@hyperfixation/db 0.1.0

package/dist/migrate.js

@@ -0,0 +1,143 @@
+import { execFile } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { migrate as drizzleMigrate } from "drizzle-orm/node-postgres/migrator";
+import { Client } from "pg";
+import { checkE005 } from "./boot-checks.js";
+import { installDeleteGuards } from "./delete-guard.js";
+import { grantReadOnly } from "./grant-ro.js";
+import { roleNames } from "./roles.js";
+const execFileAsync = promisify(execFile);
+export const CORE_MIGRATIONS_TABLE = "hf_core_migrations";
+export const CORE_MIGRATIONS_SCHEMA = "drizzle";
+export const DBOS_SCHEMA = "dbos";
+export const CORE_MIGRATIONS_DIR = fileURLToPath(new URL("../migrations", import.meta.url));
+export class MigratorError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "MigratorError";
+    }
+}
+/**
+ * The five-step migrator, run as the migrator role on every deploy:
+ * core migrations, app migrations, `dbos schema -s dbos -r hf_<app>`,
+ * delete-guard triggers, `hf_grant_ro`.
+ *
+ * Order is load-bearing at both ends. Step 3 runs on every deploy, not just the
+ * first, so an SDK upgrade that adds a system table grants it before the worker
+ * that needs it starts; steps 4 and 5 run last because both have to see the
+ * tables steps 1 and 2 just created.
+ */
+export async function migrate(migratorConnectionString, options) {
+    const names = roleNames(options.appName);
+    const applicationRole = options.applicationRole ?? names.application;
+    const readonlyRole = options.readonlyRole ?? names.readonly;
+    const coreMigrationsDir = options.coreMigrationsDir ?? CORE_MIGRATIONS_DIR;
+    const client = new Client({ connectionString: migratorConnectionString });
+    await client.connect();
+    try {
+        await assertProvisioned(client, options.appName, applicationRole);
+        const db = drizzle(client);
+        await drizzleMigrate(db, {
+            migrationsFolder: coreMigrationsDir,
+            migrationsTable: CORE_MIGRATIONS_TABLE,
+            migrationsSchema: CORE_MIGRATIONS_SCHEMA,
+        });
+        if (options.appMigrationsDir !== undefined) {
+            // E005 runs here as well as at boot: refusing the migration is the only
+            // point at which an app's attempt to reshape an hf_* table is still undone.
+            await checkE005(options.appMigrationsDir);
+            await drizzleMigrate(db, { migrationsFolder: options.appMigrationsDir });
+        }
+        const grantTo = options.dangerouslySkipApplicationRoleGrant === true ? null : applicationRole;
+        await runDbosSchema(migratorConnectionString, grantTo);
+        const deleteGuards = await installDeleteGuards(client, options.recordTables ?? []);
+        const grantRo = await grantReadOnly(client, readonlyRole);
+        return {
+            applicationRole,
+            dbosSchemaGranted: grantTo !== null,
+            appMigrationsApplied: options.appMigrationsDir !== undefined,
+            deleteGuards,
+            grantRo,
+        };
+    }
+    finally {
+        await client.end();
+    }
+}
+const PROVISION_STATEMENT = `
+  SELECT current_user AS connected_role,
+         current_database() AS database_name,
+         EXISTS (SELECT 1 FROM pg_roles WHERE rolname = $1) AS application_role_exists,
+         has_database_privilege(current_user, current_database(), 'CREATE') AS create_on_database,
+         coalesce(
+           has_schema_privilege(current_user, to_regnamespace('public'), 'CREATE'),
+           false
+         ) AS create_on_public`;
+/**
+ * The state `provisionRoles` leaves behind and the migrator cannot create for itself: a role
+ * cannot grant itself `CREATE`, and granting `dbos` to an application role that does not exist
+ * is not something a migration can fix. Each of these otherwise surfaces one at a time, several
+ * steps apart — the `CREATE SCHEMA "drizzle"` of step 1, then `public`, then step 3's `-r` —
+ * so a plain `CREATE DATABASE` costs three runs to discover what one message can say.
+ */
+async function assertProvisioned(client, appName, applicationRole) {
+    const { rows } = await client.query(PROVISION_STATEMENT, [applicationRole]);
+    const state = rows[0];
+    const missing = [];
+    if (!state.application_role_exists) {
+        missing.push(`the application role "${applicationRole}" does not exist`);
+    }
+    if (!state.create_on_database) {
+        missing.push(`"${state.connected_role}" may not CREATE in database "${state.database_name}"`);
+    }
+    if (!state.create_on_public) {
+        missing.push(`"${state.connected_role}" may not CREATE in schema "public"`);
+    }
+    if (missing.length === 0)
+        return;
+    throw new MigratorError(`database "${state.database_name}" is not provisioned for ${appName}: ${missing.join("; ")}. ` +
+        "Run `hf migrate` in the app directory, which provisions the roles before running this; " +
+        "a deployed database is provisioned by provisionRoles() from @hyperfixation/db/migrator.");
+}
+/**
+ * `dbos schema -s dbos -r <role>`: creates the DBOS system schema and grants the
+ * application role on it. The `-r` flag is the only path to those grants — the
+ * SDK's `getDbosSchemaPermissionsSql` is the sole source of `GRANT` statements
+ * anywhere in it — and without them the worker cannot launch at all.
+ */
+export async function runDbosSchema(migratorConnectionString, applicationRole, schema = DBOS_SCHEMA) {
+    const cli = resolveDbosCli();
+    const args = [cli, "schema", "-s", schema];
+    if (applicationRole !== null)
+        args.push("-r", applicationRole);
+    args.push(migratorConnectionString);
+    try {
+        await execFileAsync(process.execPath, args, { encoding: "utf8" });
+    }
+    catch (cause) {
+        throw new MigratorError(`dbos schema -s ${schema}${applicationRole === null ? "" : ` -r ${applicationRole}`} failed: ` +
+            cause.message, { cause });
+    }
+}
+function resolveDbosCli() {
+    const require = createRequire(import.meta.url);
+    let dir = path.dirname(require.resolve("@dbos-inc/dbos-sdk"));
+    for (;;) {
+        const manifest = path.join(dir, "package.json");
+        if (existsSync(manifest)) {
+            const pkg = JSON.parse(readFileSync(manifest, "utf8"));
+            if (pkg.name === "@dbos-inc/dbos-sdk" && pkg.bin?.dbos !== undefined) {
+                return path.resolve(dir, pkg.bin.dbos);
+            }
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            throw new MigratorError("could not locate the @dbos-inc/dbos-sdk CLI");
+        dir = parent;
+    }
+}

package/dist/migration-policy.d.ts

@@ -0,0 +1,14 @@
+export declare class MigrationPolicyViolation extends Error {
+    readonly statement: string | undefined;
+    constructor(message: string, statement?: string);
+}
+/**
+ * Throws unless every statement in an app migration is on the allowlist.
+ *
+ * Default-deny: a statement kind that is not listed, and any SQL the parser
+ * cannot read, is a violation. `CREATE PROCEDURE` reaches the unparseable
+ * branch — pgsql-ast-parser has no node for it — and `CREATE FUNCTION` its own;
+ * both must be refused however they are spelled, because either can hide a
+ * write behind something a later caller reads as a read.
+ */
+export declare function assertAppMigrationAllowed(sql: string): void;

package/dist/migration-policy.js

@@ -0,0 +1,85 @@
+import { parse } from "pgsql-ast-parser";
+export class MigrationPolicyViolation extends Error {
+    statement;
+    constructor(message, statement) {
+        super(message);
+        this.name = "MigrationPolicyViolation";
+        this.statement = statement;
+    }
+}
+/**
+ * Throws unless every statement in an app migration is on the allowlist.
+ *
+ * Default-deny: a statement kind that is not listed, and any SQL the parser
+ * cannot read, is a violation. `CREATE PROCEDURE` reaches the unparseable
+ * branch — pgsql-ast-parser has no node for it — and `CREATE FUNCTION` its own;
+ * both must be refused however they are spelled, because either can hide a
+ * write behind something a later caller reads as a read.
+ */
+export function assertAppMigrationAllowed(sql) {
+    for (const statement of splitStatements(sql)) {
+        let parsed;
+        try {
+            parsed = parse(statement);
+        }
+        catch (cause) {
+            throw new MigrationPolicyViolation(`app migrations may not contain SQL the migration policy cannot parse: ${cause.message}`, statement);
+        }
+        for (const node of parsed)
+            assertStatementAllowed(node, statement);
+    }
+}
+function assertStatementAllowed(node, statement) {
+    switch (node.type) {
+        case "create table":
+            return;
+        case "create index":
+            if (node.unique) {
+                throw new MigrationPolicyViolation("app migrations may not create unique indexes", statement);
+            }
+            return;
+        case "create extension":
+            if (!node.ifNotExists) {
+                throw new MigrationPolicyViolation("CREATE EXTENSION must be IF NOT EXISTS in an app migration", statement);
+            }
+            return;
+        case "alter table":
+            assertAlterTableAllowed(node, statement);
+            return;
+        case "create function":
+            throw new MigrationPolicyViolation("app migrations may not contain CREATE FUNCTION", statement);
+        default:
+            throw new MigrationPolicyViolation(`app migrations may not contain \`${node.type}\` statements`, statement);
+    }
+}
+function assertAlterTableAllowed(node, statement) {
+    for (const change of node.changes) {
+        switch (change.type) {
+            case "add column": {
+                const constraints = change.column.constraints ?? [];
+                const notNull = constraints.some((c) => c.type === "not null");
+                const hasDefault = constraints.some((c) => c.type === "default");
+                if (notNull && !hasDefault) {
+                    throw new MigrationPolicyViolation("ADD COLUMN must be nullable or carry a default in an app migration", statement);
+                }
+                break;
+            }
+            case "alter column":
+                if (change.alter.type !== "drop not null") {
+                    throw new MigrationPolicyViolation(`app migrations may not \`ALTER COLUMN … ${change.alter.type.toUpperCase()}\``, statement);
+                }
+                break;
+            default:
+                throw new MigrationPolicyViolation(`app migrations may not \`ALTER TABLE … ${change.type.toUpperCase()}\``, statement);
+        }
+    }
+}
+// Drizzle Kit writes one migration file as several statements separated by this
+// marker; the parser is happy with either form, but splitting keeps a violation's
+// `statement` pointed at the offending statement rather than the whole file.
+function splitStatements(sql) {
+    return sql
+        .split("--> statement-breakpoint")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}

package/dist/migrator.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Deploy-time surface, kept off `.` so the web and worker bundles never pull the migrator's
+ * `node:child_process` and filesystem dependencies in behind the schema.
+ */
+export { assertAppMigrationAllowed, MigrationPolicyViolation } from "./migration-policy.js";
+export { assertAppName, provisionRoles, roleNames, RoleProvisioningError, type ProvisionedRoles, type ProvisionRolesOptions, type RoleNames, } from "./roles.js";
+export { migrate, runDbosSchema, MigratorError, CORE_MIGRATIONS_DIR, CORE_MIGRATIONS_SCHEMA, CORE_MIGRATIONS_TABLE, DBOS_SCHEMA, type MigrateOptions, type MigrateResult, } from "./migrate.js";
+export { installDeleteGuards, DELETE_GUARD_FUNCTION, DELETE_GUARD_REFERENCING_TABLES, type DeleteGuardResult, type RecordTable, } from "./delete-guard.js";
+export { grantReadOnly, GRANT_RO_EXCLUDED_TABLES, type GrantRoResult } from "./grant-ro.js";

package/dist/migrator.js

@@ -0,0 +1,9 @@
+/**
+ * Deploy-time surface, kept off `.` so the web and worker bundles never pull the migrator's
+ * `node:child_process` and filesystem dependencies in behind the schema.
+ */
+export { assertAppMigrationAllowed, MigrationPolicyViolation } from "./migration-policy.js";
+export { assertAppName, provisionRoles, roleNames, RoleProvisioningError, } from "./roles.js";
+export { migrate, runDbosSchema, MigratorError, CORE_MIGRATIONS_DIR, CORE_MIGRATIONS_SCHEMA, CORE_MIGRATIONS_TABLE, DBOS_SCHEMA, } from "./migrate.js";
+export { installDeleteGuards, DELETE_GUARD_FUNCTION, DELETE_GUARD_REFERENCING_TABLES, } from "./delete-guard.js";
+export { grantReadOnly, GRANT_RO_EXCLUDED_TABLES } from "./grant-ro.js";

package/dist/roles.d.ts

@@ -0,0 +1,47 @@
+export declare class RoleProvisioningError extends Error {
+    constructor(message: string);
+}
+export interface RoleNames {
+    /** Owns every `hf_*` object and the `dbos` schema; the only role `migrate` uses. */
+    migrator: string;
+    /** Used by `web` and `worker`; owns nothing. */
+    application: string;
+    /** Metabase's read-only role; created only when a password is supplied. */
+    readonly: string;
+}
+export interface ProvisionRolesOptions {
+    appName: string;
+    databaseName: string;
+    migratorPassword?: string;
+    applicationPassword?: string;
+    /** Supply to create the `_ro` role as well; omit to leave it uncreated. */
+    readonlyPassword?: string;
+}
+export interface ProvisionedRoles extends RoleNames {
+    migratorPassword: string;
+    applicationPassword: string;
+    readonlyPassword: string | undefined;
+}
+export declare function roleNames(appName: string): RoleNames;
+export declare function assertAppName(appName: string): void;
+/**
+ * Creates the migrator role, the application role, and optionally the read-only
+ * role, and gives each the database- and schema-level privileges the migrator
+ * cannot give itself later.
+ *
+ * The application role's privileges on `hf_*` tables come from default
+ * privileges recorded here *for the migrator role*, not from a grant step in the
+ * migrator: every deploy's migrations create tables as the migrator, so tables
+ * added by a later deploy are granted at creation with no extra step to forget.
+ * Privileges on `dbos.*` are a separate matter entirely — only
+ * `dbos schema -r <role>` grants those (see `runDbosSchema`).
+ *
+ * `adminConnectionString` must be a superuser (or role-creating) connection; it
+ * may point at any database on the cluster, since the target database is
+ * reconnected to by name.
+ */
+export declare function provisionRoles(adminConnectionString: string, options: ProvisionRolesOptions): Promise<ProvisionedRoles>;
+export declare function generatePassword(): string;
+/** Swaps the database of a connection string, keeping credentials and options. */
+export declare function withDatabase(connectionString: string, databaseName: string): string;
+export declare function quoteIdent(name: string): string;

package/dist/roles.js

@@ -0,0 +1,112 @@
+import { randomBytes } from "node:crypto";
+import { Client } from "pg";
+/** The identifier rule `hf new` validates an app name against. */
+const APP_NAME = /^[a-z][a-z0-9_]{0,62}$/;
+export class RoleProvisioningError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "RoleProvisioningError";
+    }
+}
+export function roleNames(appName) {
+    assertAppName(appName);
+    return {
+        migrator: `hf_${appName}_migrator`,
+        application: `hf_${appName}`,
+        readonly: `hf_${appName}_ro`,
+    };
+}
+export function assertAppName(appName) {
+    if (!APP_NAME.test(appName)) {
+        throw new RoleProvisioningError(`app name must match ${APP_NAME.source}, got ${JSON.stringify(appName)}`);
+    }
+}
+/**
+ * Creates the migrator role, the application role, and optionally the read-only
+ * role, and gives each the database- and schema-level privileges the migrator
+ * cannot give itself later.
+ *
+ * The application role's privileges on `hf_*` tables come from default
+ * privileges recorded here *for the migrator role*, not from a grant step in the
+ * migrator: every deploy's migrations create tables as the migrator, so tables
+ * added by a later deploy are granted at creation with no extra step to forget.
+ * Privileges on `dbos.*` are a separate matter entirely — only
+ * `dbos schema -r <role>` grants those (see `runDbosSchema`).
+ *
+ * `adminConnectionString` must be a superuser (or role-creating) connection; it
+ * may point at any database on the cluster, since the target database is
+ * reconnected to by name.
+ */
+export async function provisionRoles(adminConnectionString, options) {
+    const names = roleNames(options.appName);
+    assertIdentifier(options.databaseName, "database name");
+    const provisioned = {
+        ...names,
+        migratorPassword: options.migratorPassword ?? generatePassword(),
+        applicationPassword: options.applicationPassword ?? generatePassword(),
+        readonlyPassword: options.readonlyPassword,
+    };
+    const admin = new Client({ connectionString: adminConnectionString });
+    await admin.connect();
+    try {
+        await createLoginRole(admin, names.migrator, provisioned.migratorPassword, null);
+        await createLoginRole(admin, names.application, provisioned.applicationPassword, 25);
+        if (provisioned.readonlyPassword !== undefined) {
+            await createLoginRole(admin, names.readonly, provisioned.readonlyPassword, 4);
+        }
+        const db = quoteIdent(options.databaseName);
+        await admin.query(`GRANT CONNECT, CREATE ON DATABASE ${db} TO ${quoteIdent(names.migrator)}`);
+        await admin.query(`GRANT CONNECT ON DATABASE ${db} TO ${quoteIdent(names.application)}`);
+        if (provisioned.readonlyPassword !== undefined) {
+            await admin.query(`GRANT CONNECT ON DATABASE ${db} TO ${quoteIdent(names.readonly)}`);
+        }
+    }
+    finally {
+        await admin.end();
+    }
+    const target = new Client({
+        connectionString: withDatabase(adminConnectionString, options.databaseName),
+    });
+    await target.connect();
+    try {
+        await target.query(`GRANT CREATE, USAGE ON SCHEMA public TO ${quoteIdent(names.migrator)}`);
+        await target.query(`GRANT USAGE ON SCHEMA public TO ${quoteIdent(names.application)}`);
+        await target.query(`ALTER DEFAULT PRIVILEGES FOR ROLE ${quoteIdent(names.migrator)} IN SCHEMA public ` +
+            `GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${quoteIdent(names.application)}`);
+        await target.query(`ALTER DEFAULT PRIVILEGES FOR ROLE ${quoteIdent(names.migrator)} IN SCHEMA public ` +
+            `GRANT USAGE, SELECT ON SEQUENCES TO ${quoteIdent(names.application)}`);
+        if (provisioned.readonlyPassword !== undefined) {
+            await target.query(`GRANT USAGE ON SCHEMA public TO ${quoteIdent(names.readonly)}`);
+        }
+    }
+    finally {
+        await target.end();
+    }
+    return provisioned;
+}
+async function createLoginRole(admin, role, password, connectionLimit) {
+    const { rows } = await admin.query("SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = $1) AS exists", [role]);
+    const verb = rows[0]?.exists ? "ALTER" : "CREATE";
+    const limit = connectionLimit === null ? "" : ` CONNECTION LIMIT ${connectionLimit}`;
+    await admin.query(`${verb} ROLE ${quoteIdent(role)} LOGIN PASSWORD ${quoteLiteral(password)}${limit}`);
+}
+export function generatePassword() {
+    return randomBytes(24).toString("base64url");
+}
+/** Swaps the database of a connection string, keeping credentials and options. */
+export function withDatabase(connectionString, databaseName) {
+    const url = new URL(connectionString);
+    url.pathname = `/${encodeURIComponent(databaseName)}`;
+    return url.toString();
+}
+export function quoteIdent(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+function quoteLiteral(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+function assertIdentifier(value, what) {
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]{0,62}$/.test(value)) {
+        throw new RoleProvisioningError(`${what} must be a plain identifier, got ${JSON.stringify(value)}`);
+    }
+}

package/dist/schema/app.d.ts

@@ -0,0 +1,235 @@
+export declare const hfAppState: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "hf_app_state";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "hf_app_state";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        paused: import("drizzle-orm/pg-core").PgColumn<{
+            name: "paused";
+            tableName: "hf_app_state";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        pausedBy: import("drizzle-orm/pg-core").PgColumn<{
+            name: "paused_by";
+            tableName: "hf_app_state";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        budgetUsd: import("drizzle-orm/pg-core").PgColumn<{
+            name: "budget_usd";
+            tableName: "hf_app_state";
+            dataType: "string";
+            columnType: "PgNumeric";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        readTokenHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "read_token_hash";
+            tableName: "hf_app_state";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        writeTokenHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "write_token_hash";
+            tableName: "hf_app_state";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export declare const hfAudit: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "hf_audit";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "hf_audit";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: "always";
+            generated: undefined;
+        }, {}, {}>;
+        actorId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor_id";
+            tableName: "hf_audit";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        action: import("drizzle-orm/pg-core").PgColumn<{
+            name: "action";
+            tableName: "hf_audit";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        targetType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "target_type";
+            tableName: "hf_audit";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        targetId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "target_id";
+            tableName: "hf_audit";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        meta: import("drizzle-orm/pg-core").PgColumn<{
+            name: "meta";
+            tableName: "hf_audit";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: unknown;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        at: import("drizzle-orm/pg-core").PgColumn<{
+            name: "at";
+            tableName: "hf_audit";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;