@everystack/api 0.4.13 → 0.4.15

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to `@everystack/api` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.15] - 2026-11-05
+
+### BREAKING CHANGES
+
+- afterRestore runs for a row deleted before batches existed
+
+## [0.4.14] - 2026-11-04
+
+### BREAKING CHANGES
+
+- softDelete is removed; lifecycle is the one soft delete
+- createHandler refuses softDelete; lifecycle tables are the lifecycle option
+
+### Removed
+
+- remove the handler's plain soft-delete paths
+
+### Added
+
+- like/ilike on uuid, enum and numeric columns compare their text form
+- match number and enum search terms exactly
+
+### Fixed
+
+- check filter values against column types
+
+### Documentation
+
+- softDelete is removed; lifecycle is the one soft delete
+
 ## [0.4.13] - 2026-10-30
 
 ### BREAKING CHANGES

package/README.md

@@ -83,10 +83,9 @@ createHandler(db, schema, {
     },
   },
 
-  softDelete: {
-    column: 'deletedAt',
-    tables: ['posts', 'comments'],
-  },
+  // lifecycle: true tables, the one soft delete. deriveHandlerConfig(models) emits this list;
+  // do not write it by hand. Restore is POST {basePath}/{table}/restore, client .restore(id).
+  lifecycle: ['posts', 'comments'],
 
   pgSettings: (user, client) => ({
     'request.jwt.claims': JSON.stringify(user || { role: 'anon' }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/api",
-  "version": "0.4.13",
+  "version": "0.4.15",
   "description": "PostgREST-compatible HTTP handler + typed fetch client for Drizzle ORM",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/client/index.ts

@@ -74,8 +74,8 @@ export interface QueryBuilder {
   order(column: string, direction?: 'asc' | 'desc'): QueryBuilder;
   limit(count: number): QueryBuilder;
   offset(count: number): QueryBuilder;
-  /** Soft-delete tables: ?deleted=include|only on select and update. `.deleted('only').update({ deletedAt: null })` restores,
-   *  for a role the handler lists in `softDelete.restore`; for anyone else update ignores it. */
+  /** Lifecycle tables: ?deleted=include|only on a read. An update with it is refused (400);
+   *  restore a deleted row with `.restore(id)`. */
   deleted(mode: DeletedMode): QueryBuilder;
   execute(): Promise<ClientResponse<unknown[]>>;
   executeWithCount(): Promise<CountResponse<unknown[]>>;

package/src/handler/index.ts

@@ -262,29 +262,6 @@ export interface RelationConfig {
   where?: Record<string, string | number | boolean | null>;
 }
 
-export interface SoftDeleteConfig {
-  /** Column name for soft-delete timestamp. Default: 'deletedAt' */
-  column?: string;
-  /** Tables with soft-delete enabled. If omitted, all tables with the column are treated as soft-delete. */
-  tables?: string[];
-  /** Who may restore through PATCH, per table: table name -> role names. Keyed like `tables`.
-   *  PATCH honours `?deleted=include|only` only when the caller's role claim (`auth.roleField`,
-   *  default `role`) is in the table's list: exact string match, no hierarchy, no case folding.
-   *  Anyone else gets live rows only, as if the param were absent. A restore body must be
-   *  exactly `{ <column>: null }`, or 400. Omitted: no one restores through the API.
-   *  This is a backstop. RLS must also keep other roles off deleted rows (docs/handler.md).
-   *  A lifecycle table may not appear here: it restores through `POST {table}/restore`. */
-  restore?: Record<string, string[]>;
-  /** `lifecycle: true` tables (deriveHandlerConfig emits them), keyed like `tables`. Each is a
-   *  soft-delete table whose column is always `deletedAt`, soft-deleted by the database itself:
-   *  DELETE runs a real SQL DELETE (a trigger stamps the row), reads and embeds hide deleted rows
-   *  for every role unless `?deleted=include|only` (honoured for any role; RLS decides what each
-   *  sees), and `POST {basePath}/{table}/restore {id}` calls `<schema>.<table>_restore(id)` as the
-   *  caller. PATCH with `?deleted=include|only` is refused with 400. `?deleted=only` reaches embeds
-   *  too, so a live parent embedded under a deleted child comes back null. */
-  lifecycle?: string[];
-}
-
 export interface HookConfig {
   /** Called before INSERT. Can modify the body (e.g., inject userId). Throw to abort. */
   beforeCreate?: (body: Record<string, unknown>, user: Record<string, unknown> | null, client: Record<string, unknown> | null) => Promise<Record<string, unknown>>;
@@ -295,15 +272,16 @@ export interface HookConfig {
   /** Called after UPDATE with all returned rows. Fire-and-forget. */
   afterUpdate?: (rows: Record<string, unknown>[], user: Record<string, unknown> | null, client: Record<string, unknown> | null) => Promise<void>;
   /** Inside the transaction, once per matched root row. Return veto(reason) to roll back the
-   * request with 409. Lifecycle rows are pre-images; plain and legacy softDelete rows come from
+   * request with 409. Lifecycle rows are pre-images; plain rows come from
    * RETURNING. Throws roll back too. Cascaded children run no hook: guard them with deleteWhen. */
   beforeDelete?: BeforeLifecycleHook;
   /** After commit, once per request with its root rows, best-effort. Empty deletes fire nothing.
    * Each lifecycle row carries its own deletedBatch; ctx.batch is null for a delete request. */
   afterDelete?: AfterLifecycleHook;
   /** Lifecycle tables only: after `POST {table}/restore` COMMITS, with `[{ <key>: id }]` (the id as
-   * the request sent it), `ctx.batch` and `ctx.counts`. Not called for a row deleted before batches
-   * existed (batch null). Best-effort: a throw goes to onError and never changes the response. */
+   * the request sent it), `ctx.batch` and `ctx.counts`. `ctx.batch` is null for a row deleted before
+   * batches existed: that row came back alone. Best-effort: a throw goes to onError and never changes
+   * the response. */
   afterRestore?: AfterLifecycleHook;
   /** Reserved for a future release: createHandler refuses it, so it is never silently ignored. */
   beforeRestore?: never;
@@ -382,8 +360,16 @@ export interface HandlerOptions {
   relations?: Record<string, Record<string, RelationConfig>>;
   /** Base path to strip from request URL (e.g., '/api' when mounted at /api/[...path]) */
   basePath?: string;
-  /** Enable soft-delete: DELETE becomes UPDATE SET deleted_at, reads filter deleted rows */
-  softDelete?: SoftDeleteConfig;
+  /** Removed: createHandler refuses it, so it is never silently ignored. Use `lifecycle`. */
+  softDelete?: never;
+  /** `lifecycle: true` tables (deriveHandlerConfig emits them). Each is a soft-delete table whose
+   *  column is always `deletedAt`, soft-deleted by the database itself: DELETE runs a real SQL
+   *  DELETE (a trigger stamps the row), reads and embeds hide deleted rows for every role unless
+   *  `?deleted=include|only` (honoured for any role; RLS decides what each sees), and
+   *  `POST {basePath}/{table}/restore {id}` calls `<schema>.<table>_restore(id)` as the caller.
+   *  PATCH with `?deleted=include|only` is refused with 400. `?deleted=only` reaches embeds too,
+   *  so a live parent embedded under a deleted child comes back null. */
+  lifecycle?: string[];
   /** Drizzle schema relations — enables JOIN queries via db.query API instead of batch WHERE IN */
   drizzleRelations?: Record<string, unknown>;
   /** Compute PostgreSQL session variables from the authenticated user.
@@ -466,26 +452,23 @@ export interface HandlerOptions {
   onError?: (fault: HandlerFault) => void | Promise<void>;
 }
 
-/** The lifecycle machinery's timestamp column: fixed, whatever softDelete.column says. */
+/** The lifecycle machinery's timestamp column: fixed. */
 const LIFECYCLE_DELETED_AT = 'deletedAt';
 /** The SQL name of the lifecycle batch column (columnPropertyName maps it to the table's key). */
 const LIFECYCLE_DELETED_BATCH = 'deleted_batch';
 
 function isLifecycleTable(tableName: string, options?: HandlerOptions): boolean {
-  return options?.softDelete?.lifecycle?.includes(tableName) ?? false;
+  return options?.lifecycle?.includes(tableName) ?? false;
 }
 
 function getSoftDeleteColumn(tableName: string, table: DrizzleTable, options?: HandlerOptions): DrizzleColumn | null {
-  if (!options?.softDelete) return null;
-  if (isLifecycleTable(tableName, options)) return getColumn(table, LIFECYCLE_DELETED_AT);
-  const colName = options.softDelete.column || 'deletedAt';
-  return getColumn(table, colName);
+  return isLifecycleTable(tableName, options) ? getColumn(table, LIFECYCLE_DELETED_AT) : null;
 }
 
 /**
- * The soft-delete condition for a GET or PATCH: ?deleted=include adds none, ?deleted=only
- * matches deleted rows, anything else (absent or unknown) matches live rows. DELETE does
- * not use it: it always matches live rows only.
+ * The lifecycle condition for a read or an embed: ?deleted=include adds none, ?deleted=only
+ * matches deleted rows, anything else (absent or unknown) matches live rows. PATCH and DELETE
+ * do not use it: they always match live rows only.
  */
 function softDeleteCondition(sdCol: DrizzleColumn, params: URLSearchParams): SQL | null {
   const mode = params.get('deleted');
@@ -493,20 +476,10 @@ function softDeleteCondition(sdCol: DrizzleColumn, params: URLSearchParams): SQL
   return mode === 'only' ? isNotNull(sdCol) : isNull(sdCol);
 }
 
-function isSoftDeleteTable(tableName: string, table: DrizzleTable, options?: HandlerOptions): boolean {
-  if (!options?.softDelete) return false;
-  if (isLifecycleTable(tableName, options)) return true;
-  if (options.softDelete.tables) {
-    return options.softDelete.tables.includes(tableName);
-  }
-  // Auto-detect: table has the soft-delete column
-  return getSoftDeleteColumn(tableName, table, options) != null;
-}
-
 /**
- * The soft-delete guard on an embedded table. Live rows only, except that a lifecycle table
- * honours the request's ?deleted=include|only like its top-level read: RLS decides what each
- * role sees. `params` is absent where no request applies (a pre-DB validation pass).
+ * The soft-delete guard on an embedded lifecycle table. It honours the request's
+ * ?deleted=include|only like its top-level read: RLS decides what each role sees. Live rows
+ * only where no request applies (`params` absent: a pre-DB validation pass).
  */
 function embedSoftDeleteCondition(
   tableName: string,
@@ -514,10 +487,9 @@ function embedSoftDeleteCondition(
   options: HandlerOptions | undefined,
   params: URLSearchParams | undefined,
 ): SQL | null {
-  if (!isSoftDeleteTable(tableName, table, options)) return null;
   const sdCol = getSoftDeleteColumn(tableName, table, options);
   if (!sdCol) return null;
-  return params && isLifecycleTable(tableName, options) ? softDeleteCondition(sdCol, params) : isNull(sdCol);
+  return params ? softDeleteCondition(sdCol, params) : isNull(sdCol);
 }
 
 /**
@@ -926,16 +898,7 @@ function expandTableKeyedOptions(
     ...(options.rowOwnership ? { rowOwnership: expandMap(options.rowOwnership) } : {}),
     ...(options.relations ? { relations: expandMap(options.relations) } : {}),
     ...(options.hooks ? { hooks: expandMap(options.hooks) } : {}),
-    ...(options.softDelete
-      ? {
-        softDelete: {
-          ...options.softDelete,
-          ...(options.softDelete.tables ? { tables: expandList(options.softDelete.tables) } : {}),
-          ...(options.softDelete.restore ? { restore: expandMap(options.softDelete.restore) } : {}),
-          ...(options.softDelete.lifecycle ? { lifecycle: expandList(options.softDelete.lifecycle) } : {}),
-        },
-      }
-      : {}),
+    ...(options.lifecycle ? { lifecycle: expandList(options.lifecycle) } : {}),
   };
 }
 
@@ -951,8 +914,7 @@ function declaredTables(options: HandlerOptions): Set<string> {
     ...Object.keys(options.hooks ?? {}),
     ...Object.keys(options.relations ?? {}),
     ...Object.values(options.relations ?? {}).flatMap(rels => Object.values(rels).map(rel => rel.table)),
-    ...(options.softDelete?.tables ?? []),
-    ...(options.softDelete?.lifecycle ?? []),
+    ...(options.lifecycle ?? []),
   ];
   return new Set(names.map(toSnakeCase));
 }
@@ -1002,7 +964,7 @@ function validateRowOwnership(schema: Schema, options: HandlerOptions | undefine
     if (!table) {
       if (declared.has(toSnakeCase(tableName))) continue;
       throw new Error(
-        `[everystack/api] rowOwnership.${tableName}: table "${tableName}" is not in the schema and is not declared anywhere else in the handler options (exposedTables, relations, hiddenColumns, protectedFields, softDelete, hooks). Fix the name or remove the entry.`,
+        `[everystack/api] rowOwnership.${tableName}: table "${tableName}" is not in the schema and is not declared anywhere else in the handler options (exposedTables, relations, hiddenColumns, protectedFields, lifecycle, hooks). Fix the name or remove the entry.`,
       );
     }
     if (getColumn(table, entry.column) === null) {
@@ -1018,53 +980,6 @@ function validateRowOwnership(schema: Schema, options: HandlerOptions | undefine
   }
 }
 
-/**
- * Refuse to start on a softDelete.restore config the handler cannot honour. Every entry
- * must name a soft-delete table. A restorable table must not list the soft-delete column
- * in protectedFields: the strip would leave every restore body empty. Takes the expanded
- * options, so both spellings of a table are checked.
- */
-function validateSoftDeleteRestore(schema: Schema, options: HandlerOptions | undefined): void {
-  const softDelete = options?.softDelete;
-  const colName = softDelete?.column || 'deletedAt';
-  for (const [tableName, roles] of Object.entries(softDelete?.restore ?? {})) {
-    const table = schema[tableName];
-    if (isLifecycleTable(tableName, options)) {
-      throw new Error(
-        `[everystack/api] softDelete.restore.${tableName}: table "${tableName}" is a lifecycle table. It restores through POST {basePath}/${tableName}/restore, on its delete rule; remove the entry.`,
-      );
-    }
-    const isSoftDelete = table
-      ? isSoftDeleteTable(tableName, table, options)
-      : (softDelete?.tables?.includes(tableName) ?? false);
-    if (!isSoftDelete) {
-      throw new Error(
-        `[everystack/api] softDelete.restore.${tableName}: table "${tableName}" is not a soft-delete table. Add it to softDelete.tables or remove the entry.`,
-      );
-    }
-    const sameColumn = (field: string): boolean => (table
-      ? getColumn(table, field) !== null && getColumn(table, field) === getColumn(table, colName)
-      : toSnakeCase(field) === toSnakeCase(colName));
-    if (roles.length > 0 && (ownEntry(options?.protectedFields, tableName) ?? []).some(sameColumn)) {
-      throw new Error(
-        `[everystack/api] softDelete.restore.${tableName}: the soft-delete column "${colName}" is in protectedFields.${tableName}, so every restore body is stripped to {}. Remove it from protectedFields.${tableName} or remove the restore entry.`,
-      );
-    }
-  }
-}
-
-/**
- * True when the caller may restore on this table: its role claim is an exact member of
- * softDelete.restore[tableName]. Fail closed: no option, no list, no user, or a missing or
- * non-string role claim is not a member.
- */
-function mayRestore(tableName: string, options: HandlerOptions | undefined, user: Record<string, unknown> | null): boolean {
-  const roles = ownEntry(options?.softDelete?.restore, tableName);
-  if (!roles?.length || !user) return false;
-  const role = readRoleClaim(user, options?.auth?.roleField ?? 'role');
-  return role !== '' && roles.includes(role);
-}
-
 /** Refuse a cleaning policy that cannot be enforced, including conflicting table aliases. */
 function validateSanitizeColumns(schema: Schema, options: HandlerOptions | undefined): void {
   const configured = new Map<DrizzleTable, Set<string>>();
@@ -1403,7 +1318,19 @@ function validateConstraintMessages(options?: HandlerOptions): void {
   }
 }
 
+/**
+ * `softDelete` was removed. Refuse the key with any value, rather than ignore it: an ignored
+ * option would hard-delete the rows the handler used to mark, and drop the restore path. This
+ * also catches an app that spreads an old deriveHandlerConfig output.
+ */
+function refuseRemovedSoftDelete(options: HandlerOptions | undefined): void {
+  if (options && 'softDelete' in options) {
+    throw new Error('[everystack/api] softDelete was removed. Pass lifecycle tables as lifecycle: [...] (deriveHandlerConfig emits it). For a soft delete on a plain table, declare lifecycle: true on its model.');
+  }
+}
+
 export function createHandler(db: DrizzleDb, rawSchema: Schema, rawOptions?: HandlerOptions): Handler {
+  refuseRemovedSoftDelete(rawOptions);
   refuseReservedHooks(rawOptions);
   // The naming seam: URLs, exposedTables, and relation targets historically mixed
   // drizzle export keys (`texturePacks`) with SQL names (`texture_packs`), and any
@@ -1415,7 +1342,6 @@ export function createHandler(db: DrizzleDb, rawSchema: Schema, rawOptions?: Han
   const configuredOptions = resolveHiddenColumns(schema, expandTableKeyedOptions(rawOptions, namePairs));
   validateConstraintMessages(configuredOptions);
   validateRowOwnership(schema, rawOptions);
-  validateSoftDeleteRestore(schema, configuredOptions);
   validateSanitizeColumns(schema, configuredOptions);
   validateRelationDisplay(schema, configuredOptions);
   validateDrizzleRelationNames(db, configuredOptions);
@@ -2108,13 +2034,11 @@ async function handleGet(
   }
   const conditions = filterResult.conditions;
 
-  // Soft-delete: filter deleted records unless ?deleted=include|only
-  if (isSoftDeleteTable(tableName, table, options)) {
-    const sdCol = getSoftDeleteColumn(tableName, table, options);
-    if (sdCol) {
-      const condition = softDeleteCondition(sdCol, params);
-      if (condition) conditions.push(condition);
-    }
+  // Lifecycle: filter deleted records unless ?deleted=include|only
+  const sdCol = getSoftDeleteColumn(tableName, table, options);
+  if (sdCol) {
+    const condition = softDeleteCondition(sdCol, params);
+    if (condition) conditions.push(condition);
   }
 
   // Aggregate query path: SELECT count(*), sum(amount), ... GROUP BY platform
@@ -2984,23 +2908,6 @@ async function handlePatch(
     throw err;
   }
 
-  // Restore: ?deleted=include|only is honoured only for a role in softDelete.restore for
-  // this table. Anyone else is matched to live rows, as if the param were absent.
-  const sdCol = isSoftDeleteTable(tableName, table, options) ? getSoftDeleteColumn(tableName, table, options) : null;
-  const restoring = sdCol !== null && mayRestore(tableName, options, user);
-  const deletedMode = params.get('deleted');
-  if (restoring && (deletedMode === 'include' || deletedMode === 'only')) {
-    // Checked after the protectedFields strip, so a body stripped to {} is refused here.
-    const key = columnPropertyName(table, options?.softDelete?.column || 'deletedAt');
-    const isRestoreBody = body !== null && typeof body === 'object' && !Array.isArray(body)
-      && Object.keys(body).length === 1 && key !== undefined && Object.hasOwn(body, key) && body[key] === null;
-    if (!isRestoreBody) {
-      const column = options?.softDelete?.column || 'deletedAt';
-      const wire = options?.naming === 'snake_case' ? toSnakeCase(column) : column;
-      return json({ message: `restore accepts only { ${wire}: null }` }, 400);
-    }
-  }
-
   // With the ownership backstop lifted, an unfiltered PATCH would write every row the
   // role's RLS allows. Refuse it, the same filter test DELETE applies to every caller.
   const ownership = ownEntry(options?.rowOwnership, tableName);
@@ -3050,11 +2957,9 @@ async function handlePatch(
 
   const conditions = filterResult.conditions;
 
-  // Soft-delete: update live records, unless a restore role sent ?deleted=include|only
-  if (sdCol) {
-    const condition = restoring ? softDeleteCondition(sdCol, params) : isNull(sdCol);
-    if (condition) conditions.push(condition);
-  }
+  // Lifecycle: update live records only (?deleted= was refused above)
+  const sdCol = getSoftDeleteColumn(tableName, table, options);
+  if (sdCol) conditions.push(isNull(sdCol));
 
   // Row ownership: AND WHERE <column> = user[<userField>] for IDOR protection
   if (scope.condition) conditions.push(scope.condition);
@@ -3232,12 +3137,7 @@ async function handleDelete(
     const batchKey = columnPropertyName(table, LIFECYCLE_DELETED_BATCH);
     if (batchKey) for (const [row, batch] of deleted.batchOf) row[batchKey] = batch;
   } else {
-    const sdCol = isSoftDeleteTable(tableName, table, options) && getSoftDeleteColumn(tableName, table, options);
-    if (sdCol) conditions.push(isNull(sdCol));
-    const query: any = sdCol
-      ? db.update(table).set({ [options?.softDelete?.column || 'deletedAt']: new Date() })
-      : db.delete(table);
-    rows = await query.where(conditions.length === 1 ? conditions[0] : and(...conditions)).returning();
+    rows = await db.delete(table).where(conditions.length === 1 ? conditions[0] : and(...conditions)).returning();
     // RETURNING proves the caller's write authority. A veto or throw leaves the caller's
     // transaction, so the statement rolls back before the response is made.
     if (hook?.beforeDelete) for (const row of rows) {
@@ -3276,7 +3176,7 @@ async function lifecycleDelete(
   const pk = primaryKeyColumns(table);
   const key = pk.length === 1 ? columnPropertyName(table, pk[0].name) : undefined;
   if (!sdCol || key === undefined) {
-    throw new Error(`[everystack/api] softDelete.lifecycle.${tableName}: the table needs a ${LIFECYCLE_DELETED_AT} column and a single-column primary key`);
+    throw new Error(`[everystack/api] lifecycle.${tableName}: the table needs a ${LIFECYCLE_DELETED_AT} column and a single-column primary key`);
   }
   const keyColumn = getTableColumns(table)[key];
   const batchOf = new Map<Record<string, unknown>, string>();
@@ -3348,7 +3248,7 @@ async function handleRestore(
   const keyType = key ? restoreArgType(key) : null;
   const name = sqlNameOf(table);
   if (!keyType || name === null || primaryKeyColumns(table).length !== 1) {
-    const message = `[everystack/api] softDelete.lifecycle.${tableName}: restore needs a table with a single-column primary key of a plain type`;
+    const message = `[everystack/api] lifecycle.${tableName}: restore needs a table with a single-column primary key of a plain type`;
     await emitFault(options?.onError, { requestId, kind: 'rest', name: tableName, method: 'POST', status: 500, message });
     return json({ message: options?.hideSchemaErrors ? 'Internal Server Error' : message }, 500);
   }
@@ -3361,10 +3261,10 @@ async function handleRestore(
     // After the commit (executeWithSettings has returned). Best-effort: never changes the response.
     const hook = ownEntry(options?.hooks, tableName);
     const r = result as { restored?: unknown; skipped?: unknown; batch?: unknown } | null;
-    if (hook?.afterRestore && r && typeof r.batch === 'string') {
+    if (hook?.afterRestore && r) {
       try {
         await hook.afterRestore([{ [columnPropertyName(table, key.name) ?? key.name]: id }], {
-          phase: 'restore', batch: r.batch, user, client,
+          phase: 'restore', batch: typeof r.batch === 'string' ? r.batch : null, user, client,
           counts: { restored: Number(r.restored), skipped: Number(r.skipped) },
         });
       } catch (err) {
@@ -3580,6 +3480,13 @@ function buildJsonCondition(table: DrizzleTable, filter: Filter): any {
 const ARRAY_OPERATORS = new Set(['cs', 'cd', 'ov']);
 const VALID_OPERATORS = new Set(['eq', 'neq', 'gt', 'gte', 'lt', 'lte', 'like', 'ilike', 'is', 'in', ...ARRAY_OPERATORS]);
 const TEXT_ARRAY_ELEMENT_TYPES = new Set(['PgText', 'PgVarchar']);
+// These PostgreSQL types need text for pattern matching. Keep text/custom types
+// uncast so their operators (notably citext LIKE) and indexes keep their meaning.
+const LIKE_TEXT_CAST_TYPES = new Set([
+  'PgUUID', 'PgEnumColumn', 'PgSmallInt', 'PgInteger', 'PgBigInt53', 'PgBigInt64',
+  'PgSmallSerial', 'PgSerial', 'PgBigSerial53', 'PgBigSerial64',
+  'PgNumeric', 'PgNumericNumber', 'PgNumericBigInt', 'PgReal', 'PgDoublePrecision',
+]);
 
 function arrayOperatorRefusal(operator: string, column: string): { __filterError: string } {
   return { __filterError: `Unknown filter operator: '${operator}' for column '${column}' (cs, cd and ov need a text[] or varchar[] column)` };
@@ -3634,7 +3541,47 @@ function dateFilterOperand(filter: Filter): Date | Date[] | { __filterError: str
   return filter.operator === 'in' ? dates : dates[0];
 }
 
-function buildCondition(table: DrizzleTable, filter: Filter): any {
+const INTEGER_FILTER_BOUNDS: Readonly<Record<string, readonly [bigint, bigint]>> = {
+  PgSmallInt: [-32768n, 32767n], PgSmallSerial: [-32768n, 32767n],
+  PgInteger: [-2147483648n, 2147483647n], PgSerial: [-2147483648n, 2147483647n],
+  PgBigInt53: [-9223372036854775808n, 9223372036854775807n],
+  PgBigInt64: [-9223372036854775808n, 9223372036854775807n],
+  PgBigSerial53: [-9223372036854775808n, 9223372036854775807n],
+  PgBigSerial64: [-9223372036854775808n, 9223372036854775807n],
+};
+const NUMERIC_FILTER_TYPES = new Set(['PgNumeric', 'PgNumericNumber', 'PgNumericBigInt', 'PgReal', 'PgDoublePrecision']);
+
+// PostgreSQL accepts unambiguous prefixes, but "o" could mean on or off.
+function booleanFilterValue(value: string): boolean | undefined {
+  const literal = value.trim().toLowerCase();
+  if (!literal || literal === 'o') return undefined;
+  if (literal === '1' || ['true', 'yes', 'on'].some(word => word.startsWith(literal))) return true;
+  if (literal === '0' || ['false', 'no', 'off'].some(word => word.startsWith(literal))) return false;
+  return undefined;
+}
+
+function filterValueFitsColumn(column: DrizzleColumn, value: string): boolean {
+  const bounds = INTEGER_FILTER_BOUNDS[column.columnType];
+  if (bounds) {
+    const literal = value.trim();
+    // PG16 also permits one separator after a base prefix (0x_10).
+    if (!/^[+-]?(?:[0-9](?:_?[0-9])*|0x_?[0-9a-f](?:_?[0-9a-f])*|0o_?[0-7](?:_?[0-7])*|0b_?[01](?:_?[01])*)$/i.test(literal)) return false;
+    // BigInt does not accept a sign before a base prefix; apply it separately.
+    const magnitude = BigInt(literal.replace(/^[+-]/, '').replace(/_/g, ''));
+    const integer = literal.startsWith('-') ? -magnitude : magnitude;
+    return integer >= bounds[0] && integer <= bounds[1];
+  }
+  if (NUMERIC_FILTER_TYPES.has(column.columnType)) {
+    // Deliberately permissive: PostgreSQL remains the authority for numeric edges.
+    const literal = value.trim();
+    return literal !== '' && (!Number.isNaN(Number(literal.replace(/_/g, ''))) || /^[+-]?(?:inf(?:inity)?|nan)$/i.test(literal));
+  }
+  if (column.columnType === 'PgBoolean') return booleanFilterValue(value) !== undefined;
+  if (column.columnType === 'PgEnumColumn') return column.enumValues?.includes(value) === true;
+  return true;
+}
+
+function buildCondition(table: DrizzleTable, filter: Filter, positiveOr = false): any {
   if (filter.jsonPath) {
     return buildJsonCondition(table, filter);
   }
@@ -3647,8 +3594,22 @@ function buildCondition(table: DrizzleTable, filter: Filter): any {
   }
   if (ARRAY_OPERATORS.has(filter.operator)) return buildArrayCondition(column, filter);
 
+  const typedComparison = DATE_FILTER_OPERATORS.has(filter.operator);
+  const members = filter.operator === 'in' ? parseInList(filter.value) : [filter.value];
+  if (typedComparison && members.some(member => !filterValueFitsColumn(column, member))) {
+    // Only a positive OR equality is impossible. Rewriting a range, inequality,
+    // negation or AND member would change the request's meaning.
+    if (positiveOr && filter.operator === 'eq' && !filter.negated) return sql`FALSE`;
+    return { __filterError: `Invalid value for column '${filter.column}'` };
+  }
+
   let value: unknown = filter.value;
   let values: unknown[] | null = null;
+  if (typedComparison && column.columnType === 'PgBoolean') {
+    // Bind booleans, not strings: the driver need not understand PG's literals.
+    if (filter.operator === 'in') values = members.map(booleanFilterValue);
+    else value = booleanFilterValue(filter.value);
+  }
   if (column.dataType === 'date' && filter.operator !== 'is') {
     const dated = dateFilterOperand(filter);
     if (isFilterError(dated)) return dated;
@@ -3679,10 +3640,14 @@ function buildCondition(table: DrizzleTable, filter: Filter): any {
       break;
     case 'like':
       // PostgREST uses * for wildcard, SQL uses %
-      condition = like(column, filter.value.replace(/\*/g, '%'));
+      condition = LIKE_TEXT_CAST_TYPES.has(column.columnType)
+        ? sql`${column}::text LIKE ${filter.value.replace(/\*/g, '%')}`
+        : like(column, filter.value.replace(/\*/g, '%'));
       break;
     case 'ilike':
-      condition = ilike(column, filter.value.replace(/\*/g, '%'));
+      condition = LIKE_TEXT_CAST_TYPES.has(column.columnType)
+        ? sql`${column}::text ILIKE ${filter.value.replace(/\*/g, '%')}`
+        : ilike(column, filter.value.replace(/\*/g, '%'));
       break;
     case 'is':
       if (filter.value === 'null') condition = isNull(column);
@@ -3909,7 +3874,7 @@ function buildAllConditions(table: DrizzleTable, params: URLSearchParams): { con
     for (const value of params.getAll(key)) {
       const group = parseLogicalGroup(value);
       if (group.error) return { error: group.error };
-      const groupRawResults = group.filters.map(f => buildCondition(table, f));
+      const groupRawResults = group.filters.map(f => buildCondition(table, f, key === 'or'));
       for (const r of groupRawResults) {
         if (isFilterError(r)) return { error: r.__filterError };
       }