better-supabase 0.2.0 → 0.4.0

package/dist/{respond-DMcbQwfN.js → server-BA75B0mT.js}

@@ -1,11 +1,12 @@
-import { n as dbError, o as isDbError, r as dbErrorOf } from "./errors-Bl3rkOzo.js";
-import { i as ok, n as err, o as toDbError, t as AsyncResult } from "./result-DWXatkd6.js";
-import { a as postgrestExecutor, n as StatsRecorder } from "./stats-C5W-rBfR.js";
-import { a as problemResponse } from "./problem-BTkTtRV9.js";
-import { i as loadEnv } from "./env-BEToab0I.js";
-import { h as actClaim, i as authContext, o as resolveAuth, r as checkAal } from "./mfa-CpLfJSde.js";
-import { n as postgresExecutor } from "./executor-DeppvirK.js";
+import { n as dbError, o as isDbError, r as dbErrorOf } from "./errors-L0xK41y_.js";
+import { i as ok, n as err, o as toDbError, t as AsyncResult } from "./result-Bj6yt33D.js";
+import { a as postgrestExecutor, n as StatsRecorder } from "./stats-C_YxA2r1.js";
+import { a as problemResponse } from "./problem-BihjPR0t.js";
+import { loadEnv } from "./env/index.js";
+import { _ as delegationOf, g as actorOf, i as authContext, o as prefetchJwks, r as checkAal, s as resolveAuth, v as actClaim } from "./mfa-byfjruR9.js";
+import { parseCookieHeader, serializeCookieHeader } from "@supabase/ssr";
 import { createClient } from "@supabase/supabase-js";
+import { PostgrestClient } from "@supabase/postgrest-js";
 //#region src/server/replicas.ts
 /** Cookie holding the epoch ms until which reads stay on the primary. */
 const PRIMARY_COOKIE = "bs-primary-until";
@@ -26,22 +27,21 @@ function replicaState(pinnedUntil = 0, now = Date.now()) {
 		}
 	};
 }
-/** `bs-primary-until` from a `cookie` header, or 0. */
-function pinnedUntil(cookieHeader) {
-	if (!cookieHeader) return 0;
-	for (const part of cookieHeader.split(";")) {
-		const [name, value] = part.trim().split("=", 2);
-		if (name === "bs-primary-until") {
-			const until = Number(value);
-			return Number.isFinite(until) ? until : 0;
-		}
-	}
-	return 0;
+/** `bs-primary-until` from a `cookie` header or parsed cookies, or 0. */
+function pinnedUntil(cookies) {
+	if (!cookies) return 0;
+	const value = (typeof cookies === "string" ? parseCookieHeader(cookies) : cookies).find((cookie) => cookie.name === PRIMARY_COOKIE)?.value;
+	const until = Number(value);
+	return value !== void 0 && Number.isFinite(until) ? until : 0;
 }
 /** A `Set-Cookie` value keeping the next requests on the primary for `pinMs`. */
 function primaryCookie(pinMs, now = Date.now()) {
-	const seconds = Math.max(1, Math.ceil(pinMs / 1e3));
-	return `${PRIMARY_COOKIE}=${String(now + pinMs)}; Path=/; Max-Age=${String(seconds)}; HttpOnly; SameSite=Lax`;
+	return serializeCookieHeader(PRIMARY_COOKIE, String(now + pinMs), {
+		path: "/",
+		maxAge: Math.max(1, Math.ceil(pinMs / 1e3)),
+		httpOnly: true,
+		sameSite: "lax"
+	});
 }
 /**
 * Reads go to `replica` until the context is pinned; writes, and every read
@@ -93,7 +93,7 @@ function fromAuthError(raw) {
 * Removes a user's Storage objects, then the Auth user, then announces the
 * delete. Rows referencing `auth.users` follow their foreign keys.
 */
-function deleteAccount(sb, service, userId, options = {}) {
+function deleteAccount(betterSupabase, service, userId, options = {}) {
 	return AsyncResult.from(async () => {
 		const client = service();
 		const removed = {};
@@ -121,13 +121,13 @@ function deleteAccount(sb, service, userId, options = {}) {
 			return err(fromAuthError(cause));
 		}
 		const context = options.context ?? {};
-		sb.events.emit("mutation", {
+		betterSupabase.events.emit("mutation", {
 			table: "auth.users",
 			kind: "delete",
 			rows: [{ id: userId }],
 			context
 		});
-		for (const table of options.cascades ?? []) sb.events.emit("mutation", {
+		for (const table of options.cascades ?? []) betterSupabase.events.emit("mutation", {
 			table,
 			kind: "delete",
 			rows: [],
@@ -140,6 +140,78 @@ function deleteAccount(sb, service, userId, options = {}) {
 	});
 }
 //#endregion
+//#region src/server/respond.ts
+/** The scopes a delegated user token lacks; empty for the user's own session. */
+function missingScopes(auth, required) {
+	if (required.length === 0) return [];
+	const outcome = actorOf(auth.claims);
+	if (!outcome.ok || !outcome.actor) return [];
+	const granted = new Set(delegationOf(auth.claims)?.scopes);
+	return required.filter((scope) => !granted.has(scope));
+}
+/** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
+function guard(auth, allow = ["user"], aal = "aal1", scopes = []) {
+	if (auth.kind === "invalid") return auth.error;
+	if (allow.includes(auth.kind)) {
+		const denied = checkAal(auth, aal);
+		if (denied || auth.kind !== "user") return denied;
+		const missing = missingScopes(auth, scopes);
+		return missing.length > 0 ? dbError("forbidden", `The token lacks the scope ${missing.join(" ")}`, {
+			code: "INSUFFICIENT_SCOPE",
+			scopes
+		}) : void 0;
+	}
+	return auth.kind === "anon" ? dbError("unauthorized", "Sign in to continue", { code: "MISSING_CREDENTIALS" }) : dbError("forbidden", `A ${auth.kind} caller is not allowed here`);
+}
+function isResult(value) {
+	return typeof value === "object" && value !== null && "ok" in value && "data" in value && "error" in value;
+}
+/**
+* Settles a handler's return value: `Result`s and `AsyncResult`s unwrap,
+* thrown `DbException`s (or errors whose `cause` is a `DbError`) become
+* errors, anything else is data. Other thrown
+* errors propagate.
+*/
+async function settle(run) {
+	try {
+		const value = await run();
+		if (!isResult(value)) return {
+			ok: true,
+			data: value
+		};
+		if (value.ok) return {
+			ok: true,
+			data: value.data
+		};
+		return {
+			ok: false,
+			error: isDbError(value.error) ? value.error : toDbError(value.error)
+		};
+	} catch (cause) {
+		const thrown = dbErrorOf(cause);
+		if (thrown) return {
+			ok: false,
+			error: thrown
+		};
+		throw cause;
+	}
+}
+/** A handler's value as a response: `Response` as is, data as JSON, errors as Problem Details. */
+async function respond(run, options = {}) {
+	const settled = await settle(run);
+	if (!settled.ok) return problemResponse(settled.error, options);
+	if (settled.data instanceof Response) return settled.data;
+	if (settled.data === void 0) return new Response(null, { status: 204 });
+	return Response.json(settled.data, { status: options.status ?? 200 });
+}
+/** Prefetching the JWKS would add a network call to every test that builds a server. */
+function defaultPrefetchJwks() {
+	return typeof process === "undefined" || process.env["NODE_ENV"] !== "test";
+}
+function defaultExpose() {
+	return typeof process !== "undefined" && process.env["NODE_ENV"] === "development";
+}
+//#endregion
 //#region src/server/server.ts
 const STATELESS = {
 	persistSession: false,
@@ -162,13 +234,19 @@ function withExtra(base, extra) {
 }
 /**
 * Server-side entry point for APIs, jobs, MCP servers and framework
-* adapters. Holds the secrets; `sb` stays isomorphic.
+* adapters. Holds the secrets; `betterSupabase` stays isomorphic.
 */
-function createServer(sb, options = {}) {
+function createServer(betterSupabase, options = {}) {
 	let loaded;
 	const env = () => loaded ??= options.env ?? loadEnv();
 	let adminClient;
 	let anonClient;
+	if ((options.prefetchJwks ?? defaultPrefetchJwks()) && options.auth?.jwks === void 0) try {
+		prefetchJwks({
+			...options.auth,
+			env: env()
+		});
+	} catch {}
 	const secretKey = () => {
 		const key = env().secretKey;
 		if (!key) throw new TypeError("admin() needs SUPABASE_SECRET_KEY; it is not set");
@@ -204,13 +282,38 @@ function createServer(sb, options = {}) {
 		}
 	};
 	const supabaseFor = (auth, headers = {}) => supabaseAt(env().url, auth, headers);
-	const dbFor = (auth, context = {}) => sb.connect(supabaseFor(auth), {
-		...authContext(auth),
-		...context
+	/**
+	* The client queries run on. A user's requests need only PostgREST, so they
+	* skip building Realtime, Storage and Auth clients per request; the shared
+	* service and anon clients are built once anyway.
+	*/
+	const restAt = (url, auth, headers = {}) => {
+		if (auth.kind !== "user") return supabaseAt(url, auth, headers);
+		const key = env().publishableKey;
+		return new PostgrestClient(new URL("rest/v1", url.endsWith("/") ? url : `${url}/`).href, { headers: {
+			...headers,
+			apikey: key,
+			Authorization: `Bearer ${auth.token}`
+		} });
+	};
+	/** `$client` stays the full Supabase client, built when first read. */
+	const withLazyClient = (db, client) => Object.defineProperty(db, "$client", {
+		get: client,
+		enumerable: true,
+		configurable: true
 	});
+	const dbFor = (auth, context = {}) => {
+		let supabase;
+		const rest = restAt(env().url, auth);
+		const db = betterSupabase.connect(rest, {
+			...authContext(auth),
+			...context
+		});
+		return withLazyClient(db, () => supabase ??= supabaseFor(auth));
+	};
 	const sqlFor = (claims, context, stats) => {
-		if (!options.postgres) throw new TypeError("Direct Postgres access needs createServer(sb, { postgres: createPostgres() })");
-		return sb.connect(postgresExecutor(options.postgres.asUser(claims)), context, stats ? { stats } : {});
+		if (!options.postgres) throw new TypeError("Direct Postgres access needs createServer(betterSupabase, { postgres: createPostgres() })");
+		return betterSupabase.connect(options.postgres.executorFor(claims), context, stats ? { stats } : {});
 	};
 	/** Clients and repositories are built on first access: most scopes use one of them. */
 	const contextFor = (resolution, headers, parent, until = 0) => {
@@ -237,10 +340,12 @@ function createServer(sb, options = {}) {
 			get db() {
 				if (db) return db;
 				const url = replicaUrl();
-				db = sb.connect(client(), context, {
+				const rest = supabase ?? restAt(env().url, auth, headers);
+				const connected = betterSupabase.connect(rest, context, {
 					stats: recorder,
-					...url && replica ? { executor: routedExecutor(postgrestExecutor(client()), postgrestExecutor(supabaseAt(url, auth, headers)), replica) } : {}
+					...url && replica ? { executor: routedExecutor(postgrestExecutor(rest), postgrestExecutor(restAt(url, auth, headers)), replica) } : {}
 				});
+				db = withLazyClient(connected, client);
 				return db;
 			},
 			get replica() {
@@ -248,31 +353,32 @@ function createServer(sb, options = {}) {
 				return replica;
 			},
 			get sql() {
-				if (!options.postgres || !sqlClaims) return void 0;
+				if (!options.postgres || !sqlClaims) return;
 				sql ??= sqlFor(sqlClaims, context, recorder);
 				return sql;
 			},
 			stats: () => recorder.snapshot()
 		};
 	};
+	const fromResolution = (resolution, request, contextOptions) => contextFor(resolution, options.headers?.(request) ?? {}, contextOptions.stats, contextOptions.pinnedUntil ?? (readUrl() ? pinnedUntil(resolution.requestCookies) : 0));
 	const resolve = async (request, resolveOptions = {}) => {
-		const claims = options.auth?.claims ?? sb.claimsSchema;
-		const userMetadata = sb.userMetadataSchema;
+		const claims = options.auth?.claims ?? betterSupabase.claimsSchema;
+		const userMetadata = betterSupabase.userMetadataSchema;
 		const resolution = await resolveAuth(request, {
-			logger: sb.events.logger,
+			logger: betterSupabase.events.logger,
 			...options.auth,
 			...claims ? { claims } : {},
 			...userMetadata ? { userMetadata } : {},
 			env: env(),
-			...resolveOptions.refresh !== void 0 ? { refresh: resolveOptions.refresh } : {},
+			...resolveOptions.refresh === void 0 ? {} : { refresh: resolveOptions.refresh },
 			onRefresh: (event) => {
 				options.auth?.onRefresh?.(event);
-				sb.events.emit("refresh", event);
+				betterSupabase.events.emit("refresh", event);
 			}
 		});
-		if (sb.events.has("auth")) {
+		if (betterSupabase.events.has("auth")) {
 			const { auth } = resolution;
-			sb.events.emit("auth", {
+			betterSupabase.events.emit("auth", {
 				source: auth.kind === "user" ? auth.source === "cookie" ? "cookie" : "bearer" : auth.kind === "service" ? "bearer" : "none",
 				ok: auth.kind !== "invalid",
 				...auth.kind === "user" ? { userId: auth.user.id } : {}
@@ -296,9 +402,10 @@ function createServer(sb, options = {}) {
 		}, {}, contextOptions.stats, contextOptions.pinnedUntil),
 		async context(request, contextOptions = {}) {
 			const resolution = await resolve(request, { refresh: contextOptions.refresh ?? false });
-			return contextFor(resolution, options.headers?.(request) ?? {}, contextOptions.stats, contextOptions.pinnedUntil ?? pinnedUntil(request.headers.get("cookie")));
+			return fromResolution(resolution, request, contextOptions);
 		},
-		admin: (context = {}) => sb.connect(serviceClient(), {
+		contextFromResolution: (resolution, request, contextOptions = {}) => fromResolution(resolution, request, contextOptions),
+		admin: (context = {}) => betterSupabase.connect(serviceClient(), {
 			actor: {
 				id: "service",
 				kind: "service",
@@ -307,7 +414,7 @@ function createServer(sb, options = {}) {
 			claims: { role: "service_role" },
 			...context
 		}),
-		deleteAccount: (userId, deleteOptions) => deleteAccount(sb, serviceClient, userId, deleteOptions),
+		deleteAccount: (userId, deleteOptions) => deleteAccount(betterSupabase, serviceClient, userId, deleteOptions),
 		actingAs: (userId, claims = {}, impersonation) => {
 			const full = {
 				role: "authenticated",
@@ -328,56 +435,4 @@ function createServer(sb, options = {}) {
 	};
 }
 //#endregion
-//#region src/server/respond.ts
-/** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
-function guard(auth, allow = ["user"], aal = "aal1") {
-	if (auth.kind === "invalid") return auth.error;
-	if (allow.includes(auth.kind)) return checkAal(auth, aal);
-	return auth.kind === "anon" ? dbError("unauthorized", "Sign in to continue", { code: "MISSING_CREDENTIALS" }) : dbError("forbidden", `A ${auth.kind} caller is not allowed here`);
-}
-function isResult(value) {
-	return typeof value === "object" && value !== null && "ok" in value && "data" in value && "error" in value;
-}
-/**
-* Settles a handler's return value: `Result`s and `AsyncResult`s unwrap,
-* thrown `DbException`s (or errors whose `cause` is a `DbError`) become
-* errors, anything else is data. Other thrown
-* errors propagate.
-*/
-async function settle(run) {
-	try {
-		const value = await run();
-		if (!isResult(value)) return {
-			ok: true,
-			data: value
-		};
-		if (value.ok) return {
-			ok: true,
-			data: value.data
-		};
-		return {
-			ok: false,
-			error: isDbError(value.error) ? value.error : toDbError(value.error)
-		};
-	} catch (cause) {
-		const thrown = dbErrorOf(cause);
-		if (thrown) return {
-			ok: false,
-			error: thrown
-		};
-		throw cause;
-	}
-}
-/** A handler's value as a response: `Response` as is, data as JSON, errors as Problem Details. */
-async function respond(run, options = {}) {
-	const settled = await settle(run);
-	if (!settled.ok) return problemResponse(settled.error, options);
-	if (settled.data instanceof Response) return settled.data;
-	if (settled.data === void 0) return new Response(null, { status: 204 });
-	return Response.json(settled.data, { status: options.status ?? 200 });
-}
-function defaultExpose() {
-	return typeof process !== "undefined" && process.env["NODE_ENV"] === "development";
-}
-//#endregion
-export { settle as a, withExtra as c, primaryCookie as d, respond as i, DEFAULT_PIN_MS as l, guard as n, createServer as o, isResult as r, extendServer as s, defaultExpose as t, PRIMARY_COOKIE as u };
+export { guard as a, settle as c, primaryCookie as d, defaultExpose as i, DEFAULT_PIN_MS as l, extendServer as n, isResult as o, withExtra as r, respond as s, createServer as t, PRIMARY_COOKIE as u };

package/dist/{shared-_6-uPL7E.js → shared-DnoCdMDr.js}

@@ -1,4 +1,5 @@
-import { n as dbError, t as DbException } from "./errors-Bl3rkOzo.js";
+import { n as dbError, t as DbException } from "./errors-L0xK41y_.js";
+import { t as lookupOf } from "./lookup-BaP5bI27.js";
 //#region src/plugins/shared.ts
 /** Database column name for an app column, or `undefined` if it is unknown. */
 function dbName(table, app) {
@@ -44,13 +45,13 @@ function forbidden(message) {
 /** Database-keyed row to app-keyed row. */
 function toApp(table, row) {
 	const out = {};
-	for (const [app, meta] of Object.entries(table.columns)) if (meta.db in row) out[app] = row[meta.db];
+	for (const [app, meta] of lookupOf(table).entries) if (meta.db in row) out[app] = row[meta.db];
 	return out;
 }
 /** App-keyed row to database-keyed row. Unknown keys are dropped. */
 function toDb(table, row) {
 	const out = {};
-	for (const [app, meta] of Object.entries(table.columns)) if (app in row) out[meta.db] = row[app];
+	for (const [app, meta] of lookupOf(table).entries) if (app in row) out[meta.db] = row[app];
 	return out;
 }
 //#endregion

package/dist/{simplify-bwJpLnaS.js → simplify-Cqvfr9dj.js}

@@ -1,4 +1,7 @@
-import { n as dbError, t as DbException } from "./errors-Bl3rkOzo.js";
+import { n as dbError, t as DbException } from "./errors-L0xK41y_.js";
+import { t as lookupOf } from "./lookup-BaP5bI27.js";
+import { i as temporalText } from "./temporal-BwshQk0W.js";
+import { t as temporal } from "./temporal-required-CBNHT6ni.js";
 import { i as or, r as not, t as and } from "./types-6cYK9pbJ.js";
 //#region src/schema/define.ts
 /**
@@ -27,17 +30,19 @@ function relationMeta(meta, table, relation) {
 }
 //#endregion
 //#region src/ir/codec.ts
-/** Wire form of an app value: `Date` to ISO text, `bigint` to decimal text. */
+/** Wire form of an app value: Temporal values to ISO text, `bigint` to decimal text. */
 function encodeValue(value) {
-	if (value instanceof Date) return value.toISOString();
-	if (typeof value === "bigint") return value.toString();
+	if (typeof value !== "object" || value === null) return typeof value === "bigint" ? value.toString() : value;
+	const text = temporalText(value);
+	if (text !== void 0) return text;
 	if (Array.isArray(value)) return value.map(encodeValue);
 	return value;
 }
 function decodeScalar(codec, value) {
 	if (value === null || value === void 0) return value;
 	switch (codec) {
-		case "date": return new Date(value);
+		case "instant": return temporal().Instant.from(String(value));
+		case "plainDateTime": return temporal().PlainDateTime.from(String(value));
 		case "bigint": return BigInt(value);
 		case "string": return String(value);
 		default: return codec;
@@ -48,6 +53,15 @@ function decode(codec, value) {
 }
 /** Whether decoding `selection` changes anything, so plain reads skip the walk. */
 function needsDecoding(selection) {
+	let needs = decodes.get(selection);
+	if (needs === void 0) {
+		needs = computeNeedsDecoding(selection);
+		decodes.set(selection, needs);
+	}
+	return needs;
+}
+const decodes = /* @__PURE__ */ new WeakMap();
+function computeNeedsDecoding(selection) {
 	return selection.aggregate !== void 0 || selection.columns.some((column) => column.codec !== void 0) || selection.includes.some((include) => include.count !== void 0 || include.aggregate !== void 0 || needsDecoding(include.selection));
 }
 /** PostgREST returns `[{ count }]` for a `(count)` embed; SQL returns the number. */
@@ -63,38 +77,51 @@ function measureOf(measure, value) {
 	return measure.codec ? decodeScalar(measure.codec, value) : value;
 }
 /** Adds `value` under `row[key][name]`, next to what is already there. */
-function fold(row, key, name, value) {
-	row[key] = {
-		...row[key] ?? {},
-		[name]: value
-	};
+function fold(row, folded, key, name, value) {
+	let target = folded.get(key);
+	if (!target) {
+		target = { ...row[key] };
+		folded.set(key, target);
+		row[key] = target;
+	}
+	target[name] = value;
+}
+const droppedKeys = /* @__PURE__ */ new WeakMap();
+/** Wire keys that decoding folds into `_count`, `_sum` and the rest. */
+function droppedOf(selection) {
+	let dropped = droppedKeys.get(selection);
+	if (!dropped) {
+		dropped = /* @__PURE__ */ new Set([...selection.aggregate?.measures.map((measure) => measure.key) ?? [], ...selection.includes.filter((include) => include.count !== void 0 || include.aggregate !== void 0).map((include) => include.alias)]);
+		droppedKeys.set(selection, dropped);
+	}
+	return dropped;
 }
 function decodeRow(selection, row) {
-	const out = { ...row };
+	const dropped = droppedOf(selection);
+	const out = {};
+	for (const key in row) if (!dropped.has(key) && Object.hasOwn(row, key)) out[key] = row[key];
+	const folded = /* @__PURE__ */ new Map();
 	for (const column of selection.columns) if (column.codec && column.alias in out) out[column.alias] = decode(column.codec, out[column.alias]);
 	if (selection.aggregate) {
 		if (selection.aggregate.count) out["_count"] = countOf(out["_count"]);
 		for (const measure of selection.aggregate.measures) {
-			const value = out[measure.key];
-			delete out[measure.key];
-			fold(out, `_${measure.fn}`, measure.alias, measureOf(measure, value));
+			const value = row[measure.key];
+			fold(out, folded, `_${measure.fn}`, measure.alias, measureOf(measure, value));
 		}
 	}
 	for (const include of selection.includes) {
-		const value = out[include.alias];
+		const value = row[include.alias];
 		if (include.count !== void 0) {
-			if (!(include.alias in out)) continue;
-			delete out[include.alias];
-			fold(out, "_count", include.count, countOf(value));
+			if (!(include.alias in row)) continue;
+			fold(out, folded, "_count", include.count, countOf(value));
 			continue;
 		}
 		if (include.aggregate !== void 0) {
-			if (!(include.alias in out)) continue;
-			delete out[include.alias];
+			if (!(include.alias in row)) continue;
 			const inner = Array.isArray(value) ? value[0] : value;
 			const measures = {};
 			for (const measure of include.selection.aggregate?.measures ?? []) measures[measure.alias] = measureOf(measure, inner?.[measure.key]);
-			fold(out, `_${include.aggregate.fn}`, include.aggregate.name, measures);
+			fold(out, folded, `_${include.aggregate.fn}`, include.aggregate.name, measures);
 			continue;
 		}
 		if (Array.isArray(value)) out[include.alias] = value.map((item) => decodeRow(include.selection, item));
@@ -103,8 +130,8 @@ function decodeRow(selection, row) {
 	return out;
 }
 /** Applies column codecs to returned rows, including embedded relations. */
-function decodeRows(selection, rows) {
-	if (!selection || !needsDecoding(selection)) return rows;
+function decodeRows(selection, rows, checked = false) {
+	if (!selection || !checked && !needsDecoding(selection)) return rows;
 	return rows.map((row) => decodeRow(selection, row));
 }
 //#endregion
@@ -170,10 +197,22 @@ function writable(meta, mode) {
 }
 /** Escapes LIKE wildcards so user input matches literally. */
 function escapeLike(value) {
-	return value.replace(/[\\%_]/g, (char) => `\\${char}`);
+	return value.replaceAll(/[\\%_]/g, (char) => `\\${char}`);
+}
+const builders = /* @__PURE__ */ new WeakMap();
+/** The shared builder for a schema; a builder holds no per-call state. */
+function builderFor(meta) {
+	let builder = builders.get(meta);
+	if (!builder) {
+		builder = new IrBuilder(meta);
+		builders.set(meta, builder);
+	}
+	return builder;
 }
 var IrBuilder = class {
 	meta;
+	/** Every column of a table, the selection of reads without `select`. */
+	#allColumns = /* @__PURE__ */ new WeakMap();
 	constructor(meta) {
 		this.meta = meta;
 	}
@@ -319,7 +358,7 @@ var IrBuilder = class {
 		}
 	}
 	selection(table, select, include) {
-		const columns = (select ?? Object.keys(table.columns)).map((alias) => this.selectColumn(table, alias));
+		const columns = select?.map((alias) => this.selectColumn(table, alias)) ?? this.allColumns(table);
 		const includes = [];
 		if (include !== void 0) {
 			if (!isPlainObject(include)) invalidRequest(`"include" on "${table.key}" must be an object`, table.key);
@@ -411,13 +450,7 @@ var IrBuilder = class {
 			alias,
 			column
 		};
-		return codec === "date" ? {
-			fn,
-			key,
-			alias,
-			column,
-			codec
-		} : {
+		return {
 			fn,
 			key,
 			alias,
@@ -426,6 +459,14 @@ var IrBuilder = class {
 			codec
 		};
 	}
+	allColumns(table) {
+		let columns = this.#allColumns.get(table);
+		if (!columns) {
+			columns = Object.keys(table.columns).map((alias) => this.selectColumn(table, alias));
+			this.#allColumns.set(table, columns);
+		}
+		return columns;
+	}
 	/** A selected column, with the cast and codec its metadata asks for. */
 	selectColumn(table, alias) {
 		const column = this.column(table, alias);
@@ -434,11 +475,7 @@ var IrBuilder = class {
 			alias,
 			column
 		};
-		return codec === "date" ? {
-			alias,
-			column,
-			codec
-		} : {
+		return {
 			alias,
 			column,
 			cast: "text",
@@ -537,7 +574,7 @@ var IrBuilder = class {
 	uniqueKey(table, input) {
 		if (!isPlainObject(input)) invalidRequest(`"where" on "${table.key}" must be an object`, table.key);
 		const given = Object.keys(input).filter((key) => input[key] !== void 0);
-		const keys = [table.primaryKey, ...Object.values(table.uniqueKeys)];
+		const { keys } = lookupOf(table);
 		const match = keys.find((key) => key.length > 0 && key.length === given.length && key.every((column) => given.includes(column)));
 		if (!match) {
 			const names = keys.filter((key) => key.length > 0).map((key) => `{ ${key.join(", ")} }`).join(", ");
@@ -662,4 +699,4 @@ function simplifyOrFalse(condition) {
 	};
 }
 //#endregion
-export { invalidRequest as a, needsDecoding as c, escapeLike as i, defineSchema as l, simplifyOrFalse as n, decodeRows as o, IrBuilder as r, encodeValue as s, simplify as t, tableMeta as u };
+export { invalidRequest as a, needsDecoding as c, escapeLike as i, defineSchema as l, simplifyOrFalse as n, decodeRows as o, builderFor as r, encodeValue as s, simplify as t, tableMeta as u };