
+        from t_trader tdr
+        where tdr.rid_hub = r_hub.rid_hub
+        limit 1
+        ));
+
+    end if;
+
+  end if;
+
+  j_all_parms = _jsonb_object_cat(j_all_parms, jsonb_build_object('AOP', null));
+
+  --   perform log_event(m_funcname, format('p_event_parameters=%s p_item_parameters=%s j_all_parms=%s', p_event_parameters::text,
+--                                        p_item_parameters::text, j_all_parms::text), bt_enum('eventlog', 'local notice'));
+
+  if (
+    select 1
+    from core.actionfunction af
+    where
+        (
+          af.functionname = m_exec_funcname
+            or af.functionname = r_mastertaskitem.functionname_code
+          )
+    and af.fntype = 'pgsql-function'::citext
+    )
+  then
+    if m_exec_funcname = 'event_nextaction'
+    then
+      select r.p_retval, r.p_errmsg, r.p_data
+      from core.event_nextaction(j_all_parms) r
+      into m_retval,m_errmsg, j_output;
+
+      if m_retval > 0
+      then
+        p_retval = m_retval;
+        p_errmsg = m_errmsg;
+
+        select m.v[1]
+        from regexp_matches(p_errmsg, '\[([^\]]+)\]', 'ig') m(v)
+        where length(m.v[1]) between 2 and 10
+        order by m.v[1]
+        into p_errorcode;
+
+        return;
+      end if;
+
+    elsif m_exec_funcname in ('event_pre_error_check')
+    then
+
+      select r.p_retval, r.p_errmsg, r.p_errorcode, r.p_parms
+      from core.event_pre_error_check(_jsonb_object_cat(j_all_parms, jsonb_build_object(
+          'rid_taskitem', r_taskitem.rid_taskitem
+        , 'rid_tasklist', r_taskitem.rid_tasklist
+        , 'rid_mastertaskitem', r_mastertaskitem.rid_mastertaskitem
+                                                                     ))) r
+      into p_retval,p_errmsg, p_errorcode, p_output;
+
+
+      return;
+    elsif m_exec_funcname = 'ui_maint_commitem'
+    then
+      select r.p_retval, r.p_errmsg, r.p_options
+      from core.ui_maint_commitem(_jsonb_object_cat(
+          r_taskitem.jsonvalue
+        , r_taskitemevent.jsonvalue
+        , jsonb_build_object(
+              'rid_taskitem', r_taskitem.rid_taskitem,
+              'rid_mastertaskitem', r_taskitem.rid_mastertaskitem,
+              'rid_hub_user', j_all_parms ->> 'rid_hub_user',
+              'rid_hub_payload', _try_integers(j_all_parms ->> 'rid_hub', j_all_parms ->> 'rid_hub_payload')
+          )
+                                  )) r
+      into m_retval,m_errmsg, j_output;
+
+      if m_retval > 0
+      then
+        p_retval = m_retval;
+        p_errmsg = m_errmsg;
+
+        select m.v[1]
+        from regexp_matches(p_errmsg, '\[([^\]]+)\]', 'ig') m(v)
+        where length(m.v[1]) between 2 and 10
+        order by m.v[1]
+        into p_errorcode;
+
+        return;
+      end if;
+
+    elsif m_exec_funcname = 'ui_modify_paymentplan'
+    then
+
+      select r.p_retval, r.p_errmsg, r.p_data
+      from ui_modify_paymentplan(j_all_parms) r
+      into m_retval,m_errmsg, j_output;
+
+      if m_retval > 0
+      then
+        p_retval = m_retval;
+        p_errmsg = m_errmsg;
+        select m.v[1]
+        from regexp_matches(p_errmsg, '\[([^\]]+)\]', 'ig') m(v)
+        where length(m.v[1]) between 2 and 10
+        order by m.v[1]
+        into p_errorcode;
+
+
+        return;
+      end if;
+    elsif m_exec_funcname in ('f_checkforreapprove_client')
+    then
+      select f_checkforreapprove_client(cli.rid_adproclient)
+      from t_adproclient cli
+      where cli.rid_hub = r_taskitem.rid_hub
+      into m_retval;
+
+      if m_retval > 0
+      then
+        p_retval = 1;
+        p_errmsg = 'Re-approval is required for this client and it needs to be uploaded to the PDA.';
+        p_errorcode = 'CLIAPRV1';
+        p_output = jsonb_build_object('message', p_errmsg, 'actionstatus', 'error',
+                                      'errorcode', p_errorcode
+          , 'alerttype', 'error'
+          , 'in_modal', true
+                   );
+
+        return;
+      else
+        p_retval = 0;
+        p_errmsg = '';
+        p_errorcode = '';
+        p_output = jsonb_build_object('actionstatus', 'success', 'delete_after', true);
+        return;
+      end if;
+
+    elsif m_exec_funcname in ('c_checkforreapprove')
+    then
+      select c_checkforreapprove(cli.rid_adproclient)
+      from t_adproclient cli
+      where cli.rid_hub = r_taskitem.rid_hub
+      into m_retval;
+
+      if m_retval > 0
+      then
+        p_retval = 1;
+        p_errmsg = 'Re-approval is required for this client`s payment plan and it needs to be uploaded to the PDA.';
+        p_errorcode = 'CLIAPRV2';
+        p_output = jsonb_build_object('message', p_errmsg, 'actionstatus', 'error', 'errorcode'
+          , p_errorcode
+          , 'alerttype', 'error'
+          , 'in_modal', true);
+
+        return;
+      else
+        p_retval = 0;
+        p_errmsg = '';
+        p_errorcode = '';
+        p_output = jsonb_build_object('actionstatus', 'success', 'delete_after', true);
+        return;
+      end if;
+    elsif m_exec_funcname in ('action_init_hublinks')
+    then
+
+      select r.p_retval, r.p_errmsg
+      from core.action_init_hublinks(_jsonb_object_cat(p_item_parameters, jsonb_build_object(
+          'rid_taskitem', r_taskitem.rid_taskitem,
+          'rid_mastertaskitem', r_taskitem.rid_mastertaskitem,
+          'rid_hub_user', j_all_parms ->> 'rid_hub_user',
+          'event_status', r_taskitemevent.status,
+          'parent_rid_taskitemevent', r_taskitemevent.rid_taskitemevent,
+          'calling_function', m_funcname
+                                                                          ))) r
+      into m_retval, m_errmsg;
+
+      if m_retval > 0
+      then
+        p_retval = m_retval;
+        p_errmsg = m_errmsg;
+
+        select m.v[1]
+        from regexp_matches(p_errmsg, '\[([^\]]+)\]', 'ig') m(v)
+        where length(m.v[1]) between 2 and 10
+        order by m.v[1]
+        into p_errorcode;
+
+        return;
+      end if;
+    elsif m_exec_funcname in ('ui_clientscenario_commit')
+    then
+
+      if coalesce(_try_integers(j_all_parms ->> 'rid_clientscenario', j_all_parms ->> 'p_rid_clientscenario'), 0) = 0
+      then
+        select s.rid_clientscenario
+        from clientscenario s
+        inner join t_adproclient c on c.rid_adproclient = s.rid_adproclient
+            and c.rid_hub = r_taskitem.rid_hub
+        where s.status in (1, 2)
+        order by s.status, s.rid_clientscenario desc
+        limit 1
+        into m_rid;
+
+        if nv(m_rid) = 0 and r_taskitem.rid_hub_link > 0
+        then
+          --Falback to link parent client when tasklink is for client.
+          select s.rid_clientscenario
+          from core.hub_link h
+          inner join t_adproclient c on c.rid_hub = h.rid_hub_parent
+              and h.parent_hubtype = 'client'
+          inner join clientscenario s on s.rid_adproclient = c.rid_adproclient
+              and s.status in (1, 2)
+          where h.rid_hub_link = r_taskitem.rid_hub_link
+          order by s.status, s.rid_clientscenario desc
+          limit 1
+          into m_rid;
+        end if;
+
+        j_all_parms = _jsonb_object_cat(j_all_parms, jsonb_build_object(
+            'rid_clientscenario', m_rid
+                                                     ));
+
+      end if;
+
+      select r.p_retval, r.p_errmsg
+      from public.ui_clientscenario_commit(_try_integers(j_all_parms ->> 'rid_clientscenario'
+                                             , j_all_parms ->> 'p_rid_clientscenario', null)
+        , null
+        , _jsonb_object_cat(p_item_parameters, jsonb_build_object(
+              'rid_taskitem', r_taskitem.rid_taskitem,
+              'rid_hub', r_taskitem.rid_hub,
+              'rid_mastertaskitem', r_taskitem.rid_mastertaskitem,
+              'rid_hub_user', j_all_parms ->> 'rid_hub_user',
+              'event_status', r_taskitemevent.status,
+              'parent_rid_taskitemevent', r_taskitemevent.rid_taskitemevent,
+              'calling_function', m_funcname
+                                               ))) r
+      into m_retval, m_errmsg;
+
+      if p_event_parameters ->> 'no_error' in ('1', 'true') or p_item_parameters ->> 'no_error' in ('1', 'true')
+      then
+        select m.v[1]
+        from regexp_matches(p_errmsg, '\[([^\]]+)\]', 'ig') m(v)
+        where length(m.v[1]) between 2 and 10
+        order by m.v[1]
+        into p_errorcode;
+
+        return;
+      end if;
+
+      if m_retval > 0
+      then
+        p_retval = m_retval;
+        p_errmsg = m_errmsg;
+        select m.v[1]
+        from regexp_matches(p_errmsg, '\[([^\]]+)\]', 'ig') m(v)
+        where length(m.v[1]) between 2 and 10
+        order by m.v[1]
+        into p_errorcode;
+
+        return;
+      end if;
+    elsif exists (
+      select ns.nspname, pro.*
+      from pg_proc pro
+      inner join pg_namespace ns on ns.oid = pro.pronamespace
+          and ns.nspname not in ('postgres', 'pg_catalog')
+          and ns.nspname = m_exec_schema
+      where pro.proname = m_exec_funcname
+      )
+      and m_exec_funcname in
+          ('clfrm_builderrorlist', 'upl_builduploaderrors', 'clfrm_propcalc_errlist', 'ui_clientscenarion_errorlist')
+    then
+      raise notice 'Running %',m_exec_funcname;
+
+      p_retval = 0;
+      p_errmsg = '';
+      m_errdetail = '';
+      SET session_replication_role = DEFAULT;
+
+      if not exists (
+        select cli.rid_adproclient
+        from t_adproclient cli
+        where cli.rid_hub = r_taskitem.rid_hub
+        )
+      then
+        p_retval = 1;
+        p_errmsg = 'No client found for the hub.';
+        return;
+      end if;
+
+      with
+        cli as (
+          select cli.rid_adproclient
+          from t_adproclient cli
+          where cli.rid_hub = r_taskitem.rid_hub
+          )
+      , src as (
+          select o.errordescription as errordescription
+               , o.errorcode as errorcode
+               , o.error_priority as priority
+               , o.errortype
+          from clfrm_builderrorlist((
+                                      select cli.rid_adproclient
+                                      from cli
+                                      limit 1
+                                      ), 0, 0) o
+          where m_exec_funcname in ('clfrm_builderrorlist')
+          union
+          select o.errordescription as errordescription
+               , o.errorcode as errorcode
+               , o.error_priority as priority
+               , o.errortype
+          from clfrm_builderrorlist((
+                                      select cli.rid_adproclient
+                                      from cli
+                                      limit 1
+                                      ), 0, 1) o
+          where m_exec_funcname in ('clfrm_builderrorlist')
+          union
+          select o.errordescription as errordescription, o.errorcode as errorcode, 1 as priority, 'error' as errortype
+          from clfrm_propcalc_errlist((
+            select cli.rid_adproclient
+            from cli
+            limit 1
+            )) o
+          where m_exec_funcname = 'm_exec_funcname'
+
+          union
+          select o.errdescription as errordescription
+               , o.errorcode as errorcode
+               , o.severity as priority
+               , o.errtype as errortype
+          from upl_builduploaderrors((
+                                       select cli.rid_adproclient
+                                       from cli
+                                       limit 1
+                                       )
+            , _bv(j_all_parms ->> 'p_approve_mode', j_all_parms ->> 'approve_mode', j_all_parms ->> 'mode', 'normal')) o
+          where
+            m_exec_funcname in ('upl_builduploaderrors')
+          union
+          select elm.j ->> 'errordescription' as errordescription
+               , elm.j ->> 'errorcode' as errorcode
+               , _try_integer(elm.j ->> 'priority', 1) as priority
+               , _bv(elm.j ->> 'errortype', 'error') as errortype
+          from ui_clientscenarion_errorlist((
+            select sc.rid_clientscenario
+            from cli
+            inner join clientscenario sc on sc.rid_adproclient = cli.rid_adproclient
+                and sc.status = 1
+            order by sc.rid_clientscenario desc
+            limit 1
+            )) o
+          cross join jsonb_array_elements(case
+                                            when jsonb_typeof(o.p_data) = 'object' then jsonb_build_array(o.p_data)
+                                            when jsonb_typeof(o.p_data) = 'array' then o.p_data
+                                            else jsonb_build_array()
+                                          end) elm(j)
+          where m_exec_funcname in ('ui_clientscenarion_errorlist')
+          order by priority
+          )
+      , composed as (
+          select
+--                src.errorcode
+--              , src.errordescription
+--              , src.priority as errorpriority
+--              , src.errortype
+                row_number() over (partition by src.errorcode, src.errordescription order by src.priority desc) as rn
+               , evt2.rid_mastertaskitemevent as rid_mastertaskitemevent
+               , mti.rid_mastertaskitem as rid_mastertaskitem
+               , ti.rid_taskitem as rid_taskitem
+               , core.f_get_user_hub_rid() as rid_hub_user
+               , jsonb_build_object(
+              'errordescription', src.errordescription
+            , 'errorcode', src.errorcode
+            , 'errortype', src.errortype
+            , 'errorpriority', src.priority
+                 ) as jsonvalue
+          from src
+            --Get the main linked event
+          left outer join core.mastertaskitemevent ev1 on ev1.rid_mastertaskitem = r_taskitem.rid_mastertaskitem
+              and nv(ev1.errorcode) <> ''
+              and (
+                                                            ev1.errorcode = src.errorcode
+                                                              or ev1.errorcode in (
+                                                              select m.interface_code
+                                                              from core.error_code_map(jsonb_build_object('filter_code', src.errorcode)) m
+                                                              where nv(m.interface_code) <> ''
+                                                              )
+                                                            )
+          left outer join core.mastertaskitemeventreaction er1
+                            on er1.rid_mastertaskitemevent = ev1.rid_mastertaskitemevent
+              -- Fallback to the global event list
+          left outer join core.mastertaskitemevent evt2 on (
+                                                             evt2.rid_mastertaskitemevent =
+                                                             er1.rid_mastertaskitemevent_target
+                                                               or evt2.status in (2)
+                                                               and nv(evt2.errorcode) <> ''
+                                                               and (
+                                                                    evt2.errorcode = src.errorcode
+                                                                      or evt2.errorcode in (
+                                                                      select m.interface_code
+                                                                      from core.error_code_map(jsonb_build_object('filter_code', src.errorcode)) m
+                                                                      where nv(m.interface_code) <> ''
+                                                                      )
+                                                                    )
+                                                             )
+              and nv(evt2.inactive) = 0
+          left outer join core.mastertaskitem mti on mti.rid_mastertaskitem = evt2.rid_mastertaskitem
+          left outer join core.taskitem ti on ti.rid_mastertaskitem = mti.rid_mastertaskitem
+              and ti.rid_hub = r_taskitem.rid_hub
+              and nv(ti.rid_hub_link) = nv(r_taskitem.rid_hub_link)
+              and ti.status in (1, 2, 3)
+          )
+      select jsonb_agg(_jsonb_object_cat(to_jsonb(mti), to_jsonb(ti), jsonb_strip_nulls(to_jsonb(c))))
+             filter ( where c.rn = 1 )
+           , count(1)
+      from composed c
+      left outer join core.mastertaskitem mti on mti.rid_mastertaskitem = c.rid_mastertaskitem
+      left outer join core.taskitem ti on ti.rid_taskitem = c.rid_taskitem
+      into j_tmp, m_retval;
+
+      if m_retval > 0
+      then
+        --         update core.taskitem u
+--         set jsonvalue = jsonb_build_object('errorlist', j_tmp)
+--         where u.rid_taskitem = r_taskitem.rid_taskitem;
+
+        p_output =
+            jsonb_build_object('actionstatus', 'error', 'errorcode', 'ERRLIST', 'errorlist', j_tmp, 'delete_caller',
+                               true);
+      else
+        p_output =
+            jsonb_build_object('message', null, 'actionstatus', 'success', 'errorcode', null, 'delete_after', true,
+                               'errorlist', null);
+
+      end if;
+
+      perform log_event(m_funcname, format(E'List Function (%s) Results Code=%s Error=%s.
+      MasterTaskItem:%s \n p_output:%s \nm_errdetail:%s'
+        , m_exec_funcname
+        , p_errorcode
+        , p_errmsg
+        , r_mastertaskitem.description
+        , p_output
+        , m_errdetail
+                                    )
+        , bt_enum('eventlog', 'local error'));
+
+      return;
+
+      --m_retval =0;
+
+    elsif exists (
+      select ns.nspname, pro.*
+      from pg_proc pro
+      inner join pg_namespace ns on ns.oid = pro.pronamespace
+          and ns.nspname not in ('postgres', 'pg_catalog')
+          and ns.nspname = m_exec_schema
+      where pro.proname = m_exec_funcname
+      )
+    then
+      with
+        args as (
+          select ns.nspname
+               , pro.proname
+               , t.typname
+               , i.i
+               , pro.proargnames[i - 1] as argname
+               , pro.proargmodes[i - 1] as mode
+               , CASE
+                   WHEN pro.proargdefaults IS NOT NULL
+                     AND i.i - 1 > (pro.pronargs - pro.pronargdefaults)
+                     THEN split_part(
+                       pg_get_expr(pro.proargdefaults, 0),
+                       ',',
+                       i.i - 1 - (pro.pronargs - pro.pronargdefaults)
+                          )::text
+                   ELSE NULL::text
+                 END as default_value
+               , row_number() over (order by i.i) as number
+          --,pro.*
+          from pg_proc pro
+          inner join pg_namespace ns on ns.oid = pro.pronamespace
+              and ns.nspname not in ('postgres', 'pg_catalog')
+          JOIN LATERAL generate_subscripts(pro.proallargtypes, 1) AS i ON true
+          JOIN pg_type t ON t.oid = pro.proallargtypes[i - 1]
+          where
+              pro.proname = m_exec_funcname
+          and ns.nspname = m_exec_schema
+              --pro.proname in ('hsync_upload_clienttohyphen')
+          AND (pro.proargmodes IS NULL OR pro.proargmodes[i - 1] in ('i', 'b'))
+          )
+      , argval as (
+          select args.*
+            --, _bv(j_all_parms ->> args.argname,args.default_value) as argvalue
+               , case
+                   when nv(j_all_parms ->> args.argname) in ('', '0', 'null')
+                     and args.argname ilike 'p_%' and
+                        nv(j_all_parms ->> replace(args.argname, 'p_', '')) not in ('', '0', 'null')
+                     then j_all_parms ->> replace(args.argname, 'p_', '')
+
+                   when nv(j_all_parms ->> args.argname) <> '' then j_all_parms ->> args.argname
+                   when args.argname ilike 'p_%' and nv(j_all_parms ->> replace(args.argname, 'p_', '')) <> ''
+                     then j_all_parms ->> replace(args.argname, 'p_', '')
+                   when args.argname ilike 'p_login%' and j_all_parms ->> 'login' is not null
+                     then j_all_parms ->> 'login'
+                   when args.argname ilike 'p_user%' and j_all_parms ->> 'login' is not null
+                     then j_all_parms ->> 'login'
+
+                   when nv(args.default_value) <> '' then args.default_value
+                   else null::text
+                 end as argvalue
+          from args
+
+          )
+      select (
+        select string_agg(format('%s::%s', case
+                                             when a.typname ilike '%int%' then a.argvalue
+                                             else quote_literal(a.argvalue)
+                                           end, a.typname), ', ') as args
+        from argval a
+        )
+           , (
+        select count(1)
+        from argval a
+        where a.argvalue is null
+        )
+           , (
+        select format('[ECR0002] Cannot execute function %s. The following arguments are missing: %s  (Defaults: %s) ',
+                      m_exec_funcname, string_agg(a.argname, ','), string_agg(a.default_value, ','))
+        from argval a
+        where a.argvalue is null
+        )
+      into m_sql,m_retval, m_errmsg, m_errcode;
+
+      raise notice 'Function % executed with arguments: %', m_exec_funcname, m_sql;
+
+      if m_retval > 0
+      then
+        p_retval = 1;
+        p_errmsg = m_errmsg;
+        select m.v[1]
+        from regexp_matches(p_errmsg, '\[([^\]]+)\]', 'ig') m(v)
+        where length(m.v[1]) between 2 and 10
+        order by m.v[1]
+        into p_errorcode;
+
+        perform log_event(m_funcname, format(
+            E'Error on Function (%s) Code=%s Error=%s. MasterTaskItem:%s \n SQL:%s \n j_all_parms:%s \n Controls: %s'
+          , m_exec_funcname
+          , p_errorcode
+          , p_errmsg
+          , r_mastertaskitem.description
+          , m_sql
+          , substr((j_all_parms || jsonb_build_object('AOP', null))::text, 1, 100000)
+          , j_controls::text
+                                      )
+          , bt_enum('eventlog', 'local error'));
+
+        return;
+      end if;
+
+      m_sql = format('select to_jsonb(r) as val from %s.%s(%s) r ;', m_exec_schema, m_exec_funcname, m_sql);
+
+      perform log_event(m_funcname, format('Executing Function (%s) with SQL: %s', m_exec_funcname, m_sql),
+                        bt_enum('eventlog', 'local notice'));
+
+      if m_exec_funcname::citext = any (a_broker_procs)
+      then
+        select r.p_retval, r.p_errmsg
+        from agent_job_add(format('exec  %s', m_sql)
+          , get_agent_freequeue(3)
+          , format('%s(taskitemevent=%s)', m_exec_funcname, r_taskitemevent.rid_taskitemevent)
+          , 15
+             ) r
+        into m_retval,m_errmsg;
+
+      elsif m_exec_funcname::citext = any (a_async_procs)
+      then
+        select _bv(j.val -> 'val', j.val)
+        from autoexec_query(m_sql, jsonb_build_object()) j(val)
+        into j_output;
+
+      else
+        execute m_sql into j_output;
+      end if;
+
+      p_output = j_output;
+
+      if p_event_parameters ->> 'no_error' in ('1', 'true') or p_item_parameters ->> 'no_error' in ('1', 'true')
+      then
+        select m.v[1]
+        from regexp_matches(p_errmsg, '\[([^\]]+)\]', 'ig') m(v)
+        where length(m.v[1]) between 2 and 10
+        order by m.v[1]
+        into p_errorcode;
+
+        perform log_event(m_funcname, format('Error(!) on Function (%s) Code=%s Error=%s. MasterTaskItem:%s Response:%s'
+          , m_exec_funcname
+          , p_errorcode
+          , p_errmsg
+          , r_mastertaskitem.description
+          , substr(j_output::text, 1, 10000)
+                                      )
+          , bt_enum('eventlog', 'local error'));
+
+        return;
+      end if;
+
+      if jsonb_typeof(j_output) in ('number', 'boolean', 'string')
+      then
+        perform log_event(m_funcname,
+                          format('Function (%s) returned scalar value: %s', m_exec_funcname, j_output::text),
+                          bt_enum('eventlog', 'debug'));
+
+        if j_all_parms -> 'p_output' is not null
+          and (j_all_parms ->> 'p_output')::citext is distinct from j_output::citext
+        then
+          p_retval = 1;
+          p_errmsg =
+              'Output value does not match expected value. Expected: ' || j_all_parms ->> 'p_output' || ' Actual: ' ||
+              j_output::text;
+          return;
+
+        end if;
+      end if;
+
+      if _try_integer(j_output ->> 'p_retval', 0) > 0
+        and m_exec_funcname::citext <> all (a_noerror_procs)
+      then
+        p_retval = _try_integer(j_output ->> 'p_retval', 0);
+        p_errmsg = format('%s', j_output ->> 'p_errmsg');
+        p_errorcode = _bv(j_output ->> 'p_error_code', j_output ->> 'p_errorcode', '');
+
+
+        perform log_event(m_funcname, format('Error on Function (%s) Code=%s Error=%s. MasterTaskItem:%s Response:%s'
+          , m_exec_funcname
+          , p_errorcode
+          , p_errmsg
+          , r_mastertaskitem.description
+          , substr(j_output::text, 1, 10000)
+                                      )
+          , bt_enum('eventlog', 'local error'));
+
+
+        if nv(p_errorcode) = ''
+        then
+          select m.v[1]
+          from regexp_matches(p_errmsg, '\[([^\]]+)\]', 'ig') m(v)
+          where length(m.v[1]) between 2 and 10
+          order by m.v[1]
+          into p_errorcode;
+
+          if nv(p_errorcode) = ''
+          then
+            p_errorcode = 'ECR0003';
+          end if;
+        end if;
+        return;
+      end if;
+
+    else
+      perform log_event(m_funcname, format('Function (%s) not defined for this event (%s).',
+                                           p_event_parameters -> 'AFN_RID_ACTIONFUNCTION_CODE' ->> 'functionname'
+        , r_mastertaskitem.description)
+        , bt_enum('eventlog', 'local error'));
+
+      select m.v[1]
+      from regexp_matches(p_errmsg, '\[([^\]]+)\]', 'ig') m(v)
+      where length(m.v[1]) between 2 and 10
+      order by m.v[1]
+      into p_errorcode;
+
+      return;
+    end if;
+
+
+  else
+    raise notice 'Type not supported: %', p_event_parameters -> 'AFN_RID_ACTIONFUNCTION_CODE' ->> 'fntype';
+  end if;
+
+  --select * from core.actionfunction
+  if nv(p_errorcode) = '' and nv(p_errmsg) <> ''
+  then
+    select m.v[1]
+    from regexp_matches(p_errmsg, '\[([^\]]+)\]', 'ig') m(v)
+    where length(m.v[1]) between 2 and 10
+    order by m.v[1]
+    into p_errorcode;
+
+    if nv(p_errorcode) = ''
+    then
+      p_errorcode = 'PRCERR';
+    end if;
+  end if;
+
+EXCEPTION
+  WHEN others THEN
+    GET STACKED DIAGNOSTICS
+      m_errmsg = MESSAGE_TEXT
+      ,m_errcontext = PG_EXCEPTION_CONTEXT
+      ,m_errdetail = PG_EXCEPTION_DETAIL
+      ,m_errhint = PG_EXCEPTION_HINT
+      ,m_errstate = RETURNED_SQLSTATE;
+
+    p_errmsg := get_err_msg(m_funcname, m_errmsg, m_errcontext, m_errdetail, m_errhint, m_errstate);
+    p_retval = 1;
+    if nv(p_errorcode) = '' and nv(p_errmsg) <> ''
+    then
+      select m.v[1]
+      from regexp_matches(p_errmsg, '\[([^\]]+)\]', 'ig') m(v)
+      where length(m.v[1]) between 2 and 10
+      order by m.v[1]
+      into p_errorcode;
+
+      if nv(p_errorcode) = ''
+      then
+        p_errorcode = 'PRCERR';
+      end if;
+    end if;
+END;
+$$;
+
+
+--Tests
+/*
+select  (regexp_matches('[ECR0001] No AFN inside the AOP pack.', '\[([^\]]+)\]'))[1]
+,  (regexp_matches('[21] No AFN inside the AOP pack. [45345]', '\[([^\]]+)\]'))[1]
+,  (regexp_matches('A Test', '\[([^\]]+)\]'))[1]
+ */
+/*
+select *
+from core.taskitemevent e
+where e.rid_taskitem = 26344
+limit
+;*/
+
+/*
+select *
+from core.event_exec_func((
+    select  _jsonb_object_cat( to_jsonb(e)
+              ,jsonb_build_object('AFN_RID_ACTIONFUNCTION_CODE',to_jsonb(af)))
+    from core.taskitemevent e
+      inner join core.taskitem ti on ti.rid_taskitem = e.rid_taskitem
+    inner join core.actionoption ao on ao.guid = ti.jsonvalue -> 'AOP' ->> 'guid'
+    inner join core.actionfunction af on af.rid_actionfunction = ao.rid_actionfunction_code
+    where e.rid_taskitem = 26344
+                           ),(select  _jsonb_object_cat( to_jsonb(e)
+                                                                  ,jsonb_build_object('AFN_RID_ACTIONFUNCTION_CODE',to_jsonb(af)))
+                                                        from core.taskitem e
+                                                        inner join core.mastertaskitem mti
+                                                          on mti.rid_mastertaskitem = e.rid_mastertaskitem
+                                                        inner join core.actionoption ao on ao.guid = e.jsonvalue -> 'AOP' ->> 'guid'
+                                                        inner join core.actionfunction af on af.rid_actionfunction = ao.rid_actionfunction_code
+                                                        where e.rid_taskitem = 26344
+                              ))
+
+
+selecT * from v_eventlog
+
+select * from core.taskitem ti
+order by ti.rid_taskitem desc
+
+ */

testdata/corpus/5796956_create_core.ui_action_event.pgsql

@@ -0,0 +1,613 @@
+--select * from dropall('ui_action_event','core');
+CREATE OR REPLACE FUNCTION core.ui_action_event(
+  p_payload INOUT jsonb
+, OUT p_retval integer
+, OUT p_errmsg text
+)
+  LANGUAGE plpgsql
+  VOLATILE
+  SECURITY DEFINER
+AS
+$$
+DECLARE
+  --Error Handling--
+  m_funcname            text    = 'core.ui_action_event';
+  m_errmsg              text;
+  m_errcontext          text;
+  m_errdetail           text;
+  m_errhint             text;
+  m_errstate            text;
+  m_retval              integer;
+  --Error Handling--
+  m_rid_hub             integer;
+  m_rid_hub_link        integer;
+  m_rid_hub_user        integer;
+  m_temp_rid            integer;
+  m_final_rid_taskitem  integer;
+  m_temp_rid_list       integer[];
+  m_status              integer;
+  m_outcome             integer;
+  r_mastertaskitemevent core.mastertaskitemevent%rowtype;
+  r_taskitem            core.taskitem%rowtype;
+  r_taskitemevent       core.taskitemevent%rowtype;
+  r_mastertaskitem      core.mastertaskitem%rowtype;
+  r_mastertask          core.mastertask%rowtype;
+  r_lp                  record;
+  m_check_error         boolean := false;
+  m_cancel              boolean := false;
+  j_result              jsonb;
+  j_obj                 jsonb;
+  m_tm                  timestamp ;
+BEGIN
+  m_tm = clock_timestamp();
+  p_retval = 0;
+  p_errmsg = '';
+  j_result = jsonb_build_array();
+
+  m_rid_hub = _try_integer(p_payload ->> 'rid_hub', 0);
+  m_rid_hub_user = _try_integer(p_payload ->> 'rid_hub_user', core.f_get_user_hub_rid());
+  m_status = _try_integer(p_payload ->> 'status', 0);
+  m_outcome = _try_integer(p_payload ->> 'outcome', 0);
+  m_check_error = (p_payload ->> 'check_error')::citext in ('1', 'true');
+  m_cancel = (p_payload ->> 'cancel')::citext in ('1', 'true');
+
+  select *
+  from core.mastertaskitemevent mte
+  where mte.rid_mastertaskitemevent = _try_integer(p_payload ->> 'rid_mastertaskitemevent', 0)
+  into r_mastertaskitemevent;
+
+  select mti.*
+  from core.mastertaskitem mti
+  where
+     mti.rid_mastertaskitem = _try_integer(p_payload ->> 'rid_mastertaskitem', 0)
+       and _try_integer(p_payload ->> 'rid_mastertaskitem', 0) > 0
+  or mti.rid_mastertaskitem = r_mastertaskitemevent.rid_mastertaskitem
+  into r_mastertaskitem;
+
+  select mt.*
+  from core.mastertask mt
+  where
+     mt.rid_mastertask = _try_integer(p_payload ->> 'rid_mastertask', 0)
+       and _try_integer(p_payload ->> 'rid_mastertask', 0) > 0
+  or mt.rid_mastertask = r_mastertaskitem.rid_mastertask
+  into r_mastertask;
+
+  select *
+  from core.taskitem ti
+  where ti.rid_taskitem = _try_integer(p_payload ->> 'rid_taskitem', 0)
+  into r_taskitem;
+
+  if r_taskitem.rid_taskitem > 0
+  then
+    perform set_config('session.rid_taskitem', r_taskitem.rid_taskitem::text, false);
+  end if;
+
+  if nv(r_mastertaskitem.rid_mastertaskitem) = 0
+  then
+    if r_taskitem.rid_taskitem > 0
+    then
+      select *
+      from core.mastertaskitem mti
+      where mti.rid_mastertaskitem = r_taskitem.rid_mastertaskitem
+      into r_mastertaskitem;
+    elsif r_mastertask.rid_mastertask > 0
+    then
+      select *
+      from core.mastertaskitem mti
+      where
+          mti.rid_mastertask = r_mastertask.rid_mastertask
+      and coalesce(mti.inactive, 0) = 0
+      and coalesce(mti.rid_parentmastertaskitem, 0) = 0
+      order by mti.seqno nulls first, mti.rid_mastertaskitem
+      limit 1
+      into r_mastertaskitem;
+    end if;
+  end if;
+
+  if nv(r_mastertaskitemevent.rid_mastertaskitemevent) = 0
+  then
+    if r_mastertaskitem.rid_mastertaskitem > 0
+    then
+      select *
+      from core.mastertaskitemevent mte
+      where
+          mte.rid_mastertaskitem = r_mastertaskitem.rid_mastertaskitem
+      and coalesce(mte.inactive, 0) = 0
+      and mte.status in (1, 2)
+      order by mte.status desc, mte.seqno nulls first, mte.rid_mastertaskitemevent
+      limit 1
+      into r_mastertaskitemevent;
+    end if;
+
+  end if;
+
+  ---Check error handler
+  if m_check_error
+  then
+    if nv(r_mastertaskitemevent.status) <> 13
+    then
+      select evt.*
+      from core.mastertaskitemevent evt
+      where
+          evt.rid_mastertaskitem = r_mastertaskitem.rid_mastertaskitem
+      and evt.status = 13
+      order by evt.seqno desc, evt.rid_mastertaskitemevent desc
+      into r_mastertaskitemevent;
+    end if;
+
+    --perform log_event(m_funcname,format('Init check error for rid_mastertaskitem:%s hub:%s ',r_mastertaskitemevent.rid_mastertaskitem,m_rid_hub),bt_enum('eventlog','local notice'));
+
+    if r_mastertaskitemevent.rid_mastertaskitemevent > 0
+    then
+      select r.p_retval, r.p_errmsg, r.p_parms
+      from core.action_init('mastertaskitemevent', r_mastertaskitemevent.rid_mastertaskitemevent
+        , _jsonb_object_cat(p_payload,
+                            jsonb_build_object('check_error', true, 'rid_hub', m_rid_hub, 'createmode', 'existing'))
+           ) r
+      into m_retval,m_errmsg, p_payload;
+
+      if m_retval > 0
+      then
+        p_retval = m_retval;
+        p_errmsg = m_errmsg;
+        return;
+      end if;
+    else
+      p_retval = 0;
+      p_errmsg = 'Error check enabled but no error event found for mastertaskitem.';
+    end if;
+
+    return;
+  end if;
+
+  ---Check cancel handler
+  if m_cancel
+  then
+    if nv(r_mastertaskitemevent.status) <> 6
+    then
+      select evt.*
+      from core.mastertaskitemevent evt
+      where
+          evt.rid_mastertaskitem = r_mastertaskitem.rid_mastertaskitem
+      and evt.status = 6
+      order by evt.seqno desc, evt.rid_mastertaskitemevent desc
+      into r_mastertaskitemevent;
+    end if;
+
+    perform log_event(m_funcname,
+                      format('Init cancel for rid_mastertaskitem:%s hub:%s ', r_mastertaskitemevent.rid_mastertaskitem,
+                             m_rid_hub), bt_enum('eventlog', 'local notice'));
+
+    if r_mastertaskitemevent.rid_mastertaskitemevent > 0
+    then
+      select r.p_retval, r.p_errmsg, r.p_parms
+      from core.action_init('mastertaskitemevent', r_mastertaskitemevent.rid_mastertaskitemevent
+        , _jsonb_object_cat(p_payload,
+                            jsonb_build_object('cancel', true, 'rid_hub', m_rid_hub, 'createmode', 'existing'))
+           ) r
+      into m_retval,m_errmsg, p_payload;
+
+      if m_retval > 0
+      then
+        p_retval = m_retval;
+        p_errmsg = m_errmsg;
+        return;
+      end if;
+    else
+      p_retval = 0;
+      p_errmsg = 'cancel called but no cancel event found for mastertaskitem.';
+    end if;
+
+    return;
+  end if;
+
+
+  if nv(m_rid_hub) = 0 and r_taskitem.rid_taskitem > 0 and r_taskitem.rid_hub > 0
+  then
+    m_rid_hub = r_taskitem.rid_hub;
+  end if;
+
+  --perform log_event(m_funcname,format('Init %s(%s) m_rid_hub: %s p_payload: %s',r_taskitem.description,r_taskitem.rid_taskitem,m_rid_hub,p_payload::text),bt_enum('eventlog','local notice'));
+
+  if nv(m_rid_hub) = 0
+  then
+    p_errmsg := 'Missing required parameter: rid_hub';
+    p_retval = 1;
+    return;
+  end if;
+
+  if nv(r_mastertaskitemevent.rid_mastertaskitemevent) = 0
+  then
+    p_errmsg := 'Missing required parameter: rid_mastertaskitemevent';
+    p_retval = 1;
+    return;
+  end if;
+
+  perform log_event(m_funcname,
+                    format(E'Init rid_mastertaskitemevent %s for rid_mastertaskitem:%s hub:%s \np_payload:%s',
+                           r_mastertaskitemevent.rid_mastertaskitemevent, r_mastertaskitem.rid_mastertaskitem,
+                           m_rid_hub, p_payload), bt_enum('eventlog', 'local notice'));
+
+  select r.p_retval, r.p_errmsg, r.p_a_rid_taskitem
+  from core.taskitem_get_or_prime(_jsonb_object_cat(p_payload, jsonb_build_object(
+      'parent_rid_taskitem', case
+                               when r_taskitem.rid_taskitem = _try_integer(p_payload ->> 'parent_rid_taskitem', 0)
+                                 then r_taskitem.rid_taskitem_parentaction
+                               else _try_integer(p_payload ->> 'parent_rid_taskitem',
+                                                 r_taskitem.rid_taskitem_parentaction)
+                             end
+    , 'rid_mastertaskitem', r_mastertaskitem.rid_mastertaskitem
+    , 'rid_mastertaskitemevent', r_mastertaskitemevent.rid_mastertaskitemevent
+    , 'status', r_mastertaskitemevent.status
+    , 'create_mode', p_payload ->> 'create_mode'
+    --,'create_mode','new'
+                                                               ))) r
+  into m_retval,m_errmsg,m_temp_rid_list;
+
+  if m_retval > 0
+  then
+    raise 'Error initializing taskitem %',m_errmsg;
+  end if;
+
+  for m_temp_rid in select * from unnest(m_temp_rid_list)
+    loop
+
+      select *
+      from core.taskitem ti
+      where ti.rid_taskitem = m_temp_rid
+      into r_taskitem;
+
+      if nv(r_taskitem.rid_taskitem) = 0
+      then
+        p_retval = 1;
+        p_errmsg = format('Task item not created or found. %s', m_temp_rid);
+        return;
+      end if;
+
+
+      select tie.*
+      from core.taskitemevent tie
+      where
+          tie.rid_mastertaskitemevent = r_mastertaskitemevent.rid_mastertaskitemevent
+      and tie.rid_taskitem = r_taskitem.rid_taskitem
+      into r_taskitemevent;
+
+      --raise exception 'Show me the error: % %',r_taskitemevent.rid_taskitemevent, r_taskitemevent.rid_taskitem;
+      --raise notice 'New/Update r_taskitemevent? %',r_taskitemevent;
+--     if r_taskitem.rid_taskitem > 0
+--       and p_payload->'jsonvalue'->>'errorcode' is not null
+--     then
+--       update core.taskitem u
+--       set jsonvalue = _jsonb_object_cat(u.jsonvalue, jsonb_build_object(
+--           'errorcode', _bv(p_payload->'jsonvalue'->>'errorcode',u.jsonvalue->>'errorcode')
+--         ,'errormessage',_bv( p_payload->'jsonvalue'->>'errormessage',u.jsonvalue->>'errormessage')
+--         ,'alerttype', _bv(p_payload->'jsonvalue'->>'alerttype',u.jsonvalue->>'alerttype')
+--                                                      ))
+--       where u.rid_taskitem = r_taskitem.rid_taskitem;
+--
+--     end if; 
+
+      if r_taskitemevent.rid_taskitemevent > 0
+      then
+
+
+        update core.taskitemevent u
+        set
+          retval = 0
+        , errmsg = null
+        , jsonvalue = _jsonb_object_cat(u.jsonvalue, (
+          select mte.jsonvalue
+          from core.mastertaskitemevent mte
+          where mte.rid_mastertaskitemevent = u.rid_mastertaskitemevent
+          limit 1
+          ), p_payload -> 'jsonvalue')
+        where u.rid_taskitemevent = r_taskitemevent.rid_taskitemevent;
+
+        select r.p_retval, r.p_errmsg
+        from core.event_created(r_taskitemevent.rid_taskitemevent
+          , jsonb_build_object('operation', 'UPDATE')) r
+        into m_retval,m_errmsg;
+
+        if m_retval > 0
+        then
+          raise '%',m_errmsg;
+        end if;
+
+        select e.*
+        from core.taskitemevent e
+        where e.rid_taskitemevent = r_taskitemevent.rid_taskitemevent
+        into r_taskitemevent;
+
+        if length(r_taskitemevent.errmsg) > 0
+        then
+          p_retval = 1;
+          p_errmsg = r_taskitemevent.errmsg;
+        end if;
+
+
+      else
+
+
+        insert
+        into core.taskitemevent( createddatetime, description, rid_mastertaskitemevent, rid_taskitem, status
+          --, duedatetime
+          --, escalated
+                               , jsonvalue, outcome, rid_hub_user, retval)
+        select now()
+             , r_mastertaskitemevent.description
+             , r_mastertaskitemevent.rid_mastertaskitemevent
+             , r_taskitem.rid_taskitem
+             , _bv(r_mastertaskitemevent.status, m_status)
+             , _jsonb_object_cat((
+                                   select mte.jsonvalue
+                                   from core.mastertaskitemevent mte
+                                   where mte.rid_mastertaskitemevent = r_mastertaskitemevent.rid_mastertaskitemevent
+                                   limit 1
+                                   ), p_payload -> 'jsonvalue')
+             , m_outcome
+             , m_rid_hub_user
+             , 0
+        where
+          not exists (
+            select 1
+            from core.taskitemevent tie
+            where
+                tie.rid_mastertaskitemevent = r_mastertaskitemevent.rid_mastertaskitemevent
+            and tie.rid_taskitem = r_taskitem.rid_taskitem
+            )
+        returning taskitemevent.*
+          into r_taskitemevent;
+
+        --       select r.p_retval,r.p_errmsg
+--       from core.event_created(r_taskitemevent.rid_taskitemevent
+--         ,jsonb_build_object('operation','UPDATE')) r
+--       into m_retval,m_errmsg;
+--
+--       if m_retval > 0
+--       then
+--         raise '%',m_errmsg;
+--       end if;
+
+
+        select e.*
+        from core.taskitemevent e
+        where e.rid_taskitemevent = r_taskitemevent.rid_taskitemevent
+        into r_taskitemevent;
+
+        if length(r_taskitemevent.errmsg) > 1
+        then
+          p_retval = 1;
+          p_errmsg = r_taskitemevent.errmsg;
+        end if;
+
+      end if;
+
+      with
+        recursive
+        tasklist_events as (
+          select ti.rid_taskitem
+               , 1 as level
+               , coalesce(ti.seqno, 0) as seqno
+               , ti.status
+          from core.taskitem ti
+          inner join core.mastertaskitem mti on mti.rid_mastertaskitem = ti.rid_mastertaskitem
+          where
+            (ti.rid_tasklist = r_taskitem.rid_tasklist
+              or ti.rid_tasklist in (
+                select tl.rid_tasklist_parent
+                from core.tasklistlink tl
+                where tl.rid_tasklist_child = r_taskitem.rid_tasklist
+                union
+                select tl.rid_tasklist_child
+                from core.tasklistlink tl
+                where tl.rid_tasklist_parent = r_taskitem.rid_tasklist
+                )
+              )
+          --         and mti.rid_mastertaskitem in (
+--           select ev2.rid_mastertaskitem
+--           from core.mastertaskitemeventreaction er
+--           inner join core.mastertaskitemevent ev2 on ev2.rid_mastertaskitemevent = er.rid_mastertaskitemevent_target
+--           where er.rid_mastertaskitemevent = r_taskitemevent.rid_mastertaskitemevent
+--         )
+          union
+          select ti.rid_taskitem
+               , te.level + 1
+               , coalesce(ti.seqno, 0) as seqno
+               , ti.status
+          from core.taskitem ti
+          inner join tasklist_events te on te.rid_taskitem = ti.rid_parenttaskitem
+
+          )
+      select e.rid_taskitem
+      from tasklist_events e
+      where nv(e.status) in (2, 10)
+      order by e.level desc, e.status desc, e.seqno desc
+      limit 1
+      into m_final_rid_taskitem;
+
+      j_obj = _jsonb_object_cat(to_jsonb(r_taskitemevent), jsonb_build_object(
+          'jsonvalue', _jsonb_object_cat(r_taskitemevent.jsonvalue, jsonb_build_object(
+              'rid_tasklist', r_taskitem.rid_tasklist,
+              'rid_tasklist_event', (
+                select jsonb_agg(distinct ti.rid_tasklist)
+                from core.mastertaskitemeventreaction er
+                inner join core.mastertaskitemevent mtiet
+                             on mtiet.rid_mastertaskitemevent = er.rid_mastertaskitemevent_target
+                inner join core.taskitem ti on ti.rid_mastertaskitem = mtiet.rid_mastertaskitem
+                    and ti.rid_hub = r_taskitem.rid_hub
+                    and ti.rid_tasklist = r_taskitem.rid_tasklist
+                where er.rid_mastertaskitemevent = r_taskitemevent.rid_mastertaskitemevent
+                )
+            , 'rid_tasklist_next', (
+                select jsonb_agg(distinct tl.rid_tasklist)
+                from core.taskitem ti
+                inner join core.mastertaskitem mti on mti.rid_mastertaskitem = ti.rid_mastertaskitem
+                inner join core.mastertask mtj on mti.guid = mti.jsonvalue ->> 'guid_mastertask_next'
+                inner join core.tasklist tl on tl.rid_mastertask = mtj.rid_mastertask
+                    and tl.rid_hub = r_taskitem.rid_hub
+                where ti.rid_taskitem = r_taskitemevent.rid_taskitem
+                )
+            , 'select_taskitem_guid', (
+                select ti.guid
+                from core.taskitem ti
+                where
+                  (m_final_rid_taskitem > 0
+                     and ti.rid_taskitem = m_final_rid_taskitem
+                    or nv(m_final_rid_taskitem) = 0
+                     and ti.rid_tasklist = r_taskitem.rid_tasklist
+                    )
+                order by
+                  case
+                    when ti.status in (10) then 2
+                    when ti.status in (0, 1, 2) then 1
+                    else 99
+                  end
+                , ti.status desc, ti.seqno desc
+                limit 1
+                )
+            , 'openactions', (
+                select count(ti.rid_taskitem) filter ( where
+                  coalesce(ti.status, 0) in (
+                                             core._enumi('eventstatus', 'todo'), core._enumi('eventstatus', 'planned')
+                    )
+                  )
+                from core.taskitem ti
+                where
+                    ti.rid_tasklist in (
+                      select r_taskitem.rid_tasklist
+                      union
+                      select tl.rid_tasklist_child
+                      from core.tasklistlink tl
+                      where tl.rid_tasklist_parent = r_taskitem.rid_tasklist
+                      union
+                      select tl.rid_tasklist_parent
+                      from core.tasklistlink tl
+                      where tl.rid_tasklist_child = r_taskitem.rid_tasklist
+                      )
+                and nv(ti.subitem) = 0
+                and coalesce(ti.status, 0) <> coalesce(core._enumi('eventstatus', 'Canceled'), 0)
+                )
+                                                                    ))
+        , 'WFL', to_jsonb(r_taskitem)));
+
+      j_obj = _jsonb_object_cat(j_obj
+        , jsonb_build_object('jsonvalue'
+                                  , _jsonb_object_cat(
+                                 j_obj -> 'jsonvalue'
+                               , jsonb_build_object('complete'
+                                   , (j_obj -> 'jsonvalue' ->> 'rid_tasklist_event' is null
+                        and j_obj -> 'jsonvalue' ->> 'rid_tasklist_next' is null
+                        and _try_integer(j_obj -> 'jsonvalue' ->> 'openactions', 0) = 0
+                        and nv(r_taskitemevent.jsonvalue ->> 'errorcode') not ilike 'E%'
+                                                      )
+                                 )
+                                    )
+          )
+              );
+
+      j_result = j_result || j_obj;
+
+      if m_final_rid_taskitem > 0 and m_final_rid_taskitem is distinct from r_taskitem.rid_taskitem
+      then
+        j_obj = _jsonb_object_cat(to_jsonb(ev), jsonb_build_object(
+            'jsonvalue', jsonb_build_object(
+                'rid_tasklist', ti.rid_tasklist
+              , 'select_taskitem_guid', (
+                  select ti.guid
+                  from core.taskitem ti
+                  where
+                    (m_final_rid_taskitem > 0
+                       and ti.rid_taskitem = m_final_rid_taskitem
+                      or nv(m_final_rid_taskitem) = 0
+                       and ti.rid_tasklist = r_taskitem.rid_tasklist
+                      )
+                  order by case when ti.status in (0, 1, 2) then 1 else 99 end, ti.status desc, ti.seqno desc
+                  limit 1
+                  )
+              , 'openactions', (
+                  select count(ti.rid_taskitem) filter ( where
+                    coalesce(ti.status, 0) in (
+                                               core._enumi('eventstatus', 'todo'), core._enumi('eventstatus', 'planned')
+                      )
+                    )
+                  from core.taskitem ti
+                  where
+                      ti.rid_tasklist = r_taskitem.rid_tasklist
+                  and nv(ti.subitem) = 0
+                  and coalesce(ti.status, 0) <> coalesce(core._enumi('eventstatus', 'Canceled'), 0)
+                  limit 1
+                  )
+                         )
+          , 'WFL', to_jsonb(ti)
+                                                )
+                )
+        from core.taskitem ti
+        inner join lateral (
+            select *
+            from core.taskitemevent ev
+            where
+                ev.rid_taskitem = ti.rid_taskitem
+            and ev.status in (2, 4)
+            order by ev.status desc
+            limit 1
+            ) ev on ev.rid_taskitem = ti.rid_taskitem
+        where ti.rid_taskitem = m_final_rid_taskitem;
+
+        j_result = j_result || j_obj;
+      end if;
+
+
+    end loop;
+
+  --perform log_event(m_funcname,format('Result j_result: %s',j_result),bt_enum('eventlog','local notice'));
+
+  p_payload = j_result;
+EXCEPTION
+  WHEN others THEN
+    GET STACKED DIAGNOSTICS
+      m_errmsg = MESSAGE_TEXT
+      ,m_errcontext = PG_EXCEPTION_CONTEXT
+      ,m_errdetail = PG_EXCEPTION_DETAIL
+      ,m_errhint = PG_EXCEPTION_HINT
+      ,m_errstate = RETURNED_SQLSTATE;
+
+    p_errmsg := get_err_msg(m_funcname, m_errmsg, m_errcontext, m_errdetail, m_errhint, m_errstate);
+    p_retval = 1;
+    perform log_event(m_funcname, format('Benchmark Err %s Items: %s', array_length(m_temp_rid_list, 1),
+                                         (clock_timestamp() - m_tm)::interval::text),
+                      bt_enum('eventlog', 'local notice'));
+
+END;
+$$;
+
+
+/*
+select * from core.ui_action_event(jsonb_build_object('check_error',true
+  ,'rid_mastertaskitem',(
+
+  select mti.rid_mastertaskitem from core.mastertaskitem mti
+  where mti.guid = '7a7348ec-7db6-4f13-bca7-c7840de1d22c'
+),'rid_hub',20405))
+;
+
+select * from core.ui_action_event(jsonb_build_object('check_error',true
+  ,'rid_mastertaskitem',(
+
+  select mti.rid_mastertaskitem from core.mastertaskitem mti
+  where mti.guid = '7a7348ec-7db6-4f13-bca7-c7840de1d22c'
+),'rid_hub',20405))
+;
+
+select * from v_eventlog
+
+selecT * from core.taskitem ti
+order by ti.rid_taskitem desc
+
+
+  select mti.rid_mastertask,mti.rid_mastertaskitem, mti.description, mti.guid from core.mastertaskitem mti order by mti.rid_mastertaskitem desc;
+
+
+ */
+
+
+--select cli.rid_hub from t_adproclient cli  where cli.clientid = '92092101980891'

testdata/corpus/test_a.pgsql

@@ -1,28 +1,28 @@
---select * from dropall('resolvespec_login');
+--select * from dropall('resolvespec_login');
 CREATE OR REPLACE FUNCTION resolvespec_login(
-   INOUT p_data jsonb
-  ,OUT p_success boolean
-  ,OUT p_error text
+  INOUT p_data jsonb
+, OUT p_success boolean
+, OUT p_error text
 )
-LANGUAGE plpgsql
-VOLATILE
-SECURITY DEFINER
+  LANGUAGE plpgsql
+  VOLATILE
+  SECURITY DEFINER
 AS
-$$
+$$
 DECLARE
-  --Error Handling--
-  m_funcname text = 'resolvespec_login';
-  m_errmsg text;
-  m_errcontext text;
-  m_errdetail text;
-  m_errhint text;
-  m_errstate text;
-  m_retval integer;
-  --Error Handling--
-  m_rid_user integer;
-  m_rid_hub integer;
-  m_pass_hashed citext[];
-  m_session jsonb;
+  --Error Handling--
+  m_funcname        text = 'resolvespec_login';
+  m_errmsg          text;
+  m_errcontext      text;
+  m_errdetail       text;
+  m_errhint         text;
+  m_errstate        text;
+  m_retval          integer;
+  --Error Handling--
+  m_rid_user        integer;
+  m_rid_hub         integer;
+  m_pass_hashed     citext[];
+  m_session         jsonb;
   m_allow_hash_auth boolean;
 BEGIN
   m_allow_hash_auth = _try_integer( p_data->'claims'->>'rid_user',0) > 0;
@@ -134,8 +134,6 @@ BEGIN
     where u.rid_hub = m_rid_hub;
   end if;
 
-
-
   select jsonb_build_object('token', m_session ->>'token'
            , 'session', m_session ->>'session'
            , 'user', _jsonb_object_cat(jsonb_build_object(

testdata/corpus/test_do_prime.pgsql

@@ -0,0 +1,158 @@
+DO
+$$
+DECLARE
+  m_programtype citext;
+  m_ins integer;
+  m_upd integer;
+  m_retval bigint;
+BEGIN
+
+  select s.setvalue
+  from core.setting s
+  where s.setname = 'programtype'
+    and nv(s.disableflag) = 0
+  into m_programtype;
+
+  --select newid()
+  insert into core.mastertype(category, mastertype, description, inactive, forprefix,guid)
+  select *
+  from (
+  values
+       ('module','system','Required System Module',0,'','2D4EFDEA-4E7D-4998-8E2A-1F2B67770983')
+  ) r(category, mastertype, description, inactive, forprefix,guid)
+   where not exists (
+      select 1 from core.mastertype mt
+      where mt.mastertype = r.mastertype
+        and mt.category = r.category
+    );
+
+
+  update core.mastertype u
+  set jsonvalue = _jsonb_object_cat(u.jsonvalue,jsonb_build_object('subtypes',jsonb_build_array('mergetype','mergetargettype')))
+  where u.category = 'docgentype'
+    and u.mastertype = 'merge'
+  ;
+
+  ----Merge Target Type
+  with src(category, mastertype, description, inactive, forprefix,guid,rid_parent) as (
+    select *
+         , (
+      select mt.rid_mastertype from core.mastertype mt where mt.guid = '5004E9EC-2E4B-4B36-814C-CFD96EFB434B' limit 1
+      ) --docvault
+    from (
+      values ('mergetargettype', 'html', 'HTML', 0, '', '479C8772-52C5-418F-B4FD-FA5F511831E8')
+           , ('mergetargettype', 'docx', 'Word Document', 0, '', '4899A6E6-467F-41BE-95EE-C3A3938C57C1')
+           , ('mergetargettype', 'xlsx', 'Excel Document', 0, '', 'AB40EC69-9CEE-4834-A1AC-B317CC47D679')
+           , ('mergetargettype', 'csv', 'Comma Separated Values (CSV)', 0, '', 'D8EE416A-6A40-4F09-80A7-2576278512AA')
+           , ('mergetargettype', 'pdf', 'PDF', 0, '', '3776F161-1BF8-474C-8C1A-097D851D6BF9')
+           , ('mergetargettype', 'same', 'Same as Source', 0, '', 'C7797F0B-5702-4B54-B102-0B610D62730C')
+      ) r(category, mastertype, description, inactive, forprefix, guid)
+  ), ins as (
+    insert into core.mastertype (category, mastertype, description, inactive, forprefix, guid, rid_parent)
+    select category, mastertype, description, inactive, forprefix, guid, rid_parent
+    from src
+    where
+      not exists (
+        select 1
+        from core.mastertype mt2
+        where
+            mt2.category = src.category
+        and mt2.mastertype = src.mastertype
+        )
+      returning mastertype.*
+  ), upd as (
+    update core.mastertype u
+    set description = s.description
+      , inactive = s.inactive
+      , forprefix = s.forprefix
+      , guid = s.guid
+      , rid_parent = s.rid_parent
+    from src s
+    where u.category = s.category
+      and u.mastertype = s.mastertype
+      and (
+          u.description is distinct from s.description
+          or u.inactive is distinct from s.inactive
+          or u.forprefix is distinct from s.forprefix
+          or u.guid is distinct from s.guid
+          or u.rid_parent is distinct from s.rid_parent
+      )
+    returning u.*
+  )
+  select (select count(1) from ins )
+  ,(select count(1) from upd )
+  into m_ins, m_upd
+  ;
+
+ ----Merge Type
+  insert into core.mastertype(category, mastertype, description, inactive, forprefix,guid,rid_parent)
+  select *
+   ,(select mt.rid_mastertype from core.mastertype mt where mt.guid = '5004E9EC-2E4B-4B36-814C-CFD96EFB434B' limit 1) --docvault
+  from (
+  values
+       ('mergetype','html','HTML Template',0,'','DC3588BC-1865-400D-BE46-8FABE6F9A040')
+      ,('mergetype','docx','Word Document Template',0,'','8535952E-3D9D-4DD4-9BD0-086A8E5A4804')
+      ,('mergetype','xlsx','Excel Document Template',0,'','6678B42F-C06F-4CB6-9003-AF22E80A1295')
+      ,('mergetype','csv','Comma Separated Values (CSV)',0,'','F03F0AC0-D710-4F9D-BB5C-0EAA97245E2A')
+      ,('mergetype','pdf','PDF Fill in Template',1,'','1197CD7A-D2F6-4B01-8B83-E42315E0060C')
+      ,('mergetype','stimulsoft','Stimulsoft Template',0,'','491ECBF2-6AD2-452C-8543-B15C65CB7431')
+      ,('mergetype','sql','SQL Query Template',0,'','74A47C47-2759-4FAB-A2A1-0A42FA87FA46')
+      ,('mergetype','none','None / No Merge',0,'','640B5044-DDCE-4806-A64F-098BE1324693')
+  ) r(category, mastertype, description, inactive, forprefix,guid)
+  where not exists (
+    select 1 from core.mastertype mt2
+    where mt2.category = r.category
+    and mt2.mastertype = r.mastertype
+  );
+
+
+  -----eventtype --select newid()
+  with src as (
+    select r.*
+         , mt.rid_mastertype as rid_parent
+    from (
+      values ('eventreactioncodetype', 'sql', 'SQL', 0, '', '24AE5A98-024F-4A3D-8BED-9F4A2C410BF9')
+           , ('eventreactioncodetype', 'api', 'API', 1, '', '163A3EC1-6C2A-4462-A15F-D24F953F9CDA')
+           , ('eventreactioncodetype', 'frontend', 'Frontend', 0, '', '50023BB9-A58A-4AE8-AAC9-3126D7122D18')
+           , ('eventreactioncodetype', 'json', 'JSON', 0, '', 'FA331BC2-DCB2-44E0-B835-C62C77A547E3')
+
+      ) r(category, mastertype, description, inactive, forprefix, guid)
+    cross join (
+        select mt.rid_mastertype
+        from core.mastertype mt
+        where mt.guid = '2D4EFDEA-4E7D-4998-8E2A-1F2B67770983'
+        limit 1
+        ) mt
+    ), upd as (
+    update core.mastertype u
+      set mastertype = src.mastertype
+        ,description = src.description
+        ,inactive = src.inactive
+        ,forprefix = src.forprefix
+      from src
+      where src.guid = u.guid
+      returning *
+    ), ins as (
+    insert into core.mastertype (category, mastertype, description, inactive, forprefix, guid, rid_parent)
+      select src.category, src.mastertype, src.description, src.inactive, src.forprefix, src.guid, src.rid_parent
+      from src
+      where
+        not exists (
+          select 1
+          from core.mastertype mt2
+          where
+              mt2.category = src.category
+          and mt2.mastertype = src.mastertype
+          )
+      returning *
+    )
+  select  (select count(1) from ins) +   (select count(1) from upd )
+  into m_retval;
+
+
+END;
+
+
+$$;
+
+

testdata/corpus/test_select.pgsql

@@ -0,0 +1,8 @@
+select u.name
+  ,u.surname
+  ,u.login
+from public.user u
+where u.id = 1
+  and u.name = 'test'
+  or u.name = 'joe'
+;

windows/README.md

@@ -0,0 +1,29 @@
+# Windows installer
+
+NSIS script: `installer.nsi`. Output: `dist/pgtidy-setup-windows-amd64.exe`.
+
+## Build
+
+```
+make installer-windows
+```
+
+Needs `makensis` (package `nsis`). CI builds and uploads it on release.
+
+## Installer
+
+- Installs `pgtidy.exe` to `%ProgramFiles%\PgTidy` (admin).
+- Adds the install dir to the system `PATH`; removed on uninstall.
+- Registers in Add/Remove Programs (supports silent `/S` uninstall).
+
+## Update check
+
+```
+pgtidy update            # check, prompt, download + run installer (Windows)
+pgtidy update --check    # report only
+pgtidy update --yes      # no prompt
+```
+
+- Source: latest Gitea release (`pkg/updatecheck`).
+- `dev` and commit-hash builds are never reported as outdated.
+- Non-Windows: prints the release URL.

windows/installer.nsi

@@ -0,0 +1,119 @@
+; PgTidy Windows installer (NSIS)
+;
+; Build: makensis -DVERSION=1.2.3 -DEXE=<abs path to pgtidy.exe> -DOUT=<abs path to installer> windows/installer.nsi
+; Use absolute paths for EXE and OUT; relative ones resolve unpredictably.
+
+!ifndef VERSION
+  !define VERSION "0.0.0"
+!endif
+!ifndef OUT
+  !define OUT "pgtidy-setup-windows-amd64.exe"
+!endif
+!ifndef EXE
+  !define EXE "pgtidy-windows-amd64.exe"
+!endif
+
+!define APPNAME   "PgTidy"
+!define REGKEY    "Software\Microsoft\Windows\CurrentVersion\Uninstall\PgTidy"
+!define ENVKEY    "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"
+
+Unicode true
+Name "${APPNAME} ${VERSION}"
+OutFile "${OUT}"
+InstallDir "$PROGRAMFILES64\${APPNAME}"
+InstallDirRegKey HKLM "Software\${APPNAME}" "InstallDir"
+RequestExecutionLevel admin
+SetCompressor /SOLID lzma
+
+VIProductVersion "${VERSION}.0"
+VIAddVersionKey "ProductName" "${APPNAME}"
+VIAddVersionKey "FileDescription" "${APPNAME} installer"
+VIAddVersionKey "FileVersion" "${VERSION}"
+VIAddVersionKey "ProductVersion" "${VERSION}"
+VIAddVersionKey "LegalCopyright" "Warky Devs"
+
+!include "MUI2.nsh"
+!include "LogicLib.nsh"
+!include "StrFunc.nsh"
+!include "WinMessages.nsh"
+${StrStr}
+${UnStrRep}
+
+!define MUI_ABORTWARNING
+!define MUI_ICON "..\assets\logo_128.ico"
+!define MUI_UNICON "..\assets\logo_128.ico"
+
+!insertmacro MUI_PAGE_WELCOME
+!insertmacro MUI_PAGE_LICENSE "..\LICENSE"
+!insertmacro MUI_PAGE_DIRECTORY
+!insertmacro MUI_PAGE_INSTFILES
+!insertmacro MUI_PAGE_FINISH
+!insertmacro MUI_UNPAGE_CONFIRM
+!insertmacro MUI_UNPAGE_INSTFILES
+!insertmacro MUI_LANGUAGE "English"
+
+Section "Install"
+  SetRegView 64
+  SetOutPath "$INSTDIR"
+  File "/oname=pgtidy.exe" "${EXE}"
+  File "..\LICENSE"
+  WriteUninstaller "$INSTDIR\uninstall.exe"
+
+  WriteRegStr HKLM "Software\${APPNAME}" "InstallDir" "$INSTDIR"
+  WriteRegStr HKLM "${REGKEY}" "DisplayName" "${APPNAME}"
+  WriteRegStr HKLM "${REGKEY}" "DisplayVersion" "${VERSION}"
+  WriteRegStr HKLM "${REGKEY}" "Publisher" "Warky Devs"
+  WriteRegStr HKLM "${REGKEY}" "DisplayIcon" "$INSTDIR\pgtidy.exe"
+  WriteRegStr HKLM "${REGKEY}" "InstallLocation" "$INSTDIR"
+  WriteRegStr HKLM "${REGKEY}" "UninstallString" '"$INSTDIR\uninstall.exe"'
+  WriteRegStr HKLM "${REGKEY}" "QuietUninstallString" '"$INSTDIR\uninstall.exe" /S'
+  WriteRegDWORD HKLM "${REGKEY}" "NoModify" 1
+  WriteRegDWORD HKLM "${REGKEY}" "NoRepair" 1
+
+  ; Add the install directory to the system PATH unless it is already there.
+  ReadRegStr $0 HKLM "${ENVKEY}" "Path"
+  ${StrStr} $1 ";$0;" ";$INSTDIR;"
+  ${If} $1 == ""
+    StrLen $2 $0
+    ${If} $2 > 900
+      ; NSIS strings are limited; rewriting a very long PATH could truncate it.
+      MessageBox MB_OK|MB_ICONEXCLAMATION "PATH is too long to update automatically. Add $INSTDIR to PATH manually."
+    ${Else}
+      ${If} $0 == ""
+        WriteRegExpandStr HKLM "${ENVKEY}" "Path" "$INSTDIR"
+      ${Else}
+        WriteRegExpandStr HKLM "${ENVKEY}" "Path" "$0;$INSTDIR"
+      ${EndIf}
+      SendMessage ${HWND_BROADCAST} ${WM_WININICHANGE} 0 "STR:Environment" /TIMEOUT=5000
+    ${EndIf}
+  ${EndIf}
+SectionEnd
+
+Section "Uninstall"
+  SetRegView 64
+  Delete "$INSTDIR\pgtidy.exe"
+  Delete "$INSTDIR\LICENSE"
+  Delete "$INSTDIR\uninstall.exe"
+  RMDir "$INSTDIR"
+
+  ; Remove the install directory from the system PATH.
+  ReadRegStr $0 HKLM "${ENVKEY}" "Path"
+  ; Wrap in separators so every entry, including the first and last, matches.
+  StrCpy $1 ";$0;"
+  ${UnStrRep} $1 "$1" ";$INSTDIR;" ";"
+  StrCpy $2 $1 1
+  ${If} $2 == ";"
+    StrCpy $1 $1 "" 1
+  ${EndIf}
+  StrCpy $2 $1 1 -1
+  ${If} $2 == ";"
+    StrCpy $1 $1 -1
+  ${EndIf}
+  ${If} $1 != $0
+    WriteRegExpandStr HKLM "${ENVKEY}" "Path" "$1"
+    SendMessage ${HWND_BROADCAST} ${WM_WININICHANGE} 0 "STR:Environment" /TIMEOUT=5000
+  ${EndIf}
+
+  DeleteRegKey HKLM "${REGKEY}"
+  DeleteRegKey HKLM "Software\${APPNAME}"
+SectionEnd