@effect-auth/core 0.1.0-alpha.15 → 0.1.0-alpha.18

package/dist/StorageSchemaGenerator.js

@@ -0,0 +1,1022 @@
+import { postgresAuthStorageMigrations } from "./PostgresStorageMigrations.js";
+export const storageSchemaGeneratorApiVersion = "effect-auth.storage-schema-generator/v1";
+export const storageSchemaGeneratorVersion = "1.1.0";
+export const storageSchemaVersion = "0009_auth_permissions";
+export const supportedStorageDatabases = ["postgres"];
+export const supportedStorageAdapters = ["effect-qb", "drizzle"];
+export const supportedStorageGeneratorModes = ["fresh"];
+export const storageModuleCatalog = [
+    {
+        id: "core",
+        description: "Users and login identities.",
+        dependencies: [],
+        tables: ["auth_user", "auth_user_identity"],
+    },
+    {
+        id: "credentials",
+        description: "Password and other typed credentials.",
+        dependencies: ["core"],
+        tables: ["auth_credential"],
+    },
+    {
+        id: "sessions",
+        description: "Authenticated sessions.",
+        dependencies: ["core"],
+        tables: ["auth_session"],
+    },
+    {
+        id: "verification",
+        description: "Short-lived verification challenges.",
+        dependencies: ["core"],
+        tables: ["auth_verification"],
+    },
+    {
+        id: "totp",
+        description: "TOTP factors.",
+        dependencies: ["core"],
+        tables: ["auth_totp_factor"],
+    },
+    {
+        id: "recovery-codes",
+        description: "MFA recovery codes.",
+        dependencies: ["core"],
+        tables: ["auth_recovery_code"],
+    },
+    {
+        id: "refresh-tokens",
+        description: "Rotating refresh-token families.",
+        dependencies: ["core"],
+        tables: ["auth_refresh_token"],
+    },
+    {
+        id: "oauth-accounts",
+        description: "External OAuth account links.",
+        dependencies: ["core"],
+        tables: ["auth_oauth_account"],
+    },
+    {
+        id: "passkeys",
+        description: "WebAuthn passkey credentials.",
+        dependencies: ["core"],
+        tables: ["auth_passkey_credential"],
+    },
+    {
+        id: "api-keys",
+        description: "User API keys.",
+        dependencies: ["core"],
+        tables: ["auth_api_key"],
+    },
+    {
+        id: "jwt",
+        description: "JWT revocations.",
+        dependencies: [],
+        tables: ["auth_jwt_revocation"],
+    },
+    {
+        id: "audit-log",
+        description: "Append-only authentication audit events.",
+        dependencies: ["core"],
+        tables: ["auth_audit_log"],
+    },
+    {
+        id: "login-approval",
+        description: "Out-of-band login approval reviews.",
+        dependencies: ["core", "verification"],
+        tables: ["auth_login_approval_review"],
+    },
+    {
+        id: "login-risk",
+        description: "Login risk history.",
+        dependencies: ["core"],
+        tables: ["auth_login_risk_history"],
+    },
+    {
+        id: "trusted-devices",
+        description: "Trusted-device tokens.",
+        dependencies: ["core"],
+        tables: ["auth_trusted_device"],
+    },
+    {
+        id: "webhooks",
+        description: "Webhook delivery and replay state.",
+        dependencies: [],
+        tables: ["auth_webhook_outbox", "auth_webhook_replay"],
+    },
+    {
+        id: "domain-verification",
+        description: "Domain ownership proofs.",
+        dependencies: [],
+        tables: ["auth_domain_verification"],
+    },
+    {
+        id: "security-timeline",
+        description: "User security timeline entries.",
+        dependencies: ["core"],
+        tables: ["auth_security_timeline"],
+    },
+    {
+        id: "oauth-provider",
+        description: "OAuth authorization-server clients, grants, and tokens.",
+        dependencies: ["core", "verification"],
+        tables: [
+            "auth_oauth_client",
+            "auth_oauth_consent",
+            "auth_oauth_authorization_code",
+            "auth_oauth_client_secret",
+            "auth_oauth_provider_mode_token",
+        ],
+    },
+    {
+        id: "oauth-token-vault",
+        description: "Encrypted upstream OAuth provider tokens.",
+        dependencies: ["oauth-accounts"],
+        tables: ["auth_oauth_provider_token_vault"],
+    },
+    {
+        id: "permissions",
+        description: "Permission, role, and grant definitions.",
+        dependencies: [],
+        tables: [
+            "auth_permission_definition",
+            "auth_role_definition",
+            "auth_permission_grant",
+            "auth_role_grant",
+            "auth_role_permission",
+        ],
+    },
+];
+export const storageFeatureCatalog = [
+    {
+        id: "password",
+        description: "Password authentication.",
+        modules: ["credentials", "sessions", "verification"],
+    },
+    {
+        id: "email-verification",
+        description: "Email ownership verification.",
+        modules: ["verification"],
+    },
+    {
+        id: "email-otp",
+        description: "Email one-time passwords.",
+        modules: ["sessions", "verification"],
+    },
+    {
+        id: "magic-link",
+        description: "Email magic links.",
+        modules: ["sessions", "verification"],
+    },
+    {
+        id: "sessions",
+        description: "Cookie or token-backed sessions.",
+        modules: ["sessions"],
+    },
+    {
+        id: "login-approval",
+        description: "Out-of-band login approvals.",
+        modules: ["sessions", "login-approval"],
+    },
+    {
+        id: "trusted-devices",
+        description: "Trusted-device recognition.",
+        modules: ["trusted-devices"],
+    },
+    {
+        id: "passkeys",
+        description: "Passkey authentication.",
+        modules: ["sessions", "verification", "passkeys"],
+    },
+    {
+        id: "totp",
+        description: "TOTP multi-factor authentication.",
+        modules: ["sessions", "verification", "totp"],
+    },
+    {
+        id: "recovery-codes",
+        description: "MFA recovery codes.",
+        modules: ["sessions", "verification", "recovery-codes"],
+    },
+    {
+        id: "api-keys",
+        description: "User API keys.",
+        modules: ["api-keys"],
+    },
+    {
+        id: "refresh-tokens",
+        description: "Refresh-token rotation.",
+        modules: ["refresh-tokens"],
+    },
+    {
+        id: "jwt",
+        description: "JWT revocation.",
+        modules: ["jwt"],
+    },
+    {
+        id: "oauth",
+        description: "OAuth client login and account linking.",
+        modules: ["sessions", "verification", "oauth-accounts"],
+    },
+    {
+        id: "oauth-provider",
+        description: "OAuth authorization-server mode.",
+        modules: ["sessions", "oauth-provider"],
+    },
+    {
+        id: "oauth-token-vault",
+        description: "Encrypted upstream provider-token storage.",
+        modules: ["oauth-token-vault"],
+    },
+    {
+        id: "audit-log",
+        description: "Authentication audit logging.",
+        modules: ["audit-log"],
+    },
+    {
+        id: "login-risk",
+        description: "Login risk history.",
+        modules: ["login-risk"],
+    },
+    {
+        id: "security-timeline",
+        description: "User security timelines.",
+        modules: ["security-timeline"],
+    },
+    {
+        id: "webhooks",
+        description: "Reliable webhook delivery.",
+        modules: ["webhooks"],
+    },
+    {
+        id: "domain-verification",
+        description: "Domain ownership verification.",
+        modules: ["domain-verification"],
+    },
+    {
+        id: "permissions",
+        description: "Roles and permissions.",
+        modules: ["permissions"],
+    },
+];
+export const storageSchemaGeneratorCatalog = {
+    apiVersion: storageSchemaGeneratorApiVersion,
+    generatorVersion: storageSchemaGeneratorVersion,
+    schemaVersion: storageSchemaVersion,
+    databases: supportedStorageDatabases,
+    adapters: supportedStorageAdapters,
+    adapterOutputs: {
+        "effect-qb": ["migration-sql"],
+        drizzle: ["migration-sql", "drizzle-schema"],
+    },
+    modes: supportedStorageGeneratorModes,
+    outputKinds: ["migration-sql", "drizzle-schema"],
+    sqlLayouts: ["single", "module"],
+    drizzleLayouts: ["single", "module", "table"],
+    features: storageFeatureCatalog,
+    modules: storageModuleCatalog,
+};
+export class StorageSchemaGeneratorError extends Error {
+    name = "StorageSchemaGeneratorError";
+    code;
+    path;
+    suggestions;
+    constructor(code, path, message, suggestions = []) {
+        super(message);
+        this.code = code;
+        this.path = path;
+        this.suggestions = suggestions;
+    }
+    toJSON() {
+        return {
+            name: this.name,
+            code: this.code,
+            path: this.path,
+            message: this.message,
+            suggestions: this.suggestions,
+        };
+    }
+}
+const moduleById = new Map(storageModuleCatalog.map((entry) => [entry.id, entry]));
+const featureById = new Map(storageFeatureCatalog.map((feature) => [feature.id, feature]));
+const moduleOrder = new Map(storageModuleCatalog.map((entry, index) => [entry.id, index]));
+const featureOrder = new Map(storageFeatureCatalog.map((feature, index) => [feature.id, index]));
+const tableModule = new Map();
+for (const entry of storageModuleCatalog) {
+    for (const table of entry.tables) {
+        tableModule.set(table, entry.id);
+    }
+}
+const splitSqlStatements = (sql) => {
+    const statements = [];
+    let start = 0;
+    let singleQuoted = false;
+    let doubleQuoted = false;
+    for (let index = 0; index < sql.length; index += 1) {
+        const character = sql[index];
+        const next = sql[index + 1];
+        if (character === "'" && !doubleQuoted) {
+            if (singleQuoted && next === "'") {
+                index += 1;
+            }
+            else {
+                singleQuoted = !singleQuoted;
+            }
+        }
+        else if (character === '"' && !singleQuoted) {
+            if (doubleQuoted && next === '"') {
+                index += 1;
+            }
+            else {
+                doubleQuoted = !doubleQuoted;
+            }
+        }
+        else if (character === ";" && !singleQuoted && !doubleQuoted) {
+            const statement = sql.slice(start, index).trim();
+            if (statement.length > 0) {
+                statements.push(`${statement};`);
+            }
+            start = index + 1;
+        }
+    }
+    const remainder = sql.slice(start).trim();
+    if (remainder.length > 0) {
+        statements.push(remainder.endsWith(";") ? remainder : `${remainder};`);
+    }
+    return statements;
+};
+const canonicalTables = (() => {
+    const creates = new Map();
+    const indexes = new Map();
+    let order = 0;
+    for (const migration of postgresAuthStorageMigrations) {
+        for (const statement of splitSqlStatements(migration.sql)) {
+            const createMatch = /^create table ([a-z0-9_]+)\s*\(/i.exec(statement);
+            if (createMatch?.[1] !== undefined) {
+                creates.set(createMatch[1], { sql: statement, order });
+                indexes.set(createMatch[1], []);
+                order += 1;
+                continue;
+            }
+            const indexMatch = /^create (?:unique )?index [a-z0-9_]+\s+on ([a-z0-9_]+)\s*\(/i.exec(statement);
+            if (indexMatch?.[1] !== undefined) {
+                const tableIndexes = indexes.get(indexMatch[1]);
+                if (tableIndexes === undefined) {
+                    throw new Error(`Index references unknown canonical table ${indexMatch[1]}`);
+                }
+                tableIndexes.push(statement);
+            }
+        }
+    }
+    const result = [];
+    for (const [name, create] of creates) {
+        const moduleId = tableModule.get(name);
+        if (moduleId === undefined) {
+            throw new Error(`Canonical table ${name} is missing from the module catalog`);
+        }
+        result.push({
+            name: name,
+            module: moduleId,
+            order: create.order,
+            createTable: create.sql,
+            indexes: indexes.get(name) ?? [],
+        });
+    }
+    for (const table of tableModule.keys()) {
+        if (!creates.has(table)) {
+            throw new Error(`Catalog table ${table} is missing from canonical migrations`);
+        }
+    }
+    // oxlint-disable-next-line unicorn/no-array-sort -- ES2023 toSorted is outside the supported target.
+    return result.sort((left, right) => left.order - right.order);
+})();
+const splitTopLevel = (value) => {
+    const parts = [];
+    let depth = 0;
+    let start = 0;
+    let singleQuoted = false;
+    let doubleQuoted = false;
+    for (let index = 0; index < value.length; index += 1) {
+        const character = value[index];
+        const next = value[index + 1];
+        if (character === "'" && !doubleQuoted) {
+            if (singleQuoted && next === "'") {
+                index += 1;
+            }
+            else {
+                singleQuoted = !singleQuoted;
+            }
+        }
+        else if (character === '"' && !singleQuoted) {
+            if (doubleQuoted && next === '"') {
+                index += 1;
+            }
+            else {
+                doubleQuoted = !doubleQuoted;
+            }
+        }
+        else if (!singleQuoted && !doubleQuoted) {
+            if (character === "(") {
+                depth += 1;
+            }
+            else if (character === ")") {
+                depth -= 1;
+            }
+            else if (character === "," && depth === 0) {
+                parts.push(value.slice(start, index).trim());
+                start = index + 1;
+            }
+        }
+    }
+    parts.push(value.slice(start).trim());
+    return parts.filter((part) => part.length > 0);
+};
+const parseCanonicalTable = (canonical) => {
+    const tableMatch = /^create table [a-z0-9_]+\s*\(([\s\S]*)\);$/i.exec(canonical.createTable);
+    if (tableMatch?.[1] === undefined) {
+        throw new Error(`Unable to parse canonical table ${canonical.name}`);
+    }
+    const columns = [];
+    const constraints = [];
+    for (const definition of splitTopLevel(tableMatch[1])) {
+        const constraintMatch = /^constraint ([a-z0-9_]+)\s+(primary key|unique|check)\s*\(([\s\S]*)\)$/i.exec(definition);
+        if (constraintMatch !== null) {
+            const [, name, rawKind, value] = constraintMatch;
+            if (name === undefined || rawKind === undefined || value === undefined) {
+                throw new Error(`Unable to parse constraint in ${canonical.name}`);
+            }
+            const kind = rawKind.toLowerCase();
+            constraints.push(kind === "check"
+                ? { name, kind: "check", expression: value.trim() }
+                : {
+                    name,
+                    kind: kind === "unique" ? "unique" : "primary-key",
+                    columns: splitTopLevel(value).map((column) => column.trim().split(/\s+/u)[0].toLowerCase()),
+                });
+            continue;
+        }
+        const columnMatch = /^([a-z0-9_]+)\s+(text|bigint|integer|boolean|jsonb)\b([\s\S]*)$/i.exec(definition);
+        if (columnMatch === null) {
+            throw new Error(`Unable to parse column definition in ${canonical.name}: ${definition}`);
+        }
+        const [, name, rawType, modifiers = ""] = columnMatch;
+        if (name === undefined || rawType === undefined) {
+            throw new Error(`Unable to parse column in ${canonical.name}`);
+        }
+        const inlinePrimaryKey = /constraint ([a-z0-9_]+) primary key/i.exec(modifiers);
+        if (inlinePrimaryKey?.[1] !== undefined) {
+            constraints.push({
+                name: inlinePrimaryKey[1],
+                kind: "primary-key",
+                columns: [name],
+            });
+        }
+        const defaultMatch = /\bdefault\s+(false|true|-?\d+|'(?:''|[^'])*')/i.exec(modifiers);
+        const defaultValue = defaultMatch?.[1];
+        columns.push({
+            name,
+            type: rawType.toLowerCase(),
+            notNull: /\bnot null\b/i.test(modifiers) || inlinePrimaryKey !== null,
+            defaultValue: defaultValue === undefined
+                ? undefined
+                : /^(?:false|true)$/iu.test(defaultValue)
+                    ? defaultValue.toLowerCase()
+                    : defaultValue,
+            identity: /\bgenerated always as identity\b/i.test(modifiers),
+            collateC: /\bcollate "C"/i.test(modifiers),
+        });
+    }
+    return { canonical, columns, constraints };
+};
+const parsedTableByName = new Map(canonicalTables.map((table) => [table.name, parseCanonicalTable(table)]));
+const compareByOrder = (order) => (left, right) => (order.get(left) ?? Number.MAX_SAFE_INTEGER) -
+    (order.get(right) ?? Number.MAX_SAFE_INTEGER);
+const resolveModules = (directModules) => {
+    const resolved = new Set();
+    const include = (moduleId) => {
+        if (resolved.has(moduleId)) {
+            return;
+        }
+        const moduleEntry = moduleById.get(moduleId);
+        if (moduleEntry === undefined) {
+            throw new Error(`Unknown catalog module ${moduleId}`);
+        }
+        for (const dependency of moduleEntry.dependencies) {
+            include(dependency);
+        }
+        resolved.add(moduleId);
+    };
+    for (const moduleId of directModules) {
+        include(moduleId);
+    }
+    // oxlint-disable-next-line unicorn/no-array-sort -- ES2023 toSorted is outside the supported target.
+    return [...resolved].sort(compareByOrder(moduleOrder));
+};
+export const resolveStorageFeatures = (features) => {
+    // oxlint-disable-next-line unicorn/no-array-sort -- ES2023 toSorted is outside the supported target.
+    const normalizedFeatures = [...new Set(features)].sort(compareByOrder(featureOrder));
+    const directModules = new Set();
+    for (const featureId of normalizedFeatures) {
+        const feature = featureById.get(featureId);
+        if (feature === undefined) {
+            throw new StorageSchemaGeneratorError("UNKNOWN_FEATURE", "features", `Unsupported storage feature ${JSON.stringify(featureId)}.`, storageFeatureCatalog.map((entry) => entry.id));
+        }
+        for (const moduleId of feature.modules) {
+            directModules.add(moduleId);
+        }
+    }
+    const modules = resolveModules(directModules);
+    const selectedModules = new Set(modules);
+    const tables = canonicalTables
+        .filter((table) => selectedModules.has(table.module))
+        .map((table) => table.name);
+    return {
+        features: normalizedFeatures,
+        modules,
+        tables,
+        impliedModules: modules.filter((moduleId) => !directModules.has(moduleId)),
+    };
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const assertKnownKeys = (value, keys, path, code) => {
+    const allowed = new Set(keys);
+    for (const key of Object.keys(value)) {
+        if (!allowed.has(key)) {
+            throw new StorageSchemaGeneratorError(code, path === "$" ? key : `${path}.${key}`, `Unknown property ${JSON.stringify(key)}.`, keys);
+        }
+    }
+};
+// oxlint-disable-next-line eslint/complexity -- validation keeps precise error paths in one pass
+const normalizeRequest = (input) => {
+    if (!isRecord(input)) {
+        throw new StorageSchemaGeneratorError("INVALID_REQUEST", "$", "The generator request must be an object.");
+    }
+    const request = input;
+    assertKnownKeys(request, ["database", "adapter", "mode", "features", "outputs"], "$", "INVALID_REQUEST");
+    if (request.database !== "postgres") {
+        throw new StorageSchemaGeneratorError("UNSUPPORTED_DATABASE", "database", `Unsupported database ${JSON.stringify(request.database)}.`, ["postgres"]);
+    }
+    if (request.adapter !== "effect-qb" && request.adapter !== "drizzle") {
+        throw new StorageSchemaGeneratorError("UNSUPPORTED_ADAPTER", "adapter", `Unsupported adapter ${JSON.stringify(request.adapter)}.`, supportedStorageAdapters);
+    }
+    const { adapter } = request;
+    if (request.mode !== undefined && request.mode !== "fresh") {
+        throw new StorageSchemaGeneratorError("UNSUPPORTED_MODE", "mode", `Unsupported generation mode ${JSON.stringify(request.mode)}.`, ["fresh"]);
+    }
+    if (!Array.isArray(request.features) || request.features.length === 0) {
+        throw new StorageSchemaGeneratorError("INVALID_REQUEST", "features", "At least one storage feature is required.", storageFeatureCatalog.map((feature) => feature.id));
+    }
+    const features = [];
+    for (const [index, feature] of request.features.entries()) {
+        if (typeof feature !== "string" ||
+            !featureById.has(feature)) {
+            throw new StorageSchemaGeneratorError("UNKNOWN_FEATURE", `features[${index}]`, `Unsupported storage feature ${JSON.stringify(feature)}.`, storageFeatureCatalog.map((entry) => entry.id));
+        }
+        features.push(feature);
+    }
+    if (!Array.isArray(request.outputs) || request.outputs.length === 0) {
+        throw new StorageSchemaGeneratorError("INVALID_REQUEST", "outputs", "At least one output is required.", ["migration-sql", "drizzle-schema"]);
+    }
+    const outputs = [];
+    const outputKinds = new Set();
+    for (const [index, output] of request.outputs.entries()) {
+        const path = `outputs[${index}]`;
+        if (!isRecord(output)) {
+            throw new StorageSchemaGeneratorError("INVALID_OUTPUT", path, "Each output must be an object.");
+        }
+        assertKnownKeys(output, ["kind", "layout", "includeRelations"], path, "INVALID_OUTPUT");
+        if (output.kind === "migration-sql") {
+            if (output.layout !== "single" && output.layout !== "module") {
+                throw new StorageSchemaGeneratorError("INVALID_OUTPUT", `${path}.layout`, `Invalid migration SQL layout ${JSON.stringify(output.layout)}.`, ["single", "module"]);
+            }
+            outputs.push({ kind: "migration-sql", layout: output.layout });
+        }
+        else if (output.kind === "drizzle-schema") {
+            if (output.layout !== "single" &&
+                output.layout !== "module" &&
+                output.layout !== "table") {
+                throw new StorageSchemaGeneratorError("INVALID_OUTPUT", `${path}.layout`, `Invalid Drizzle schema layout ${JSON.stringify(output.layout)}.`, ["single", "module", "table"]);
+            }
+            if (output.includeRelations !== undefined &&
+                typeof output.includeRelations !== "boolean") {
+                throw new StorageSchemaGeneratorError("INVALID_OUTPUT", `${path}.includeRelations`, "includeRelations must be a boolean.");
+            }
+            outputs.push({
+                kind: "drizzle-schema",
+                layout: output.layout,
+                includeRelations: output.includeRelations === true,
+            });
+        }
+        else {
+            throw new StorageSchemaGeneratorError("INVALID_OUTPUT", `${path}.kind`, `Unsupported output kind ${JSON.stringify(output.kind)}.`, ["migration-sql", "drizzle-schema"]);
+        }
+        if (outputKinds.has(output.kind)) {
+            throw new StorageSchemaGeneratorError("DUPLICATE_OUTPUT", `${path}.kind`, `Only one ${String(output.kind)} output may be requested.`, ["Combine the requested files by choosing one layout."]);
+        }
+        outputKinds.add(output.kind);
+    }
+    if (adapter === "effect-qb") {
+        const unsupportedOutputIndex = outputs.findIndex((output) => output.kind !== "migration-sql");
+        if (unsupportedOutputIndex !== -1) {
+            throw new StorageSchemaGeneratorError("UNSUPPORTED_OUTPUT_FOR_ADAPTER", `outputs[${unsupportedOutputIndex}].kind`, "The effect-qb adapter owns its table declarations and only requires migration SQL.", ["migration-sql"]);
+        }
+    }
+    // oxlint-disable-next-line unicorn/no-array-sort -- ES2023 toSorted is outside the supported target.
+    outputs.sort((left, right) => {
+        if (left.kind !== right.kind) {
+            return left.kind === "migration-sql" ? -1 : 1;
+        }
+        return left.layout.localeCompare(right.layout);
+    });
+    return {
+        database: "postgres",
+        adapter,
+        mode: "fresh",
+        // oxlint-disable-next-line unicorn/no-array-sort -- ES2023 toSorted is outside the supported target.
+        features: [...new Set(features)].sort(compareByOrder(featureOrder)),
+        outputs,
+    };
+};
+const renderCanonicalSql = (tables) => `${tables
+    .flatMap((table) => [table.createTable, ...table.indexes])
+    .join("\n\n")}
+`;
+const sqlFiles = (layout, selection) => {
+    const selectedTables = new Set(selection.tables);
+    const tables = canonicalTables.filter((table) => selectedTables.has(table.name));
+    if (layout === "single") {
+        return [
+            {
+                path: "effect-auth.sql",
+                mediaType: "application/sql",
+                content: renderCanonicalSql(tables),
+            },
+        ];
+    }
+    return selection.modules.map((moduleId, index) => ({
+        path: `${String(index + 1).padStart(4, "0")}_effect_auth_${moduleId.replaceAll("-", "_")}.sql`,
+        mediaType: "application/sql",
+        content: renderCanonicalSql(tables.filter((table) => table.module === moduleId)),
+    }));
+};
+const camelCase = (value) => value.replaceAll(/_([a-z0-9])/g, (_, character) => character.toUpperCase());
+const kebabCase = (value) => value.replaceAll("_", "-");
+const escapeTemplate = (value) => value.replaceAll("`", "\\`").replaceAll("${", "\\${");
+const renderColumn = (column) => {
+    let expression;
+    switch (column.type) {
+        case "bigint": {
+            expression = `bigint(${JSON.stringify(column.name)}, { mode: "number" })`;
+            break;
+        }
+        case "boolean": {
+            expression = `boolean(${JSON.stringify(column.name)})`;
+            break;
+        }
+        case "integer": {
+            expression = `integer(${JSON.stringify(column.name)})`;
+            break;
+        }
+        case "jsonb": {
+            expression = `jsonb(${JSON.stringify(column.name)})`;
+            break;
+        }
+        case "text": {
+            expression = `${column.collateC ? "textC" : "text"}(${JSON.stringify(column.name)})`;
+            break;
+        }
+    }
+    if (column.identity) {
+        expression += ".generatedAlwaysAsIdentity()";
+    }
+    if (column.notNull && !column.identity) {
+        expression += ".notNull()";
+    }
+    if (column.defaultValue !== undefined) {
+        const defaultValue = column.defaultValue.startsWith("'")
+            ? JSON.stringify(column.defaultValue.slice(1, -1).replaceAll("''", "'"))
+            : column.defaultValue;
+        expression += `.default(${defaultValue})`;
+    }
+    return `    ${camelCase(column.name)}: ${expression},`;
+};
+const renderSqlTemplate = (value) => `sql\`${escapeTemplate(value)}\``;
+const renderIndexColumn = (value) => {
+    const match = /^([a-z0-9_]+)(?:\s+collate\s+"C")?$/i.exec(value.trim());
+    if (match?.[1] === undefined) {
+        return renderSqlTemplate(value.trim());
+    }
+    const column = camelCase(match[1]);
+    return /\bcollate\s+"C"/i.test(value)
+        ? `sql\`\${t.${column}} collate "C"\``
+        : `t.${column}`;
+};
+const renderIndex = (statement) => {
+    const match = /^create (unique )?index ([a-z0-9_]+)\s+on [a-z0-9_]+\s*\(([\s\S]*?)\)(?:\s+where\s+([\s\S]+?))?;$/i.exec(statement);
+    if (match === null || match[2] === undefined || match[3] === undefined) {
+        throw new Error(`Unable to render canonical index: ${statement}`);
+    }
+    const [, uniqueMarker, name, columns, where] = match;
+    let expression = `${uniqueMarker === undefined ? "index" : "uniqueIndex"}(${JSON.stringify(name)}).on(${splitTopLevel(columns).map(renderIndexColumn).join(", ")})`;
+    if (where !== undefined) {
+        expression += `.where(${renderSqlTemplate(where.trim())})`;
+    }
+    return `    ${expression},`;
+};
+const renderConstraint = (constraint) => {
+    switch (constraint.kind) {
+        case "check": {
+            return `    check(${JSON.stringify(constraint.name)}, ${renderSqlTemplate(constraint.expression ?? "")}),`;
+        }
+        case "primary-key": {
+            return `    primaryKey({ name: ${JSON.stringify(constraint.name)}, columns: [${(constraint.columns ?? [])
+                .map((column) => `t.${camelCase(column)}`)
+                .join(", ")}] }),`;
+        }
+        case "unique": {
+            return `    unique(${JSON.stringify(constraint.name)}).on(${(constraint.columns ?? [])
+                .map((column) => `t.${camelCase(column)}`)
+                .join(", ")}),`;
+        }
+    }
+};
+const drizzleImports = (tables) => {
+    const imports = new Set(["pgTable"]);
+    for (const table of tables) {
+        for (const column of table.columns) {
+            imports.add(column.type);
+            if (column.collateC) {
+                imports.add("customType");
+            }
+        }
+        for (const constraint of table.constraints) {
+            imports.add(constraint.kind === "primary-key"
+                ? "primaryKey"
+                : constraint.kind === "unique"
+                    ? "unique"
+                    : "check");
+            if (constraint.kind === "check") {
+                imports.add("sql");
+            }
+        }
+        for (const statement of table.canonical.indexes) {
+            imports.add(/^create unique index/i.test(statement) ? "uniqueIndex" : "index");
+            if (/\bwhere\b|\bcollate\b/i.test(statement)) {
+                imports.add("sql");
+            }
+        }
+    }
+    // oxlint-disable-next-line unicorn/no-array-sort -- ES2023 toSorted is outside the supported target.
+    return [...imports].sort();
+};
+const renderTable = (table) => {
+    const variable = camelCase(table.canonical.name);
+    const extras = [
+        ...table.constraints.map(renderConstraint),
+        ...table.canonical.indexes.map(renderIndex),
+    ];
+    return `export const ${variable} = pgTable(
+  ${JSON.stringify(table.canonical.name)},
+  {
+${table.columns.map(renderColumn).join("\n")}
+  },
+  (t) => [
+${extras.join("\n")}
+  ]
+);`;
+};
+const renderDrizzleTables = (tables) => {
+    const imports = drizzleImports(tables);
+    const usesSql = imports.includes("sql");
+    const pgImports = imports.filter((name) => name !== "sql");
+    const importLines = [
+        ...(usesSql ? ['import { sql } from "drizzle-orm";'] : []),
+        `import { ${pgImports.join(", ")} } from "drizzle-orm/pg-core";`,
+    ];
+    const collatedText = tables.some((table) => table.columns.some((column) => column.collateC))
+        ? `
+const textC = customType<{ data: string }>({
+  dataType: () => 'text collate "C"',
+});`
+        : "";
+    return `${importLines.join("\n")}${collatedText}
+
+${tables.map(renderTable).join("\n\n")}
+`;
+};
+// oxlint-disable-next-line eslint/complexity -- each branch describes one canonical relation family
+const logicalRelations = (tables) => {
+    const byName = new Map(tables.map((table) => [table.canonical.name, table]));
+    const relations = [];
+    const addRelation = (sourceTable, sourceColumnName, targetTable, targetColumnName, name) => {
+        const source = byName.get(sourceTable);
+        const target = byName.get(targetTable);
+        const sourceColumn = source?.columns.find((column) => column.name === sourceColumnName);
+        const targetColumn = target?.columns.find((column) => column.name === targetColumnName);
+        if (source !== undefined &&
+            target !== undefined &&
+            sourceColumn !== undefined &&
+            targetColumn !== undefined) {
+            relations.push({ source, sourceColumn, target, targetColumn, name });
+        }
+    };
+    const user = byName.get("auth_user");
+    const userId = user?.columns.find((column) => column.name === "id");
+    if (user !== undefined && userId !== undefined) {
+        for (const table of tables) {
+            for (const column of table.columns) {
+                if (table !== user && column.name.endsWith("user_id")) {
+                    const prefix = column.name
+                        .slice(0, -"user_id".length)
+                        .replace(/_$/, "");
+                    relations.push({
+                        source: table,
+                        sourceColumn: column,
+                        target: user,
+                        targetColumn: userId,
+                        name: prefix.length === 0 ? "user" : `${camelCase(prefix)}User`,
+                    });
+                }
+            }
+        }
+    }
+    const oauthClient = byName.get("auth_oauth_client");
+    const oauthClientId = oauthClient?.columns.find((column) => column.name === "id");
+    if (oauthClient !== undefined && oauthClientId !== undefined) {
+        for (const tableName of [
+            "auth_oauth_consent",
+            "auth_oauth_authorization_code",
+            "auth_oauth_client_secret",
+            "auth_oauth_provider_mode_token",
+        ]) {
+            const source = byName.get(tableName);
+            const sourceColumn = source?.columns.find((column) => column.name === "client_id");
+            if (source !== undefined && sourceColumn !== undefined) {
+                relations.push({
+                    source,
+                    sourceColumn,
+                    target: oauthClient,
+                    targetColumn: oauthClientId,
+                    name: "client",
+                });
+            }
+        }
+    }
+    const oauthAccount = byName.get("auth_oauth_account");
+    const oauthAccountId = oauthAccount?.columns.find((column) => column.name === "id");
+    const vault = byName.get("auth_oauth_provider_token_vault");
+    const vaultAccountId = vault?.columns.find((column) => column.name === "account_id");
+    if (oauthAccount !== undefined &&
+        oauthAccountId !== undefined &&
+        vault !== undefined &&
+        vaultAccountId !== undefined) {
+        relations.push({
+            source: vault,
+            sourceColumn: vaultAccountId,
+            target: oauthAccount,
+            targetColumn: oauthAccountId,
+            name: "account",
+        });
+    }
+    addRelation("auth_user_identity", "replaced_by_id", "auth_user_identity", "id", "replacedBy");
+    addRelation("auth_refresh_token", "replaced_by_id", "auth_refresh_token", "id", "replacedBy");
+    addRelation("auth_login_approval_review", "approval_challenge_id", "auth_verification", "id", "challenge");
+    addRelation("auth_oauth_provider_mode_token", "replaced_by_token_hash", "auth_oauth_provider_mode_token", "token_hash", "replacedBy");
+    addRelation("auth_permission_grant", "permission_id", "auth_permission_definition", "id", "permission");
+    addRelation("auth_role_grant", "role_id", "auth_role_definition", "id", "role");
+    addRelation("auth_role_permission", "role_id", "auth_role_definition", "id", "role");
+    addRelation("auth_role_permission", "permission_id", "auth_permission_definition", "id", "permission");
+    return relations;
+};
+const renderRelations = (tables, schemaExpression, importPath) => {
+    const relations = logicalRelations(tables);
+    const grouped = new Map();
+    for (const relation of relations) {
+        const existing = grouped.get(relation.source) ?? [];
+        existing.push(relation);
+        grouped.set(relation.source, existing);
+    }
+    const entries = [...grouped.entries()].map(([table, tableRelations]) => {
+        const sourceName = camelCase(table.canonical.name);
+        return `  ${sourceName}: {
+${tableRelations
+            .map((relation) => {
+            const targetName = camelCase(relation.target.canonical.name);
+            return `    ${relation.name}: r.one.${targetName}({
+      from: r.${sourceName}.${camelCase(relation.sourceColumn.name)},
+      to: r.${targetName}.${camelCase(relation.targetColumn.name)},
+    }),`;
+        })
+            .join("\n")}
+  },`;
+    });
+    const imports = [
+        'import { defineRelations } from "drizzle-orm";',
+        ...(importPath === undefined
+            ? []
+            : [`import * as schema from ${JSON.stringify(importPath)};`]),
+    ];
+    return `${imports.join("\n")}
+
+// Drizzle relations are application-level only and do not create PostgreSQL foreign keys.
+export const relations = defineRelations(${schemaExpression}, (r) => ({
+${entries.join("\n")}
+}));
+`;
+};
+const exportFile = (paths) => `${paths.map((path) => `export * from ${JSON.stringify(path)};`).join("\n")}
+`;
+const drizzleFiles = (layout, includeRelations, selection) => {
+    const selected = new Set(selection.tables);
+    const tables = canonicalTables
+        .filter((table) => selected.has(table.name))
+        .map((table) => parsedTableByName.get(table.name));
+    if (layout === "single") {
+        let content = renderDrizzleTables(tables);
+        if (includeRelations) {
+            const schema = `{ ${tables
+                .map((table) => camelCase(table.canonical.name))
+                .join(", ")} }`;
+            content += `\n${renderRelations(tables, schema)}`;
+        }
+        return [{ path: "schema.ts", mediaType: "text/typescript", content }];
+    }
+    const directory = layout === "module" ? "modules" : "tables";
+    const groups = layout === "module"
+        ? selection.modules.map((moduleId) => ({
+            name: moduleId,
+            tables: tables.filter((table) => table.canonical.module === moduleId),
+        }))
+        : tables.map((table) => ({
+            name: kebabCase(table.canonical.name),
+            tables: [table],
+        }));
+    const files = groups.map((group) => ({
+        path: `${directory}/${group.name}.ts`,
+        mediaType: "text/typescript",
+        content: renderDrizzleTables(group.tables),
+    }));
+    files.push({
+        path: `${directory}/index.ts`,
+        mediaType: "text/typescript",
+        content: exportFile(groups.map((group) => `./${group.name}.js`)),
+    });
+    if (includeRelations) {
+        files.push({
+            path: "relations.ts",
+            mediaType: "text/typescript",
+            content: renderRelations(tables, "schema", `./${directory}/index.js`),
+        });
+    }
+    files.push({
+        path: "index.ts",
+        mediaType: "text/typescript",
+        content: exportFile([
+            `./${directory}/index.js`,
+            ...(includeRelations ? ["./relations.js"] : []),
+        ]),
+    });
+    return files;
+};
+const fingerprint = (value) => {
+    let hash = 2_166_136_261;
+    for (let index = 0; index < value.length; index += 1) {
+        hash ^= value.codePointAt(index) ?? 0;
+        hash = Math.imul(hash, 16_777_619);
+    }
+    const unsignedHash = hash < 0 ? hash + 4_294_967_296 : hash;
+    return `fnv1a32:${unsignedHash.toString(16).padStart(8, "0")}`;
+};
+export const parseStorageSchemaGeneratorRequest = (request) => normalizeRequest(request);
+export const generateStorageArtifacts = (request) => {
+    const normalized = normalizeRequest(request);
+    const resolved = resolveStorageFeatures(normalized.features);
+    const files = [];
+    const warnings = [];
+    for (const output of normalized.outputs) {
+        if (output.kind === "migration-sql") {
+            files.push(...sqlFiles(output.layout, resolved));
+        }
+        else {
+            files.push(...drizzleFiles(output.layout, output.includeRelations, resolved));
+            if (output.includeRelations) {
+                warnings.push("Drizzle relations are application-level only and do not create PostgreSQL foreign keys.");
+            }
+        }
+    }
+    const fingerprintInput = JSON.stringify({
+        request: normalized,
+        resolved,
+        files,
+        warnings,
+    });
+    return {
+        apiVersion: storageSchemaGeneratorApiVersion,
+        generatorVersion: storageSchemaGeneratorVersion,
+        schemaVersion: storageSchemaVersion,
+        fingerprint: fingerprint(fingerprintInput),
+        request: normalized,
+        resolved,
+        files,
+        warnings,
+    };
+};
+//# sourceMappingURL=StorageSchemaGenerator.js.map