@zeno-lib/db 0.3.1 → 0.3.2

package/dist/index.d.mts

@@ -0,0 +1,42 @@
+import { AnyRelations, EmptyRelations } from "drizzle-orm";
+import { DrizzlePgConfig } from "drizzle-orm/pg-core";
+import { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import { JwtPayload, SupabaseClient } from "@supabase/supabase-js";
+//#region src/clients.d.ts
+type CloseFn = (options?: {
+  timeout?: number;
+}) => Promise<void>;
+type CreateClientConfig<TRelations extends AnyRelations = EmptyRelations> = DrizzlePgConfig<TRelations> & {
+  /** Overrides `process.env.SUPABASE_DATABASE_URL`. */
+  connectionString?: string;
+};
+type DrizzleClient<TRelations extends AnyRelations = EmptyRelations> = PostgresJsDatabase<TRelations> & {
+  close: CloseFn;
+};
+type SupabaseToken = Pick<JwtPayload, "role" | "sub">;
+/**
+ * RLS-bypassing client (the docs' `admin`). Connects with
+ * `SUPABASE_DATABASE_URL` and queries drizzle directly. Use for webhooks,
+ * background jobs, and seeding, never for user-scoped reads/writes.
+ */
+declare function createAdminClient<TRelations extends AnyRelations = EmptyRelations>(config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
+/**
+ * RLS client scoped to an already-verified, decoded token (e.g. from
+ * `supabase.auth.getClaims()`). The role is clamped to the allowlist.
+ */
+declare function createSupabaseClient<TRelations extends AnyRelations = EmptyRelations>(accessToken: SupabaseToken, config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
+/**
+ * RLS client bound to a Supabase client. Verified claims are resolved via
+ * `supabase.auth.getClaims()` on every query, so it always reflects the live
+ * session.
+ */
+declare function createAuthClient<TRelations extends AnyRelations = EmptyRelations>(supabase: SupabaseClient, config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
+/** RLS client that runs every query as the `anon` role. */
+declare function createAnonClient<TRelations extends AnyRelations = EmptyRelations>(config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
+/**
+ * Client that runs every query as `service_role`, which bypasses RLS via
+ * Supabase's BYPASSRLS grant. Use for trusted server-side work.
+ */
+declare function createServiceClient<TRelations extends AnyRelations = EmptyRelations>(config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
+//#endregion
+export { type CreateClientConfig, type DrizzleClient, type SupabaseToken, createAdminClient, createAnonClient, createAuthClient, createServiceClient, createSupabaseClient };

package/dist/index.mjs

@@ -0,0 +1,167 @@
+import { sql } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+//#region src/rls-query-client.ts
+function replayAsUserChain(tx, path) {
+	let receiver = tx;
+	let current = tx;
+	for (const step of path) if (step.kind === "get") {
+		receiver = current;
+		current = current[step.prop];
+	} else current = current.apply(receiver, step.args);
+	return current;
+}
+const PROMISE_METHODS = /* @__PURE__ */ new Set([
+	"then",
+	"catch",
+	"finally"
+]);
+function replayPromiseMethod(prop, path, runTransaction) {
+	return (...promiseArgs) => {
+		const promise = runTransaction((tx) => replayAsUserChain(tx, path));
+		return promise[prop].apply(promise, promiseArgs);
+	};
+}
+function createRlsQueryClient(runTransaction, close) {
+	const build = (path, isRoot) => {
+		const target = () => void 0;
+		return new Proxy(target, {
+			apply(_target, _thisArg, args) {
+				if (isRoot) throw new Error("The createSupabaseDrizzle() client is queried directly (e.g. db.select().from(table)). Use db.transaction(cb) to run multiple statements in one RLS transaction.");
+				return build([...path, {
+					args,
+					kind: "apply"
+				}], false);
+			},
+			get(_target, prop) {
+				if (isRoot && prop === "transaction") return runTransaction;
+				if (isRoot && prop === "close") return close;
+				if (PROMISE_METHODS.has(prop)) return isRoot ? void 0 : replayPromiseMethod(prop, path, runTransaction);
+				if (typeof prop === "symbol") return;
+				return build([...path, {
+					kind: "get",
+					prop
+				}], false);
+			}
+		});
+	};
+	return build([], true);
+}
+//#endregion
+//#region src/clients.ts
+const ALLOWED_RLS_ROLES = /* @__PURE__ */ new Set(["anon", "authenticated"]);
+function clampClaims(token) {
+	const role = token.role && ALLOWED_RLS_ROLES.has(token.role) ? token.role : "anon";
+	return {
+		claims: JSON.stringify({
+			...token,
+			role
+		}),
+		role,
+		sub: token.sub ?? ""
+	};
+}
+function fixedContext(role) {
+	return {
+		claims: JSON.stringify({ role }),
+		role,
+		sub: ""
+	};
+}
+const poolCache = /* @__PURE__ */ new Map();
+function acquirePool(connectionString, kind) {
+	const key = `${kind} ${connectionString}`;
+	let entry = poolCache.get(key);
+	if (!entry) {
+		entry = {
+			client: postgres(connectionString, { prepare: false }),
+			ended: false,
+			key,
+			refCount: 0
+		};
+		poolCache.set(key, entry);
+	}
+	entry.refCount += 1;
+	return entry;
+}
+function makeClose(entry) {
+	let released = false;
+	return async (options) => {
+		if (released) return;
+		released = true;
+		entry.refCount -= 1;
+		if (entry.refCount <= 0 && !entry.ended) {
+			entry.ended = true;
+			if (poolCache.get(entry.key) === entry) poolCache.delete(entry.key);
+			await entry.client.end(options);
+		}
+	};
+}
+function buildDrizzle(kind, config) {
+	const { connectionString, ...drizzleConfig } = config ?? {};
+	const url = connectionString ?? process.env.SUPABASE_DATABASE_URL ?? "";
+	if (!url) throw new Error("Missing SUPABASE_DATABASE_URL environment variable");
+	const entry = acquirePool(url, kind);
+	const db = drizzle({
+		client: entry.client,
+		...drizzleConfig
+	});
+	return {
+		close: makeClose(entry),
+		db
+	};
+}
+function buildRlsClient(resolveContext, config) {
+	const { close, db } = buildDrizzle("rls", config);
+	const runTransaction = async (transaction) => {
+		const { claims, role, sub } = await resolveContext();
+		return db.transaction(async (tx) => {
+			await tx.execute(sql`select set_config('request.jwt.claims', ${claims}, true), set_config('request.jwt.claim.sub', ${sub}, true)`);
+			await tx.execute(sql`set local role ${sql.raw(role)}`);
+			return transaction(tx);
+		});
+	};
+	return createRlsQueryClient(runTransaction, close);
+}
+/**
+* RLS-bypassing client (the docs' `admin`). Connects with
+* `SUPABASE_DATABASE_URL` and queries drizzle directly. Use for webhooks,
+* background jobs, and seeding, never for user-scoped reads/writes.
+*/
+function createAdminClient(config) {
+	const { close, db } = buildDrizzle("admin", config);
+	return Object.assign(db, { close });
+}
+/**
+* RLS client scoped to an already-verified, decoded token (e.g. from
+* `supabase.auth.getClaims()`). The role is clamped to the allowlist.
+*/
+function createSupabaseClient(accessToken, config) {
+	const context = clampClaims(accessToken);
+	return buildRlsClient(() => Promise.resolve(context), config);
+}
+/**
+* RLS client bound to a Supabase client. Verified claims are resolved via
+* `supabase.auth.getClaims()` on every query, so it always reflects the live
+* session.
+*/
+function createAuthClient(supabase, config) {
+	return buildRlsClient(async () => {
+		const { data, error } = await supabase.auth.getClaims();
+		if (error) throw error;
+		return clampClaims(data?.claims ?? {});
+	}, config);
+}
+/** RLS client that runs every query as the `anon` role. */
+function createAnonClient(config) {
+	return buildRlsClient(() => Promise.resolve(fixedContext("anon")), config);
+}
+/**
+* Client that runs every query as `service_role`, which bypasses RLS via
+* Supabase's BYPASSRLS grant. Use for trusted server-side work.
+*/
+function createServiceClient(config) {
+	return buildRlsClient(() => Promise.resolve(fixedContext("service_role")), config);
+}
+//#endregion
+export { createAdminClient, createAnonClient, createAuthClient, createServiceClient, createSupabaseClient };

package/dist/schema.d.mts

@@ -0,0 +1,149 @@
+import { AnyPgColumn, ExtraConfigColumn, HasIdentity, PgBigInt53Builder, PgBigInt64Builder, PgIntegerBuilder, PgPolicyConfig, PgUUIDBuilder, Precision, ReferenceConfig, SetHasDefault, SetIsPrimaryKey, SetNotNull, isPgEnum as isEnum, isPgMaterializedView as isMaterializedView, isPgSchema as isSchema, isPgSequence as isSequence, isPgView as isView, pgEnum as enum$1, pgMaterializedView as materializedView, pgPolicy as policy, pgRole as role, pgSequence as sequence, pgTableCreator as tableCreator, pgView as view } from "drizzle-orm/pg-core";
+import { anonRole, authUid, authenticatedRole, postgresRole, realtimeMessages, realtimeTopic, serviceRole, supabaseAuthAdminRole } from "drizzle-orm/supabase";
+//#region src/schema.d.ts
+type TimestampsOptions = {
+  withTimezone?: boolean;
+  /** Fractional-second digits. Postgres allows 0 to 6. */
+  precision?: Precision;
+};
+declare const timestamps: ({ precision, withTimezone }?: TimestampsOptions) => {
+  createdAt: SetHasDefault<SetNotNull<import("drizzle-orm/pg-core").PgTimestampBuilder>>;
+  updatedAt: SetHasDefault<SetNotNull<import("drizzle-orm/pg-core").PgTimestampBuilder>>;
+};
+type ReferenceActions = ReferenceConfig["config"];
+type AuthorColumn<TNotNull extends boolean> = [TNotNull] extends [true] ? SetNotNull<PgUUIDBuilder> : PgUUIDBuilder;
+type AuthorReference = {
+  reference?: () => AnyPgColumn;
+  actions?: ReferenceActions;
+} | {
+  reference: null;
+  actions?: never;
+};
+type AuthorshipOptions<TNotNull extends boolean = false> = AuthorReference & {
+  notNull?: TNotNull;
+};
+declare function authUserId<TNotNull extends boolean = false>(options?: AuthorshipOptions<TNotNull> & {
+  name?: string;
+}): AuthorColumn<TNotNull>;
+declare function userId<TNotNull extends boolean = false>(reference: () => AnyPgColumn, options?: {
+  name?: string;
+  actions?: ReferenceActions;
+  notNull?: TNotNull;
+}): AuthorColumn<TNotNull>;
+declare function createdBy<TNotNull extends boolean = false>(options?: AuthorshipOptions<TNotNull>): SetHasDefault<AuthorColumn<TNotNull>>;
+declare function updatedBy<TNotNull extends boolean = false>(options?: AuthorshipOptions<TNotNull>): SetHasDefault<AuthorColumn<TNotNull>>;
+declare const authorship: <TNotNull extends boolean = false>(options?: AuthorshipOptions<TNotNull>) => {
+  createdBy: SetHasDefault<AuthorColumn<TNotNull>>;
+  updatedBy: SetHasDefault<AuthorColumn<TNotNull>>;
+};
+declare const auditColumns: <TNotNull extends boolean = false>(options?: AuthorshipOptions<TNotNull> & TimestampsOptions) => {
+  createdAt: SetHasDefault<SetNotNull<import("drizzle-orm/pg-core").PgTimestampBuilder>>;
+  updatedAt: SetHasDefault<SetNotNull<import("drizzle-orm/pg-core").PgTimestampBuilder>>;
+  createdBy: SetHasDefault<AuthorColumn<TNotNull>>;
+  updatedBy: SetHasDefault<AuthorColumn<TNotNull>>;
+};
+type UuidPrimaryIdColumn<TDefaultRandom extends boolean> = [TDefaultRandom] extends [false] ? SetIsPrimaryKey<PgUUIDBuilder> : SetHasDefault<SetIsPrimaryKey<PgUUIDBuilder>>;
+declare function uuidPrimaryId<TDefaultRandom extends boolean = true>(options?: {
+  name?: string;
+  defaultRandom?: TDefaultRandom;
+}): UuidPrimaryIdColumn<TDefaultRandom>;
+type IdentityType = "integer" | "bigint";
+type IdentityMode = "number" | "bigint";
+type IdentityGeneration = "byDefault" | "always";
+type IdentityBuilder<TType extends IdentityType, TMode extends IdentityMode> = TType extends "integer" ? PgIntegerBuilder : TMode extends "bigint" ? PgBigInt64Builder : PgBigInt53Builder;
+type SequentialPrimaryIdColumn<TType extends IdentityType, TMode extends IdentityMode, TGeneration extends IdentityGeneration> = HasIdentity<SetIsPrimaryKey<IdentityBuilder<TType, TMode>>, TGeneration>;
+declare function sequentialPrimaryId<TType extends IdentityType = "bigint", TMode extends IdentityMode = "number", TGeneration extends IdentityGeneration = "byDefault">(options?: {
+  name?: string;
+  type?: TType;
+  mode?: TType extends "integer" ? never : TMode;
+  generated?: TGeneration;
+}): SequentialPrimaryIdColumn<TType, TMode, TGeneration>;
+declare const assignedPrimaryId: ({ name, length }?: {
+  name?: string;
+  length?: number;
+}) => SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>;
+type PrimaryIdKind = "uuid" | "sequential" | "assigned";
+type PrimaryIdColumn<TKind extends PrimaryIdKind> = TKind extends "uuid" ? UuidPrimaryIdColumn<true> : TKind extends "sequential" ? SequentialPrimaryIdColumn<"bigint", "number", "byDefault"> : ReturnType<typeof assignedPrimaryId>;
+declare function primaryId<TKind extends PrimaryIdKind = "sequential">(kind?: TKind): PrimaryIdColumn<TKind>;
+type PolicyOptions = Omit<PgPolicyConfig, "for">;
+type PolicyOperation = NonNullable<PgPolicyConfig["for"]>;
+type AuthenticatedPolicyOptions = Omit<PgPolicyConfig, "for" | "to">;
+declare const selectPolicy: (name: string, config?: PolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const insertPolicy: (name: string, config?: PolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const updatePolicy: (name: string, config?: PolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const deletePolicy: (name: string, config?: PolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const allPolicy: (name: string, config?: PolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedSelectPolicy: (name: string, config?: AuthenticatedPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedInsertPolicy: (name: string, config?: AuthenticatedPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedUpdatePolicy: (name: string, config?: AuthenticatedPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedDeletePolicy: (name: string, config?: AuthenticatedPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedAllPolicy: (name: string, config?: AuthenticatedPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const FUNCTION_POLICY_OPERATIONS: readonly ["select", "insert", "update", "delete"];
+type FunctionPolicyOperation = (typeof FUNCTION_POLICY_OPERATIONS)[number];
+/** Columns one function is called with. `null` calls it with none. */
+type FunctionArgument = AnyPgColumn | readonly AnyPgColumn[] | null;
+type FunctionPoliciesOptions = {
+  /**
+   * Passed to each function, e.g. the row's id: one column, an array for a
+   * function taking several, or a record to vary them per operation. The
+   * common shape is that the row-scoped operations take the row and `insert`
+   * takes nothing, there being no row yet to authorise, only the caller. An
+   * operation missing from the record, or set to `null`, is called with no
+   * arguments; so is every operation when `argument` is omitted.
+   */
+  argument?: FunctionArgument | Partial<Record<FunctionPolicyOperation, FunctionArgument>>;
+  /**
+   * Schema the functions live in, e.g. `"billing"` for
+   * `billing.can_select_invoices`. Omit to emit the name unqualified and let
+   * the `search_path` in effect resolve it.
+   */
+  schema?: string;
+  /** Prefix for the default function and policy names. Default `"can"`. */
+  prefix?: string;
+  /** Overrides the generated policy name. */
+  name?: (operation: PolicyOperation, table: string) => string;
+};
+type ExtraConfigColumns = Record<string, ExtraConfigColumn>;
+/**
+ * One policy per operation, each delegating to a `security definer` function.
+ *
+ * Access rarely depends only on the row's own owner column, and the usual
+ * answer is a function, which is also the standard advice for keeping RLS
+ * predicates out of the planner's way:
+ *
+ * ```ts
+ * table("posts", { id: primaryId("uuid") }, (t) =>
+ *   functionPolicies(t, { argument: t.id })
+ * )
+ * ```
+ *
+ * ```sql
+ * CREATE POLICY "can_select_posts" ON "posts" FOR SELECT TO "authenticated"
+ *   USING ((select "can_select_posts"("posts"."id")));
+ * ```
+ *
+ * `argument` also takes a record, for the usual shape where `insert` has no
+ * row to authorise yet:
+ *
+ * ```ts
+ * functionPolicies(t, {
+ *   argument: { delete: t.id, select: t.id, update: t.id },
+ * })
+ * ```
+ */
+declare const functionPolicies: (columns: ExtraConfigColumns, { argument, name, prefix, schema: functionSchema }?: FunctionPoliciesOptions) => import("drizzle-orm/pg-core").PgPolicy[];
+declare const authUserOwns: (ownerColumn: AnyPgColumn) => import("drizzle-orm").SQL<unknown>;
+type OwnerPolicyOptions = Omit<PgPolicyConfig, "for" | "to">;
+declare const authenticatedOwnerSelectPolicy: (name: string, ownerColumn: AnyPgColumn, config?: OwnerPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedOwnerInsertPolicy: (name: string, ownerColumn: AnyPgColumn, config?: OwnerPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedOwnerUpdatePolicy: (name: string, ownerColumn: AnyPgColumn, config?: OwnerPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedOwnerDeletePolicy: (name: string, ownerColumn: AnyPgColumn, config?: OwnerPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedOwnerAllPolicy: (name: string, ownerColumn: AnyPgColumn, config?: OwnerPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const table: import("drizzle-orm/pg-core").PgTableFnInternal<undefined>;
+declare const unsecureTable: import("drizzle-orm/pg-core").PgTableFn<undefined>;
+declare const schema: <TName extends string>(name: TName) => import("drizzle-orm/pg-core").PgSchema<TName> & {
+  table: import("drizzle-orm/pg-core").PgTableFnInternal<TName>;
+  unsecureTable: import("drizzle-orm/pg-core").PgTableFn<TName>;
+};
+//#endregion
+export { AuthorshipOptions, allPolicy, anonRole, assignedPrimaryId, auditColumns, authUid, authUserId, authUserOwns, authenticatedAllPolicy, authenticatedDeletePolicy, authenticatedInsertPolicy, authenticatedOwnerAllPolicy, authenticatedOwnerDeletePolicy, authenticatedOwnerInsertPolicy, authenticatedOwnerSelectPolicy, authenticatedOwnerUpdatePolicy, authenticatedRole, authenticatedSelectPolicy, authenticatedUpdatePolicy, authorship, createdBy, deletePolicy, enum$1 as enum, functionPolicies, insertPolicy, isEnum, isMaterializedView, isSchema, isSequence, isView, materializedView, policy, postgresRole, primaryId, realtimeMessages, realtimeTopic, role, schema, selectPolicy, sequence, sequentialPrimaryId, serviceRole, supabaseAuthAdminRole, table, tableCreator, timestamps, unsecureTable, updatePolicy, updatedBy, userId, uuidPrimaryId, view };

package/dist/schema.mjs

@@ -0,0 +1,220 @@
+import { authUsers } from "./auth-schema.mjs";
+import { Column, getColumnTable, getTableName, is, sql } from "drizzle-orm";
+import { bigint, integer, isPgEnum as isEnum, isPgMaterializedView as isMaterializedView, isPgSchema as isSchema, isPgSequence as isSequence, isPgView as isView, pgEnum as enum$1, pgMaterializedView as materializedView, pgPolicy, pgPolicy as policy, pgRole as role, pgSequence as sequence, pgTableCreator as tableCreator, pgView as view, timestamp, uuid, varchar } from "drizzle-orm/pg-core";
+import { snakeCase } from "drizzle-orm/pg-core/casing";
+import { anonRole, authUid, authUid as authUid$1, authenticatedRole, authenticatedRole as authenticatedRole$1, postgresRole, realtimeMessages, realtimeTopic, serviceRole, supabaseAuthAdminRole } from "drizzle-orm/supabase";
+//#region src/schema.ts
+const timestamps = ({ precision, withTimezone = true } = {}) => {
+	const config = {
+		precision,
+		withTimezone
+	};
+	return {
+		createdAt: timestamp("created_at", config).notNull().defaultNow(),
+		updatedAt: timestamp("updated_at", config).notNull().defaultNow()
+	};
+};
+const NULLABLE_AUTHOR_ACTIONS = {
+	onDelete: "set null",
+	onUpdate: "cascade"
+};
+const REQUIRED_AUTHOR_ACTIONS = {
+	onDelete: "restrict",
+	onUpdate: "cascade"
+};
+const authorColumn = ({ name, reference = () => authUsers.id, actions, notNull = false }) => {
+	const column = reference === null ? uuid(name) : uuid(name).references(reference, actions ?? (notNull ? REQUIRED_AUTHOR_ACTIONS : NULLABLE_AUTHOR_ACTIONS));
+	return notNull ? column.notNull() : column;
+};
+function authUserId(options = {}) {
+	return authorColumn(options);
+}
+function userId(reference, options = {}) {
+	return authorColumn({
+		...options,
+		reference
+	});
+}
+const AUTH_UID_DEFAULT = sql`auth.uid()`;
+function createdBy(options = {}) {
+	return authorColumn({
+		...options,
+		name: "created_by"
+	}).default(AUTH_UID_DEFAULT);
+}
+function updatedBy(options = {}) {
+	return authorColumn({
+		...options,
+		name: "updated_by"
+	}).default(AUTH_UID_DEFAULT);
+}
+const authorship = (options) => ({
+	createdBy: createdBy(options),
+	updatedBy: updatedBy(options)
+});
+const auditColumns = (options = {}) => ({
+	...timestamps(options),
+	...authorship(options)
+});
+const DEFAULT_ID_NAME = "id";
+function uuidPrimaryId(options = {}) {
+	const { name = DEFAULT_ID_NAME, defaultRandom = true } = options;
+	const column = uuid(name).primaryKey();
+	return defaultRandom ? column.defaultRandom() : column;
+}
+function sequentialPrimaryId(options = {}) {
+	const { name = DEFAULT_ID_NAME, type = "bigint", mode = "number", generated = "byDefault" } = options;
+	const column = type === "integer" ? integer(name).primaryKey() : bigint(name, { mode }).primaryKey();
+	return generated === "always" ? column.generatedAlwaysAsIdentity() : column.generatedByDefaultAsIdentity();
+}
+const assignedPrimaryId = ({ name = DEFAULT_ID_NAME, length } = {}) => varchar(name, { length }).primaryKey();
+function primaryId(kind = "sequential") {
+	if (kind === "uuid") return uuidPrimaryId();
+	if (kind === "assigned") return assignedPrimaryId();
+	return sequentialPrimaryId();
+}
+function operationPolicy(name, operation, config = {}) {
+	return pgPolicy(name, {
+		...config,
+		for: operation
+	});
+}
+const selectPolicy = (name, config = {}) => operationPolicy(name, "select", config);
+const insertPolicy = (name, config = {}) => operationPolicy(name, "insert", config);
+const updatePolicy = (name, config = {}) => operationPolicy(name, "update", config);
+const deletePolicy = (name, config = {}) => operationPolicy(name, "delete", config);
+const allPolicy = (name, config = {}) => operationPolicy(name, "all", config);
+const authenticatedSelectPolicy = (name, config = {}) => selectPolicy(name, {
+	...config,
+	to: authenticatedRole$1
+});
+const authenticatedInsertPolicy = (name, config = {}) => insertPolicy(name, {
+	...config,
+	to: authenticatedRole$1
+});
+const authenticatedUpdatePolicy = (name, config = {}) => updatePolicy(name, {
+	...config,
+	to: authenticatedRole$1
+});
+const authenticatedDeletePolicy = (name, config = {}) => deletePolicy(name, {
+	...config,
+	to: authenticatedRole$1
+});
+const authenticatedAllPolicy = (name, config = {}) => allPolicy(name, {
+	...config,
+	to: authenticatedRole$1
+});
+const POLICY_CLAUSE = {
+	all: "using",
+	delete: "using",
+	insert: "withCheck",
+	select: "using",
+	update: "using"
+};
+const POLICY_BUILDERS = {
+	all: allPolicy,
+	delete: deletePolicy,
+	insert: insertPolicy,
+	select: selectPolicy,
+	update: updatePolicy
+};
+const FUNCTION_POLICY_OPERATIONS = [
+	"select",
+	"insert",
+	"update",
+	"delete"
+];
+const isWholeSetArgument = (argument) => is(argument, Column) || Array.isArray(argument);
+const argumentsFor = (argument, operation) => {
+	if (!argument) return [];
+	const forOperation = isWholeSetArgument(argument) ? argument : argument[operation];
+	if (!forOperation) return [];
+	return is(forOperation, Column) ? [forOperation] : [...forOperation];
+};
+/**
+* One policy per operation, each delegating to a `security definer` function.
+*
+* Access rarely depends only on the row's own owner column, and the usual
+* answer is a function, which is also the standard advice for keeping RLS
+* predicates out of the planner's way:
+*
+* ```ts
+* table("posts", { id: primaryId("uuid") }, (t) =>
+*   functionPolicies(t, { argument: t.id })
+* )
+* ```
+*
+* ```sql
+* CREATE POLICY "can_select_posts" ON "posts" FOR SELECT TO "authenticated"
+*   USING ((select "can_select_posts"("posts"."id")));
+* ```
+*
+* `argument` also takes a record, for the usual shape where `insert` has no
+* row to authorise yet:
+*
+* ```ts
+* functionPolicies(t, {
+*   argument: { delete: t.id, select: t.id, update: t.id },
+* })
+* ```
+*/
+const functionPolicies = (columns, { argument, name, prefix = "can", schema: functionSchema } = {}) => {
+	const [firstColumn] = Object.values(columns);
+	if (!firstColumn) throw new Error("functionPolicies needs a table with at least one column");
+	const tableName = getTableName(getColumnTable(firstColumn));
+	return FUNCTION_POLICY_OPERATIONS.map((operation) => {
+		const functionName = `${prefix}_${operation}_${tableName}`;
+		const callee = functionSchema ? sql`${sql.identifier(functionSchema)}.${sql.identifier(functionName)}` : sql`${sql.identifier(functionName)}`;
+		const condition = sql`(select ${callee}(${sql.join(argumentsFor(argument, operation), sql`, `)}))`;
+		const clause = { [POLICY_CLAUSE[operation]]: condition };
+		return POLICY_BUILDERS[operation](name?.(operation, tableName) ?? functionName, {
+			to: authenticatedRole$1,
+			...clause
+		});
+	});
+};
+const authUserOwns = (ownerColumn) => sql`${ownerColumn} = ${authUid$1}`;
+const authenticatedOwnerSelectPolicy = (name, ownerColumn, config = {}) => selectPolicy(name, {
+	...config,
+	to: authenticatedRole$1,
+	using: config.using ?? authUserOwns(ownerColumn)
+});
+const authenticatedOwnerInsertPolicy = (name, ownerColumn, config = {}) => insertPolicy(name, {
+	...config,
+	to: authenticatedRole$1,
+	withCheck: config.withCheck ?? authUserOwns(ownerColumn)
+});
+const authenticatedOwnerUpdatePolicy = (name, ownerColumn, config = {}) => {
+	const ownerCondition = authUserOwns(ownerColumn);
+	return updatePolicy(name, {
+		...config,
+		to: authenticatedRole$1,
+		using: config.using ?? ownerCondition,
+		withCheck: config.withCheck ?? ownerCondition
+	});
+};
+const authenticatedOwnerDeletePolicy = (name, ownerColumn, config = {}) => deletePolicy(name, {
+	...config,
+	to: authenticatedRole$1,
+	using: config.using ?? authUserOwns(ownerColumn)
+});
+const authenticatedOwnerAllPolicy = (name, ownerColumn, config = {}) => {
+	const ownerCondition = authUserOwns(ownerColumn);
+	return allPolicy(name, {
+		...config,
+		to: authenticatedRole$1,
+		using: config.using ?? ownerCondition,
+		withCheck: config.withCheck ?? ownerCondition
+	});
+};
+const table = snakeCase.table.withRLS;
+const unsecureTable = snakeCase.table;
+const schema = (name) => {
+	const built = snakeCase.schema(name);
+	return Object.assign(built, {
+		table: built.table.withRLS,
+		unsecureTable: built.table
+	});
+};
+//#endregion
+export { allPolicy, anonRole, assignedPrimaryId, auditColumns, authUid, authUserId, authUserOwns, authenticatedAllPolicy, authenticatedDeletePolicy, authenticatedInsertPolicy, authenticatedOwnerAllPolicy, authenticatedOwnerDeletePolicy, authenticatedOwnerInsertPolicy, authenticatedOwnerSelectPolicy, authenticatedOwnerUpdatePolicy, authenticatedRole, authenticatedSelectPolicy, authenticatedUpdatePolicy, authorship, createdBy, deletePolicy, enum$1 as enum, functionPolicies, insertPolicy, isEnum, isMaterializedView, isSchema, isSequence, isView, materializedView, policy, postgresRole, primaryId, realtimeMessages, realtimeTopic, role, schema, selectPolicy, sequence, sequentialPrimaryId, serviceRole, supabaseAuthAdminRole, table, tableCreator, timestamps, unsecureTable, updatePolicy, updatedBy, userId, uuidPrimaryId, view };

package/dist/triggers.d.mts

@@ -0,0 +1,65 @@
+import { PgTable } from "drizzle-orm/pg-core";
+//#region src/triggers.d.ts
+type UpdatedAtTriggerOptions = {
+  /** Column the trigger maintains. Default `"updated_at"`. */
+  column?: string;
+  /** Schema holding the table. Default `"public"`, or the table's own. */
+  schema?: string;
+  /** Trigger name. Default `handle_<column>`. */
+  name?: string;
+  /** Schema `moddatetime` is installed into. Default `"extensions"`. */
+  extensionSchema?: string;
+  /** Emit `create extension if not exists`. Default `true`. */
+  createExtension?: boolean;
+};
+/**
+ * `CREATE TRIGGER` SQL that keeps `updated_at` current for **every** writer,
+ * including PostgREST, the dashboard and psql.
+ *
+ * `timestamps()` gives the column a `DEFAULT now()`, which covers the insert.
+ * SQL has no "on update" default, so without this trigger the column is only
+ * ever the insert time. Required, not optional.
+ *
+ * ```ts
+ * // pnpm db:generate --custom --name=posts_audit_triggers
+ * // then paste the output into the generated migration:
+ * console.log(updatedAtTrigger(posts))
+ * ```
+ */
+declare function updatedAtTrigger(table: PgTable | string, { column, createExtension, extensionSchema, name, schema }?: UpdatedAtTriggerOptions): string;
+/** `create extension if not exists moddatetime`, safe to repeat per migration. */
+declare function moddatetimeExtension(schema?: string): string;
+type UpdatedByTriggerOptions = {
+  /** Column the trigger maintains. Default `"updated_by"`. */
+  column?: string;
+  /** Schema holding the table. Default `"public"`, or the table's own. */
+  schema?: string;
+  /** Trigger name. Default `handle_<column>`. */
+  name?: string;
+  /** Schema the helper function is created in. Default `"public"`. */
+  functionSchema?: string;
+  /** Emit `create or replace function`. Default `true`. */
+  createFunction?: boolean;
+};
+/**
+ * `CREATE TRIGGER` SQL that stamps an author column with `auth.uid()` on every
+ * update, the `updated_at` story for `updated_by`.
+ *
+ * `updatedBy()` gives the column a `DEFAULT (select auth.uid())`, which covers
+ * the insert. This covers the update, for every writer rather than only the
+ * ones going through Drizzle.
+ *
+ * A write with no session (the admin or `service_role` clients) records `NULL`,
+ * because that is what `auth.uid()` returns there.
+ */
+declare function updatedByTrigger(table: PgTable | string, { column, createFunction, functionSchema, name, schema }?: UpdatedByTriggerOptions): string;
+/**
+ * Both update triggers `auditColumns()` needs, in one string.
+ *
+ * `auditColumns()` and `timestamps()` leave `updated_at` and `updated_by` at
+ * their insert values without these, so a table using either helper wants this
+ * in a `drizzle-kit generate --custom` migration.
+ */
+declare function auditTriggers(table: PgTable | string, options?: UpdatedAtTriggerOptions & UpdatedByTriggerOptions): string;
+//#endregion
+export { auditTriggers, moddatetimeExtension, updatedAtTrigger, updatedByTrigger };