@zeno-lib/db 0.3.1 → 0.4.0

package/dist/query.d.mts

@@ -0,0 +1,103 @@
+import { t as FunctionPolicyOperation } from "./function-names-hv2mj_x1.mjs";
+import { SQL } from "drizzle-orm";
+import { PgTable } from "drizzle-orm/pg-core";
+//#region src/query.d.ts
+/**
+ * PostgREST's `.single()`: exactly one row, or an error.
+ *
+ * `findFirst()` returns `undefined` for no rows and silently drops the rest
+ * when there are several, and `.returning()` hands back an array.
+ */
+declare const one: <T>(rows: readonly T[]) => T;
+/**
+ * PostgREST's `.maybeSingle()`: one row or none, erroring on more than one.
+ * Returns `undefined` rather than `null`, which is what `findFirst()` does.
+ */
+declare const maybeOne: <T>(rows: readonly T[]) => T | undefined;
+type ColumnKey<TTable extends PgTable> = Extract<keyof TTable["_"]["columns"], string>;
+type ExcludedSetOptions<TTable extends PgTable> = {
+  /**
+   * The conflict target's column keys, never written back from `excluded`.
+   * The first one that exists is also the empty-set fallback. Default `"id"`.
+   */
+  target?: ColumnKey<TTable> | readonly ColumnKey<TTable>[];
+};
+/**
+ * The `set` for `onConflictDoUpdate` that reproduces PostgREST's
+ * `.upsert(row, { onConflict })`: on conflict, every column the caller
+ * supplied is overwritten from the proposed row (`col = excluded.col`).
+ *
+ * - A key carrying `undefined` is skipped. Drizzle omits an undefined column
+ *   from the INSERT, so `excluded.x` would be the column default, and on a
+ *   conflict `x = excluded.x` would overwrite a stored value with it.
+ * - The conflict target (`id` unless `target` says otherwise) is excluded.
+ * - An empty result falls back to `<target> = excluded.<target>`. Drizzle
+ *   throws `No values to set` while *building* the statement, so a payload
+ *   holding nothing but the key would fail even on the plain insert path.
+ *   Writing the key back to itself is a no-op that keeps `.returning()`
+ *   yielding the row, which `onConflictDoNothing` does not.
+ *
+ * With no target column in the table (a junction keyed only by its foreign
+ * keys, with the default target) the fallback cannot apply and the result
+ * stays empty: such a table wants `onConflictDoNothing` anyway.
+ *
+ * Column names come from the schema, never from `values`.
+ */
+declare const excludedSet: <TTable extends PgTable>(table: TTable, values: Record<string, unknown>, { target }?: ExcludedSetOptions<TTable>) => Record<string, SQL>;
+/**
+ * The same values with every `undefined` key dropped, so an insert and its
+ * `excludedSet` agree on which columns were supplied.
+ */
+declare const definedValues: <T extends Record<string, unknown>>(values: T) => T;
+/** Table name to the schema its `<prefix>_<operation>_<table>` functions live in. */
+type FunctionPermissionTables = ReadonlyMap<string, string>;
+type FunctionPermissionTablesOptions = {
+  /** Schemas whose tables are included. Default `["public"]`. */
+  schemas?: readonly string[];
+};
+/**
+ * The allowlist `selectFunctionPermissions` resolves a table name against,
+ * built from a Drizzle schema object (`import * as schema`) or the result of
+ * `defineRelations`. Build it once at module scope. Views and non-table
+ * exports are ignored; a table name that appears in two included schemas
+ * throws, since a bare name could not tell them apart.
+ */
+declare const functionPermissionTables: (schemaObject: Record<string, unknown>, { schemas }?: FunctionPermissionTablesOptions) => FunctionPermissionTables;
+type FunctionPermissions = Record<FunctionPolicyOperation, boolean>;
+/**
+ * Anything with Drizzle's `execute` returning rows: a postgres-js client from
+ * `@zeno-lib/db`, a `PgAsyncDatabase`, or a transaction.
+ */
+type QueryExecutor = {
+  execute: (query: SQL) => PromiseLike<readonly Record<string, unknown>[]>;
+};
+type SelectFunctionPermissionsOptions = {
+  /** From `functionPermissionTables`. */
+  tables: FunctionPermissionTables;
+  /** The table asked about, checked against `tables`. */
+  table: string;
+  /**
+   * The row, passed to every function but `insert` (there is no row yet) as
+   * a named argument. Omit to call all four with none.
+   */
+  id?: number | string;
+  /** Name of the functions' row parameter. Default `"id"`. */
+  argumentName?: string;
+  /** Function prefix, as given to `functionPolicies`. Default `"can"`. */
+  prefix?: string;
+  /** Schema the functions live in. Default: the table's own. */
+  functionSchema?: string;
+};
+/**
+ * The four `<prefix>_<operation>_<table>()` answers for one table, in one
+ * statement: the read side of `functionPolicies`, for showing or hiding UI.
+ *
+ * `table` is only ever a map key: every identifier that reaches the statement
+ * comes from `tables` and is quoted with `sql.identifier`. A function missing
+ * or with another signature raises `42883` (`SqlState.undefinedFunction`).
+ * A `null` answer, which a function gives for a row the caller cannot see,
+ * counts as `false`, as does anything else that is not `true`.
+ */
+declare const selectFunctionPermissions: (db: QueryExecutor, { argumentName, functionSchema, id, prefix, table, tables }: SelectFunctionPermissionsOptions) => Promise<FunctionPermissions>;
+//#endregion
+export { ExcludedSetOptions, FunctionPermissionTables, FunctionPermissionTablesOptions, FunctionPermissions, QueryExecutor, SelectFunctionPermissionsOptions, definedValues, excludedSet, functionPermissionTables, maybeOne, one, selectFunctionPermissions };

package/dist/query.mjs

@@ -0,0 +1,115 @@
+import { n as functionPolicyName, t as FUNCTION_POLICY_OPERATIONS } from "./function-names-BDc-AuFm.mjs";
+import { getColumns, is, sql } from "drizzle-orm";
+import { PgTable, getTableConfig } from "drizzle-orm/pg-core";
+//#region src/query.ts
+/**
+* PostgREST's `.single()`: exactly one row, or an error.
+*
+* `findFirst()` returns `undefined` for no rows and silently drops the rest
+* when there are several, and `.returning()` hands back an array.
+*/
+const one = (rows) => {
+	if (rows.length !== 1) throw new Error(`Expected exactly one row, received ${rows.length}`);
+	return rows[0];
+};
+/**
+* PostgREST's `.maybeSingle()`: one row or none, erroring on more than one.
+* Returns `undefined` rather than `null`, which is what `findFirst()` does.
+*/
+const maybeOne = (rows) => {
+	if (rows.length > 1) throw new Error(`Expected at most one row, received ${rows.length}`);
+	return rows[0];
+};
+/**
+* The `set` for `onConflictDoUpdate` that reproduces PostgREST's
+* `.upsert(row, { onConflict })`: on conflict, every column the caller
+* supplied is overwritten from the proposed row (`col = excluded.col`).
+*
+* - A key carrying `undefined` is skipped. Drizzle omits an undefined column
+*   from the INSERT, so `excluded.x` would be the column default, and on a
+*   conflict `x = excluded.x` would overwrite a stored value with it.
+* - The conflict target (`id` unless `target` says otherwise) is excluded.
+* - An empty result falls back to `<target> = excluded.<target>`. Drizzle
+*   throws `No values to set` while *building* the statement, so a payload
+*   holding nothing but the key would fail even on the plain insert path.
+*   Writing the key back to itself is a no-op that keeps `.returning()`
+*   yielding the row, which `onConflictDoNothing` does not.
+*
+* With no target column in the table (a junction keyed only by its foreign
+* keys, with the default target) the fallback cannot apply and the result
+* stays empty: such a table wants `onConflictDoNothing` anyway.
+*
+* Column names come from the schema, never from `values`.
+*/
+const excludedSet = (table, values, { target = "id" } = {}) => {
+	const columns = getColumns(table);
+	const targets = typeof target === "string" ? [target] : target;
+	const set = {};
+	for (const [key, column] of Object.entries(columns)) if (key in values && values[key] !== void 0 && !targets.includes(key)) set[key] = sql`excluded.${sql.identifier(column.name)}`;
+	if (Object.keys(set).length > 0) return set;
+	const fallback = targets.find((key) => key in columns);
+	const fallbackColumn = fallback === void 0 ? void 0 : columns[fallback];
+	if (fallback !== void 0 && fallbackColumn) set[fallback] = sql`excluded.${sql.identifier(fallbackColumn.name)}`;
+	return set;
+};
+/**
+* The same values with every `undefined` key dropped, so an insert and its
+* `excludedSet` agree on which columns were supplied.
+*/
+const definedValues = (values) => Object.fromEntries(Object.entries(values).filter(([, value]) => value !== void 0));
+const DEFAULT_SCHEMA = "public";
+const tableOf = (value) => {
+	if (is(value, PgTable)) return value;
+	if (typeof value === "object" && value !== null && "table" in value) {
+		const { table } = value;
+		return is(table, PgTable) ? table : void 0;
+	}
+};
+/**
+* The allowlist `selectFunctionPermissions` resolves a table name against,
+* built from a Drizzle schema object (`import * as schema`) or the result of
+* `defineRelations`. Build it once at module scope. Views and non-table
+* exports are ignored; a table name that appears in two included schemas
+* throws, since a bare name could not tell them apart.
+*/
+const functionPermissionTables = (schemaObject, { schemas = [DEFAULT_SCHEMA] } = {}) => {
+	const tables = /* @__PURE__ */ new Map();
+	for (const value of Object.values(schemaObject)) {
+		const table = tableOf(value);
+		if (!table) continue;
+		const { name, schema = DEFAULT_SCHEMA } = getTableConfig(table);
+		if (!schemas.includes(schema)) continue;
+		const existing = tables.get(name);
+		if (existing !== void 0 && existing !== schema) throw new Error(`Table "${name}" exists in both "${existing}" and "${schema}"; include only one of those schemas`);
+		tables.set(name, schema);
+	}
+	return tables;
+};
+/**
+* The four `<prefix>_<operation>_<table>()` answers for one table, in one
+* statement: the read side of `functionPolicies`, for showing or hiding UI.
+*
+* `table` is only ever a map key: every identifier that reaches the statement
+* comes from `tables` and is quoted with `sql.identifier`. A function missing
+* or with another signature raises `42883` (`SqlState.undefinedFunction`).
+* A `null` answer, which a function gives for a row the caller cannot see,
+* counts as `false`, as does anything else that is not `true`.
+*/
+const selectFunctionPermissions = async (db, { argumentName = "id", functionSchema, id, prefix = "can", table, tables }) => {
+	const tableSchema = tables.get(table);
+	if (tableSchema === void 0) throw new Error(`No permission functions for table "${table}"`);
+	const schema = functionSchema ?? tableSchema;
+	const call = (operation) => {
+		const callee = sql`${sql.identifier(schema)}.${sql.identifier(functionPolicyName(prefix, operation, table))}`;
+		return operation === "insert" || id === void 0 ? sql`${callee}()` : sql`${callee}(${sql.identifier(argumentName)} => ${id})`;
+	};
+	const row = one(await db.execute(sql`select ${sql.join(FUNCTION_POLICY_OPERATIONS.map((operation) => sql`${call(operation)} as ${sql.identifier(operation)}`), sql`, `)}`));
+	return {
+		delete: row.delete === true,
+		insert: row.insert === true,
+		select: row.select === true,
+		update: row.update === true
+	};
+};
+//#endregion
+export { definedValues, excludedSet, functionPermissionTables, maybeOne, one, selectFunctionPermissions };

package/dist/schema.d.mts

@@ -0,0 +1,158 @@
+import { t as FunctionPolicyOperation } from "./function-names-hv2mj_x1.mjs";
+import { AnyPgColumn, ExtraConfigColumn, HasIdentity, PgBigInt53Builder, PgBigInt64Builder, PgIntegerBuilder, PgPolicyConfig, PgTimestampBuilder, PgTimestampStringBuilder, PgUUIDBuilder, Precision, ReferenceConfig, SetHasDefault, SetIsPrimaryKey, SetNotNull, isPgEnum as isEnum, isPgMaterializedView as isMaterializedView, isPgSchema as isSchema, isPgSequence as isSequence, isPgView as isView, pgEnum as enum$1, pgMaterializedView as materializedView, pgPolicy as policy, pgRole as role, pgSequence as sequence, pgTableCreator as tableCreator, pgView as view } from "drizzle-orm/pg-core";
+import { anonRole, authUid, authenticatedRole, postgresRole, realtimeMessages, realtimeTopic, serviceRole, supabaseAuthAdminRole } from "drizzle-orm/supabase";
+//#region src/schema.d.ts
+/** How a timestamp column is read back: a `Date` (the default) or Postgres's own text. */
+type TimestampMode = "date" | "string";
+type TimestampsOptions<TMode extends TimestampMode = "date"> = {
+  /**
+   * `"date"` (the default) reads a `Date`; `"string"` keeps Postgres's text
+   * form, which also keeps the microseconds a `Date` truncates. A JavaScript
+   * mapping only: it emits no SQL.
+   */
+  mode?: TMode;
+  withTimezone?: boolean;
+  /** Fractional-second digits. Postgres allows 0 to 6. */
+  precision?: Precision;
+};
+type TimestampColumn<TMode extends TimestampMode> = SetHasDefault<SetNotNull<[TMode] extends ["string"] ? PgTimestampStringBuilder : PgTimestampBuilder>>;
+type TimestampColumns<TMode extends TimestampMode = "date"> = {
+  createdAt: TimestampColumn<TMode>;
+  updatedAt: TimestampColumn<TMode>;
+};
+declare const timestamps: <TMode extends TimestampMode = "date">({ mode, precision, withTimezone }?: TimestampsOptions<TMode>) => TimestampColumns<TMode>;
+type ReferenceActions = ReferenceConfig["config"];
+type AuthorColumn<TNotNull extends boolean> = [TNotNull] extends [true] ? SetNotNull<PgUUIDBuilder> : PgUUIDBuilder;
+type AuthorReference = {
+  reference?: () => AnyPgColumn;
+  actions?: ReferenceActions;
+} | {
+  reference: null;
+  actions?: never;
+};
+type AuthorshipOptions<TNotNull extends boolean = false> = AuthorReference & {
+  notNull?: TNotNull;
+};
+declare function authUserId<TNotNull extends boolean = false>(options?: AuthorshipOptions<TNotNull> & {
+  name?: string;
+}): AuthorColumn<TNotNull>;
+declare function userId<TNotNull extends boolean = false>(reference: () => AnyPgColumn, options?: {
+  name?: string;
+  actions?: ReferenceActions;
+  notNull?: TNotNull;
+}): AuthorColumn<TNotNull>;
+declare function createdBy<TNotNull extends boolean = false>(options?: AuthorshipOptions<TNotNull>): SetHasDefault<AuthorColumn<TNotNull>>;
+declare function updatedBy<TNotNull extends boolean = false>(options?: AuthorshipOptions<TNotNull>): SetHasDefault<AuthorColumn<TNotNull>>;
+declare const authorship: <TNotNull extends boolean = false>(options?: AuthorshipOptions<TNotNull>) => {
+  createdBy: SetHasDefault<AuthorColumn<TNotNull>>;
+  updatedBy: SetHasDefault<AuthorColumn<TNotNull>>;
+};
+declare const auditColumns: <TNotNull extends boolean = false, TMode extends TimestampMode = "date">(options?: AuthorshipOptions<TNotNull> & TimestampsOptions<TMode>) => {
+  createdAt: TimestampColumn<TMode>;
+  updatedAt: TimestampColumn<TMode>;
+  createdBy: SetHasDefault<AuthorColumn<TNotNull>>;
+  updatedBy: SetHasDefault<AuthorColumn<TNotNull>>;
+};
+type UuidPrimaryIdColumn<TDefaultRandom extends boolean> = [TDefaultRandom] extends [false] ? SetIsPrimaryKey<PgUUIDBuilder> : SetHasDefault<SetIsPrimaryKey<PgUUIDBuilder>>;
+declare function uuidPrimaryId<TDefaultRandom extends boolean = true>(options?: {
+  name?: string;
+  defaultRandom?: TDefaultRandom;
+}): UuidPrimaryIdColumn<TDefaultRandom>;
+type IdentityType = "integer" | "bigint";
+type IdentityMode = "number" | "bigint";
+type IdentityGeneration = "byDefault" | "always";
+type IdentityBuilder<TType extends IdentityType, TMode extends IdentityMode> = TType extends "integer" ? PgIntegerBuilder : TMode extends "bigint" ? PgBigInt64Builder : PgBigInt53Builder;
+type SequentialPrimaryIdColumn<TType extends IdentityType, TMode extends IdentityMode, TGeneration extends IdentityGeneration> = HasIdentity<SetIsPrimaryKey<IdentityBuilder<TType, TMode>>, TGeneration>;
+declare function sequentialPrimaryId<TType extends IdentityType = "bigint", TMode extends IdentityMode = "number", TGeneration extends IdentityGeneration = "byDefault">(options?: {
+  name?: string;
+  type?: TType;
+  mode?: TType extends "integer" ? never : TMode;
+  generated?: TGeneration;
+}): SequentialPrimaryIdColumn<TType, TMode, TGeneration>;
+declare const assignedPrimaryId: ({ name, length }?: {
+  name?: string;
+  length?: number;
+}) => SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>;
+type PrimaryIdKind = "uuid" | "sequential" | "assigned";
+type PrimaryIdColumn<TKind extends PrimaryIdKind> = TKind extends "uuid" ? UuidPrimaryIdColumn<true> : TKind extends "sequential" ? SequentialPrimaryIdColumn<"bigint", "number", "byDefault"> : ReturnType<typeof assignedPrimaryId>;
+declare function primaryId<TKind extends PrimaryIdKind = "sequential">(kind?: TKind): PrimaryIdColumn<TKind>;
+type PolicyOptions = Omit<PgPolicyConfig, "for">;
+type PolicyOperation = NonNullable<PgPolicyConfig["for"]>;
+type AuthenticatedPolicyOptions = Omit<PgPolicyConfig, "for" | "to">;
+declare const selectPolicy: (name: string, config?: PolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const insertPolicy: (name: string, config?: PolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const updatePolicy: (name: string, config?: PolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const deletePolicy: (name: string, config?: PolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const allPolicy: (name: string, config?: PolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedSelectPolicy: (name: string, config?: AuthenticatedPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedInsertPolicy: (name: string, config?: AuthenticatedPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedUpdatePolicy: (name: string, config?: AuthenticatedPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedDeletePolicy: (name: string, config?: AuthenticatedPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedAllPolicy: (name: string, config?: AuthenticatedPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+/** Columns one function is called with. `null` calls it with none. */
+type FunctionArgument = AnyPgColumn | readonly AnyPgColumn[] | null;
+type FunctionPoliciesOptions = {
+  /**
+   * Passed to each function, e.g. the row's id: one column, an array for a
+   * function taking several, or a record to vary them per operation. The
+   * common shape is that the row-scoped operations take the row and `insert`
+   * takes nothing, there being no row yet to authorise, only the caller. An
+   * operation missing from the record, or set to `null`, is called with no
+   * arguments; so is every operation when `argument` is omitted.
+   */
+  argument?: FunctionArgument | Partial<Record<FunctionPolicyOperation, FunctionArgument>>;
+  /**
+   * Schema the functions live in, e.g. `"billing"` for
+   * `billing.can_select_invoices`. Omit to emit the name unqualified and let
+   * the `search_path` in effect resolve it.
+   */
+  schema?: string;
+  /** Prefix for the default function and policy names. Default `"can"`. */
+  prefix?: string;
+  /** Overrides the generated policy name. */
+  name?: (operation: PolicyOperation, table: string) => string;
+};
+type ExtraConfigColumns = Record<string, ExtraConfigColumn>;
+/**
+ * One policy per operation, each delegating to a `security definer` function.
+ *
+ * Access rarely depends only on the row's own owner column, and the usual
+ * answer is a function, which is also the standard advice for keeping RLS
+ * predicates out of the planner's way:
+ *
+ * ```ts
+ * table("posts", { id: primaryId("uuid") }, (t) =>
+ *   functionPolicies(t, { argument: t.id })
+ * )
+ * ```
+ *
+ * ```sql
+ * CREATE POLICY "can_select_posts" ON "posts" FOR SELECT TO "authenticated"
+ *   USING ((select "can_select_posts"("posts"."id")));
+ * ```
+ *
+ * `argument` also takes a record, for the usual shape where `insert` has no
+ * row to authorise yet:
+ *
+ * ```ts
+ * functionPolicies(t, {
+ *   argument: { delete: t.id, select: t.id, update: t.id },
+ * })
+ * ```
+ */
+declare const functionPolicies: (columns: ExtraConfigColumns, { argument, name, prefix, schema: functionSchema }?: FunctionPoliciesOptions) => import("drizzle-orm/pg-core").PgPolicy[];
+declare const authUserOwns: (ownerColumn: AnyPgColumn) => import("drizzle-orm").SQL<unknown>;
+type OwnerPolicyOptions = Omit<PgPolicyConfig, "for" | "to">;
+declare const authenticatedOwnerSelectPolicy: (name: string, ownerColumn: AnyPgColumn, config?: OwnerPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedOwnerInsertPolicy: (name: string, ownerColumn: AnyPgColumn, config?: OwnerPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedOwnerUpdatePolicy: (name: string, ownerColumn: AnyPgColumn, config?: OwnerPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedOwnerDeletePolicy: (name: string, ownerColumn: AnyPgColumn, config?: OwnerPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const authenticatedOwnerAllPolicy: (name: string, ownerColumn: AnyPgColumn, config?: OwnerPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
+declare const table: import("drizzle-orm/pg-core").PgTableFnInternal<undefined>;
+declare const unsecureTable: import("drizzle-orm/pg-core").PgTableFn<undefined>;
+declare const schema: <TName extends string>(name: TName) => import("drizzle-orm/pg-core").PgSchema<TName> & {
+  table: import("drizzle-orm/pg-core").PgTableFnInternal<TName>;
+  unsecureTable: import("drizzle-orm/pg-core").PgTableFn<TName>;
+};
+//#endregion
+export { AuthorshipOptions, TimestampColumns, TimestampMode, TimestampsOptions, allPolicy, anonRole, assignedPrimaryId, auditColumns, authUid, authUserId, authUserOwns, authenticatedAllPolicy, authenticatedDeletePolicy, authenticatedInsertPolicy, authenticatedOwnerAllPolicy, authenticatedOwnerDeletePolicy, authenticatedOwnerInsertPolicy, authenticatedOwnerSelectPolicy, authenticatedOwnerUpdatePolicy, authenticatedRole, authenticatedSelectPolicy, authenticatedUpdatePolicy, authorship, createdBy, deletePolicy, enum$1 as enum, functionPolicies, insertPolicy, isEnum, isMaterializedView, isSchema, isSequence, isView, materializedView, policy, postgresRole, primaryId, realtimeMessages, realtimeTopic, role, schema, selectPolicy, sequence, sequentialPrimaryId, serviceRole, supabaseAuthAdminRole, table, tableCreator, timestamps, unsecureTable, updatePolicy, updatedBy, userId, uuidPrimaryId, view };

package/dist/schema.mjs

@@ -0,0 +1,219 @@
+import { authUsers } from "./auth-schema.mjs";
+import { n as functionPolicyName, t as FUNCTION_POLICY_OPERATIONS } from "./function-names-BDc-AuFm.mjs";
+import { Column, getColumnTable, getTableName, is, sql } from "drizzle-orm";
+import { bigint, integer, isPgEnum as isEnum, isPgMaterializedView as isMaterializedView, isPgSchema as isSchema, isPgSequence as isSequence, isPgView as isView, pgEnum as enum$1, pgMaterializedView as materializedView, pgPolicy, pgPolicy as policy, pgRole as role, pgSequence as sequence, pgTableCreator as tableCreator, pgView as view, timestamp, uuid, varchar } from "drizzle-orm/pg-core";
+import { snakeCase } from "drizzle-orm/pg-core/casing";
+import { anonRole, authUid, authUid as authUid$1, authenticatedRole, authenticatedRole as authenticatedRole$1, postgresRole, realtimeMessages, realtimeTopic, serviceRole, supabaseAuthAdminRole } from "drizzle-orm/supabase";
+//#region src/schema.ts
+const timestamps = ({ mode, precision, withTimezone = true } = {}) => {
+	const column = (name) => mode === "string" ? timestamp(name, {
+		mode: "string",
+		precision,
+		withTimezone
+	}).notNull().defaultNow() : timestamp(name, {
+		precision,
+		withTimezone
+	}).notNull().defaultNow();
+	return {
+		createdAt: column("created_at"),
+		updatedAt: column("updated_at")
+	};
+};
+const NULLABLE_AUTHOR_ACTIONS = {
+	onDelete: "set null",
+	onUpdate: "cascade"
+};
+const REQUIRED_AUTHOR_ACTIONS = {
+	onDelete: "restrict",
+	onUpdate: "cascade"
+};
+const authorColumn = ({ name, reference = () => authUsers.id, actions, notNull = false }) => {
+	const column = reference === null ? uuid(name) : uuid(name).references(reference, actions ?? (notNull ? REQUIRED_AUTHOR_ACTIONS : NULLABLE_AUTHOR_ACTIONS));
+	return notNull ? column.notNull() : column;
+};
+function authUserId(options = {}) {
+	return authorColumn(options);
+}
+function userId(reference, options = {}) {
+	return authorColumn({
+		...options,
+		reference
+	});
+}
+const AUTH_UID_DEFAULT = sql`auth.uid()`;
+function createdBy(options = {}) {
+	return authorColumn({
+		...options,
+		name: "created_by"
+	}).default(AUTH_UID_DEFAULT);
+}
+function updatedBy(options = {}) {
+	return authorColumn({
+		...options,
+		name: "updated_by"
+	}).default(AUTH_UID_DEFAULT);
+}
+const authorship = (options) => ({
+	createdBy: createdBy(options),
+	updatedBy: updatedBy(options)
+});
+const auditColumns = (options = {}) => ({
+	...timestamps(options),
+	...authorship(options)
+});
+const DEFAULT_ID_NAME = "id";
+function uuidPrimaryId(options = {}) {
+	const { name = DEFAULT_ID_NAME, defaultRandom = true } = options;
+	const column = uuid(name).primaryKey();
+	return defaultRandom ? column.defaultRandom() : column;
+}
+function sequentialPrimaryId(options = {}) {
+	const { name = DEFAULT_ID_NAME, type = "bigint", mode = "number", generated = "byDefault" } = options;
+	const column = type === "integer" ? integer(name).primaryKey() : bigint(name, { mode }).primaryKey();
+	return generated === "always" ? column.generatedAlwaysAsIdentity() : column.generatedByDefaultAsIdentity();
+}
+const assignedPrimaryId = ({ name = DEFAULT_ID_NAME, length } = {}) => varchar(name, { length }).primaryKey();
+function primaryId(kind = "sequential") {
+	if (kind === "uuid") return uuidPrimaryId();
+	if (kind === "assigned") return assignedPrimaryId();
+	return sequentialPrimaryId();
+}
+function operationPolicy(name, operation, config = {}) {
+	return pgPolicy(name, {
+		...config,
+		for: operation
+	});
+}
+const selectPolicy = (name, config = {}) => operationPolicy(name, "select", config);
+const insertPolicy = (name, config = {}) => operationPolicy(name, "insert", config);
+const updatePolicy = (name, config = {}) => operationPolicy(name, "update", config);
+const deletePolicy = (name, config = {}) => operationPolicy(name, "delete", config);
+const allPolicy = (name, config = {}) => operationPolicy(name, "all", config);
+const authenticatedSelectPolicy = (name, config = {}) => selectPolicy(name, {
+	...config,
+	to: authenticatedRole$1
+});
+const authenticatedInsertPolicy = (name, config = {}) => insertPolicy(name, {
+	...config,
+	to: authenticatedRole$1
+});
+const authenticatedUpdatePolicy = (name, config = {}) => updatePolicy(name, {
+	...config,
+	to: authenticatedRole$1
+});
+const authenticatedDeletePolicy = (name, config = {}) => deletePolicy(name, {
+	...config,
+	to: authenticatedRole$1
+});
+const authenticatedAllPolicy = (name, config = {}) => allPolicy(name, {
+	...config,
+	to: authenticatedRole$1
+});
+const POLICY_CLAUSE = {
+	all: "using",
+	delete: "using",
+	insert: "withCheck",
+	select: "using",
+	update: "using"
+};
+const POLICY_BUILDERS = {
+	all: allPolicy,
+	delete: deletePolicy,
+	insert: insertPolicy,
+	select: selectPolicy,
+	update: updatePolicy
+};
+const isWholeSetArgument = (argument) => is(argument, Column) || Array.isArray(argument);
+const argumentsFor = (argument, operation) => {
+	if (!argument) return [];
+	const forOperation = isWholeSetArgument(argument) ? argument : argument[operation];
+	if (!forOperation) return [];
+	return is(forOperation, Column) ? [forOperation] : [...forOperation];
+};
+/**
+* One policy per operation, each delegating to a `security definer` function.
+*
+* Access rarely depends only on the row's own owner column, and the usual
+* answer is a function, which is also the standard advice for keeping RLS
+* predicates out of the planner's way:
+*
+* ```ts
+* table("posts", { id: primaryId("uuid") }, (t) =>
+*   functionPolicies(t, { argument: t.id })
+* )
+* ```
+*
+* ```sql
+* CREATE POLICY "can_select_posts" ON "posts" FOR SELECT TO "authenticated"
+*   USING ((select "can_select_posts"("posts"."id")));
+* ```
+*
+* `argument` also takes a record, for the usual shape where `insert` has no
+* row to authorise yet:
+*
+* ```ts
+* functionPolicies(t, {
+*   argument: { delete: t.id, select: t.id, update: t.id },
+* })
+* ```
+*/
+const functionPolicies = (columns, { argument, name, prefix = "can", schema: functionSchema } = {}) => {
+	const [firstColumn] = Object.values(columns);
+	if (!firstColumn) throw new Error("functionPolicies needs a table with at least one column");
+	const tableName = getTableName(getColumnTable(firstColumn));
+	return FUNCTION_POLICY_OPERATIONS.map((operation) => {
+		const functionName = functionPolicyName(prefix, operation, tableName);
+		const callee = functionSchema ? sql`${sql.identifier(functionSchema)}.${sql.identifier(functionName)}` : sql`${sql.identifier(functionName)}`;
+		const condition = sql`(select ${callee}(${sql.join(argumentsFor(argument, operation), sql`, `)}))`;
+		const clause = { [POLICY_CLAUSE[operation]]: condition };
+		return POLICY_BUILDERS[operation](name?.(operation, tableName) ?? functionName, {
+			to: authenticatedRole$1,
+			...clause
+		});
+	});
+};
+const authUserOwns = (ownerColumn) => sql`${ownerColumn} = ${authUid$1}`;
+const authenticatedOwnerSelectPolicy = (name, ownerColumn, config = {}) => selectPolicy(name, {
+	...config,
+	to: authenticatedRole$1,
+	using: config.using ?? authUserOwns(ownerColumn)
+});
+const authenticatedOwnerInsertPolicy = (name, ownerColumn, config = {}) => insertPolicy(name, {
+	...config,
+	to: authenticatedRole$1,
+	withCheck: config.withCheck ?? authUserOwns(ownerColumn)
+});
+const authenticatedOwnerUpdatePolicy = (name, ownerColumn, config = {}) => {
+	const ownerCondition = authUserOwns(ownerColumn);
+	return updatePolicy(name, {
+		...config,
+		to: authenticatedRole$1,
+		using: config.using ?? ownerCondition,
+		withCheck: config.withCheck ?? ownerCondition
+	});
+};
+const authenticatedOwnerDeletePolicy = (name, ownerColumn, config = {}) => deletePolicy(name, {
+	...config,
+	to: authenticatedRole$1,
+	using: config.using ?? authUserOwns(ownerColumn)
+});
+const authenticatedOwnerAllPolicy = (name, ownerColumn, config = {}) => {
+	const ownerCondition = authUserOwns(ownerColumn);
+	return allPolicy(name, {
+		...config,
+		to: authenticatedRole$1,
+		using: config.using ?? ownerCondition,
+		withCheck: config.withCheck ?? ownerCondition
+	});
+};
+const table = snakeCase.table.withRLS;
+const unsecureTable = snakeCase.table;
+const schema = (name) => {
+	const built = snakeCase.schema(name);
+	return Object.assign(built, {
+		table: built.table.withRLS,
+		unsecureTable: built.table
+	});
+};
+//#endregion
+export { allPolicy, anonRole, assignedPrimaryId, auditColumns, authUid, authUserId, authUserOwns, authenticatedAllPolicy, authenticatedDeletePolicy, authenticatedInsertPolicy, authenticatedOwnerAllPolicy, authenticatedOwnerDeletePolicy, authenticatedOwnerInsertPolicy, authenticatedOwnerSelectPolicy, authenticatedOwnerUpdatePolicy, authenticatedRole, authenticatedSelectPolicy, authenticatedUpdatePolicy, authorship, createdBy, deletePolicy, enum$1 as enum, functionPolicies, insertPolicy, isEnum, isMaterializedView, isSchema, isSequence, isView, materializedView, policy, postgresRole, primaryId, realtimeMessages, realtimeTopic, role, schema, selectPolicy, sequence, sequentialPrimaryId, serviceRole, supabaseAuthAdminRole, table, tableCreator, timestamps, unsecureTable, updatePolicy, updatedBy, userId, uuidPrimaryId, view };

package/dist/triggers.d.mts

@@ -0,0 +1,65 @@
+import { PgTable } from "drizzle-orm/pg-core";
+//#region src/triggers.d.ts
+type UpdatedAtTriggerOptions = {
+  /** Column the trigger maintains. Default `"updated_at"`. */
+  column?: string;
+  /** Schema holding the table. Default `"public"`, or the table's own. */
+  schema?: string;
+  /** Trigger name. Default `handle_<column>`. */
+  name?: string;
+  /** Schema `moddatetime` is installed into. Default `"extensions"`. */
+  extensionSchema?: string;
+  /** Emit `create extension if not exists`. Default `true`. */
+  createExtension?: boolean;
+};
+/**
+ * `CREATE TRIGGER` SQL that keeps `updated_at` current for **every** writer,
+ * including PostgREST, the dashboard and psql.
+ *
+ * `timestamps()` gives the column a `DEFAULT now()`, which covers the insert.
+ * SQL has no "on update" default, so without this trigger the column is only
+ * ever the insert time. Required, not optional.
+ *
+ * ```ts
+ * // pnpm db:generate --custom --name=posts_audit_triggers
+ * // then paste the output into the generated migration:
+ * console.log(updatedAtTrigger(posts))
+ * ```
+ */
+declare function updatedAtTrigger(table: PgTable | string, { column, createExtension, extensionSchema, name, schema }?: UpdatedAtTriggerOptions): string;
+/** `create extension if not exists moddatetime`, safe to repeat per migration. */
+declare function moddatetimeExtension(schema?: string): string;
+type UpdatedByTriggerOptions = {
+  /** Column the trigger maintains. Default `"updated_by"`. */
+  column?: string;
+  /** Schema holding the table. Default `"public"`, or the table's own. */
+  schema?: string;
+  /** Trigger name. Default `handle_<column>`. */
+  name?: string;
+  /** Schema the helper function is created in. Default `"public"`. */
+  functionSchema?: string;
+  /** Emit `create or replace function`. Default `true`. */
+  createFunction?: boolean;
+};
+/**
+ * `CREATE TRIGGER` SQL that stamps an author column with `auth.uid()` on every
+ * update, the `updated_at` story for `updated_by`.
+ *
+ * `updatedBy()` gives the column a `DEFAULT (select auth.uid())`, which covers
+ * the insert. This covers the update, for every writer rather than only the
+ * ones going through Drizzle.
+ *
+ * A write with no session (the admin or `service_role` clients) records `NULL`,
+ * because that is what `auth.uid()` returns there.
+ */
+declare function updatedByTrigger(table: PgTable | string, { column, createFunction, functionSchema, name, schema }?: UpdatedByTriggerOptions): string;
+/**
+ * Both update triggers `auditColumns()` needs, in one string.
+ *
+ * `auditColumns()` and `timestamps()` leave `updated_at` and `updated_by` at
+ * their insert values without these, so a table using either helper wants this
+ * in a `drizzle-kit generate --custom` migration.
+ */
+declare function auditTriggers(table: PgTable | string, options?: UpdatedAtTriggerOptions & UpdatedByTriggerOptions): string;
+//#endregion
+export { auditTriggers, moddatetimeExtension, updatedAtTrigger, updatedByTrigger };