better-supabase 0.14.0 → 0.15.0

package/dist/executor-_2ekNofh.d.ts

@@ -0,0 +1,104 @@
+import { L as WorkflowGraph } from "./types-BBQLbui9.js";
+//#region src/blocks/workflow-editor/executor.d.ts
+/** The record a run belongs to. */
+interface GraphSubject {
+  readonly type: string;
+  readonly id: string;
+}
+/** What a step node passes to the engine's step: plain data, so it serializes. */
+interface GraphStepCall {
+  /** The node id, which `workflow_node_runs` keys on. */
+  readonly node: string;
+  /** The library step's name. */
+  readonly step: string;
+  readonly config: Readonly<Record<string, unknown>>;
+  /** The trigger's input. */
+  readonly input: unknown;
+  /** The outputs of the nodes that ran before it, by node id. */
+  readonly results: Readonly<Record<string, unknown>>;
+  /** The run's key; approval hooks use `<runKey>:<node>` as their token. */
+  readonly runKey: string;
+  /** The published version's id; pass it to `builder.versions.runAs`. */
+  readonly version?: string;
+  /** The tenant the run belongs to; pass it to `builder.versions.runAs` too. */
+  readonly tenant?: string;
+  readonly subject?: GraphSubject;
+}
+/**
+ * What an approval node passes to `GraphRuntime.requestApproval`: plain data,
+ * so it serializes.
+ */
+interface GraphApprovalCall {
+  readonly node: string;
+  /** The node's config, e.g. the approvals `action` to file the request under. */
+  readonly config: Readonly<Record<string, unknown>>;
+  readonly input: unknown;
+  readonly results: Readonly<Record<string, unknown>>;
+  readonly runKey: string;
+  readonly version?: string;
+  readonly tenant?: string;
+  readonly subject?: GraphSubject;
+}
+/** What the engine does for each kind of node. */
+interface GraphRuntime {
+  readonly runKey: string;
+  /** The published version's id (`GraphRunMeta.versionId`), passed to each step. */
+  readonly version?: string;
+  /** The run's tenant, passed to each step. */
+  readonly tenant?: string;
+  /**
+   * The record the run belongs to: passed to each step, and conditions read it
+   * as `subject`.
+   */
+  readonly subject?: GraphSubject;
+  /** The trigger node the run starts at; required when the graph has several. */
+  readonly triggerNode?: string;
+  /**
+   * Set for a test run: each step node returns its stub (by node id, else `{
+   * stubbed: true }`) instead of calling `step`, sleeps are skipped, and an
+   * approval node takes its stub as the decision (else approved).
+   */
+  readonly stubs?: Readonly<Record<string, unknown>>;
+  step(call: GraphStepCall): PromiseLike<unknown>;
+  sleep(ms: number): PromiseLike<unknown>;
+  /**
+   * Files the approval request for an approval node and returns its id, which
+   * becomes the hook token. Run it as a step that calls the approvals block's
+   * `request`; `wakeOnApproval` resumes the run once an eligible approver
+   * decides. Without it the token is `<runKey>:<node>`, which anyone who knows
+   * the run key can guess.
+   */
+  requestApproval?(call: GraphApprovalCall): PromiseLike<string>;
+  /** Waits for the approval hook with `token` and returns its payload. */
+  approval(token: string, node: string): PromiseLike<unknown>;
+}
+/** The hook token of an approval node without `requestApproval`. */
+declare const approvalToken: (runKey: string, node: string) => string;
+/**
+ * The run fields a graph run's meta carries (`GraphRunMeta` in
+ * `workflow-sdk/builder`).
+ */
+type GraphRunFields = Pick<GraphRuntime, "runKey" | "version" | "tenant" | "subject" | "triggerNode" | "stubs">;
+/**
+ * The runtime fields of a static executor's `meta`: spread them into the
+ * runtime passed to `executeGraph`, so a run starts at its trigger node,
+ * conditions read its subject, and a test run returns its stubs instead of
+ * running steps.
+ */
+declare function graphRunFields(meta: unknown): GraphRunFields;
+/**
+ * The trigger node a run starts at: `requested` when the graph has it, else the
+ * graph's only trigger. Throws when neither picks one.
+ */
+declare function startNodeOf(graph: WorkflowGraph, requested: string | undefined): string;
+/**
+ * Runs `graph` in dependency order from its start trigger
+ * (`runtime.triggerNode`): a node runs when the trigger reaches it through
+ * edges whose sources ran (and, from a condition or an approval, took the
+ * edge's branch). Returns each node's output by id. It only calls `runtime`, so
+ * it is deterministic and runs inside a `"use workflow"` function as the static
+ * executor.
+ */
+declare function executeGraph(graph: WorkflowGraph, input: unknown, runtime: GraphRuntime): Promise<Record<string, unknown>>;
+//#endregion
+export { GraphSubject as a, graphRunFields as c, GraphStepCall as i, startNodeOf as l, GraphRunFields as n, approvalToken as o, GraphRuntime as r, executeGraph as s, GraphApprovalCall as t };

package/dist/executor-hGjrop3A.d.ts

@@ -0,0 +1,37 @@
+import { Bt as Executor } from "./types-DFdg_4yN.js";
+//#region src/postgres/executor.d.ts
+/**
+ * Anything that runs parameterized SQL: `ctx.postgres` from
+ * `@supabase/server/middleware/postgres`, or a client from `createPostgres()`.
+ */
+interface SqlClient {
+  queryRaw<T = Record<string, unknown>>(text: string, params?: unknown[]): Promise<T[]>;
+  /**
+   * Runs `fn` on one connection in one transaction. Optional; without it
+   * `db.$many` sends its statements separately.
+   */
+  transaction?<T>(fn: (client: SqlClient) => Promise<T>): Promise<T>;
+}
+interface PostgresExecutorOptions {
+  /**
+   * Rows an `estimated` count counts exactly before it switches to the
+   * planner's estimate, like PostgREST's `db-max-rows`. Defaults to 1000.
+   */
+  readonly estimatedCountThreshold?: number;
+}
+/**
+ * Executes repository operations as SQL on a direct Postgres connection. Rows
+ * have the same shape as over PostgREST. RLS applies when the client runs as
+ * the caller (`ctx.postgres`, `createPostgres().asUser()`).
+ *
+ * `maxAffected` fails the statement itself, so its writes roll back. A call's
+ * `timeout` is checked before the statement starts; set `statement_timeout` on
+ * the connection to bound a running statement. `retry` does nothing here.
+ *
+ * `count: "planned"` reads the planner's row estimate from `explain (format
+ * json)`; `count: "estimated"` counts exactly up to `estimatedCountThreshold`
+ * rows and uses the estimate past it, like PostgREST.
+ */
+declare function postgresExecutor(client: SqlClient, options?: PostgresExecutorOptions): Executor;
+//#endregion
+export { SqlClient as n, postgresExecutor as r, PostgresExecutorOptions as t };

package/dist/expo/index.d.ts

@@ -1,7 +1,7 @@
-import { M as AnyFunctions, N as AnyModels } from "../executor-CPyrQdjh.js";
-import { t as BetterSupabase } from "../define-Dw7pRO4h.js";
-import { a as ServerContext, c as ServerOptions, n as BetterServer, r as ContextOptions } from "../server-types-BOs-eFpo.js";
-import { i as MiddlewareOptions, r as GuardOptions } from "../respond-CZYibxUx.js";
+import { O as AnyFunctions, k as AnyModels } from "../types-DFdg_4yN.js";
+import { t as BetterSupabase } from "../define-DFBnQyYg.js";
+import { a as ServerContext, c as ServerOptions, n as BetterServer, r as ContextOptions } from "../server-types-CFtehAsr.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-Dn1_YhC1.js";
 import { t as Validated } from "../shared-CRRfQAKG.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { ImmutableRequest, MiddlewareFunction } from "expo-server";
@@ -39,8 +39,9 @@ export interface ExpoOptions extends ServerOptions {
 export interface ExpoContextOptions extends Omit<ContextOptions, "refresh">, GuardOptions {
   /**
    * Refresh an expired cookie session and write the new cookies with
-   * `setResponseHeaders`. Defaults to true; bearer tokens never refresh. When
-   * `bs.middleware()` already ran for the request, the context reads the
+   * `setResponseHeaders`. Defaults to true; bearer tokens and prefetches never
+   * refresh, so parallel prefetches never race on the refresh token. When
+   * `bsb.middleware()` already ran for the request, the context reads the
    * session it refreshed and never calls Auth again, whatever this option
    * says.
    */
@@ -69,20 +70,20 @@ export interface BetterExpo<M extends AnyModels, F extends AnyFunctions, E, C =
    */
   request(request: ExpoRequest, options?: ExpoContextOptions): Promise<ServerContext<M, F, E, C, P, B>>;
   /**
-   * A server loader (`export const loader = bs.loader(...)`) that runs `fn` as
+   * A server loader (`export const loader = bsb.loader(...)`) that runs `fn` as
    * the caller. A `DbException` from `.orThrow()` becomes a `StatusError` with
    * the error's status. Throws during static rendering, which has no request.
    */
   loader<T>(fn: (ctx: ServerContext<M, F, E, C, P, B>, params: ExpoParams, request: ImmutableRequest) => Promise<T> | T, options?: ExpoContextOptions): (request: ImmutableRequest | undefined, params: ExpoParams) => Promise<T>;
   /**
-   * An API route handler (`export const GET = bs.handler(...)`): `Result`s
+   * An API route handler (`export const GET = bsb.handler(...)`): `Result`s
    * become JSON or Problem Details, `undefined` becomes 204.
    */
   handler(fn: (request: Request, ctx: ServerContext<M, F, E, C, P, B>, params: ExpoParams) => unknown, options?: MiddlewareOptions): (request: Request, params?: ExpoParams) => Promise<Response>;
   /**
-   * `+middleware.ts`: refreshes an expired cookie session once per request,
-   * before loaders run, and redirects refused callers when `redirectTo` is
-   * set.
+   * `+middleware.ts`: refreshes an expired cookie session once per request
+   * (never on a prefetch), before loaders run, and redirects refused callers
+   * when `redirectTo` is set.
    */
   middleware(options?: ExpoMiddlewareOptions): MiddlewareFunction;
 }

package/dist/expo/index.js

@@ -1,9 +1,9 @@
 import { t as DbException } from "../db-exception-Lngc1W49.js";
-import { c as toProblem } from "../problem-BWElIgIb.js";
-import { a as unexpectedResponse, c as extendServer, s as createServer, x as refreshFor } from "../adapter-BCFAg58A.js";
-import { m as serializeCookie } from "../resolve-DAYdcs22.js";
-import { a as respond, r as guard, t as defaultExpose } from "../respond-z_yfyitp.js";
-import { t as withBetterSupabase } from "../composite-Dv6o2BSw.js";
+import { c as toProblem } from "../problem-Bf0cJ7tk.js";
+import { a as unexpectedResponse, b as isPrefetch, c as extendServer, s as createServer, x as refreshFor } from "../adapter-B0b6MXYS.js";
+import { h as serializeCookie } from "../resolve-B0mW2m7f.js";
+import { a as respond, r as guard, t as defaultExpose } from "../respond-C3CcOZlA.js";
+import { t as withBetterSupabase } from "../composite-BARuBEDE.js";
 import { r as handoffOf } from "../shared-Bf-I13Ht.js";
 import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { StatusError, setResponseHeaders } from "expo-server";
@@ -98,9 +98,10 @@ function createExpo(betterSupabase, options = {}) {
 	const request = async (incoming, contextOptions = {}) => {
 		const { allow, aal, scopes, refresh = true, ...rest } = contextOptions;
 		const handoff = handedOff(incoming);
-		const ctx = await server.context(handoff ? withCookie(toRequest(incoming), handoff.cookie) : toRequest(incoming), {
+		const resolved = toRequest(incoming);
+		const ctx = await server.context(handoff ? withCookie(resolved, handoff.cookie) : resolved, {
 			...rest,
-			refresh: handoff ? false : refresh
+			refresh: !handoff && refresh && !isPrefetch(resolved)
 		});
 		writeHeaders(ctx);
 		if (allow !== void 0 || aal !== void 0 || scopes !== void 0) {
@@ -113,7 +114,7 @@ function createExpo(betterSupabase, options = {}) {
 		request,
 		loader(fn, loaderOptions) {
 			return async (incoming, params) => {
-				if (!incoming) throw new StatusError(500, "better-supabase: bs.loader() needs a request, and static rendering has none. Turn on unstable_useServerRendering on Expo SDK 57, or read public data in a loader built with createStaticLoader from \"expo-server\".");
+				if (!incoming) throw new StatusError(500, "better-supabase: bsb.loader() needs a request, and static rendering has none. Turn on unstable_useServerRendering on Expo SDK 57, or read public data in a loader built with createStaticLoader from \"expo-server\".");
 				const ctx = await request(incoming, loaderOptions);
 				try {
 					return await fn(ctx, params, incoming);
@@ -130,7 +131,7 @@ function createExpo(betterSupabase, options = {}) {
 			})], async (incoming, ctx, params) => {
 				const instance = new URL(incoming.url).pathname;
 				try {
-					return await respond(() => fn(incoming, ctx.bs, params), {
+					return await respond(() => fn(incoming, ctx.bsb, params), {
 						instance,
 						expose
 					});
@@ -146,7 +147,7 @@ function createExpo(betterSupabase, options = {}) {
 			const { redirectTo, allow, aal, scopes, publicPaths = [] } = middlewareOptions;
 			return async (incoming) => {
 				const resolved = toRequest(incoming);
-				const ctx = await server.context(resolved, { refresh: refreshFor(middlewareOptions.refresh, resolved) ?? true });
+				const ctx = await server.context(resolved, { refresh: refreshFor(middlewareOptions.refresh, resolved) ?? !isPrefetch(resolved) });
 				const url = new URL(incoming.url);
 				const target = redirectTo === void 0 ? void 0 : new URL(redirectTo, url);
 				if (!target || under(url.pathname, target.pathname) || publicPaths.some((path) => under(url.pathname, path)) || !guard(ctx.auth, allow, aal, scopes)) {

package/dist/extension-B-lajjex.js

@@ -0,0 +1,58 @@
+import { r as definePlugin } from "./plugin-AKwwe2gF.js";
+import { a as insertsOnly, c as withDefault, i as guardManaged, t as dbName } from "./extension-shared-Djm8mGHD.js";
+//#region src/blocks/created-by/extension.ts
+function defaultActor(context) {
+	const actor = context.actor;
+	return actor && actor.kind !== "anon" ? actor.id : void 0;
+}
+/**
+* The `created-by` block's repository extension. Stamps the columns generated
+* as `Flags.actor`: `createdBy` on insert and `updatedBy` on insert and update.
+* Soft deletes are updates, so they record who deleted the row.
+* `impersonatedBy` gets `context.actor.impersonator` on an impersonated insert
+* or update and is left alone otherwise, so a user's own update keeps the
+* stamp, like the block's `track_actor` trigger. Without an actor (anonymous
+* requests) nothing is set.
+*/
+function createdByExtension(options = {}) {
+	const resolve = options.resolve ?? defaultActor;
+	return definePlugin({
+		name: "actor",
+		beforeMutation(op, { table, context, options }) {
+			const flags = table.flags.actor;
+			if (!flags) return op;
+			const created = dbName(table, flags.createdBy);
+			const updated = dbName(table, flags.updatedBy);
+			const impersonated = dbName(table, flags.impersonatedBy);
+			guardManaged(op, [
+				created,
+				updated,
+				impersonated
+			], "actor", options);
+			const id = resolve(context);
+			if (id === void 0) return op;
+			const impersonator = context.actor?.impersonator;
+			const stamp = (row) => {
+				const stamped = withDefault(row, updated, id);
+				return impersonator === void 0 ? stamped : withDefault(stamped, impersonated, impersonator);
+			};
+			switch (op.kind) {
+				case "insert": {
+					const stampCreated = insertsOnly(op);
+					return {
+						...op,
+						rows: op.rows.map((row) => stamp(stampCreated ? withDefault(row, created, id) : row))
+					};
+				}
+				case "update": return {
+					...op,
+					set: stamp(op.set)
+				};
+				case "delete": return op;
+				default: return op;
+			}
+		}
+	});
+}
+//#endregion
+export { createdByExtension as t };

package/dist/extension-B0EjCYhO.js

@@ -0,0 +1,61 @@
+import { r as definePlugin } from "./plugin-AKwwe2gF.js";
+import { a as insertsOnly, c as withDefault, i as guardManaged, t as dbName } from "./extension-shared-Djm8mGHD.js";
+//#region src/blocks/updated-at/extension.ts
+/**
+* The `updated-at` block's repository extension. Stamps the columns generated
+* as `Flags.timestamps`: `createdAt` on insert, `updatedAt` on insert and
+* update. A call that sets either column fails with `invalid_request` unless it
+* passes `{ override: true }`, which keeps the caller's values. The block's
+* `track_updated_at` trigger covers writes that bypass the app, and every write
+* when the runtime has no Temporal.
+*/
+function updatedAtExtension() {
+	return definePlugin({
+		name: "timestamps",
+		describe(api) {
+			for (const { table } of api.resources) {
+				const flags = table.flags.timestamps;
+				if (flags?.createdAt) api.markReadOnly(table.key, flags.createdAt, "Set by the server when the row is created.");
+				if (flags?.updatedAt) api.markReadOnly(table.key, flags.updatedAt, "Set by the server on every write.");
+			}
+		},
+		beforeMutation(op, { table, now, options }) {
+			const flags = table.flags.timestamps;
+			if (!flags) return op;
+			const created = dbName(table, flags.createdAt);
+			const updated = dbName(table, flags.updatedAt);
+			guardManaged(op, [created, updated], "timestamps", options);
+			if (op.kind === "delete") return op;
+			const stamp = readClock(now);
+			if (stamp === void 0) return op;
+			switch (op.kind) {
+				case "insert": {
+					const stampCreated = insertsOnly(op);
+					return {
+						...op,
+						rows: op.rows.map((row) => withDefault(stampCreated ? withDefault(row, created, stamp) : row, updated, stamp))
+					};
+				}
+				case "update": return {
+					...op,
+					set: withDefault(op.set, updated, stamp)
+				};
+				default: return op;
+			}
+		}
+	});
+}
+/**
+* The clock's reading, or `undefined` when the runtime has no Temporal. The
+* column defaults and the block's trigger fill the columns then.
+*/
+function readClock(now) {
+	try {
+		return now().toString();
+	} catch (error) {
+		if (error instanceof TypeError) return;
+		throw error;
+	}
+}
+//#endregion
+export { updatedAtExtension as t };

package/dist/extension-DeAd_MqI.js

@@ -0,0 +1,121 @@
+import { t as DbException } from "./db-exception-Lngc1W49.js";
+import { n as dbError } from "./errors-BVFgt8BZ.js";
+import { a as spansAllTenants, r as definePlugin } from "./plugin-AKwwe2gF.js";
+import { n as scopeOperation } from "./scope-DgWjuXUw.js";
+import { o as tenantFrom, s as tenantPathsFor } from "./claims-Bp9My7XP.js";
+import { a as insertsOnly, n as equals, r as forbidden, t as dbName } from "./extension-shared-Djm8mGHD.js";
+//#region src/blocks/memberships/extension.ts
+/**
+* The tenant for a request: `context.tenant`, then the configured claim.
+* `schema` supplies the default claim (`config.claims.tenant`).
+*/
+function resolveOrganization(context, options = {}, schema) {
+	if (options.resolve) return options.resolve(context);
+	const claim = options.claim;
+	return tenantFrom(context, tenantPathsFor(claim, schema));
+}
+/** Tenant columns may be numeric; the resolved tenant is always a string. */
+function sameTenant(value, id) {
+	if (value === id) return true;
+	return (typeof value === "number" || typeof value === "bigint") && String(value) === id;
+}
+function tenantColumn(table) {
+	return dbName(table, table.flags.tenant);
+}
+/**
+* The `memberships` block's repository extension, for tables generated with
+* `Flags.tenant`. Scopes reads, updates and deletes to the request's
+* organization (nested includes and relation filters too), fills the
+* organization column on insert and rejects writes that would move rows to
+* another organization. It complements RLS; it does not replace it. `gen`
+* installs it with `auth.organization`; `.use()` it again to replace it.
+*/
+function membershipsExtension(options = {}) {
+	const onMissing = options.onMissing ?? "skip";
+	/** A context is fixed for a connection, so its tenant is resolved once. */
+	const resolved = /* @__PURE__ */ new WeakMap();
+	const resolvedFor = (context, schema) => {
+		let id = resolved.get(context);
+		if (id === void 0 && !resolved.has(context)) {
+			id = resolveOrganization(context, options, schema);
+			resolved.set(context, id);
+		}
+		return id;
+	};
+	const missing = (table) => {
+		throw new DbException(dbError("forbidden", `No tenant in the request context for "${table.key}"`));
+	};
+	const current = (table, context, schema) => {
+		const id = resolvedFor(context, schema);
+		if (id === void 0 && onMissing === "error" && tenantColumn(table)) missing(table);
+		return id;
+	};
+	return definePlugin({
+		name: "tenant",
+		scopes: ["tenant"],
+		describe(api) {
+			for (const { table } of api.resources) {
+				const flag = table.flags.tenant;
+				if (!flag) continue;
+				api.markReadOnly(table.key, flag, "Set from the request's tenant.");
+				if (options.header) api.addParameter(table.key, {
+					name: options.header,
+					in: "header",
+					required: onMissing === "error",
+					description: "The tenant the request acts for.",
+					schema: { type: "string" }
+				});
+			}
+		},
+		context(context, { schema }) {
+			if (spansAllTenants(context)) return context;
+			const id = resolvedFor(context, schema);
+			if (id === void 0 || id === context.tenant) return context;
+			const derived = {
+				...context,
+				tenant: id
+			};
+			resolved.set(derived, id);
+			return derived;
+		},
+		transformQuery(op, { context, schema, options: call }) {
+			if (call["allTenants"] === true || spansAllTenants(context)) return op;
+			const id = resolvedFor(context, schema);
+			if (id === void 0) {
+				if (onMissing === "error") scopeOperation(op, (table) => tenantColumn(table) ? missing(table) : void 0);
+				return op;
+			}
+			return scopeOperation(op, (table) => {
+				const column = tenantColumn(table);
+				return column ? equals(column, id) : void 0;
+			});
+		},
+		beforeMutation(op, { table, context, schema, options: call }) {
+			const column = tenantColumn(table);
+			if (!column || call["allTenants"] === true || spansAllTenants(context)) return op;
+			const id = current(table, context, schema);
+			if (id === void 0) return op;
+			switch (op.kind) {
+				case "insert":
+					if (!insertsOnly(op) && !op.onConflict?.columns.includes(column)) forbidden(`An upsert on ${table.key} that updates on conflict needs the tenant column "${column}" in its conflict target`);
+					return {
+						...op,
+						rows: op.rows.map((row) => {
+							if (column in row && !sameTenant(row[column], id)) forbidden(`Cannot write a ${table.key} row for another tenant`);
+							return {
+								...row,
+								[column]: id
+							};
+						})
+					};
+				case "update":
+					if (column in op.set && !sameTenant(op.set[column], id)) forbidden(`Cannot move a ${table.key} row to another tenant`);
+					return op;
+				case "delete": return op;
+				default: return op;
+			}
+		}
+	});
+}
+//#endregion
+export { resolveOrganization as n, membershipsExtension as t };

package/dist/extension-DzCc0IOd.js

@@ -0,0 +1,103 @@
+import { t as and } from "./types-R6syp1el.js";
+import { a as ok, t as AsyncResult } from "./result-ntFBW2p2.js";
+import { r as definePlugin } from "./plugin-AKwwe2gF.js";
+import { n as scopeOperation } from "./scope-DgWjuXUw.js";
+import { a as insertsOnly, c as withDefault, i as guardManaged, o as isNotNull, s as isNull, t as dbName } from "./extension-shared-Djm8mGHD.js";
+//#region src/blocks/trash/extension.ts
+function deletedColumn(table) {
+	return dbName(table, table.flags.softDelete);
+}
+function scopeFor(table) {
+	const column = deletedColumn(table);
+	return column ? isNull(column) : void 0;
+}
+/**
+* The `trash` block's repository extension, for tables generated with
+* `Flags.softDelete`:
+*
+* - Reads, updates and deletes skip deleted rows, including inside includes and
+*   relation filters (`withDeleted` / `onlyDeleted` change the root table);
+* - `delete` sets the column instead (`{ hard: true }` really deletes);
+* - `restore(key)` clears it.
+*
+* Deletes become updates without `RETURNING`, so a SELECT policy that hides
+* deleted rows does not make them fail. `delete({ where }, { returning: true
+* })` keeps `RETURNING`, which needs a SELECT policy that still shows the row.
+*/
+function trashExtension() {
+	return definePlugin({
+		name: "softDelete",
+		enforce: "pre",
+		scopes: ["softDelete"],
+		describe(api) {
+			for (const { table } of api.resources) {
+				const flag = table.flags.softDelete;
+				if (!flag) continue;
+				api.markReadOnly(table.key, flag, "Set when the row is deleted. Deleted rows are not returned, and delete sets this column instead of removing the row.");
+			}
+		},
+		transformQuery(op, { options }) {
+			const hardDelete = op.kind === "delete" && options["hard"] === true;
+			const withDeleted = options["withDeleted"] === true || hardDelete;
+			const onlyDeleted = options["onlyDeleted"] === true;
+			const scoped = scopeOperation(op, scopeFor, !withDeleted && !onlyDeleted);
+			const column = deletedColumn(op.table);
+			if (!onlyDeleted || !column || scoped.kind === "insert") return scoped;
+			return {
+				...scoped,
+				where: and(scoped.where, isNotNull(column))
+			};
+		},
+		beforeMutation(op, { table, options, now }) {
+			const column = deletedColumn(table);
+			if (!column) return op;
+			guardManaged(op, [column], "softDelete", options);
+			if (op.kind === "insert") {
+				if (insertsOnly(op)) return op;
+				return {
+					...op,
+					rows: op.rows.map((row) => withDefault(row, column, null))
+				};
+			}
+			if (op.kind !== "delete" || options["hard"] === true) return op;
+			return {
+				kind: "update",
+				intent: "softDelete",
+				table,
+				set: { [column]: deletedAt(now) },
+				where: op.where,
+				returning: options["returning"] === true ? op.returning : void 0,
+				...op.maxAffected === void 0 ? {} : { maxAffected: op.maxAffected },
+				...op.count === void 0 ? {} : { count: op.count }
+			};
+		},
+		repository({ table, base }) {
+			const flag = table.flags.softDelete;
+			if (!flag) return;
+			const update = base["update"];
+			return { restore: (key, args) => AsyncResult.from(async () => {
+				const result = await update(key, { [flag]: null }, {
+					...args,
+					withDeleted: true,
+					returning: false,
+					override: true
+				});
+				return result.ok ? ok(void 0) : result;
+			}) };
+		}
+	});
+}
+/**
+* The clock's reading, or the system clock's when the runtime has no Temporal:
+* a soft delete needs a time, and no trigger sets one.
+*/
+function deletedAt(now) {
+	try {
+		return now().toString();
+	} catch (error) {
+		if (error instanceof TypeError) return (/* @__PURE__ */ new Date()).toISOString();
+		throw error;
+	}
+}
+//#endregion
+export { trashExtension as t };

package/dist/extension-shared-Djm8mGHD.js

@@ -0,0 +1,60 @@
+import { t as DbException } from "./db-exception-Lngc1W49.js";
+import { n as dbError } from "./errors-BVFgt8BZ.js";
+//#region src/blocks/extension-shared.ts
+/** Database column name for an app column, or `undefined` if it is unknown. */
+function dbName(table, app) {
+	return app === void 0 ? void 0 : table.columns[app]?.db;
+}
+function isNull(column) {
+	return {
+		kind: "column",
+		column,
+		op: "is",
+		value: null
+	};
+}
+function isNotNull(column) {
+	return {
+		kind: "not",
+		item: isNull(column)
+	};
+}
+function equals(column, value) {
+	return {
+		kind: "column",
+		column,
+		op: "eq",
+		value
+	};
+}
+/** Sets `column` on a row unless the caller already provided it. */
+function withDefault(row, column, value) {
+	if (column === void 0 || column in row) return row;
+	return {
+		...row,
+		[column]: value
+	};
+}
+/**
+* Refuses caller-supplied values for columns a plugin fills (timestamps, actor,
+* soft delete) unless the call passes `{ override: true }`. Returns whether the
+* caller may keep its own values.
+*/
+function guardManaged(op, columns, plugin, options) {
+	if (options["override"] === true) return true;
+	const rows = op.kind === "insert" ? op.rows : op.kind === "update" ? [op.set] : [];
+	for (const column of columns) {
+		if (column === void 0) continue;
+		if (rows.some((row) => column in row)) throw new DbException(dbError("invalid_request", `"${column}" on ${op.table.key} is filled by ${plugin}(); pass { override: true } to set it yourself`, { table: op.table.key }));
+	}
+	return false;
+}
+/** Upserts that may update existing rows must not overwrite "created" columns. */
+function insertsOnly(op) {
+	return !op.onConflict || op.onConflict.action === "ignore";
+}
+function forbidden(message) {
+	throw new DbException(dbError("forbidden", message));
+}
+//#endregion
+export { insertsOnly as a, withDefault as c, guardManaged as i, equals as n, isNotNull as o, forbidden as r, isNull as s, dbName as t };