better-supabase 0.14.0 → 0.15.1

package/dist/cli/cache-DkplpIGe.js

@@ -0,0 +1,607 @@
+import { t as VERSION } from "./version-CyavsyGA.js";
+import { dirname, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+//#region src/cli/introspect/extras.ts
+/**
+* Catalog details `@supabase/postgrest-typegen` leaves out: named unique and
+* CHECK constraints, foreign key actions, ordered primary keys, indexes,
+* policies, triggers, grants, buckets and the realtime publication.
+*
+* The SQL takes no bind parameters because the Management API endpoint only
+* accepts a query string; schema names are inlined as escaped literals.
+*/
+const literalArray = (values) => `array[${values.map((value) => `'${value.replaceAll("'", "''")}'`).join(", ")}]::text[]`;
+/** Row estimate from which a table counts as large in the snapshot. */
+const LARGE_TABLE_ROWS = 1e4;
+const RELATIONS = (schemas) => `
+select c.oid::int8 as id, n.nspname as schema, c.relname as name,
+  c.reltuples >= ${LARGE_TABLE_ROWS} as large,
+  (select pn.nspname || '.' || pc.relname from pg_inherits i
+    join pg_class pc on pc.oid = i.inhparent
+    join pg_namespace pn on pn.oid = pc.relnamespace
+    where i.inhrelid = c.oid and c.relispartition) as partition_of
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+where n.nspname = any(${schemas}) and c.relkind in ('r', 'p', 'v', 'm', 'f')
+order by 2, 3`;
+const CONSTRAINTS = (schemas) => `
+select con.conrelid::int8 as table_id, con.conname as name, con.contype as type,
+  array(select a.attname from unnest(con.conkey) with ordinality k(attnum, ord)
+    join pg_attribute a on a.attrelid = con.conrelid and a.attnum = k.attnum order by k.ord)::text[] as columns,
+  con.confdeltype as on_delete, con.confupdtype as on_update,
+  pg_get_constraintdef(con.oid) as definition
+from pg_constraint con
+join pg_class c on c.oid = con.conrelid
+join pg_namespace n on n.oid = c.relnamespace
+where n.nspname = any(${schemas}) and con.contype in ('p', 'u', 'f', 'c')
+order by 1, 2`;
+const INDEXES = (schemas) => `
+select ix.indrelid::int8 as table_id, i.relname as name,
+  ix.indisunique as unique, ix.indisprimary as primary,
+  (ix.indpred is not null or 0 = any(ix.indkey::int2[])) as partial,
+  am.amname as method, pg_get_expr(ix.indpred, ix.indrelid) as predicate,
+  array(select a.attname from unnest((ix.indkey::int2[])[0:ix.indnkeyatts - 1]) with ordinality k(attnum, ord)
+    join pg_attribute a on a.attrelid = ix.indrelid and a.attnum = k.attnum order by k.ord)::text[] as columns
+from pg_index ix
+join pg_class i on i.oid = ix.indexrelid
+join pg_am am on am.oid = i.relam
+join pg_class c on c.oid = ix.indrelid
+join pg_namespace n on n.oid = c.relnamespace
+where n.nspname = any(${schemas}) and ix.indisvalid
+order by 1, 2`;
+const POLICIES = (schemas) => `
+select c.oid::int8 as table_id, p.policyname as name,
+  (p.permissive = 'PERMISSIVE') as permissive, p.roles::text[] as roles, lower(p.cmd) as command,
+  p.qual as using_expr, p.with_check as check_expr,
+  array(
+    select distinct fn.nspname || '.' || pr.proname
+    from pg_policy pol
+    join pg_depend d on d.classid = 'pg_policy'::regclass and d.objid = pol.oid
+      and d.refclassid = 'pg_proc'::regclass
+    join pg_proc pr on pr.oid = d.refobjid
+    join pg_namespace fn on fn.oid = pr.pronamespace
+    where pol.polrelid = c.oid and pol.polname = p.policyname
+    order by 1
+  )::text[] as functions
+from pg_policies p
+join pg_namespace n on n.nspname = p.schemaname
+join pg_class c on c.relnamespace = n.oid and c.relname = p.tablename
+where p.schemaname = any(${schemas})
+order by 1, 2`;
+const FUNCTIONS = (schemas) => `
+select n.nspname as schema, p.proname as name,
+  pg_get_function_identity_arguments(p.oid) as signature,
+  l.lanname as language, p.provolatile as volatility,
+  p.prosecdef as security_definer, coalesce(p.proconfig, '{}')::text[] as config,
+  array(
+    select r from unnest(array['anon', 'authenticated']) r
+    where has_function_privilege(r, p.oid, 'EXECUTE')
+  ) as execute
+from pg_proc p
+join pg_namespace n on n.oid = p.pronamespace
+join pg_language l on l.oid = p.prolang
+where p.oid in (
+    select d.refobjid
+    from pg_depend d
+    join pg_policy pol on d.classid = 'pg_policy'::regclass and d.objid = pol.oid
+    join pg_class c on c.oid = pol.polrelid
+    join pg_namespace cn on cn.oid = c.relnamespace
+    where d.refclassid = 'pg_proc'::regclass and cn.nspname = any(${schemas})
+  )
+  or (n.nspname = any(${schemas}) and ((p.prosecdef
+    and p.prorettype not in ('trigger'::regtype, 'event_trigger'::regtype)) or exists (
+    select 1 from unnest(p.proconfig) setting where setting not like 'search_path=%'
+  )))
+order by 1, 2, 3`;
+/**
+* Roles the hook checks care about: the one Auth calls it as, and the API
+* roles.
+*/
+const HOOK_ROLES = literalArray([
+	"supabase_auth_admin",
+	"authenticated",
+	"anon"
+]);
+const HOOKS = (names) => `
+select n.nspname as schema, p.proname as name,
+  pg_get_function_identity_arguments(p.oid) as signature,
+  l.lanname as language, p.provolatile as volatility,
+  p.prosecdef as security_definer, coalesce(p.proconfig, '{}')::text[] as config,
+  array(select r.rolname::text from pg_roles r
+    where r.rolname = any(${HOOK_ROLES}) and has_function_privilege(r.oid, p.oid, 'execute')
+    order by 1) as execute,
+  exists(select 1 from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) a
+    where a.grantee = 0 and a.privilege_type = 'EXECUTE') as public_execute,
+  array(select r.rolname::text from pg_roles r
+    where r.rolname = any(${HOOK_ROLES}) and has_schema_privilege(r.oid, n.oid, 'usage')
+    order by 1) as schema_usage,
+  p.prosrc as source
+from pg_proc p
+join pg_namespace n on n.oid = p.pronamespace
+join pg_language l on l.oid = p.prolang
+where n.nspname || '.' || p.proname = any(${names})
+order by 1, 2, 3`;
+const TRIGGERS = (schemas) => `
+select t.tgrelid::int8 as table_id, t.tgname as name,
+  pn.nspname || '.' || p.proname as function,
+  case when t.tgtype & 2 = 2 then 'before' when t.tgtype & 64 = 64 then 'instead of' else 'after' end as timing,
+  array_remove(array[
+    case when t.tgtype & 4 = 4 then 'insert' end,
+    case when t.tgtype & 16 = 16 then 'update' end,
+    case when t.tgtype & 8 = 8 then 'delete' end,
+    case when t.tgtype & 32 = 32 then 'truncate' end
+  ], null)::text[] as events,
+  case when t.tgtype & 1 = 1 then 'row' else 'statement' end as level,
+  case when t.tgnargs > 0 then array(
+    select replace(a, '\\\\', '\\') from unnest(string_to_array(left(encode(t.tgargs, 'escape'), -4), '\\000')) with ordinality as x(a, i) order by i
+  ) end as args,
+  case when pn.nspname || '.' || p.proname <> 'better_supabase.broadcast_topic'
+    and p.prosrc ~ 'realtime\\.(broadcast_changes|send)\\s*\\(' then p.prosrc end as source,
+  case when pn.nspname || '.' || p.proname <> 'better_supabase.broadcast_topic'
+    and p.prosrc ~ 'realtime\\.(broadcast_changes|send)\\s*\\(' then obj_description(p.oid, 'pg_proc') end as comment
+from pg_trigger t
+join pg_class c on c.oid = t.tgrelid
+join pg_namespace n on n.oid = c.relnamespace
+join pg_proc p on p.oid = t.tgfoid
+join pg_namespace pn on pn.oid = p.pronamespace
+where not t.tgisinternal and n.nspname = any(${schemas})
+order by 1, 2`;
+const GRANTS = (schemas) => `
+select c.oid::int8 as table_id, coalesce(r.rolname, 'PUBLIC') as role,
+  array_agg(distinct acl.privilege_type order by acl.privilege_type)::text[] as privileges
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+cross join lateral aclexplode(coalesce(c.relacl, acldefault('r', c.relowner))) acl
+left join pg_roles r on r.oid = acl.grantee
+where n.nspname = any(${schemas}) and c.relkind in ('r', 'p', 'v', 'm', 'f')
+  and (acl.grantee = 0 or r.rolname in ('anon', 'authenticated', 'service_role'))
+  and acl.privilege_type <> 'MAINTAIN'
+group by 1, 2
+order by 1, 2`;
+const COLUMN_GRANTS = (schemas) => `
+select c.oid::int8 as table_id, a.attname as column, coalesce(r.rolname, 'PUBLIC') as role,
+  array_agg(distinct acl.privilege_type order by acl.privilege_type)::text[] as privileges
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+join pg_attribute a on a.attrelid = c.oid and a.attnum > 0 and not a.attisdropped and a.attacl is not null
+cross join lateral aclexplode(a.attacl) acl
+left join pg_roles r on r.oid = acl.grantee
+where n.nspname = any(${schemas})
+  and (acl.grantee = 0 or r.rolname in ('anon', 'authenticated'))
+  and acl.privilege_type in ('SELECT', 'INSERT', 'UPDATE')
+group by 1, 2, 3
+order by 1, 2, 3`;
+const BUCKETS = `
+select id, public, file_size_limit, allowed_mime_types,
+  to_jsonb(b) ? 'versioning_status' as has_versioning,
+  to_jsonb(b) -> 'versioning_status' as versioning_status,
+  to_jsonb(b) ? 'lifecycle_configuration' as has_lifecycle,
+  to_jsonb(b) -> 'lifecycle_configuration' as lifecycle_configuration
+from storage.buckets b
+order by id`;
+const REALTIME = `
+select schemaname || '.' || tablename as name
+from pg_publication_tables
+where pubname = 'supabase_realtime'
+order by 1`;
+const ROLE_SETTINGS = `
+select r.rolname as role, s.setconfig as config
+from pg_catalog.pg_db_role_setting s
+join pg_catalog.pg_roles r on r.oid = s.setrole
+where r.rolname in ('authenticator', 'anon', 'authenticated')
+  and s.setdatabase in (0, (select oid from pg_catalog.pg_database where datname = current_database()))
+order by s.setdatabase`;
+const FUNCTION_COMMENTS = (schemas) => `
+select n.nspname || '.' || p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')' as key,
+  obj_description(p.oid, 'pg_proc') as comment
+from pg_proc p
+join pg_namespace n on n.oid = p.pronamespace
+where n.nspname = any(${schemas}) and obj_description(p.oid, 'pg_proc') ~ '@notNull'
+order by 1`;
+const FUNCTION_DOMAINS = (schemas) => `
+select distinct tn.nspname as schema, t.typname as name,
+  bt.typname as base_type, bn.nspname as base_schema, t.typnotnull as not_null
+from pg_proc p
+join pg_namespace n on n.oid = p.pronamespace
+cross join lateral unnest(array_append(coalesce(p.proallargtypes, p.proargtypes::oid[]), p.prorettype)) as a(type_id)
+join pg_type t on t.oid = a.type_id and t.typtype = 'd'
+join pg_namespace tn on tn.oid = t.typnamespace
+join pg_type bt on bt.oid = t.typbasetype
+join pg_namespace bn on bn.oid = bt.typnamespace
+where n.nspname = any(${schemas})
+order by 1, 2`;
+const HAS_TABLE = (qualified) => `select to_regclass('${qualified}') is not null as present`;
+const ACTIONS = {
+	a: "no action",
+	r: "restrict",
+	c: "cascade",
+	n: "set null",
+	d: "set default"
+};
+const VOLATILITY = {
+	i: "immutable",
+	s: "stable",
+	v: "volatile"
+};
+/** `['statement_timeout=5s']` as `{ statement_timeout: '5s' }`. */
+function settingsOf(config) {
+	const settings = {};
+	for (const entry of config ?? []) {
+		const at = entry.indexOf("=");
+		if (at > 0) settings[entry.slice(0, at)] = entry.slice(at + 1);
+	}
+	return settings;
+}
+const functionOf = (row) => ({
+	schema: row.schema,
+	name: row.name,
+	signature: row.signature,
+	language: row.language,
+	volatility: VOLATILITY[row.volatility],
+	securityDefiner: row.security_definer,
+	settings: settingsOf(row.config)
+});
+/** The functions behind Auth hooks, in any schema, with their ACLs. */
+async function readHooks(db, targets) {
+	if (targets.length === 0) return [];
+	const found = await rows(db, HOOKS(literalArray(targets.map((t) => `${t.schema}.${t.name}`))));
+	return targets.map((target) => ({
+		hook: target.hook,
+		schema: target.schema,
+		name: target.name,
+		functions: found.filter((row) => row.schema === target.schema && row.name === target.name).map((row) => ({
+			...functionOf(row),
+			execute: row.execute,
+			publicExecute: row.public_execute,
+			schemaUsage: row.schema_usage,
+			...row.source === null ? {} : { source: row.source }
+		}))
+	}));
+}
+async function rows(db, sql) {
+	return (await db.query(sql)).rows;
+}
+/** Rows from a table owned by another Supabase service, if it exists. */
+async function serviceRows(db, qualified, sql) {
+	const [probe] = await rows(db, HAS_TABLE(qualified));
+	return probe?.present ? rows(db, sql) : [];
+}
+function groupById(list) {
+	const map = /* @__PURE__ */ new Map();
+	for (const row of list) {
+		const id = Number(row.table_id);
+		const entry = map.get(id);
+		if (entry) entry.push(row);
+		else map.set(id, [row]);
+	}
+	return map;
+}
+/** Reads the extras for `schemas`, with the catalog queries in flight together. */
+async function readExtras(db, schemas, hooks = []) {
+	const list = literalArray(schemas);
+	const [relations, constraintRows, indexRows, policyRows, triggerRows, grantRows, columnGrantRows, buckets, realtime, functions, roleRows, hookRows, commentRows, domainRows] = await Promise.all([
+		rows(db, RELATIONS(list)),
+		rows(db, CONSTRAINTS(list)),
+		rows(db, INDEXES(list)),
+		rows(db, POLICIES(list)),
+		rows(db, TRIGGERS(list)),
+		rows(db, GRANTS(list)),
+		rows(db, COLUMN_GRANTS(list)),
+		serviceRows(db, "storage.buckets", BUCKETS),
+		rows(db, REALTIME),
+		rows(db, FUNCTIONS(list)),
+		rows(db, ROLE_SETTINGS),
+		hooks.length > 0 ? readHooks(db, hooks) : void 0,
+		rows(db, FUNCTION_COMMENTS(list)),
+		rows(db, FUNCTION_DOMAINS(list))
+	]);
+	const constraints = groupById(constraintRows);
+	const indexes = groupById(indexRows);
+	const policies = groupById(policyRows);
+	const triggers = groupById(triggerRows);
+	const grants = groupById(grantRows);
+	const columnGrants = groupById(columnGrantRows);
+	const roleSettings = {};
+	for (const row of roleRows) Object.assign(roleSettings[row.role] ??= {}, settingsOf(row.config));
+	return {
+		tables: relations.map((relation) => {
+			const id = Number(relation.id);
+			const own = constraints.get(id) ?? [];
+			const ownIndexes = indexes.get(id) ?? [];
+			const uniques = own.filter((con) => con.type === "u").map((con) => ({
+				name: con.name,
+				columns: con.columns
+			}));
+			const constraintNames = new Set(own.map((con) => con.name));
+			for (const index of ownIndexes) if (index.unique && !index.primary && !index.partial && !constraintNames.has(index.name)) uniques.push({
+				name: index.name,
+				columns: index.columns
+			});
+			return {
+				id,
+				schema: relation.schema,
+				name: relation.name,
+				primaryKey: own.find((con) => con.type === "p")?.columns ?? [],
+				uniques,
+				foreignKeys: own.filter((con) => con.type === "f").map((con) => ({
+					name: con.name,
+					onDelete: ACTIONS[con.on_delete] ?? "no action",
+					onUpdate: ACTIONS[con.on_update] ?? "no action"
+				})),
+				checks: own.filter((con) => con.type === "c").map((con) => ({
+					name: con.name,
+					definition: con.definition
+				})),
+				indexes: ownIndexes.map((index) => ({
+					name: index.name,
+					columns: index.columns,
+					unique: index.unique,
+					primary: index.primary,
+					partial: index.partial,
+					method: index.method,
+					predicate: index.predicate
+				})),
+				policies: (policies.get(id) ?? []).map((policy) => ({
+					name: policy.name,
+					command: policy.command,
+					roles: policy.roles,
+					permissive: policy.permissive,
+					using: policy.using_expr,
+					check: policy.check_expr,
+					functions: policy.functions ?? []
+				})),
+				triggers: (triggers.get(id) ?? []).map((trigger) => ({
+					name: trigger.name,
+					timing: trigger.timing,
+					events: trigger.events,
+					level: trigger.level,
+					function: trigger.function,
+					...trigger.args === null ? {} : { args: trigger.args },
+					...trigger.source === null ? {} : { source: trigger.source },
+					...trigger.comment === null ? {} : { comment: trigger.comment }
+				})),
+				grants: (grants.get(id) ?? []).map((grant) => ({
+					role: grant.role,
+					privileges: grant.privileges
+				})),
+				columnGrants: (columnGrants.get(id) ?? []).map((grant) => ({
+					column: grant.column,
+					role: grant.role,
+					privileges: grant.privileges
+				})),
+				...relation.large ? { large: true } : {},
+				...relation.partition_of ? { partitionOf: relation.partition_of } : {}
+			};
+		}),
+		buckets: buckets.map((row) => ({
+			id: row.id,
+			public: row.public,
+			fileSizeLimit: row.file_size_limit === null ? null : Number(row.file_size_limit),
+			allowedMimeTypes: row.allowed_mime_types,
+			...row.has_versioning ? { versioning: row.versioning_status } : {},
+			...row.has_lifecycle ? { lifecycle: row.lifecycle_configuration } : {}
+		})),
+		realtime: realtime.map((row) => row.name),
+		roleSettings,
+		functions: functions.map((row) => ({
+			...functionOf(row),
+			execute: row.execute
+		})),
+		...hookRows ? { hooks: hookRows } : {},
+		...commentRows.length > 0 ? { functionComments: Object.fromEntries(commentRows.map((row) => [row.key, row.comment])) } : {},
+		...domainRows.length > 0 ? { domains: domainRows.map((row) => ({
+			schema: row.schema,
+			name: row.name,
+			baseType: row.base_type,
+			baseSchema: row.base_schema,
+			notNull: row.not_null
+		})) } : {}
+	};
+}
+//#endregion
+//#region src/cli/introspect/fingerprint.ts
+/**
+* Catalogs whose rows only change with DDL, grants, comments or settings, with
+* the column that ties a row to a relation or namespace, if any.
+*/
+const CATALOGS = [
+	["pg_namespace", "oid"],
+	["pg_attribute", "attrelid"],
+	["pg_attrdef", "adrelid"],
+	["pg_constraint", "conrelid"],
+	["pg_index", "indrelid"],
+	["pg_inherits"],
+	["pg_rewrite"],
+	["pg_policy"],
+	["pg_trigger", "tgrelid"],
+	["pg_proc"],
+	["pg_type", "typnamespace"],
+	["pg_enum"],
+	["pg_description"],
+	["pg_db_role_setting"],
+	["pg_publication"],
+	["pg_publication_rel"],
+	["pg_extension"]
+];
+const TEMP_NAMESPACES = String.raw`(select oid from pg_catalog.pg_namespace where nspname like 'pg\_temp\_%' or nspname like 'pg\_toast\_temp\_%')`;
+const TEMP_RELATIONS = `(select oid from pg_catalog.pg_class where relnamespace in ${TEMP_NAMESPACES})`;
+const catalogRows = ([name, column]) => {
+	if (column === void 0) return `pg_catalog.${name}`;
+	return `(select * from pg_catalog.${name} where ${column} not in ${column === "oid" || column === "typnamespace" ? TEMP_NAMESPACES : TEMP_RELATIONS})`;
+};
+const digest = (from) => `(select md5(coalesce(string_agg(x::text, ',' order by x::text), '')) from ${from} x)`;
+/**
+* One cheap query whose result changes whenever introspection could. pg_class
+* leaves out the planner statistics that VACUUM and ANALYZE rewrite, except the
+* row-count threshold the snapshot records. pg_depend is limited to the
+* policies' rows, which name the tables and functions each policy uses.
+* pg_auth_members decides which privileges a role inherits, so the execute
+* lists change with it. Bucket rows are data, so they are hashed when
+* `storage.buckets` exists.
+*/
+const FINGERPRINT_SQL = `select md5(concat_ws('|',
+  ${digest(`(select oid, relname, relnamespace, relkind, relacl, reloptions, relrowsecurity, relforcerowsecurity, relreplident, relispartition, reltuples >= ${LARGE_TABLE_ROWS} as large from pg_catalog.pg_class where relnamespace not in ${TEMP_NAMESPACES})`)},
+  ${CATALOGS.map((entry) => digest(catalogRows(entry))).join(",\n  ")},
+  ${digest(`(select objid, refclassid, refobjid, refobjsubid, deptype from pg_catalog.pg_depend where classid = 'pg_catalog.pg_policy'::regclass)`)},
+  (select md5(coalesce(string_agg(rolname, ',' order by rolname), '')) from pg_catalog.pg_roles),
+  ${digest("pg_catalog.pg_auth_members")},
+  case when to_regclass('storage.buckets') is not null
+    then md5(query_to_xml('select id, public, file_size_limit, allowed_mime_types, to_jsonb(b) -> ''versioning_status'' as versioning, to_jsonb(b) -> ''lifecycle_configuration'' as lifecycle from storage.buckets b order by id', false, false, '')::text)
+  end
+)) as fingerprint`;
+/**
+* A hash of the catalog; equal values mean introspection would return the same
+* snapshot.
+*/
+async function catalogFingerprint(db) {
+	const [row] = (await db.query(FINGERPRINT_SQL)).rows;
+	const value = row && typeof row === "object" && "fingerprint" in row ? row.fingerprint : void 0;
+	if (typeof value !== "string") throw new TypeError("The catalog fingerprint query returned no row.");
+	return value;
+}
+//#endregion
+//#region src/cli/introspect/typegen-version.ts
+/**
+* The `@supabase/postgrest-typegen` version `database.types.ts` output is
+* pinned to. The default catalog pins this exact version and the peer range
+* sits around it (ADR 0016); a test checks both catalogs.
+*/
+const TYPEGEN_VERSION = "0.6.0";
+//#endregion
+//#region src/cli/introspect/cache.ts
+/** Shared with the splinter download cache. */
+const CACHE_DIR = "node_modules/.cache/better-supabase";
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+function isEntry(value) {
+	return typeof value === "object" && value !== null && "key" in value && typeof value.key === "string" && "snapshot" in value && typeof value.snapshot === "object";
+}
+/**
+* Calls `read`, or returns the snapshot cached under `root` when the catalog
+* fingerprint, the `inputs` (schemas and hooks), the CLI version and the
+* typegen version all match. One file per source keeps the cache from growing.
+* A source that cannot report a fingerprint is read every time.
+*/
+async function cachedIntrospect(root, source, inputs, read) {
+	const fingerprint = await catalogFingerprint(source.queryable).catch(() => void 0);
+	if (fingerprint === void 0) return read();
+	const key = sha256(JSON.stringify([
+		VERSION,
+		TYPEGEN_VERSION,
+		source.describe,
+		inputs,
+		fingerprint
+	]));
+	const file = resolve(root, CACHE_DIR, `snapshot-${sha256(source.describe).slice(0, 16)}.json`);
+	const cached = await readFile(file, "utf-8").then((text) => JSON.parse(text)).catch(() => void 0);
+	if (isEntry(cached) && cached.key === key) return cached.snapshot;
+	const snapshot = await read();
+	await writeAtomic(file, JSON.stringify({
+		key,
+		snapshot
+	})).catch(() => void 0);
+	return snapshot;
+}
+/**
+* Calls `produce`, or returns the `database.types.ts` cached under `root` for
+* the same `inputs`, CLI version and typegen version. Typegen and oxfmt are
+* most of a `gen` run on a large schema, and their output only depends on the
+* inputs.
+*/
+async function cachedDatabaseTypes(root, inputs, produce) {
+	const key = sha256(JSON.stringify([
+		VERSION,
+		TYPEGEN_VERSION,
+		inputs
+	]));
+	const file = resolve(root, CACHE_DIR, "database-types.json");
+	const cached = await readFile(file, "utf-8").then((text) => JSON.parse(text)).catch(() => void 0);
+	if (typeof cached === "object" && cached !== null && "key" in cached && cached.key === key && "contents" in cached && typeof cached.contents === "string") return cached.contents;
+	const contents = await produce();
+	await writeAtomic(file, JSON.stringify({
+		key,
+		contents
+	})).catch(() => void 0);
+	return contents;
+}
+/**
+* JSON for the resolved config with each function as its source text, so
+* generators and plugins count toward the key. Options a factory closes over
+* are invisible here, which is why the key also takes the config file's text.
+*/
+function configJson(config) {
+	return JSON.stringify(config, (_key, value) => typeof value === "function" ? String(value) : typeof value === "bigint" ? `${value}n` : value);
+}
+/**
+* The key of the module the content mapper serves: the CLI and typegen
+* versions, the config (resolved, and the text of its file) and the snapshot.
+* `gen` and the mapper compute the same key, so a `gen` run warms the mapper.
+*/
+function typesModuleKey(config, configText, snapshot) {
+	return sha256(JSON.stringify([
+		VERSION,
+		TYPEGEN_VERSION,
+		configText ?? null,
+		sha256(configJson(config)),
+		sha256(JSON.stringify(snapshot))
+	]));
+}
+const typesModuleFile = (root, output) => resolve(root, CACHE_DIR, `types-${sha256(output).slice(0, 16)}.json`);
+async function readTypesModule(root, output) {
+	const cached = await readFile(typesModuleFile(root, output), "utf-8").then((text) => JSON.parse(text)).catch(() => void 0);
+	return typeof cached === "object" && cached !== null && "key" in cached && typeof cached.key === "string" && "contents" in cached && typeof cached.contents === "string" ? {
+		key: cached.key,
+		contents: cached.contents
+	} : void 0;
+}
+/**
+* Stores the module the content mapper serves for `output`, and returns whether
+* it replaced one under another key. One file per generated module keeps the
+* cache from growing.
+*/
+async function storeTypesModule(root, output, key, contents) {
+	if ((await readTypesModule(root, output))?.key === key) return false;
+	await writeAtomic(typesModuleFile(root, output), JSON.stringify({
+		key,
+		contents
+	})).catch(() => void 0);
+	return true;
+}
+/**
+* Calls `produce`, or returns the module cached for `output` under the same
+* `key` (see `typesModuleKey`).
+*/
+async function cachedTypesModule(root, output, key, produce) {
+	const cached = await readTypesModule(root, output);
+	if (cached?.key === key) return cached.contents;
+	const contents = await produce();
+	await writeAtomic(typesModuleFile(root, output), JSON.stringify({
+		key,
+		contents
+	})).catch(() => void 0);
+	return contents;
+}
+/**
+* The module last cached for `output`, whatever its key: what the content
+* mapper serves while the schema source can't be read.
+*/
+async function lastTypesModule(root, output) {
+	return (await readTypesModule(root, output))?.contents;
+}
+/**
+* Writes through a temporary file, so a concurrent reader never sees half a
+* file.
+*/
+async function writeAtomic(file, contents) {
+	await mkdir(dirname(file), { recursive: true });
+	const temporary = `${file}.${process.pid}-${crypto.randomUUID()}.tmp`;
+	try {
+		await writeFile(temporary, contents);
+		await rename(temporary, file);
+	} catch (cause) {
+		await rm(temporary, { force: true });
+		throw cause;
+	}
+}
+//#endregion
+export { lastTypesModule as a, writeAtomic as c, readExtras as d, cachedTypesModule as i, TYPEGEN_VERSION as l, cachedDatabaseTypes as n, storeTypesModule as o, cachedIntrospect as r, typesModuleKey as s, CACHE_DIR as t, catalogFingerprint as u };