@lunora/do 1.0.0-alpha.4 → 1.0.0-alpha.5

package/dist/index.d.mts

@@ -195,10 +195,17 @@ interface RelationDefinitionLike {
   readonly references: string;
   readonly table: string;
 }
-/** Per-relation refinements: filter / order / cap / recurse into the children. */
+/** Per-relation refinements: filter / order / cap / project / recurse into the children. */
 interface NestedWith {
   limit?: number;
   orderBy?: OrderByInput[];
+  /**
+  * Project each loaded child down to these fields (like the top-level
+  * `findMany` `select`). Applied AFTER grouping, so the join key stays
+  * available to map children to parents; `_id`/`_creationTime` and any deeper
+  * `with` relations are always retained.
+  */
+  select?: ReadonlyArray<string>;
   where?: WhereInput;
   with?: WithInput;
 }
@@ -304,6 +311,12 @@ interface QueryArgs {
   */
   baseWhere?: WhereInput;
   cursor?: null | string;
+  /**
+  * Opt a list read OUT of soft-delete scoping: when `true`, rows whose
+  * soft-delete column is set are INCLUDED. Has no effect on a table without
+  * `.softDelete()`. Default (absent/false) hides soft-deleted rows.
+  */
+  includeDeleted?: boolean;
   limit?: number;
   orderBy?: OrderByInput[];
   /**
@@ -324,6 +337,15 @@ interface QueryArgs {
   * reads (`findMany`/`findFirst`) — this flag specifically guards `count`.
   */
   restrictsCounts?: boolean;
+  /**
+  * Project each returned row down to these fields. The system fields `_id` and
+  * `_creationTime` are always retained (cursors + by-id reuse depend on them),
+  * and any relations attached via `with` (their relation keys and `_count`)
+  * survive the trim. Applied AFTER the rows are read and relations resolved, so
+  * read-dependency tracking and cursor encoding see the full row — only the
+  * payload returned to the caller is narrowed. Omit for the full document.
+  */
+  select?: ReadonlyArray<string>;
   where?: WhereInput;
   with?: WithInput;
 }
@@ -376,6 +398,26 @@ declare const buildSeekWhere: (keys: OrderKey[], cursorValues: unknown[]) => Whe
 * the page it terminates. Reactive pagination uses this for a page's fixed end
 * cursor; the shared compiler renders it per dialect.
 */
+
+/**
+* Project `page` rows down to `select` — plus the always-kept system fields and
+* the relation/`_count` keys attached by a `with` load (passed as `withInput`,
+* the same object handed to `findMany`). Returns the page unchanged when
+* `select` is undefined. Pure; callers apply it AFTER relation resolution +
+* cursor encoding so only the returned payload is trimmed (dependency tracking +
+* the cursor still see the full row).
+*/
+declare const applySelect: (page: Record<string, unknown>[], select: ReadonlyArray<string> | undefined, withInput?: Record<string, unknown>) => Record<string, unknown>[];
+/**
+* The read-scope predicate that hides soft-deleted rows — `{ [field]: { isNull:
+* true } }` matching the live rows whose soft-delete column is null/absent — or
+* `undefined` when the table isn't `.softDelete()` or the read opted in via
+* `includeDeleted`. AND-merge it into a list read's `where` (the by-id path
+* never calls this, so `get`/`patch`/`replace`/`restore` still address the row).
+*/
+declare const softDeleteScope: (softDeleteMode: {
+  field: string;
+} | undefined, includeDeleted: boolean | undefined) => undefined | WhereInput;
 type RankDirection = "asc" | "desc";
 interface RankSortKeyLike {
   readonly direction: RankDirection;
@@ -1233,6 +1275,16 @@ interface TableDefinitionLike {
     field?: string;
     kind: "global" | "root" | "shardBy";
   };
+  /**
+  * Mirror of `@lunora/server`'s `TableDefinition.softDeleteMode` (set by
+  * `.softDelete()`). When present, `delete()` flips the `field` column to a
+  * timestamp instead of physically removing the row (cascading as a soft
+  * delete), and list reads scope out rows whose `field` is set unless
+  * `includeDeleted` is passed. By-id reads/writes are unaffected.
+  */
+  readonly softDeleteMode?: {
+    field: string;
+  };
   readonly triggerMap?: Record<string, TriggerDefinitionLike>;
 }
 interface IndexDefinitionLike {
@@ -1525,7 +1577,16 @@ interface DatabaseWriterLike {
   * RLS-aware ctx seam from §3.2).
   */
   count: (tableName: string, where?: RestrictableQueryOptions | WhereInput) => Promise<number>;
-  delete: (id: string, expectedTable?: string) => Promise<void>;
+  /**
+  * Delete a row by id. On a `.softDelete()` table this flips the marker column
+  * (cascading as a soft delete) instead of removing the row; pass
+  * `options.hard` to force a physical removal (which cascades as a physical
+  * delete, reaching already-soft-deleted children too). Non-soft tables ignore
+  * `options.hard` — they always delete physically.
+  */
+  delete: (id: string, expectedTable?: string, options?: {
+    hard?: boolean;
+  }) => Promise<void>;
   /**
   * Delete many rows by id in one call (a loop over `delete()`). The returned
   * `deleted` is the number of ids **requested**, not rows actually removed (an
@@ -1702,6 +1763,14 @@ interface DatabaseWriterLike {
   rankPageRows?: (tableName: string, indexName: string, options?: RankPageOptions) => Promise<ShardRankPageResult>;
   replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
   /**
+  * Un-soft-delete a row: clears the `.softDelete()` marker column (a by-id
+  * UPDATE, so it works on a row that list reads currently hide). Throws when
+  * the row's table isn't `.softDelete()`. Optional on the interface — the DO
+  * writer implements it; the `.global()` twin does too, so a restore on a
+  * global table routes through the DO writer's global fallback.
+  */
+  restore?: (id: string, expectedTable?: string) => Promise<void>;
+  /**
   * Best-effort, read-only reader over Lunora's system tables
   * (`_scheduled_functions`, `_storage`). Eventually consistent and **not**
   * part of the shard's transaction snapshot — see {@link SystemDatabaseReader}.
@@ -5586,4 +5655,4 @@ interface WhereSqlStrategy {
 * `undefined` when the input imposes no constraint (empty `where`).
 */
 declare const compileWhereSql: (where: WhereInput | undefined, strategy: WhereSqlStrategy) => SQL | undefined;
-export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, AGGREGATE_SQL_FUNCTION, AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, type AdvisoriesResult, type AdvisoryFinding, type AggregateIndexDefinitionLike, type AggregateOp, type AggregateOptions, type AggregateResult, type AggregateTally, type ApplyOnDeleteOptions, type AuditEntry, type AuditLogResult, type AuthMetrics, type AuthMetricsBucket, type BroadcastDelta, CDC_LOG_TABLE, type CacheEntry, type CapturedMailRow, type CdcChange, type Clock, type ColumnMeta, type ColumnMetaLike, ConflictError, type CountArgs, CountRlsUnsupportedError, type CtxDbOptions, DATA_MIGRATION_STATE_TABLE, DEFAULT_MAX_RELATION_KEYS, type DataMigrationDocument, type DataMigrationLike, type DataMigrationTransform, type DatabaseWriterLike, type DependencyTracker, type DeployInfo, type ExportRow, type ExportShardAdminArgs, type ExportShardArgs, FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, type FacetColumnOptions, type FacetColumnResult, type FacetValue, type FieldOperators, type FunctionCallStat, type FunctionMetricBucket, type FunctionMetricIndexHit, type FunctionStatsResult, type GroupByEntry, type GroupByOptions, type HibernatableWebSocket, type IdGenerator, type ImportError, type ImportShardAdminArgs, type ImportShardArgs, type ImportShardResult, type IndexDefinitionLike, type IndexRangeBuilderLike, LogBuffer, type LogEntry, type LogEventInput, type LogLevel, type LogSink, MAIL_RETENTION, MAIL_TABLE, MAX_SQL_ROWS, MIN_ADMIN_TOKEN_LENGTH, MIN_AUTH_SECRET_LENGTH, type MaskColumnMetadata, type MaskPoliciesResult, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, type MutationDelta, type NestedWith, NotFoundError, NotUniqueError, type OnDeleteActionLike, type OrderByInput, type OrderKey, type PaginationOptions, type PitrBookmarkResult, type PitrRestoreArgs, type PitrRestoreResult, type PitrStorage, type QueryArgs, type QueryPage, RANK_TIEBREAK, RELATION_FUNCTION_PREFIX, RLS_UNWRAP_SYMBOL, ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, type RankDirection, type RankIndexDefinitionLike, type RankOptions, type RankPage, type RankPageOptions, type RankPageRow, type RankPageRowKey, type RankResult, type RankSortKeyLike, ReactiveCache, type ReactiveCacheOptions, type ReadHook, type ReadTablePageOptions, type RecordAuthEventInput, type RecordFunctionMetricInput, type RecordMailInput, type RelationDefinitionLike, type RenderedSql, type ResolveRelationPredicatesOptions, type ResolveWithOptions, type RestrictableQueryOptions, type RlsPoliciesResult, type RlsPolicyMetadata, RlsRequiredError, type RlsRoleMetadata, type RpcRequest, type RunDataMigrationOptions, type RunShardApplyCdcArgs, type RunShardApplyCdcResult, type RunShardBulkDeleteArgs, type RunShardBulkDeleteResult, type RunShardExportArgs, type RunShardImportArgs, type RunShardMigrationArgs, type RunShardRankBeforeArgs, type RunShardRankPageArgs, type RunShardWriteArgs, type RunShardWriteResult, type RunTriggersOptions, SCAN_DEP, SESSION_DO_TTL_DEFAULT, SHARD_REGISTRY_DO_NAME, type ScheduledFunctionDoc, type SchedulerLike, type SchemaLike, type SearchFilterBuilderLike, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SelectMatchingIdsOptions, type ServerDefaultContextLike, SessionDO, type SessionRecord, type SettingEntry, type SettingKind, type SettingsResult, ShardDO, type ShardDOOptions, type ShardDOState, type ShardRankPageResult, ShardRegistryDO, type SocketAttachment, type SortDirection, type SqlConsoleResult, type SqlCursor, type SqlEngine, type SqlExec, type StorageRuleMetadata, type StorageRulesResult, type StudioFeaturesResult, type SubscriptionEnvelope, type SubscriptionOutcome, type SubscriptionQuery, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemReaderOptions, type SystemReaderSchedulerLike, type SystemReaderStorageLike, type SystemTableName, type TableColumnsResult, type TableDefinitionLike, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type TableReaderLike, type TablesColumnsResult, type TransactionSqlLike, type TriggerContextLike, type TriggerDefinitionLike, type TriggerEventLike, type TriggerOpLike, type TriggerTimingLike, type ValidatorLike, type WhereInput, type WhereSqlStrategy, type WithInput, type WorkflowMetadata, type WorkflowsResult, type WriteEvent, type WriteHook, aggregateSqlFunction, aggregateTableName, applyCdcChanges, applyOnDelete, armRestore, assertFlatPredicate, assertReadonly, assertValidClientId, backfillAggregateIndexes, backfillRankIndexes, buildFtsMatch, buildSecurityAudit, buildSeekWhere, clearCapturedMail, coerceAggregateNumber, compileWhereSql, containsRelationPredicate, createDependencyTracker, createShardCtxDb, createSystemReader, decodeCursor, depKey, encodeAggregateKey, encodeCursor, encodePartitionKey, ensureAuthMetricsTables, ensureFunctionMetricsTables, ensureMailTable, exportShardRows, exportShardTable, facetColumn, foldAggregateTally, ftsTableName, guardWriter, hasTrigger, importShardRows, isRelationPredicate, listTables, matchesRankStaticWhere, matchesStaticWhere, mergeWhere, normalizeCountArgument, normalizeIdStructurally, normalizeOrderKeys, parseExportShardArgs, parseImportShardArgs, planAggregateLookup, rankTableName, reactiveCacheKey, readAggregateValue, readAuthMetrics, readBookmark, readCapturedMail, readCdcChanges, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, readMigrationStatus, readTablePage, recordAuthEvent, recordCapturedMail, recordFunctionMetric, renderSql, resolveRankPartition, resolveRelationPredicates, resolveWith, runDataMigration, runReadonlySql, runRowValidators, runShardMigrations, runTriggers, scoreDocument, selectExportTables, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy, selectMatchingIds, serveRelationFanout, sortColumnName, stableStringify, stringifySearchText, subscriptionListDeltas, throwingScheduler, tokenizeSearch, trimCdcChanges, validateImportRow };
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, AGGREGATE_SQL_FUNCTION, AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, type AdvisoriesResult, type AdvisoryFinding, type AggregateIndexDefinitionLike, type AggregateOp, type AggregateOptions, type AggregateResult, type AggregateTally, type ApplyOnDeleteOptions, type AuditEntry, type AuditLogResult, type AuthMetrics, type AuthMetricsBucket, type BroadcastDelta, CDC_LOG_TABLE, type CacheEntry, type CapturedMailRow, type CdcChange, type Clock, type ColumnMeta, type ColumnMetaLike, ConflictError, type CountArgs, CountRlsUnsupportedError, type CtxDbOptions, DATA_MIGRATION_STATE_TABLE, DEFAULT_MAX_RELATION_KEYS, type DataMigrationDocument, type DataMigrationLike, type DataMigrationTransform, type DatabaseWriterLike, type DependencyTracker, type DeployInfo, type ExportRow, type ExportShardAdminArgs, type ExportShardArgs, FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, type FacetColumnOptions, type FacetColumnResult, type FacetValue, type FieldOperators, type FunctionCallStat, type FunctionMetricBucket, type FunctionMetricIndexHit, type FunctionStatsResult, type GroupByEntry, type GroupByOptions, type HibernatableWebSocket, type IdGenerator, type ImportError, type ImportShardAdminArgs, type ImportShardArgs, type ImportShardResult, type IndexDefinitionLike, type IndexRangeBuilderLike, LogBuffer, type LogEntry, type LogEventInput, type LogLevel, type LogSink, MAIL_RETENTION, MAIL_TABLE, MAX_SQL_ROWS, MIN_ADMIN_TOKEN_LENGTH, MIN_AUTH_SECRET_LENGTH, type MaskColumnMetadata, type MaskPoliciesResult, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, type MutationDelta, type NestedWith, NotFoundError, NotUniqueError, type OnDeleteActionLike, type OrderByInput, type OrderKey, type PaginationOptions, type PitrBookmarkResult, type PitrRestoreArgs, type PitrRestoreResult, type PitrStorage, type QueryArgs, type QueryPage, RANK_TIEBREAK, RELATION_FUNCTION_PREFIX, RLS_UNWRAP_SYMBOL, ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, type RankDirection, type RankIndexDefinitionLike, type RankOptions, type RankPage, type RankPageOptions, type RankPageRow, type RankPageRowKey, type RankResult, type RankSortKeyLike, ReactiveCache, type ReactiveCacheOptions, type ReadHook, type ReadTablePageOptions, type RecordAuthEventInput, type RecordFunctionMetricInput, type RecordMailInput, type RelationDefinitionLike, type RenderedSql, type ResolveRelationPredicatesOptions, type ResolveWithOptions, type RestrictableQueryOptions, type RlsPoliciesResult, type RlsPolicyMetadata, RlsRequiredError, type RlsRoleMetadata, type RpcRequest, type RunDataMigrationOptions, type RunShardApplyCdcArgs, type RunShardApplyCdcResult, type RunShardBulkDeleteArgs, type RunShardBulkDeleteResult, type RunShardExportArgs, type RunShardImportArgs, type RunShardMigrationArgs, type RunShardRankBeforeArgs, type RunShardRankPageArgs, type RunShardWriteArgs, type RunShardWriteResult, type RunTriggersOptions, SCAN_DEP, SESSION_DO_TTL_DEFAULT, SHARD_REGISTRY_DO_NAME, type ScheduledFunctionDoc, type SchedulerLike, type SchemaLike, type SearchFilterBuilderLike, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SelectMatchingIdsOptions, type ServerDefaultContextLike, SessionDO, type SessionRecord, type SettingEntry, type SettingKind, type SettingsResult, ShardDO, type ShardDOOptions, type ShardDOState, type ShardRankPageResult, ShardRegistryDO, type SocketAttachment, type SortDirection, type SqlConsoleResult, type SqlCursor, type SqlEngine, type SqlExec, type StorageRuleMetadata, type StorageRulesResult, type StudioFeaturesResult, type SubscriptionEnvelope, type SubscriptionOutcome, type SubscriptionQuery, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemReaderOptions, type SystemReaderSchedulerLike, type SystemReaderStorageLike, type SystemTableName, type TableColumnsResult, type TableDefinitionLike, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type TableReaderLike, type TablesColumnsResult, type TransactionSqlLike, type TriggerContextLike, type TriggerDefinitionLike, type TriggerEventLike, type TriggerOpLike, type TriggerTimingLike, type ValidatorLike, type WhereInput, type WhereSqlStrategy, type WithInput, type WorkflowMetadata, type WorkflowsResult, type WriteEvent, type WriteHook, aggregateSqlFunction, aggregateTableName, applyCdcChanges, applyOnDelete, applySelect, armRestore, assertFlatPredicate, assertReadonly, assertValidClientId, backfillAggregateIndexes, backfillRankIndexes, buildFtsMatch, buildSecurityAudit, buildSeekWhere, clearCapturedMail, coerceAggregateNumber, compileWhereSql, containsRelationPredicate, createDependencyTracker, createShardCtxDb, createSystemReader, decodeCursor, depKey, encodeAggregateKey, encodeCursor, encodePartitionKey, ensureAuthMetricsTables, ensureFunctionMetricsTables, ensureMailTable, exportShardRows, exportShardTable, facetColumn, foldAggregateTally, ftsTableName, guardWriter, hasTrigger, importShardRows, isRelationPredicate, listTables, matchesRankStaticWhere, matchesStaticWhere, mergeWhere, normalizeCountArgument, normalizeIdStructurally, normalizeOrderKeys, parseExportShardArgs, parseImportShardArgs, planAggregateLookup, rankTableName, reactiveCacheKey, readAggregateValue, readAuthMetrics, readBookmark, readCapturedMail, readCdcChanges, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, readMigrationStatus, readTablePage, recordAuthEvent, recordCapturedMail, recordFunctionMetric, renderSql, resolveRankPartition, resolveRelationPredicates, resolveWith, runDataMigration, runReadonlySql, runRowValidators, runShardMigrations, runTriggers, scoreDocument, selectExportTables, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy, selectMatchingIds, serveRelationFanout, softDeleteScope, sortColumnName, stableStringify, stringifySearchText, subscriptionListDeltas, throwingScheduler, tokenizeSearch, trimCdcChanges, validateImportRow };

package/dist/index.d.ts

@@ -195,10 +195,17 @@ interface RelationDefinitionLike {
   readonly references: string;
   readonly table: string;
 }
-/** Per-relation refinements: filter / order / cap / recurse into the children. */
+/** Per-relation refinements: filter / order / cap / project / recurse into the children. */
 interface NestedWith {
   limit?: number;
   orderBy?: OrderByInput[];
+  /**
+  * Project each loaded child down to these fields (like the top-level
+  * `findMany` `select`). Applied AFTER grouping, so the join key stays
+  * available to map children to parents; `_id`/`_creationTime` and any deeper
+  * `with` relations are always retained.
+  */
+  select?: ReadonlyArray<string>;
   where?: WhereInput;
   with?: WithInput;
 }
@@ -304,6 +311,12 @@ interface QueryArgs {
   */
   baseWhere?: WhereInput;
   cursor?: null | string;
+  /**
+  * Opt a list read OUT of soft-delete scoping: when `true`, rows whose
+  * soft-delete column is set are INCLUDED. Has no effect on a table without
+  * `.softDelete()`. Default (absent/false) hides soft-deleted rows.
+  */
+  includeDeleted?: boolean;
   limit?: number;
   orderBy?: OrderByInput[];
   /**
@@ -324,6 +337,15 @@ interface QueryArgs {
   * reads (`findMany`/`findFirst`) — this flag specifically guards `count`.
   */
   restrictsCounts?: boolean;
+  /**
+  * Project each returned row down to these fields. The system fields `_id` and
+  * `_creationTime` are always retained (cursors + by-id reuse depend on them),
+  * and any relations attached via `with` (their relation keys and `_count`)
+  * survive the trim. Applied AFTER the rows are read and relations resolved, so
+  * read-dependency tracking and cursor encoding see the full row — only the
+  * payload returned to the caller is narrowed. Omit for the full document.
+  */
+  select?: ReadonlyArray<string>;
   where?: WhereInput;
   with?: WithInput;
 }
@@ -376,6 +398,26 @@ declare const buildSeekWhere: (keys: OrderKey[], cursorValues: unknown[]) => Whe
 * the page it terminates. Reactive pagination uses this for a page's fixed end
 * cursor; the shared compiler renders it per dialect.
 */
+
+/**
+* Project `page` rows down to `select` — plus the always-kept system fields and
+* the relation/`_count` keys attached by a `with` load (passed as `withInput`,
+* the same object handed to `findMany`). Returns the page unchanged when
+* `select` is undefined. Pure; callers apply it AFTER relation resolution +
+* cursor encoding so only the returned payload is trimmed (dependency tracking +
+* the cursor still see the full row).
+*/
+declare const applySelect: (page: Record<string, unknown>[], select: ReadonlyArray<string> | undefined, withInput?: Record<string, unknown>) => Record<string, unknown>[];
+/**
+* The read-scope predicate that hides soft-deleted rows — `{ [field]: { isNull:
+* true } }` matching the live rows whose soft-delete column is null/absent — or
+* `undefined` when the table isn't `.softDelete()` or the read opted in via
+* `includeDeleted`. AND-merge it into a list read's `where` (the by-id path
+* never calls this, so `get`/`patch`/`replace`/`restore` still address the row).
+*/
+declare const softDeleteScope: (softDeleteMode: {
+  field: string;
+} | undefined, includeDeleted: boolean | undefined) => undefined | WhereInput;
 type RankDirection = "asc" | "desc";
 interface RankSortKeyLike {
   readonly direction: RankDirection;
@@ -1233,6 +1275,16 @@ interface TableDefinitionLike {
     field?: string;
     kind: "global" | "root" | "shardBy";
   };
+  /**
+  * Mirror of `@lunora/server`'s `TableDefinition.softDeleteMode` (set by
+  * `.softDelete()`). When present, `delete()` flips the `field` column to a
+  * timestamp instead of physically removing the row (cascading as a soft
+  * delete), and list reads scope out rows whose `field` is set unless
+  * `includeDeleted` is passed. By-id reads/writes are unaffected.
+  */
+  readonly softDeleteMode?: {
+    field: string;
+  };
   readonly triggerMap?: Record<string, TriggerDefinitionLike>;
 }
 interface IndexDefinitionLike {
@@ -1525,7 +1577,16 @@ interface DatabaseWriterLike {
   * RLS-aware ctx seam from §3.2).
   */
   count: (tableName: string, where?: RestrictableQueryOptions | WhereInput) => Promise<number>;
-  delete: (id: string, expectedTable?: string) => Promise<void>;
+  /**
+  * Delete a row by id. On a `.softDelete()` table this flips the marker column
+  * (cascading as a soft delete) instead of removing the row; pass
+  * `options.hard` to force a physical removal (which cascades as a physical
+  * delete, reaching already-soft-deleted children too). Non-soft tables ignore
+  * `options.hard` — they always delete physically.
+  */
+  delete: (id: string, expectedTable?: string, options?: {
+    hard?: boolean;
+  }) => Promise<void>;
   /**
   * Delete many rows by id in one call (a loop over `delete()`). The returned
   * `deleted` is the number of ids **requested**, not rows actually removed (an
@@ -1702,6 +1763,14 @@ interface DatabaseWriterLike {
   rankPageRows?: (tableName: string, indexName: string, options?: RankPageOptions) => Promise<ShardRankPageResult>;
   replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
   /**
+  * Un-soft-delete a row: clears the `.softDelete()` marker column (a by-id
+  * UPDATE, so it works on a row that list reads currently hide). Throws when
+  * the row's table isn't `.softDelete()`. Optional on the interface — the DO
+  * writer implements it; the `.global()` twin does too, so a restore on a
+  * global table routes through the DO writer's global fallback.
+  */
+  restore?: (id: string, expectedTable?: string) => Promise<void>;
+  /**
   * Best-effort, read-only reader over Lunora's system tables
   * (`_scheduled_functions`, `_storage`). Eventually consistent and **not**
   * part of the shard's transaction snapshot — see {@link SystemDatabaseReader}.
@@ -5586,4 +5655,4 @@ interface WhereSqlStrategy {
 * `undefined` when the input imposes no constraint (empty `where`).
 */
 declare const compileWhereSql: (where: WhereInput | undefined, strategy: WhereSqlStrategy) => SQL | undefined;
-export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, AGGREGATE_SQL_FUNCTION, AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, type AdvisoriesResult, type AdvisoryFinding, type AggregateIndexDefinitionLike, type AggregateOp, type AggregateOptions, type AggregateResult, type AggregateTally, type ApplyOnDeleteOptions, type AuditEntry, type AuditLogResult, type AuthMetrics, type AuthMetricsBucket, type BroadcastDelta, CDC_LOG_TABLE, type CacheEntry, type CapturedMailRow, type CdcChange, type Clock, type ColumnMeta, type ColumnMetaLike, ConflictError, type CountArgs, CountRlsUnsupportedError, type CtxDbOptions, DATA_MIGRATION_STATE_TABLE, DEFAULT_MAX_RELATION_KEYS, type DataMigrationDocument, type DataMigrationLike, type DataMigrationTransform, type DatabaseWriterLike, type DependencyTracker, type DeployInfo, type ExportRow, type ExportShardAdminArgs, type ExportShardArgs, FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, type FacetColumnOptions, type FacetColumnResult, type FacetValue, type FieldOperators, type FunctionCallStat, type FunctionMetricBucket, type FunctionMetricIndexHit, type FunctionStatsResult, type GroupByEntry, type GroupByOptions, type HibernatableWebSocket, type IdGenerator, type ImportError, type ImportShardAdminArgs, type ImportShardArgs, type ImportShardResult, type IndexDefinitionLike, type IndexRangeBuilderLike, LogBuffer, type LogEntry, type LogEventInput, type LogLevel, type LogSink, MAIL_RETENTION, MAIL_TABLE, MAX_SQL_ROWS, MIN_ADMIN_TOKEN_LENGTH, MIN_AUTH_SECRET_LENGTH, type MaskColumnMetadata, type MaskPoliciesResult, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, type MutationDelta, type NestedWith, NotFoundError, NotUniqueError, type OnDeleteActionLike, type OrderByInput, type OrderKey, type PaginationOptions, type PitrBookmarkResult, type PitrRestoreArgs, type PitrRestoreResult, type PitrStorage, type QueryArgs, type QueryPage, RANK_TIEBREAK, RELATION_FUNCTION_PREFIX, RLS_UNWRAP_SYMBOL, ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, type RankDirection, type RankIndexDefinitionLike, type RankOptions, type RankPage, type RankPageOptions, type RankPageRow, type RankPageRowKey, type RankResult, type RankSortKeyLike, ReactiveCache, type ReactiveCacheOptions, type ReadHook, type ReadTablePageOptions, type RecordAuthEventInput, type RecordFunctionMetricInput, type RecordMailInput, type RelationDefinitionLike, type RenderedSql, type ResolveRelationPredicatesOptions, type ResolveWithOptions, type RestrictableQueryOptions, type RlsPoliciesResult, type RlsPolicyMetadata, RlsRequiredError, type RlsRoleMetadata, type RpcRequest, type RunDataMigrationOptions, type RunShardApplyCdcArgs, type RunShardApplyCdcResult, type RunShardBulkDeleteArgs, type RunShardBulkDeleteResult, type RunShardExportArgs, type RunShardImportArgs, type RunShardMigrationArgs, type RunShardRankBeforeArgs, type RunShardRankPageArgs, type RunShardWriteArgs, type RunShardWriteResult, type RunTriggersOptions, SCAN_DEP, SESSION_DO_TTL_DEFAULT, SHARD_REGISTRY_DO_NAME, type ScheduledFunctionDoc, type SchedulerLike, type SchemaLike, type SearchFilterBuilderLike, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SelectMatchingIdsOptions, type ServerDefaultContextLike, SessionDO, type SessionRecord, type SettingEntry, type SettingKind, type SettingsResult, ShardDO, type ShardDOOptions, type ShardDOState, type ShardRankPageResult, ShardRegistryDO, type SocketAttachment, type SortDirection, type SqlConsoleResult, type SqlCursor, type SqlEngine, type SqlExec, type StorageRuleMetadata, type StorageRulesResult, type StudioFeaturesResult, type SubscriptionEnvelope, type SubscriptionOutcome, type SubscriptionQuery, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemReaderOptions, type SystemReaderSchedulerLike, type SystemReaderStorageLike, type SystemTableName, type TableColumnsResult, type TableDefinitionLike, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type TableReaderLike, type TablesColumnsResult, type TransactionSqlLike, type TriggerContextLike, type TriggerDefinitionLike, type TriggerEventLike, type TriggerOpLike, type TriggerTimingLike, type ValidatorLike, type WhereInput, type WhereSqlStrategy, type WithInput, type WorkflowMetadata, type WorkflowsResult, type WriteEvent, type WriteHook, aggregateSqlFunction, aggregateTableName, applyCdcChanges, applyOnDelete, armRestore, assertFlatPredicate, assertReadonly, assertValidClientId, backfillAggregateIndexes, backfillRankIndexes, buildFtsMatch, buildSecurityAudit, buildSeekWhere, clearCapturedMail, coerceAggregateNumber, compileWhereSql, containsRelationPredicate, createDependencyTracker, createShardCtxDb, createSystemReader, decodeCursor, depKey, encodeAggregateKey, encodeCursor, encodePartitionKey, ensureAuthMetricsTables, ensureFunctionMetricsTables, ensureMailTable, exportShardRows, exportShardTable, facetColumn, foldAggregateTally, ftsTableName, guardWriter, hasTrigger, importShardRows, isRelationPredicate, listTables, matchesRankStaticWhere, matchesStaticWhere, mergeWhere, normalizeCountArgument, normalizeIdStructurally, normalizeOrderKeys, parseExportShardArgs, parseImportShardArgs, planAggregateLookup, rankTableName, reactiveCacheKey, readAggregateValue, readAuthMetrics, readBookmark, readCapturedMail, readCdcChanges, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, readMigrationStatus, readTablePage, recordAuthEvent, recordCapturedMail, recordFunctionMetric, renderSql, resolveRankPartition, resolveRelationPredicates, resolveWith, runDataMigration, runReadonlySql, runRowValidators, runShardMigrations, runTriggers, scoreDocument, selectExportTables, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy, selectMatchingIds, serveRelationFanout, sortColumnName, stableStringify, stringifySearchText, subscriptionListDeltas, throwingScheduler, tokenizeSearch, trimCdcChanges, validateImportRow };
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, AGGREGATE_SQL_FUNCTION, AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, type AdvisoriesResult, type AdvisoryFinding, type AggregateIndexDefinitionLike, type AggregateOp, type AggregateOptions, type AggregateResult, type AggregateTally, type ApplyOnDeleteOptions, type AuditEntry, type AuditLogResult, type AuthMetrics, type AuthMetricsBucket, type BroadcastDelta, CDC_LOG_TABLE, type CacheEntry, type CapturedMailRow, type CdcChange, type Clock, type ColumnMeta, type ColumnMetaLike, ConflictError, type CountArgs, CountRlsUnsupportedError, type CtxDbOptions, DATA_MIGRATION_STATE_TABLE, DEFAULT_MAX_RELATION_KEYS, type DataMigrationDocument, type DataMigrationLike, type DataMigrationTransform, type DatabaseWriterLike, type DependencyTracker, type DeployInfo, type ExportRow, type ExportShardAdminArgs, type ExportShardArgs, FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, type FacetColumnOptions, type FacetColumnResult, type FacetValue, type FieldOperators, type FunctionCallStat, type FunctionMetricBucket, type FunctionMetricIndexHit, type FunctionStatsResult, type GroupByEntry, type GroupByOptions, type HibernatableWebSocket, type IdGenerator, type ImportError, type ImportShardAdminArgs, type ImportShardArgs, type ImportShardResult, type IndexDefinitionLike, type IndexRangeBuilderLike, LogBuffer, type LogEntry, type LogEventInput, type LogLevel, type LogSink, MAIL_RETENTION, MAIL_TABLE, MAX_SQL_ROWS, MIN_ADMIN_TOKEN_LENGTH, MIN_AUTH_SECRET_LENGTH, type MaskColumnMetadata, type MaskPoliciesResult, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, type MutationDelta, type NestedWith, NotFoundError, NotUniqueError, type OnDeleteActionLike, type OrderByInput, type OrderKey, type PaginationOptions, type PitrBookmarkResult, type PitrRestoreArgs, type PitrRestoreResult, type PitrStorage, type QueryArgs, type QueryPage, RANK_TIEBREAK, RELATION_FUNCTION_PREFIX, RLS_UNWRAP_SYMBOL, ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, type RankDirection, type RankIndexDefinitionLike, type RankOptions, type RankPage, type RankPageOptions, type RankPageRow, type RankPageRowKey, type RankResult, type RankSortKeyLike, ReactiveCache, type ReactiveCacheOptions, type ReadHook, type ReadTablePageOptions, type RecordAuthEventInput, type RecordFunctionMetricInput, type RecordMailInput, type RelationDefinitionLike, type RenderedSql, type ResolveRelationPredicatesOptions, type ResolveWithOptions, type RestrictableQueryOptions, type RlsPoliciesResult, type RlsPolicyMetadata, RlsRequiredError, type RlsRoleMetadata, type RpcRequest, type RunDataMigrationOptions, type RunShardApplyCdcArgs, type RunShardApplyCdcResult, type RunShardBulkDeleteArgs, type RunShardBulkDeleteResult, type RunShardExportArgs, type RunShardImportArgs, type RunShardMigrationArgs, type RunShardRankBeforeArgs, type RunShardRankPageArgs, type RunShardWriteArgs, type RunShardWriteResult, type RunTriggersOptions, SCAN_DEP, SESSION_DO_TTL_DEFAULT, SHARD_REGISTRY_DO_NAME, type ScheduledFunctionDoc, type SchedulerLike, type SchemaLike, type SearchFilterBuilderLike, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SelectMatchingIdsOptions, type ServerDefaultContextLike, SessionDO, type SessionRecord, type SettingEntry, type SettingKind, type SettingsResult, ShardDO, type ShardDOOptions, type ShardDOState, type ShardRankPageResult, ShardRegistryDO, type SocketAttachment, type SortDirection, type SqlConsoleResult, type SqlCursor, type SqlEngine, type SqlExec, type StorageRuleMetadata, type StorageRulesResult, type StudioFeaturesResult, type SubscriptionEnvelope, type SubscriptionOutcome, type SubscriptionQuery, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemReaderOptions, type SystemReaderSchedulerLike, type SystemReaderStorageLike, type SystemTableName, type TableColumnsResult, type TableDefinitionLike, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type TableReaderLike, type TablesColumnsResult, type TransactionSqlLike, type TriggerContextLike, type TriggerDefinitionLike, type TriggerEventLike, type TriggerOpLike, type TriggerTimingLike, type ValidatorLike, type WhereInput, type WhereSqlStrategy, type WithInput, type WorkflowMetadata, type WorkflowsResult, type WriteEvent, type WriteHook, aggregateSqlFunction, aggregateTableName, applyCdcChanges, applyOnDelete, applySelect, armRestore, assertFlatPredicate, assertReadonly, assertValidClientId, backfillAggregateIndexes, backfillRankIndexes, buildFtsMatch, buildSecurityAudit, buildSeekWhere, clearCapturedMail, coerceAggregateNumber, compileWhereSql, containsRelationPredicate, createDependencyTracker, createShardCtxDb, createSystemReader, decodeCursor, depKey, encodeAggregateKey, encodeCursor, encodePartitionKey, ensureAuthMetricsTables, ensureFunctionMetricsTables, ensureMailTable, exportShardRows, exportShardTable, facetColumn, foldAggregateTally, ftsTableName, guardWriter, hasTrigger, importShardRows, isRelationPredicate, listTables, matchesRankStaticWhere, matchesStaticWhere, mergeWhere, normalizeCountArgument, normalizeIdStructurally, normalizeOrderKeys, parseExportShardArgs, parseImportShardArgs, planAggregateLookup, rankTableName, reactiveCacheKey, readAggregateValue, readAuthMetrics, readBookmark, readCapturedMail, readCdcChanges, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, readMigrationStatus, readTablePage, recordAuthEvent, recordCapturedMail, recordFunctionMetric, renderSql, resolveRankPartition, resolveRelationPredicates, resolveWith, runDataMigration, runReadonlySql, runRowValidators, runShardMigrations, runTriggers, scoreDocument, selectExportTables, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy, selectMatchingIds, serveRelationFanout, softDeleteScope, sortColumnName, stableStringify, stringifySearchText, subscriptionListDeltas, throwingScheduler, tokenizeSearch, trimCdcChanges, validateImportRow };

package/dist/index.mjs

@@ -3,7 +3,7 @@ export { AGGREGATE_SQL_FUNCTION, aggregateSqlFunction, matchesStaticWhere, norma
 export { aggregateTableName, coerceAggregateNumber, encodeAggregateKey, foldAggregateTally, readAggregateValue } from './packem_shared/aggregateTableName-CxNqY1Sl.mjs';
 export { CountRlsUnsupportedError, mergeWhere, planAggregateLookup, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy } from './packem_shared/CountRlsUnsupportedError-28ZvvwKS.mjs';
 export { AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, ensureAuthMetricsTables, readAuthMetrics, recordAuthEvent } from './packem_shared/AUTH_METRICS_BUCKETS_TABLE-CiHHYeJi.mjs';
-export { NotUniqueError, assertValidClientId, createShardCtxDb, normalizeIdStructurally } from './packem_shared/NotUniqueError-B6tzuDmM.mjs';
+export { NotUniqueError, assertValidClientId, createShardCtxDb, normalizeIdStructurally } from './packem_shared/NotUniqueError-h_thNFSZ.mjs';
 export { DATA_MIGRATION_STATE_TABLE, readMigrationStatus, runDataMigration } from './packem_shared/DATA_MIGRATION_STATE_TABLE-PTtTiQ7U.mjs';
 export { SCAN_DEP, createDependencyTracker, depKey } from './packem_shared/SCAN_DEP-DLJF8dsj.mjs';
 export { renderSql } from './packem_shared/renderSql-D6eUcn2N.mjs';
@@ -13,13 +13,13 @@ export { LogBuffer } from './packem_shared/LogBuffer-B_Ezju_N.mjs';
 export { MAIL_RETENTION, MAIL_TABLE, clearCapturedMail, ensureMailTable, readCapturedMail, recordCapturedMail } from './packem_shared/MAIL_RETENTION-CPpgl-dX.mjs';
 export { default as NotFoundError } from './packem_shared/NotFoundError-CMuMZt81.mjs';
 export { armRestore, readBookmark } from './packem_shared/armRestore-BJk53Ro8.mjs';
-export { buildSeekWhere, decodeCursor, encodeCursor, normalizeOrderKeys } from './packem_shared/buildSeekWhere-lVsNXSLy.mjs';
+export { applySelect, buildSeekWhere, decodeCursor, encodeCursor, normalizeOrderKeys, softDeleteScope } from './packem_shared/applySelect-BvZdFUBT.mjs';
 export { R as RANK_TIEBREAK, e as encodePartitionKey, m as matchesRankStaticWhere, r as rankTableName, a as resolveRankPartition, s as sortColumnName } from './packem_shared/rank-CrkEIpF4.mjs';
 export { ReactiveCache, reactiveCacheKey, stableStringify } from './packem_shared/ReactiveCache-ByVzgH3d.mjs';
 export { serveRelationFanout } from './packem_shared/serveRelationFanout-CFBKWJ8Q.mjs';
-export { DEFAULT_MAX_RELATION_KEYS, assertFlatPredicate, containsRelationPredicate, isRelationPredicate, resolveRelationPredicates } from './packem_shared/DEFAULT_MAX_RELATION_KEYS-DyVYReuT.mjs';
-export { applyOnDelete, resolveWith, runRowValidators } from './packem_shared/applyOnDelete-CMif2RKw.mjs';
-export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_shared/RLS_UNWRAP_SYMBOL-u3UlnCH5.mjs';
+export { DEFAULT_MAX_RELATION_KEYS, assertFlatPredicate, containsRelationPredicate, isRelationPredicate, resolveRelationPredicates } from './packem_shared/DEFAULT_MAX_RELATION_KEYS-Dou2PWdO.mjs';
+export { applyOnDelete, resolveWith, runRowValidators } from './packem_shared/applyOnDelete-sA7o1CqD.mjs';
+export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_shared/RLS_UNWRAP_SYMBOL-EtGQdC9d.mjs';
 export { buildFtsMatch, ftsTableName, scoreDocument, stringifySearchText, tokenizeSearch } from './packem_shared/buildFtsMatch-BLEMawrp.mjs';
 export { M as MIN_ADMIN_TOKEN_LENGTH, a as MIN_AUTH_SECRET_LENGTH, b as buildSecurityAudit } from './packem_shared/security-audit-CucgBice.mjs';
 export { SESSION_DO_TTL_DEFAULT, SessionDO } from './packem_shared/SESSION_DO_TTL_DEFAULT-ilPZsVwu.mjs';

package/dist/packem_shared/{DEFAULT_MAX_RELATION_KEYS-DyVYReuT.mjs → DEFAULT_MAX_RELATION_KEYS-Dou2PWdO.mjs}

@@ -1,4 +1,4 @@
-import { distinctValues } from './applyOnDelete-CMif2RKw.mjs';
+import { distinctValues } from './applyOnDelete-sA7o1CqD.mjs';
 
 const RELATION_EXISTS_KEY = "__relationExists";
 

package/dist/packem_shared/{NotUniqueError-B6tzuDmM.mjs → NotUniqueError-h_thNFSZ.mjs}

@@ -10,11 +10,11 @@ import { param } from './renderSql-D6eUcn2N.mjs';
 import { s as sortColumnName, m as matchesRankStaticWhere, e as encodePartitionKey, b as serializeSqlValue, r as rankTableName, a as resolveRankPartition, R as RANK_TIEBREAK } from './rank-CrkEIpF4.mjs';
 import { stringifySearchText, ftsTableName, tokenizeSearch, buildFtsMatch, scoreDocument } from './buildFtsMatch-BLEMawrp.mjs';
 import { SCAN_DEP } from './SCAN_DEP-DLJF8dsj.mjs';
-import { decodeCursor, normalizeOrderKeys, buildSeekWhere, encodeCursor, buildSeekBeforeWhere } from './buildSeekWhere-lVsNXSLy.mjs';
+import { decodeCursor, normalizeOrderKeys, buildSeekWhere, applySelect, encodeCursor, softDeleteScope, buildSeekBeforeWhere } from './applySelect-BvZdFUBT.mjs';
 import NotFoundError from './NotFoundError-CMuMZt81.mjs';
-import { assertFlatPredicate, resolveRelationPredicates } from './DEFAULT_MAX_RELATION_KEYS-DyVYReuT.mjs';
-import { runRowValidators, resolveWith, applyOnDelete } from './applyOnDelete-CMif2RKw.mjs';
-import { guardWriter } from './RLS_UNWRAP_SYMBOL-u3UlnCH5.mjs';
+import { assertFlatPredicate, resolveRelationPredicates } from './DEFAULT_MAX_RELATION_KEYS-Dou2PWdO.mjs';
+import { runRowValidators, resolveWith, applyOnDelete } from './applyOnDelete-sA7o1CqD.mjs';
+import { guardWriter } from './RLS_UNWRAP_SYMBOL-EtGQdC9d.mjs';
 import { createSystemReader } from './createSystemReader-8CzSZP9V.mjs';
 import { ConflictError } from './ConflictError-C0STs6bU.mjs';
 import { runTriggers } from './hasTrigger-5N6_Fx0A.mjs';
@@ -534,7 +534,7 @@ const createSearchBuilder = (search, tableName) => {
   };
   return builder;
 };
-const searchViaFts = (sql$1, tableName, search, limit) => {
+const searchViaFts = (sql$1, tableName, search, limit, scopeCondition) => {
   const tokens = tokenizeSearch(search.query);
   if (tokens.length === 0) {
     return [];
@@ -544,6 +544,9 @@ const searchViaFts = (sql$1, tableName, search, limit) => {
   for (const filter of search.filters) {
     whereClauses.push(sql`${jsonPathSql(filter.field)} = ${serializeSqlValue(filter.value)}`);
   }
+  if (scopeCondition) {
+    whereClauses.push(scopeCondition);
+  }
   let query = sql`SELECT m.id, m._creationTime, m.${sql.identifier(DOC_COLUMN$1)} FROM ${sql.identifier(ftName)} f JOIN ${sql.identifier(tableName)} m ON m.id = f.${sql.identifier("__id__")} WHERE ${sql.join(whereClauses, sql` AND `)} ORDER BY f.rank, m._creationTime DESC`;
   if (typeof limit === "number") {
     query = sql`${query} LIMIT ${sql.raw(String(Math.max(0, Math.floor(limit))))}`;
@@ -558,7 +561,7 @@ const searchViaFts = (sql$1, tableName, search, limit) => {
   }
   return docs;
 };
-const searchViaScan = (sql$1, tableName, search, limit) => {
+const searchViaScan = (sql$1, tableName, search, limit, scopeCondition) => {
   const tokens = tokenizeSearch(search.query);
   if (tokens.length === 0) {
     return [];
@@ -567,6 +570,9 @@ const searchViaScan = (sql$1, tableName, search, limit) => {
   for (const filter of search.filters) {
     whereClauses.push(sql`${jsonPathSql(filter.field)} = ${serializeSqlValue(filter.value)}`);
   }
+  if (scopeCondition) {
+    whereClauses.push(scopeCondition);
+  }
   let query = sql`SELECT id, _creationTime, ${sql.identifier(DOC_COLUMN$1)} FROM ${sql.identifier(tableName)}`;
   if (whereClauses.length > 0) {
     query = sql`${query} WHERE ${sql.join(whereClauses, sql` AND `)}`;
@@ -660,11 +666,12 @@ const scanDocs = (rows, filters, cap) => {
   }
   return docs;
 };
-const paginateStage = (sql$1, tableName, stage, options) => {
+const paginateStage = (sql$1, tableName, stage, options, scopeCondition) => {
   const numberItems = Math.max(0, Math.floor(options.numItems));
   const orderKeys = paginateOrderKeys(stage);
   const bounded = typeof options.endCursor === "string";
-  const whereCondition = compileWhereSql(paginateWhere(stage, orderKeys, options.cursor, options.endCursor), doWhereSqlStrategy);
+  const pageWhere = compileWhereSql(paginateWhere(stage, orderKeys, options.cursor, options.endCursor), doWhereSqlStrategy);
+  const whereCondition = scopeCondition && pageWhere ? sql`${pageWhere} AND ${scopeCondition}` : scopeCondition ?? pageWhere;
   let query = sql`SELECT id, _creationTime, ${sql.identifier(DOC_COLUMN$1)} FROM ${sql.identifier(tableName)}`;
   if (whereCondition) {
     query = sql`${query} WHERE ${whereCondition}`;
@@ -721,6 +728,8 @@ const buildReader = (sql$1, schema, tableName, onIndexUse = () => void 0) => {
   if (!tableDefinition) {
     throw new Error(`unknown table: ${tableName}`);
   }
+  const scopeWhere = softDeleteScope(tableDefinition.softDeleteMode, void 0);
+  const scopeCondition = scopeWhere ? compileWhereSql(scopeWhere, doWhereSqlStrategy) : void 0;
   const stage = {
     indexFields: [],
     indexName: void 0,
@@ -735,7 +744,7 @@ const buildReader = (sql$1, schema, tableName, onIndexUse = () => void 0) => {
     }
     const filtered = stage.inMemoryFilters.length > 0;
     const engineLimit = filtered ? void 0 : limit;
-    const docs = isFtsAvailable(sql$1) ? searchViaFts(sql$1, tableName, search, engineLimit) : searchViaScan(sql$1, tableName, search, engineLimit);
+    const docs = isFtsAvailable(sql$1) ? searchViaFts(sql$1, tableName, search, engineLimit, scopeCondition) : searchViaScan(sql$1, tableName, search, engineLimit, scopeCondition);
     if (!filtered) {
       return docs;
     }
@@ -766,6 +775,9 @@ const buildReader = (sql$1, schema, tableName, onIndexUse = () => void 0) => {
     for (const condition of stage.sqlConditions) {
       whereClauses.push(sql`${jsonPathSql(condition.field)} ${sql.raw(condition.comparator)} ${serializeSqlValue(condition.value)}`);
     }
+    if (scopeCondition) {
+      whereClauses.push(scopeCondition);
+    }
     let query = sql`SELECT id, _creationTime, ${sql.identifier(DOC_COLUMN$1)} FROM ${sql.identifier(tableName)}`;
     if (whereClauses.length > 0) {
       query = sql`${query} WHERE ${sql.join(whereClauses, sql` AND `)}`;
@@ -813,7 +825,7 @@ const buildReader = (sql$1, schema, tableName, onIndexUse = () => void 0) => {
       if (stage.search) {
         throw new Error("pagination is not supported on search queries; use .take(n) or .collect()");
       }
-      return paginateStage(sql$1, tableName, stage, options);
+      return paginateStage(sql$1, tableName, stage, options, scopeCondition);
     },
     // eslint-disable-next-line @typescript-eslint/require-await -- TableReaderLike returns Promises (the D1 twin awaits real I/O); the DO impl is synchronous over local SQLite
     async take(limit) {
@@ -1130,10 +1142,11 @@ const createShardCtxDb = (options) => {
         throw new Error(`aggregate(${tableName}, { op: "${aggOptions.op}" }): "field" is required for non-count reducers`);
       }
       onRead(tableName, SCAN_DEP);
-      const effective = mergeWhere(aggOptions.baseWhere, aggOptions.where);
+      const aggScope = softDeleteScope(definition.softDeleteMode, void 0);
+      const effective = mergeWhere(mergeWhere(aggOptions.baseWhere, aggOptions.where), aggScope);
       const resolved = await resolveAggregateRelations(effective, tableName, aggOptions.relationBaseWhere);
       const hasRelation = resolved !== effective;
-      if (definition.aggregateIndexes && !aggOptions.baseWhere && !hasRelation) {
+      if (definition.aggregateIndexes && !aggOptions.baseWhere && !hasRelation && !aggScope) {
         const planned = selectIndexForAggregate(definition.aggregateIndexes, aggOptions.op, aggOptions.field, aggOptions.where);
         if (planned) {
           ensureBackfilled(tableName, planned.index);
@@ -1175,10 +1188,11 @@ const createShardCtxDb = (options) => {
         throw new CountRlsUnsupportedError(tableName);
       }
       onRead(tableName, SCAN_DEP);
-      const effective = mergeWhere(countOptions.baseWhere, countOptions.where);
+      const countScope = softDeleteScope(definition.softDeleteMode, void 0);
+      const effective = mergeWhere(mergeWhere(countOptions.baseWhere, countOptions.where), countScope);
       const resolved = await resolveAggregateRelations(effective, tableName, countOptions.relationBaseWhere);
       const hasRelation = resolved !== effective;
-      if (definition.aggregateIndexes && !countOptions.baseWhere && !hasRelation) {
+      if (definition.aggregateIndexes && !countOptions.baseWhere && !hasRelation && !countScope) {
         const planned = selectIndexForCount(definition.aggregateIndexes, countOptions.where);
         if (planned) {
           ensureBackfilled(tableName, planned.index);
@@ -1199,16 +1213,22 @@ const createShardCtxDb = (options) => {
       const row = runDrizzle(sql$1, query).one();
       return row.count;
     },
-    async delete(id, expectedTable) {
+    async delete(id, expectedTable, deleteOptions) {
       const located = locateRowById(id, expectedTable);
       if (!located) {
         const global = expectedTable === void 0 ? globalFallback() : void 0;
         if (global) {
-          await global.delete(id);
+          await global.delete(id, void 0, deleteOptions);
         }
         return;
       }
       const { docJson: existingJson, row: existing, tableName } = located;
+      const definition = schema.tables[tableName];
+      const hard = deleteOptions?.hard === true;
+      const softField = !hard && definition?.softDeleteMode ? definition.softDeleteMode.field : void 0;
+      if (softField && existing[softField] !== null && existing[softField] !== void 0) {
+        return;
+      }
       if (hasMatchingTrigger(tableName, "before", "delete")) {
         await fireTriggers("before", "delete", { id, op: "delete", previous: existing, table: tableName });
       }
@@ -1216,10 +1236,10 @@ const createShardCtxDb = (options) => {
         deletedId: id,
         deletedReference: (references) => existing[references],
         findHolders: async (holderTable, field, value) => {
-          const holders = await routeForHolder(holderTable).findMany(holderTable, { where: { [field]: value } });
+          const holders = await routeForHolder(holderTable).findMany(holderTable, { includeDeleted: hard, where: { [field]: value } });
           return holders.page;
         },
-        onCascade: (holderTable, holderId) => routeForHolder(holderTable).delete(holderId),
+        onCascade: (holderTable, holderId) => routeForHolder(holderTable).delete(holderId, void 0, deleteOptions),
         onRestrict: (message) => {
           throw new ConflictError(message, "restrict");
         },
@@ -1230,6 +1250,25 @@ const createShardCtxDb = (options) => {
       });
       ensureBackfilledForTable(tableName);
       ensureRankBackfilledForTable(tableName);
+      if (softField) {
+        const merged = { ...existing, [softField]: clock(), _id: id };
+        runGuardedWrite(
+          sql$1,
+          tableName,
+          sql`UPDATE ${sql.identifier(tableName)} SET ${sql.identifier(DOC_COLUMN$1)} = ${JSON.stringify(merged)} WHERE id = ${id} AND ${sql.identifier(DOC_COLUMN$1)} = ${existingJson}`
+        );
+        syncSearch(tableName, id, merged);
+        syncAggregates(tableName, existing, merged);
+        syncRanks(tableName, id, existing, void 0);
+        cache?.invalidate(tableName, id);
+        recordCdc(tableName, id, "update", merged);
+        broadcast({ key: id, op: "update", row: merged, table: tableName });
+        if (hasMatchingTrigger(tableName, "after", "delete")) {
+          await fireTriggers("after", "delete", { id, op: "delete", previous: existing, table: tableName });
+        }
+        await onWrite({ id, op: "delete", table: tableName });
+        return;
+      }
       runGuardedWrite(
         sql$1,
         tableName,
@@ -1271,7 +1310,8 @@ const createShardCtxDb = (options) => {
         onRead(tableName, SCAN_DEP);
         return global.findMany(tableName, args);
       }
-      if (!schema.tables[tableName]) {
+      const findManyDefinition = schema.tables[tableName];
+      if (!findManyDefinition) {
         throw new Error(`unknown table: ${tableName}`);
       }
       const isFullScan = !args.where && !args.baseWhere;
@@ -1283,6 +1323,7 @@ const createShardCtxDb = (options) => {
       const orderKeys = normalizeOrderKeys(args.orderBy);
       const seek = args.cursor ? buildSeekWhere(orderKeys, decodeCursor(args.cursor)) : void 0;
       let predicate = mergeWhere(args.baseWhere, args.where);
+      predicate = mergeWhere(predicate, softDeleteScope(findManyDefinition.softDeleteMode, args.includeDeleted));
       predicate = await resolveRelationPredicates(predicate, {
         canPushExists: relationExistsPushDownEnabled ? canPushRelationExists : void 0,
         existsPushMode: relationExistsPushDown === "always" ? "always" : "auto",
@@ -1329,7 +1370,7 @@ const createShardCtxDb = (options) => {
             with: args.with
           });
         }
-        return { continueCursor: null, isDone: true, page: docs };
+        return { continueCursor: null, isDone: true, page: applySelect(docs, args.select, args.with) };
       }
       const hasMore = docs.length > limit;
       const page = hasMore ? docs.slice(0, limit) : docs;
@@ -1346,10 +1387,12 @@ const createShardCtxDb = (options) => {
         });
       }
       return {
+        // The cursor is encoded from `last` (the full, unprojected row) above,
+        // so `applySelect` only trims the returned payload — paging is intact.
         // eslint-disable-next-line unicorn/no-null -- QueryPage.continueCursor is `null | string`: null is the documented "no further page" cursor on the wire
         continueCursor: hasMore && last ? encodeCursor(last, orderKeys) : null,
         isDone: !hasMore,
-        page
+        page: applySelect(page, args.select, args.with)
       };
     },
     async get(id, expectedTable) {
@@ -1390,10 +1433,11 @@ const createShardCtxDb = (options) => {
       if (agg.op !== "count" && !agg.field) {
         throw new Error(`groupBy(${tableName}, { agg: { op: "${agg.op}" } }): "field" is required for non-count reducers`);
       }
-      const effective = mergeWhere(groupOptions.baseWhere, groupOptions.where);
+      const groupScope = softDeleteScope(definition.softDeleteMode, void 0);
+      const effective = mergeWhere(mergeWhere(groupOptions.baseWhere, groupOptions.where), groupScope);
       const resolved = await resolveAggregateRelations(effective, tableName, groupOptions.relationBaseWhere);
       const hasRelation = resolved !== effective;
-      if (definition.aggregateIndexes && !groupOptions.baseWhere && !hasRelation) {
+      if (definition.aggregateIndexes && !groupOptions.baseWhere && !hasRelation && !groupScope) {
         const planned = selectIndexForGroupBy(definition.aggregateIndexes, agg.op, agg.field, groupOptions.by, groupOptions.where);
         if (planned) {
           ensureBackfilled(tableName, planned.index);
@@ -1696,6 +1740,26 @@ const createShardCtxDb = (options) => {
       const { directions, hasMore, rows } = computeRankPage(rankPageDeps, tableName, indexName, rankPageOptions);
       return { directions, hasMore, rows };
     },
+    async restore(id, expectedTable) {
+      const located = locateRowById(id, expectedTable);
+      if (!located) {
+        const global = expectedTable === void 0 ? globalFallback() : void 0;
+        if (global?.restore) {
+          await global.restore(id);
+          return;
+        }
+        throw new Error(`document not found: ${id}`);
+      }
+      const field = schema.tables[located.tableName]?.softDeleteMode?.field;
+      if (!field) {
+        throw new Error(`ctx.db.restore: table "${located.tableName}" is not a .softDelete() table`);
+      }
+      const wasDeleted = located.row[field] !== null && located.row[field] !== void 0;
+      await writer.patch(id, { [field]: null }, expectedTable);
+      if (wasDeleted) {
+        syncRanks(located.tableName, id, void 0, located.row);
+      }
+    },
     async replace(id, document, expectedTable) {
       const located = locateRowById(id, expectedTable);
       if (!located) {

package/dist/packem_shared/{RLS_UNWRAP_SYMBOL-u3UlnCH5.mjs → RLS_UNWRAP_SYMBOL-EtGQdC9d.mjs}

@@ -47,9 +47,9 @@ const guardWriter = (raw, schema, tableOfId) => {
       guardTable(tableName);
       return base.count(tableName, whereOrArgs);
     },
-    delete: async (id, expectedTable) => {
+    delete: async (id, expectedTable, options) => {
       await guardById(id, expectedTable);
-      return base.delete(id, expectedTable);
+      return base.delete(id, expectedTable, options);
     },
     deleteMany: async (ids, options, expectedTable) => {
       for (const id of ids) {
@@ -114,6 +114,10 @@ const guardWriter = (raw, schema, tableOfId) => {
     replace: async (id, document, expectedTable) => {
       await guardById(id, expectedTable);
       return base.replace(id, document, expectedTable);
+    },
+    restore: async (id, expectedTable) => {
+      await guardById(id, expectedTable);
+      return base.restore?.(id, expectedTable);
     }
   };
   if (baseRankBefore) {