@hot-updater/supabase 1.0.0-rc.2 → 1.0.0-rc.22

package/dist/edge.cjs

@@ -1,7 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_supabaseStorage = require("./supabaseStorage-CbzHzqCa.cjs");
+const require_plugins = require("./plugins-jpIkI_T2.cjs");
 //#region src/supabaseEdgeFunctionStorage.ts
-const supabaseEdgeFunctionStorage = (config) => require_supabaseStorage.supabaseStorage(config);
+const supabaseEdgeFunctionStorage = (config) => require_plugins.supabaseStorage(config);
 //#endregion
-exports.supabaseDatabase = require_supabaseStorage.supabaseDatabase;
+exports.plugins = require_plugins.plugins;
+exports.supabaseDatabase = require_plugins.supabaseDatabase;
 exports.supabaseStorage = supabaseEdgeFunctionStorage;

package/dist/edge.d.cts

@@ -1,5 +1,5 @@
-import { n as supabaseDatabase, t as SupabaseDatabaseConfig } from "./supabaseDatabase-3d90EtUD.cjs";
-import { StoragePluginWith } from "@hot-updater/plugin-core";
+import { i as plugins, n as supabaseDatabase, t as SupabaseDatabaseConfig } from "./supabaseDatabase-DVb3-y2x.cjs";
+import { StorageAdapterWith } from "@hot-updater/plugin-core";
 //#region src/supabaseEdgeFunctionStorage.d.ts
 interface SupabaseEdgeFunctionStorageConfig {
   supabaseUrl: string;
@@ -8,6 +8,6 @@ interface SupabaseEdgeFunctionStorageConfig {
   basePath?: string;
   signedUrlExpiresIn?: number;
 }
-declare const supabaseEdgeFunctionStorage: (config: SupabaseEdgeFunctionStorageConfig) => StoragePluginWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
+declare const supabaseEdgeFunctionStorage: (config: SupabaseEdgeFunctionStorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
 //#endregion
-export { type SupabaseDatabaseConfig, type SupabaseEdgeFunctionStorageConfig as SupabaseStorageConfig, supabaseDatabase, supabaseEdgeFunctionStorage as supabaseStorage };
+export { type SupabaseDatabaseConfig, type SupabaseEdgeFunctionStorageConfig as SupabaseStorageConfig, plugins, supabaseDatabase, supabaseEdgeFunctionStorage as supabaseStorage };

package/dist/edge.d.mts

@@ -1,5 +1,5 @@
-import { n as supabaseDatabase, t as SupabaseDatabaseConfig } from "./supabaseDatabase-3d90EtUD.mjs";
-import { StoragePluginWith } from "@hot-updater/plugin-core";
+import { i as plugins, n as supabaseDatabase, t as SupabaseDatabaseConfig } from "./supabaseDatabase-DVb3-y2x.mjs";
+import { StorageAdapterWith } from "@hot-updater/plugin-core";
 //#region src/supabaseEdgeFunctionStorage.d.ts
 interface SupabaseEdgeFunctionStorageConfig {
   supabaseUrl: string;
@@ -8,6 +8,6 @@ interface SupabaseEdgeFunctionStorageConfig {
   basePath?: string;
   signedUrlExpiresIn?: number;
 }
-declare const supabaseEdgeFunctionStorage: (config: SupabaseEdgeFunctionStorageConfig) => StoragePluginWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
+declare const supabaseEdgeFunctionStorage: (config: SupabaseEdgeFunctionStorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
 //#endregion
-export { type SupabaseDatabaseConfig, type SupabaseEdgeFunctionStorageConfig as SupabaseStorageConfig, supabaseDatabase, supabaseEdgeFunctionStorage as supabaseStorage };
+export { type SupabaseDatabaseConfig, type SupabaseEdgeFunctionStorageConfig as SupabaseStorageConfig, plugins, supabaseDatabase, supabaseEdgeFunctionStorage as supabaseStorage };

package/dist/edge.mjs

@@ -1,5 +1,5 @@
-import { n as supabaseDatabase, t as supabaseStorage } from "./supabaseStorage-CjteZ2zX.mjs";
+import { n as supabaseStorage, r as supabaseDatabase, t as plugins } from "./plugins-Dj-4Pk3j.mjs";
 //#region src/supabaseEdgeFunctionStorage.ts
 const supabaseEdgeFunctionStorage = (config) => supabaseStorage(config);
 //#endregion
-export { supabaseDatabase, supabaseEdgeFunctionStorage as supabaseStorage };
+export { plugins, supabaseDatabase, supabaseEdgeFunctionStorage as supabaseStorage };

package/dist/index.cjs

@@ -1,4 +1,144 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_supabaseStorage = require("./supabaseStorage-CbzHzqCa.cjs");
-exports.supabaseDatabase = require_supabaseStorage.supabaseDatabase;
-exports.supabaseStorage = require_supabaseStorage.supabaseStorage;
+const require_plugins = require("./plugins-jpIkI_T2.cjs");
+let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
+//#region src/supabaseSchema.ts
+/** Every table the apply RPC may name: models, index tables, settings, and the write guard. */
+const supabaseTableNames = (schema = _hot_updater_plugin_core.coreTarget.schema) => [
+	...schema.tables.flatMap((table) => [table.name, ...table.indexes.filter((index) => (0, _hot_updater_plugin_core.isMultiIndex)(table, index)).map((index) => `${table.name}__${index.name}`)]),
+	_hot_updater_plugin_core.SETTINGS_TABLE.name,
+	_hot_updater_plugin_core.WRITE_GUARD_TABLE.name
+].map((name) => require_plugins.SUPABASE_TABLE_PREFIX + name);
+/** The words the SQL core's statements use besides quoted names, numbers, and operators. */
+const KEYWORDS = [
+	"SELECT",
+	"FROM",
+	"WHERE",
+	"AND",
+	"OR",
+	"NOT",
+	"EXISTS",
+	"INSERT",
+	"INTO",
+	"VALUES",
+	"UPDATE",
+	"SET",
+	"DELETE",
+	"ORDER",
+	"BY",
+	"ASC",
+	"DESC",
+	"LIMIT",
+	"IS",
+	"NULL",
+	"ON",
+	"CONFLICT",
+	"DO",
+	"JOIN",
+	"FOR",
+	"bigint",
+	"double",
+	"precision",
+	"boolean",
+	"jsonb",
+	"i",
+	"b"
+];
+const literal = (value) => `'${value.replaceAll("'", "''")}'`;
+/**
+* Runs a batch of the SQL core's statements in the caller's transaction and
+* privileges (service role only), with every parameter read from one jsonb
+* array. Only the core's statement shapes on Hot Updater's tables pass: one
+* statement each, no literal, comment, or function call, and no word the
+* core does not write.
+*/
+const applyFunction = (tables) => `CREATE OR REPLACE FUNCTION public.${require_plugins.SUPABASE_APPLY_FUNCTION}(p_statements jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY INVOKER
+SET search_path = public, pg_temp
+AS $apply$
+DECLARE
+  item jsonb;
+  statement text;
+  shape text;
+  target text;
+  found record;
+  rows jsonb;
+  changed bigint;
+  results jsonb := '[]'::jsonb;
+BEGIN
+  FOR item IN SELECT value FROM jsonb_array_elements(p_statements) LOOP
+    statement := item->>'sql';
+    FOR target IN SELECT (regexp_matches(statement, '(?:FROM|INTO|UPDATE|JOIN) "([^"]+)"', 'g'))[1] LOOP
+      IF NOT target = ANY (ARRAY[${tables.map(literal).join(", ")}]) THEN
+        RAISE EXCEPTION '${require_plugins.SUPABASE_APPLY_FUNCTION}: % is not a Hot Updater table', target USING ERRCODE = '42501';
+      END IF;
+    END LOOP;
+    shape := regexp_replace(regexp_replace(statement, '^INSERT INTO "[^"]+" \\(', 'INSERT INTO ('), '"[^"]*"', '"', 'g');
+    IF shape !~ '^(SELECT|INSERT INTO|UPDATE|DELETE FROM) '
+      OR shape ~ '"[[:space:]]*\\('
+      OR shape ~ '[;''\\\\]|--|/\\*'
+      OR regexp_replace(shape, '\\m(${KEYWORDS.join("|")})\\M', '', 'gi') !~ '^[[:space:]"(),.*=<>+0-9$:-]*$' THEN
+      RAISE EXCEPTION '${require_plugins.SUPABASE_APPLY_FUNCTION}: statement not allowed' USING ERRCODE = '42501';
+    END IF;
+    IF statement ~ '^SELECT ' THEN
+      rows := '[]'::jsonb;
+      FOR found IN EXECUTE statement USING item->'params' LOOP
+        rows := rows || jsonb_build_array(to_jsonb(found));
+      END LOOP;
+      results := results || jsonb_build_array(jsonb_build_object('rows', rows, 'changes', 0));
+    ELSE
+      EXECUTE statement USING item->'params';
+      GET DIAGNOSTICS changed = ROW_COUNT;
+      results := results || jsonb_build_array(jsonb_build_object('rows', '[]'::jsonb, 'changes', changed));
+    END IF;
+  END LOOP;
+  RETURN results;
+END;
+$apply$`;
+/**
+* Supabase's migration: the shared SQL schema under the table prefix, the
+* write guard, row-level security on every table (no policy, so only the
+* service role reads or writes), the apply RPC for the service role alone,
+* and the settings rows last. Every statement can run again, so a migration
+* for a server's plugin tables repeats core's.
+*/
+const supabaseSchemaStatements = ({ schema, settings: expected } = _hot_updater_plugin_core.coreTarget) => {
+	const engine = (0, _hot_updater_plugin_core.generateEngineSql)("postgresql", schema, expected, { tablePrefix: require_plugins.SUPABASE_TABLE_PREFIX });
+	const settings = engine.slice(-Object.keys(expected).length);
+	const tables = supabaseTableNames(schema);
+	const apply = `public.${require_plugins.SUPABASE_APPLY_FUNCTION}(jsonb)`;
+	return [
+		...(0, _hot_updater_plugin_core.createTableStatements)("postgresql", [_hot_updater_plugin_core.WRITE_GUARD_TABLE], require_plugins.SUPABASE_TABLE_PREFIX),
+		...engine.slice(0, -settings.length),
+		...tables.map((table) => `ALTER TABLE "${table}" ENABLE ROW LEVEL SECURITY`),
+		applyFunction(tables),
+		`REVOKE EXECUTE ON FUNCTION ${apply} FROM PUBLIC, anon, authenticated`,
+		`GRANT EXECUTE ON FUNCTION ${apply} TO service_role`,
+		...settings
+	];
+};
+const supabaseSchemaSql = (target) => `-- HotUpdater.schema\n\n${supabaseSchemaStatements(target).map((statement) => `${statement};`).join("\n\n")}\n`;
+//#endregion
+//#region src/supabaseMigration.ts
+/**
+* Hot Updater's database on Supabase, with the migration `hot-updater db
+* generate` writes to `supabase/migrations`: core's tables, the server's
+* plugin tables, the apply RPC that may name them, and their settings rows.
+* `supabase db push` applies it.
+*/
+const supabaseDatabase = (config) => ({
+	...require_plugins.supabaseDatabase(config),
+	generateSchema: ((version, _name, target = _hot_updater_plugin_core.coreTarget) => {
+		if (version !== "latest" && version !== _hot_updater_plugin_core.coreSettings["schema.core"]) throw new Error(`Invalid version ${version}`);
+		const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14);
+		return {
+			code: supabaseSchemaSql(target),
+			path: `supabase/migrations/${timestamp}_hot-updater.sql`
+		};
+	})
+});
+//#endregion
+exports.plugins = require_plugins.plugins;
+exports.supabaseDatabase = supabaseDatabase;
+exports.supabaseStorage = require_plugins.supabaseStorage;

package/dist/index.d.cts

@@ -1,5 +1,14 @@
-import { n as supabaseDatabase, r as SupabaseServiceRoleConfig, t as SupabaseDatabaseConfig } from "./supabaseDatabase-3d90EtUD.cjs";
-import { StoragePluginWith } from "@hot-updater/plugin-core";
+import { i as plugins, r as SupabaseServiceRoleConfig, t as SupabaseDatabaseConfig } from "./supabaseDatabase-DVb3-y2x.cjs";
+import { StorageAdapterWith, ToolingDatabase } from "@hot-updater/plugin-core";
+//#region src/supabaseMigration.d.ts
+/**
+ * Hot Updater's database on Supabase, with the migration `hot-updater db
+ * generate` writes to `supabase/migrations`: core's tables, the server's
+ * plugin tables, the apply RPC that may name them, and their settings rows.
+ * `supabase db push` applies it.
+ */
+declare const supabaseDatabase: (config: SupabaseDatabaseConfig) => ToolingDatabase;
+//#endregion
 //#region src/supabaseStorage.d.ts
 type SupabaseStorageConfig = SupabaseServiceRoleConfig & {
   bucketName: string;
@@ -8,6 +17,6 @@ type SupabaseStorageConfig = SupabaseServiceRoleConfig & {
   /** Signed download URL lifetime in seconds. @default 3600 */
   signedUrlExpiresIn?: number;
 };
-declare const supabaseStorage: (config: SupabaseStorageConfig) => StoragePluginWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
+declare const supabaseStorage: (config: SupabaseStorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
 //#endregion
-export { SupabaseDatabaseConfig, SupabaseStorageConfig, supabaseDatabase, supabaseStorage };
+export { type SupabaseDatabaseConfig, SupabaseStorageConfig, plugins, supabaseDatabase, supabaseStorage };

package/dist/index.d.mts

@@ -1,5 +1,14 @@
-import { n as supabaseDatabase, r as SupabaseServiceRoleConfig, t as SupabaseDatabaseConfig } from "./supabaseDatabase-3d90EtUD.mjs";
-import { StoragePluginWith } from "@hot-updater/plugin-core";
+import { i as plugins, r as SupabaseServiceRoleConfig, t as SupabaseDatabaseConfig } from "./supabaseDatabase-DVb3-y2x.mjs";
+import { StorageAdapterWith, ToolingDatabase } from "@hot-updater/plugin-core";
+//#region src/supabaseMigration.d.ts
+/**
+ * Hot Updater's database on Supabase, with the migration `hot-updater db
+ * generate` writes to `supabase/migrations`: core's tables, the server's
+ * plugin tables, the apply RPC that may name them, and their settings rows.
+ * `supabase db push` applies it.
+ */
+declare const supabaseDatabase: (config: SupabaseDatabaseConfig) => ToolingDatabase;
+//#endregion
 //#region src/supabaseStorage.d.ts
 type SupabaseStorageConfig = SupabaseServiceRoleConfig & {
   bucketName: string;
@@ -8,6 +17,6 @@ type SupabaseStorageConfig = SupabaseServiceRoleConfig & {
   /** Signed download URL lifetime in seconds. @default 3600 */
   signedUrlExpiresIn?: number;
 };
-declare const supabaseStorage: (config: SupabaseStorageConfig) => StoragePluginWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
+declare const supabaseStorage: (config: SupabaseStorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
 //#endregion
-export { SupabaseDatabaseConfig, SupabaseStorageConfig, supabaseDatabase, supabaseStorage };
+export { type SupabaseDatabaseConfig, SupabaseStorageConfig, plugins, supabaseDatabase, supabaseStorage };

package/dist/index.mjs

@@ -1,2 +1,141 @@
-import { n as supabaseDatabase, t as supabaseStorage } from "./supabaseStorage-CjteZ2zX.mjs";
-export { supabaseDatabase, supabaseStorage };
+import { a as SUPABASE_TABLE_PREFIX, i as SUPABASE_APPLY_FUNCTION, n as supabaseStorage, r as supabaseDatabase$1, t as plugins } from "./plugins-Dj-4Pk3j.mjs";
+import { SETTINGS_TABLE, WRITE_GUARD_TABLE, coreSettings, coreTarget, createTableStatements, generateEngineSql, isMultiIndex } from "@hot-updater/plugin-core";
+//#region src/supabaseSchema.ts
+/** Every table the apply RPC may name: models, index tables, settings, and the write guard. */
+const supabaseTableNames = (schema = coreTarget.schema) => [
+	...schema.tables.flatMap((table) => [table.name, ...table.indexes.filter((index) => isMultiIndex(table, index)).map((index) => `${table.name}__${index.name}`)]),
+	SETTINGS_TABLE.name,
+	WRITE_GUARD_TABLE.name
+].map((name) => SUPABASE_TABLE_PREFIX + name);
+/** The words the SQL core's statements use besides quoted names, numbers, and operators. */
+const KEYWORDS = [
+	"SELECT",
+	"FROM",
+	"WHERE",
+	"AND",
+	"OR",
+	"NOT",
+	"EXISTS",
+	"INSERT",
+	"INTO",
+	"VALUES",
+	"UPDATE",
+	"SET",
+	"DELETE",
+	"ORDER",
+	"BY",
+	"ASC",
+	"DESC",
+	"LIMIT",
+	"IS",
+	"NULL",
+	"ON",
+	"CONFLICT",
+	"DO",
+	"JOIN",
+	"FOR",
+	"bigint",
+	"double",
+	"precision",
+	"boolean",
+	"jsonb",
+	"i",
+	"b"
+];
+const literal = (value) => `'${value.replaceAll("'", "''")}'`;
+/**
+* Runs a batch of the SQL core's statements in the caller's transaction and
+* privileges (service role only), with every parameter read from one jsonb
+* array. Only the core's statement shapes on Hot Updater's tables pass: one
+* statement each, no literal, comment, or function call, and no word the
+* core does not write.
+*/
+const applyFunction = (tables) => `CREATE OR REPLACE FUNCTION public.${SUPABASE_APPLY_FUNCTION}(p_statements jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY INVOKER
+SET search_path = public, pg_temp
+AS $apply$
+DECLARE
+  item jsonb;
+  statement text;
+  shape text;
+  target text;
+  found record;
+  rows jsonb;
+  changed bigint;
+  results jsonb := '[]'::jsonb;
+BEGIN
+  FOR item IN SELECT value FROM jsonb_array_elements(p_statements) LOOP
+    statement := item->>'sql';
+    FOR target IN SELECT (regexp_matches(statement, '(?:FROM|INTO|UPDATE|JOIN) "([^"]+)"', 'g'))[1] LOOP
+      IF NOT target = ANY (ARRAY[${tables.map(literal).join(", ")}]) THEN
+        RAISE EXCEPTION '${SUPABASE_APPLY_FUNCTION}: % is not a Hot Updater table', target USING ERRCODE = '42501';
+      END IF;
+    END LOOP;
+    shape := regexp_replace(regexp_replace(statement, '^INSERT INTO "[^"]+" \\(', 'INSERT INTO ('), '"[^"]*"', '"', 'g');
+    IF shape !~ '^(SELECT|INSERT INTO|UPDATE|DELETE FROM) '
+      OR shape ~ '"[[:space:]]*\\('
+      OR shape ~ '[;''\\\\]|--|/\\*'
+      OR regexp_replace(shape, '\\m(${KEYWORDS.join("|")})\\M', '', 'gi') !~ '^[[:space:]"(),.*=<>+0-9$:-]*$' THEN
+      RAISE EXCEPTION '${SUPABASE_APPLY_FUNCTION}: statement not allowed' USING ERRCODE = '42501';
+    END IF;
+    IF statement ~ '^SELECT ' THEN
+      rows := '[]'::jsonb;
+      FOR found IN EXECUTE statement USING item->'params' LOOP
+        rows := rows || jsonb_build_array(to_jsonb(found));
+      END LOOP;
+      results := results || jsonb_build_array(jsonb_build_object('rows', rows, 'changes', 0));
+    ELSE
+      EXECUTE statement USING item->'params';
+      GET DIAGNOSTICS changed = ROW_COUNT;
+      results := results || jsonb_build_array(jsonb_build_object('rows', '[]'::jsonb, 'changes', changed));
+    END IF;
+  END LOOP;
+  RETURN results;
+END;
+$apply$`;
+/**
+* Supabase's migration: the shared SQL schema under the table prefix, the
+* write guard, row-level security on every table (no policy, so only the
+* service role reads or writes), the apply RPC for the service role alone,
+* and the settings rows last. Every statement can run again, so a migration
+* for a server's plugin tables repeats core's.
+*/
+const supabaseSchemaStatements = ({ schema, settings: expected } = coreTarget) => {
+	const engine = generateEngineSql("postgresql", schema, expected, { tablePrefix: SUPABASE_TABLE_PREFIX });
+	const settings = engine.slice(-Object.keys(expected).length);
+	const tables = supabaseTableNames(schema);
+	const apply = `public.${SUPABASE_APPLY_FUNCTION}(jsonb)`;
+	return [
+		...createTableStatements("postgresql", [WRITE_GUARD_TABLE], SUPABASE_TABLE_PREFIX),
+		...engine.slice(0, -settings.length),
+		...tables.map((table) => `ALTER TABLE "${table}" ENABLE ROW LEVEL SECURITY`),
+		applyFunction(tables),
+		`REVOKE EXECUTE ON FUNCTION ${apply} FROM PUBLIC, anon, authenticated`,
+		`GRANT EXECUTE ON FUNCTION ${apply} TO service_role`,
+		...settings
+	];
+};
+const supabaseSchemaSql = (target) => `-- HotUpdater.schema\n\n${supabaseSchemaStatements(target).map((statement) => `${statement};`).join("\n\n")}\n`;
+//#endregion
+//#region src/supabaseMigration.ts
+/**
+* Hot Updater's database on Supabase, with the migration `hot-updater db
+* generate` writes to `supabase/migrations`: core's tables, the server's
+* plugin tables, the apply RPC that may name them, and their settings rows.
+* `supabase db push` applies it.
+*/
+const supabaseDatabase = (config) => ({
+	...supabaseDatabase$1(config),
+	generateSchema: ((version, _name, target = coreTarget) => {
+		if (version !== "latest" && version !== coreSettings["schema.core"]) throw new Error(`Invalid version ${version}`);
+		const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14);
+		return {
+			code: supabaseSchemaSql(target),
+			path: `supabase/migrations/${timestamp}_hot-updater.sql`
+		};
+	})
+});
+//#endregion
+export { plugins, supabaseDatabase, supabaseStorage };