@zeno-lib/db 0.3.2 → 0.4.0

package/dist/next.d.mts

@@ -0,0 +1,87 @@
+import { n as DrizzleClient, t as CreateClientConfig } from "./clients-BlUEH7QJ.mjs";
+import { AnyRelations, EmptyRelations } from "drizzle-orm";
+import { JwtPayload, SupabaseClient } from "@supabase/supabase-js";
+//#region src/define-action.d.ts
+/**
+ * The slice of a schema `defineAction` needs: a throwing `parse`, plus the
+ * Standard Schema `types` marker it reads the caller-facing input type from.
+ * Zod 4 schemas satisfy it as they are; so does anything else that implements
+ * Standard Schema and exposes `parse`.
+ */
+interface ActionSchema<TInput, TOutput> {
+  readonly "~standard": {
+    readonly types?: {
+      readonly input: TInput;
+      readonly output: TOutput;
+    } | undefined;
+  };
+  parse(input: unknown): TOutput;
+}
+/** What a request context must carry for `defineAction` to hand it over. */
+interface ActionContext<TDb> {
+  readonly db: TDb;
+}
+/** An action's body: the RLS-bound `db`, the parsed input, and the context. */
+type ActionHandler<TContext extends ActionContext<unknown>, TOutput, TResult> = (db: TContext["db"], input: TOutput, context: TContext) => TResult | Promise<TResult>;
+/**
+ * `defineAction(schema, handler)` returns the server action itself: an async
+ * function that parses its argument, resolves the request context, then calls
+ * `handler(db, input, context)`.
+ */
+type DefineAction<TContext extends ActionContext<unknown>> = <TInput, TOutput, TResult>(schema: ActionSchema<TInput, TOutput>, handler: ActionHandler<TContext, TOutput, TResult>) => (input: TInput) => Promise<TResult>;
+//#endregion
+//#region src/next.d.ts
+/**
+ * Thrown when a request carries no verified session. A named class so a caller
+ * with a legitimate answer for that case (a permission check, where "not signed
+ * in" means "no") can tell it apart from a real failure with `instanceof`.
+ */
+declare class UnauthenticatedError extends Error {
+  constructor(message?: string);
+}
+/** The only part of a Supabase client the request context reads. */
+type ClaimsSource = {
+  auth: Pick<SupabaseClient["auth"], "getClaims">;
+};
+/** A verified request: the full `getClaims()` payload and the RLS client. */
+type RequestContext<TRelations extends AnyRelations = EmptyRelations> = {
+  readonly claims: JwtPayload;
+  readonly db: DrizzleClient<TRelations>;
+};
+type CreateRequestDbOptions<TRelations extends AnyRelations = EmptyRelations> = Omit<CreateClientConfig<TRelations>, "connectionString"> & {
+  /**
+   * Builds the request's Supabase client, e.g. `createClient` from
+   * `@zeno-lib/supabase/next-server` (cookie session via `next/headers`).
+   */
+  supabase: () => ClaimsSource | Promise<ClaimsSource>;
+  /**
+   * Overrides `SUPABASE_DATABASE_URL`. A function is resolved per request, not
+   * at import, so a build without server secrets can still import the module.
+   */
+  connectionString?: string | (() => string);
+};
+type RequestDb<TRelations extends AnyRelations = EmptyRelations> = {
+  /** Memoised per render: `{ claims, db }` for the verified caller. */
+  getRequestContext: () => Promise<RequestContext<TRelations>>;
+  /** The common case: just the RLS-bound client. */
+  getRequestDb: () => Promise<DrizzleClient<TRelations>>;
+  /** Wraps a handler into a `"use server"` export; see `DefineAction`. */
+  defineAction: DefineAction<RequestContext<TRelations>>;
+};
+/**
+ * Request-scoped, RLS-bound Drizzle access for Next.js. Verifies the session
+ * with `getClaims()` (which checks the signature) and installs the **whole**
+ * claims object, so custom claims reach `auth.jwt()` in policies. There is no
+ * fallback to `anon`: a caller without a verified `sub` gets
+ * `UnauthenticatedError` rather than the empty result of a policy it never
+ * satisfied.
+ *
+ * `getRequestContext` is wrapped in React's `cache`, so one server render shares
+ * one verification and one handle. A server action invoked from the browser
+ * runs outside a render and resolves afresh on every call.
+ *
+ * Do not `close()` the handle: pools are shared and reference-counted.
+ */
+declare function createRequestDb<TRelations extends AnyRelations = EmptyRelations>(options: CreateRequestDbOptions<TRelations>): RequestDb<TRelations>;
+//#endregion
+export { type ActionContext, type ActionHandler, type ActionSchema, ClaimsSource, CreateRequestDbOptions, type DefineAction, RequestContext, RequestDb, UnauthenticatedError, createRequestDb };

package/dist/next.mjs

@@ -0,0 +1,69 @@
+import { a as createSupabaseClient } from "./clients-CdPr3mCZ.mjs";
+import { cache } from "react";
+//#region src/define-action.ts
+/**
+* Binds `defineAction` to a request-context resolver. Deliberately not a
+* `"use server"` module: it only returns a function, and the app file that
+* exports the result is the one that carries the directive.
+*
+* Input is parsed before the context is resolved, so a malformed call fails
+* without a session round trip, and the handler never sees an unparsed value.
+*/
+function createDefineAction(getContext) {
+	return (schema, handler) => async (input) => {
+		const parsed = schema.parse(input);
+		const context = await getContext();
+		return await handler(context.db, parsed, context);
+	};
+}
+//#endregion
+//#region src/next.ts
+/**
+* Thrown when a request carries no verified session. A named class so a caller
+* with a legitimate answer for that case (a permission check, where "not signed
+* in" means "no") can tell it apart from a real failure with `instanceof`.
+*/
+var UnauthenticatedError = class extends Error {
+	constructor(message = "Unauthorized: no verified session on this request") {
+		super(message);
+		this.name = "UnauthenticatedError";
+	}
+};
+/**
+* Request-scoped, RLS-bound Drizzle access for Next.js. Verifies the session
+* with `getClaims()` (which checks the signature) and installs the **whole**
+* claims object, so custom claims reach `auth.jwt()` in policies. There is no
+* fallback to `anon`: a caller without a verified `sub` gets
+* `UnauthenticatedError` rather than the empty result of a policy it never
+* satisfied.
+*
+* `getRequestContext` is wrapped in React's `cache`, so one server render shares
+* one verification and one handle. A server action invoked from the browser
+* runs outside a render and resolves afresh on every call.
+*
+* Do not `close()` the handle: pools are shared and reference-counted.
+*/
+function createRequestDb(options) {
+	const { connectionString, supabase, ...config } = options;
+	const getRequestContext = cache(async () => {
+		const { data, error } = await (await supabase()).auth.getClaims();
+		if (error) throw error;
+		if (!data?.claims.sub) throw new UnauthenticatedError();
+		const url = typeof connectionString === "function" ? connectionString() : connectionString;
+		const db = createSupabaseClient(data.claims, url === void 0 ? config : {
+			...config,
+			connectionString: url
+		});
+		return {
+			claims: data.claims,
+			db
+		};
+	});
+	return {
+		defineAction: createDefineAction(getRequestContext),
+		getRequestContext,
+		getRequestDb: async () => (await getRequestContext()).db
+	};
+}
+//#endregion
+export { UnauthenticatedError, createRequestDb };

package/dist/query.d.mts

@@ -0,0 +1,103 @@
+import { t as FunctionPolicyOperation } from "./function-names-hv2mj_x1.mjs";
+import { SQL } from "drizzle-orm";
+import { PgTable } from "drizzle-orm/pg-core";
+//#region src/query.d.ts
+/**
+ * PostgREST's `.single()`: exactly one row, or an error.
+ *
+ * `findFirst()` returns `undefined` for no rows and silently drops the rest
+ * when there are several, and `.returning()` hands back an array.
+ */
+declare const one: <T>(rows: readonly T[]) => T;
+/**
+ * PostgREST's `.maybeSingle()`: one row or none, erroring on more than one.
+ * Returns `undefined` rather than `null`, which is what `findFirst()` does.
+ */
+declare const maybeOne: <T>(rows: readonly T[]) => T | undefined;
+type ColumnKey<TTable extends PgTable> = Extract<keyof TTable["_"]["columns"], string>;
+type ExcludedSetOptions<TTable extends PgTable> = {
+  /**
+   * The conflict target's column keys, never written back from `excluded`.
+   * The first one that exists is also the empty-set fallback. Default `"id"`.
+   */
+  target?: ColumnKey<TTable> | readonly ColumnKey<TTable>[];
+};
+/**
+ * The `set` for `onConflictDoUpdate` that reproduces PostgREST's
+ * `.upsert(row, { onConflict })`: on conflict, every column the caller
+ * supplied is overwritten from the proposed row (`col = excluded.col`).
+ *
+ * - A key carrying `undefined` is skipped. Drizzle omits an undefined column
+ *   from the INSERT, so `excluded.x` would be the column default, and on a
+ *   conflict `x = excluded.x` would overwrite a stored value with it.
+ * - The conflict target (`id` unless `target` says otherwise) is excluded.
+ * - An empty result falls back to `<target> = excluded.<target>`. Drizzle
+ *   throws `No values to set` while *building* the statement, so a payload
+ *   holding nothing but the key would fail even on the plain insert path.
+ *   Writing the key back to itself is a no-op that keeps `.returning()`
+ *   yielding the row, which `onConflictDoNothing` does not.
+ *
+ * With no target column in the table (a junction keyed only by its foreign
+ * keys, with the default target) the fallback cannot apply and the result
+ * stays empty: such a table wants `onConflictDoNothing` anyway.
+ *
+ * Column names come from the schema, never from `values`.
+ */
+declare const excludedSet: <TTable extends PgTable>(table: TTable, values: Record<string, unknown>, { target }?: ExcludedSetOptions<TTable>) => Record<string, SQL>;
+/**
+ * The same values with every `undefined` key dropped, so an insert and its
+ * `excludedSet` agree on which columns were supplied.
+ */
+declare const definedValues: <T extends Record<string, unknown>>(values: T) => T;
+/** Table name to the schema its `<prefix>_<operation>_<table>` functions live in. */
+type FunctionPermissionTables = ReadonlyMap<string, string>;
+type FunctionPermissionTablesOptions = {
+  /** Schemas whose tables are included. Default `["public"]`. */
+  schemas?: readonly string[];
+};
+/**
+ * The allowlist `selectFunctionPermissions` resolves a table name against,
+ * built from a Drizzle schema object (`import * as schema`) or the result of
+ * `defineRelations`. Build it once at module scope. Views and non-table
+ * exports are ignored; a table name that appears in two included schemas
+ * throws, since a bare name could not tell them apart.
+ */
+declare const functionPermissionTables: (schemaObject: Record<string, unknown>, { schemas }?: FunctionPermissionTablesOptions) => FunctionPermissionTables;
+type FunctionPermissions = Record<FunctionPolicyOperation, boolean>;
+/**
+ * Anything with Drizzle's `execute` returning rows: a postgres-js client from
+ * `@zeno-lib/db`, a `PgAsyncDatabase`, or a transaction.
+ */
+type QueryExecutor = {
+  execute: (query: SQL) => PromiseLike<readonly Record<string, unknown>[]>;
+};
+type SelectFunctionPermissionsOptions = {
+  /** From `functionPermissionTables`. */
+  tables: FunctionPermissionTables;
+  /** The table asked about, checked against `tables`. */
+  table: string;
+  /**
+   * The row, passed to every function but `insert` (there is no row yet) as
+   * a named argument. Omit to call all four with none.
+   */
+  id?: number | string;
+  /** Name of the functions' row parameter. Default `"id"`. */
+  argumentName?: string;
+  /** Function prefix, as given to `functionPolicies`. Default `"can"`. */
+  prefix?: string;
+  /** Schema the functions live in. Default: the table's own. */
+  functionSchema?: string;
+};
+/**
+ * The four `<prefix>_<operation>_<table>()` answers for one table, in one
+ * statement: the read side of `functionPolicies`, for showing or hiding UI.
+ *
+ * `table` is only ever a map key: every identifier that reaches the statement
+ * comes from `tables` and is quoted with `sql.identifier`. A function missing
+ * or with another signature raises `42883` (`SqlState.undefinedFunction`).
+ * A `null` answer, which a function gives for a row the caller cannot see,
+ * counts as `false`, as does anything else that is not `true`.
+ */
+declare const selectFunctionPermissions: (db: QueryExecutor, { argumentName, functionSchema, id, prefix, table, tables }: SelectFunctionPermissionsOptions) => Promise<FunctionPermissions>;
+//#endregion
+export { ExcludedSetOptions, FunctionPermissionTables, FunctionPermissionTablesOptions, FunctionPermissions, QueryExecutor, SelectFunctionPermissionsOptions, definedValues, excludedSet, functionPermissionTables, maybeOne, one, selectFunctionPermissions };

package/dist/query.mjs

@@ -0,0 +1,115 @@
+import { n as functionPolicyName, t as FUNCTION_POLICY_OPERATIONS } from "./function-names-BDc-AuFm.mjs";
+import { getColumns, is, sql } from "drizzle-orm";
+import { PgTable, getTableConfig } from "drizzle-orm/pg-core";
+//#region src/query.ts
+/**
+* PostgREST's `.single()`: exactly one row, or an error.
+*
+* `findFirst()` returns `undefined` for no rows and silently drops the rest
+* when there are several, and `.returning()` hands back an array.
+*/
+const one = (rows) => {
+	if (rows.length !== 1) throw new Error(`Expected exactly one row, received ${rows.length}`);
+	return rows[0];
+};
+/**
+* PostgREST's `.maybeSingle()`: one row or none, erroring on more than one.
+* Returns `undefined` rather than `null`, which is what `findFirst()` does.
+*/
+const maybeOne = (rows) => {
+	if (rows.length > 1) throw new Error(`Expected at most one row, received ${rows.length}`);
+	return rows[0];
+};
+/**
+* The `set` for `onConflictDoUpdate` that reproduces PostgREST's
+* `.upsert(row, { onConflict })`: on conflict, every column the caller
+* supplied is overwritten from the proposed row (`col = excluded.col`).
+*
+* - A key carrying `undefined` is skipped. Drizzle omits an undefined column
+*   from the INSERT, so `excluded.x` would be the column default, and on a
+*   conflict `x = excluded.x` would overwrite a stored value with it.
+* - The conflict target (`id` unless `target` says otherwise) is excluded.
+* - An empty result falls back to `<target> = excluded.<target>`. Drizzle
+*   throws `No values to set` while *building* the statement, so a payload
+*   holding nothing but the key would fail even on the plain insert path.
+*   Writing the key back to itself is a no-op that keeps `.returning()`
+*   yielding the row, which `onConflictDoNothing` does not.
+*
+* With no target column in the table (a junction keyed only by its foreign
+* keys, with the default target) the fallback cannot apply and the result
+* stays empty: such a table wants `onConflictDoNothing` anyway.
+*
+* Column names come from the schema, never from `values`.
+*/
+const excludedSet = (table, values, { target = "id" } = {}) => {
+	const columns = getColumns(table);
+	const targets = typeof target === "string" ? [target] : target;
+	const set = {};
+	for (const [key, column] of Object.entries(columns)) if (key in values && values[key] !== void 0 && !targets.includes(key)) set[key] = sql`excluded.${sql.identifier(column.name)}`;
+	if (Object.keys(set).length > 0) return set;
+	const fallback = targets.find((key) => key in columns);
+	const fallbackColumn = fallback === void 0 ? void 0 : columns[fallback];
+	if (fallback !== void 0 && fallbackColumn) set[fallback] = sql`excluded.${sql.identifier(fallbackColumn.name)}`;
+	return set;
+};
+/**
+* The same values with every `undefined` key dropped, so an insert and its
+* `excludedSet` agree on which columns were supplied.
+*/
+const definedValues = (values) => Object.fromEntries(Object.entries(values).filter(([, value]) => value !== void 0));
+const DEFAULT_SCHEMA = "public";
+const tableOf = (value) => {
+	if (is(value, PgTable)) return value;
+	if (typeof value === "object" && value !== null && "table" in value) {
+		const { table } = value;
+		return is(table, PgTable) ? table : void 0;
+	}
+};
+/**
+* The allowlist `selectFunctionPermissions` resolves a table name against,
+* built from a Drizzle schema object (`import * as schema`) or the result of
+* `defineRelations`. Build it once at module scope. Views and non-table
+* exports are ignored; a table name that appears in two included schemas
+* throws, since a bare name could not tell them apart.
+*/
+const functionPermissionTables = (schemaObject, { schemas = [DEFAULT_SCHEMA] } = {}) => {
+	const tables = /* @__PURE__ */ new Map();
+	for (const value of Object.values(schemaObject)) {
+		const table = tableOf(value);
+		if (!table) continue;
+		const { name, schema = DEFAULT_SCHEMA } = getTableConfig(table);
+		if (!schemas.includes(schema)) continue;
+		const existing = tables.get(name);
+		if (existing !== void 0 && existing !== schema) throw new Error(`Table "${name}" exists in both "${existing}" and "${schema}"; include only one of those schemas`);
+		tables.set(name, schema);
+	}
+	return tables;
+};
+/**
+* The four `<prefix>_<operation>_<table>()` answers for one table, in one
+* statement: the read side of `functionPolicies`, for showing or hiding UI.
+*
+* `table` is only ever a map key: every identifier that reaches the statement
+* comes from `tables` and is quoted with `sql.identifier`. A function missing
+* or with another signature raises `42883` (`SqlState.undefinedFunction`).
+* A `null` answer, which a function gives for a row the caller cannot see,
+* counts as `false`, as does anything else that is not `true`.
+*/
+const selectFunctionPermissions = async (db, { argumentName = "id", functionSchema, id, prefix = "can", table, tables }) => {
+	const tableSchema = tables.get(table);
+	if (tableSchema === void 0) throw new Error(`No permission functions for table "${table}"`);
+	const schema = functionSchema ?? tableSchema;
+	const call = (operation) => {
+		const callee = sql`${sql.identifier(schema)}.${sql.identifier(functionPolicyName(prefix, operation, table))}`;
+		return operation === "insert" || id === void 0 ? sql`${callee}()` : sql`${callee}(${sql.identifier(argumentName)} => ${id})`;
+	};
+	const row = one(await db.execute(sql`select ${sql.join(FUNCTION_POLICY_OPERATIONS.map((operation) => sql`${call(operation)} as ${sql.identifier(operation)}`), sql`, `)}`));
+	return {
+		delete: row.delete === true,
+		insert: row.insert === true,
+		select: row.select === true,
+		update: row.update === true
+	};
+};
+//#endregion
+export { definedValues, excludedSet, functionPermissionTables, maybeOne, one, selectFunctionPermissions };

package/dist/schema.d.mts

@@ -1,15 +1,26 @@
-import { AnyPgColumn, ExtraConfigColumn, HasIdentity, PgBigInt53Builder, PgBigInt64Builder, PgIntegerBuilder, PgPolicyConfig, PgUUIDBuilder, Precision, ReferenceConfig, SetHasDefault, SetIsPrimaryKey, SetNotNull, isPgEnum as isEnum, isPgMaterializedView as isMaterializedView, isPgSchema as isSchema, isPgSequence as isSequence, isPgView as isView, pgEnum as enum$1, pgMaterializedView as materializedView, pgPolicy as policy, pgRole as role, pgSequence as sequence, pgTableCreator as tableCreator, pgView as view } from "drizzle-orm/pg-core";
+import { t as FunctionPolicyOperation } from "./function-names-hv2mj_x1.mjs";
+import { AnyPgColumn, ExtraConfigColumn, HasIdentity, PgBigInt53Builder, PgBigInt64Builder, PgIntegerBuilder, PgPolicyConfig, PgTimestampBuilder, PgTimestampStringBuilder, PgUUIDBuilder, Precision, ReferenceConfig, SetHasDefault, SetIsPrimaryKey, SetNotNull, isPgEnum as isEnum, isPgMaterializedView as isMaterializedView, isPgSchema as isSchema, isPgSequence as isSequence, isPgView as isView, pgEnum as enum$1, pgMaterializedView as materializedView, pgPolicy as policy, pgRole as role, pgSequence as sequence, pgTableCreator as tableCreator, pgView as view } from "drizzle-orm/pg-core";
 import { anonRole, authUid, authenticatedRole, postgresRole, realtimeMessages, realtimeTopic, serviceRole, supabaseAuthAdminRole } from "drizzle-orm/supabase";
 //#region src/schema.d.ts
-type TimestampsOptions = {
+/** How a timestamp column is read back: a `Date` (the default) or Postgres's own text. */
+type TimestampMode = "date" | "string";
+type TimestampsOptions<TMode extends TimestampMode = "date"> = {
+  /**
+   * `"date"` (the default) reads a `Date`; `"string"` keeps Postgres's text
+   * form, which also keeps the microseconds a `Date` truncates. A JavaScript
+   * mapping only: it emits no SQL.
+   */
+  mode?: TMode;
   withTimezone?: boolean;
   /** Fractional-second digits. Postgres allows 0 to 6. */
   precision?: Precision;
 };
-declare const timestamps: ({ precision, withTimezone }?: TimestampsOptions) => {
-  createdAt: SetHasDefault<SetNotNull<import("drizzle-orm/pg-core").PgTimestampBuilder>>;
-  updatedAt: SetHasDefault<SetNotNull<import("drizzle-orm/pg-core").PgTimestampBuilder>>;
+type TimestampColumn<TMode extends TimestampMode> = SetHasDefault<SetNotNull<[TMode] extends ["string"] ? PgTimestampStringBuilder : PgTimestampBuilder>>;
+type TimestampColumns<TMode extends TimestampMode = "date"> = {
+  createdAt: TimestampColumn<TMode>;
+  updatedAt: TimestampColumn<TMode>;
 };
+declare const timestamps: <TMode extends TimestampMode = "date">({ mode, precision, withTimezone }?: TimestampsOptions<TMode>) => TimestampColumns<TMode>;
 type ReferenceActions = ReferenceConfig["config"];
 type AuthorColumn<TNotNull extends boolean> = [TNotNull] extends [true] ? SetNotNull<PgUUIDBuilder> : PgUUIDBuilder;
 type AuthorReference = {
@@ -36,9 +47,9 @@ declare const authorship: <TNotNull extends boolean = false>(options?: Authorshi
   createdBy: SetHasDefault<AuthorColumn<TNotNull>>;
   updatedBy: SetHasDefault<AuthorColumn<TNotNull>>;
 };
-declare const auditColumns: <TNotNull extends boolean = false>(options?: AuthorshipOptions<TNotNull> & TimestampsOptions) => {
-  createdAt: SetHasDefault<SetNotNull<import("drizzle-orm/pg-core").PgTimestampBuilder>>;
-  updatedAt: SetHasDefault<SetNotNull<import("drizzle-orm/pg-core").PgTimestampBuilder>>;
+declare const auditColumns: <TNotNull extends boolean = false, TMode extends TimestampMode = "date">(options?: AuthorshipOptions<TNotNull> & TimestampsOptions<TMode>) => {
+  createdAt: TimestampColumn<TMode>;
+  updatedAt: TimestampColumn<TMode>;
   createdBy: SetHasDefault<AuthorColumn<TNotNull>>;
   updatedBy: SetHasDefault<AuthorColumn<TNotNull>>;
 };
@@ -78,8 +89,6 @@ declare const authenticatedInsertPolicy: (name: string, config?: AuthenticatedPo
 declare const authenticatedUpdatePolicy: (name: string, config?: AuthenticatedPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
 declare const authenticatedDeletePolicy: (name: string, config?: AuthenticatedPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
 declare const authenticatedAllPolicy: (name: string, config?: AuthenticatedPolicyOptions) => import("drizzle-orm/pg-core").PgPolicy;
-declare const FUNCTION_POLICY_OPERATIONS: readonly ["select", "insert", "update", "delete"];
-type FunctionPolicyOperation = (typeof FUNCTION_POLICY_OPERATIONS)[number];
 /** Columns one function is called with. `null` calls it with none. */
 type FunctionArgument = AnyPgColumn | readonly AnyPgColumn[] | null;
 type FunctionPoliciesOptions = {
@@ -146,4 +155,4 @@ declare const schema: <TName extends string>(name: TName) => import("drizzle-orm
   unsecureTable: import("drizzle-orm/pg-core").PgTableFn<TName>;
 };
 //#endregion
-export { AuthorshipOptions, allPolicy, anonRole, assignedPrimaryId, auditColumns, authUid, authUserId, authUserOwns, authenticatedAllPolicy, authenticatedDeletePolicy, authenticatedInsertPolicy, authenticatedOwnerAllPolicy, authenticatedOwnerDeletePolicy, authenticatedOwnerInsertPolicy, authenticatedOwnerSelectPolicy, authenticatedOwnerUpdatePolicy, authenticatedRole, authenticatedSelectPolicy, authenticatedUpdatePolicy, authorship, createdBy, deletePolicy, enum$1 as enum, functionPolicies, insertPolicy, isEnum, isMaterializedView, isSchema, isSequence, isView, materializedView, policy, postgresRole, primaryId, realtimeMessages, realtimeTopic, role, schema, selectPolicy, sequence, sequentialPrimaryId, serviceRole, supabaseAuthAdminRole, table, tableCreator, timestamps, unsecureTable, updatePolicy, updatedBy, userId, uuidPrimaryId, view };
+export { AuthorshipOptions, TimestampColumns, TimestampMode, TimestampsOptions, allPolicy, anonRole, assignedPrimaryId, auditColumns, authUid, authUserId, authUserOwns, authenticatedAllPolicy, authenticatedDeletePolicy, authenticatedInsertPolicy, authenticatedOwnerAllPolicy, authenticatedOwnerDeletePolicy, authenticatedOwnerInsertPolicy, authenticatedOwnerSelectPolicy, authenticatedOwnerUpdatePolicy, authenticatedRole, authenticatedSelectPolicy, authenticatedUpdatePolicy, authorship, createdBy, deletePolicy, enum$1 as enum, functionPolicies, insertPolicy, isEnum, isMaterializedView, isSchema, isSequence, isView, materializedView, policy, postgresRole, primaryId, realtimeMessages, realtimeTopic, role, schema, selectPolicy, sequence, sequentialPrimaryId, serviceRole, supabaseAuthAdminRole, table, tableCreator, timestamps, unsecureTable, updatePolicy, updatedBy, userId, uuidPrimaryId, view };

package/dist/schema.mjs

@@ -1,17 +1,22 @@
 import { authUsers } from "./auth-schema.mjs";
+import { n as functionPolicyName, t as FUNCTION_POLICY_OPERATIONS } from "./function-names-BDc-AuFm.mjs";
 import { Column, getColumnTable, getTableName, is, sql } from "drizzle-orm";
 import { bigint, integer, isPgEnum as isEnum, isPgMaterializedView as isMaterializedView, isPgSchema as isSchema, isPgSequence as isSequence, isPgView as isView, pgEnum as enum$1, pgMaterializedView as materializedView, pgPolicy, pgPolicy as policy, pgRole as role, pgSequence as sequence, pgTableCreator as tableCreator, pgView as view, timestamp, uuid, varchar } from "drizzle-orm/pg-core";
 import { snakeCase } from "drizzle-orm/pg-core/casing";
 import { anonRole, authUid, authUid as authUid$1, authenticatedRole, authenticatedRole as authenticatedRole$1, postgresRole, realtimeMessages, realtimeTopic, serviceRole, supabaseAuthAdminRole } from "drizzle-orm/supabase";
 //#region src/schema.ts
-const timestamps = ({ precision, withTimezone = true } = {}) => {
-	const config = {
+const timestamps = ({ mode, precision, withTimezone = true } = {}) => {
+	const column = (name) => mode === "string" ? timestamp(name, {
+		mode: "string",
 		precision,
 		withTimezone
-	};
+	}).notNull().defaultNow() : timestamp(name, {
+		precision,
+		withTimezone
+	}).notNull().defaultNow();
 	return {
-		createdAt: timestamp("created_at", config).notNull().defaultNow(),
-		updatedAt: timestamp("updated_at", config).notNull().defaultNow()
+		createdAt: column("created_at"),
+		updatedAt: column("updated_at")
 	};
 };
 const NULLABLE_AUTHOR_ACTIONS = {
@@ -118,12 +123,6 @@ const POLICY_BUILDERS = {
 	select: selectPolicy,
 	update: updatePolicy
 };
-const FUNCTION_POLICY_OPERATIONS = [
-	"select",
-	"insert",
-	"update",
-	"delete"
-];
 const isWholeSetArgument = (argument) => is(argument, Column) || Array.isArray(argument);
 const argumentsFor = (argument, operation) => {
 	if (!argument) return [];
@@ -163,7 +162,7 @@ const functionPolicies = (columns, { argument, name, prefix = "can", schema: fun
 	if (!firstColumn) throw new Error("functionPolicies needs a table with at least one column");
 	const tableName = getTableName(getColumnTable(firstColumn));
 	return FUNCTION_POLICY_OPERATIONS.map((operation) => {
-		const functionName = `${prefix}_${operation}_${tableName}`;
+		const functionName = functionPolicyName(prefix, operation, tableName);
 		const callee = functionSchema ? sql`${sql.identifier(functionSchema)}.${sql.identifier(functionName)}` : sql`${sql.identifier(functionName)}`;
 		const condition = sql`(select ${callee}(${sql.join(argumentsFor(argument, operation), sql`, `)}))`;
 		const clause = { [POLICY_CLAUSE[operation]]: condition };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeno-lib/db",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "type": "module",
   "exports": {
     ".": {
@@ -18,6 +18,21 @@
       "import": "./dist/config.mjs",
       "default": "./dist/config.mjs"
     },
+    "./errors": {
+      "types": "./dist/errors.d.mts",
+      "import": "./dist/errors.mjs",
+      "default": "./dist/errors.mjs"
+    },
+    "./next": {
+      "types": "./dist/next.d.mts",
+      "import": "./dist/next.mjs",
+      "default": "./dist/next.mjs"
+    },
+    "./query": {
+      "types": "./dist/query.d.mts",
+      "import": "./dist/query.mjs",
+      "default": "./dist/query.mjs"
+    },
     "./schema": {
       "types": "./dist/schema.d.mts",
       "import": "./dist/schema.mjs",
@@ -44,21 +59,30 @@
     "@supabase/supabase-js": ">=2",
     "drizzle-kit": "1.0.0-rc.3",
     "drizzle-orm": "1.0.0-rc.3",
-    "postgres": ">=3.4"
+    "postgres": ">=3.4",
+    "react": ">=19"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
   },
   "devDependencies": {
-    "@supabase/supabase-js": "2.106.1",
+    "@supabase/supabase-js": "2.116.0",
     "@types/node": "24.10.0",
+    "@types/react": "19.2.14",
     "dotenv": "17.4.2",
     "drizzle-kit": "1.0.0-rc.3",
     "drizzle-orm": "1.0.0-rc.3",
     "postgres": "3.4.7",
+    "react": "^19.2.5",
     "supabase": "2.84.1",
     "tsdown": "^0.22.14",
     "typescript": "7.0.2",
     "vite": "8.0.16",
-    "vitest": "4.1.0",
-    "@zeno-lib/test": "0.0.3",
+    "vitest": "4.1.11",
+    "zod": "^4.4.3",
+    "@zeno-lib/test": "0.1.0",
     "@zeno-lib/typescript": "^1.1.0"
   },
   "scripts": {