better-supabase 0.3.0 → 0.4.0

package/dist/{respond-C44EZAJo.js → server-BA75B0mT.js}

@@ -1,12 +1,12 @@
-import { n as dbError, o as isDbError, r as dbErrorOf } from "./errors-Bl3rkOzo.js";
-import { i as ok, n as err, o as toDbError, t as AsyncResult } from "./result-DWXatkd6.js";
-import { a as postgrestExecutor, n as StatsRecorder } from "./stats-D78UQ8Yu.js";
-import { a as problemResponse } from "./problem-CGt1ADix.js";
+import { n as dbError, o as isDbError, r as dbErrorOf } from "./errors-L0xK41y_.js";
+import { i as ok, n as err, o as toDbError, t as AsyncResult } from "./result-Bj6yt33D.js";
+import { a as postgrestExecutor, n as StatsRecorder } from "./stats-C_YxA2r1.js";
+import { a as problemResponse } from "./problem-BihjPR0t.js";
 import { loadEnv } from "./env/index.js";
-import { _ as actClaim, g as delegationOf, h as actorOf, i as authContext, o as resolveAuth, r as checkAal } from "./mfa-BxoR1RkN.js";
-import { n as postgresExecutor } from "./executor-C57jx2pn.js";
+import { _ as delegationOf, g as actorOf, i as authContext, o as prefetchJwks, r as checkAal, s as resolveAuth, v as actClaim } from "./mfa-byfjruR9.js";
 import { parseCookieHeader, serializeCookieHeader } from "@supabase/ssr";
 import { createClient } from "@supabase/supabase-js";
+import { PostgrestClient } from "@supabase/postgrest-js";
 //#region src/server/replicas.ts
 /** Cookie holding the epoch ms until which reads stay on the primary. */
 const PRIMARY_COOKIE = "bs-primary-until";
@@ -27,10 +27,10 @@ function replicaState(pinnedUntil = 0, now = Date.now()) {
 		}
 	};
 }
-/** `bs-primary-until` from a `cookie` header, or 0. */
-function pinnedUntil(cookieHeader) {
-	if (!cookieHeader) return 0;
-	const value = parseCookieHeader(cookieHeader).find((cookie) => cookie.name === PRIMARY_COOKIE)?.value;
+/** `bs-primary-until` from a `cookie` header or parsed cookies, or 0. */
+function pinnedUntil(cookies) {
+	if (!cookies) return 0;
+	const value = (typeof cookies === "string" ? parseCookieHeader(cookies) : cookies).find((cookie) => cookie.name === PRIMARY_COOKIE)?.value;
 	const until = Number(value);
 	return value !== void 0 && Number.isFinite(until) ? until : 0;
 }
@@ -93,7 +93,7 @@ function fromAuthError(raw) {
 * Removes a user's Storage objects, then the Auth user, then announces the
 * delete. Rows referencing `auth.users` follow their foreign keys.
 */
-function deleteAccount(sb, service, userId, options = {}) {
+function deleteAccount(betterSupabase, service, userId, options = {}) {
 	return AsyncResult.from(async () => {
 		const client = service();
 		const removed = {};
@@ -121,13 +121,13 @@ function deleteAccount(sb, service, userId, options = {}) {
 			return err(fromAuthError(cause));
 		}
 		const context = options.context ?? {};
-		sb.events.emit("mutation", {
+		betterSupabase.events.emit("mutation", {
 			table: "auth.users",
 			kind: "delete",
 			rows: [{ id: userId }],
 			context
 		});
-		for (const table of options.cascades ?? []) sb.events.emit("mutation", {
+		for (const table of options.cascades ?? []) betterSupabase.events.emit("mutation", {
 			table,
 			kind: "delete",
 			rows: [],
@@ -140,6 +140,78 @@ function deleteAccount(sb, service, userId, options = {}) {
 	});
 }
 //#endregion
+//#region src/server/respond.ts
+/** The scopes a delegated user token lacks; empty for the user's own session. */
+function missingScopes(auth, required) {
+	if (required.length === 0) return [];
+	const outcome = actorOf(auth.claims);
+	if (!outcome.ok || !outcome.actor) return [];
+	const granted = new Set(delegationOf(auth.claims)?.scopes);
+	return required.filter((scope) => !granted.has(scope));
+}
+/** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
+function guard(auth, allow = ["user"], aal = "aal1", scopes = []) {
+	if (auth.kind === "invalid") return auth.error;
+	if (allow.includes(auth.kind)) {
+		const denied = checkAal(auth, aal);
+		if (denied || auth.kind !== "user") return denied;
+		const missing = missingScopes(auth, scopes);
+		return missing.length > 0 ? dbError("forbidden", `The token lacks the scope ${missing.join(" ")}`, {
+			code: "INSUFFICIENT_SCOPE",
+			scopes
+		}) : void 0;
+	}
+	return auth.kind === "anon" ? dbError("unauthorized", "Sign in to continue", { code: "MISSING_CREDENTIALS" }) : dbError("forbidden", `A ${auth.kind} caller is not allowed here`);
+}
+function isResult(value) {
+	return typeof value === "object" && value !== null && "ok" in value && "data" in value && "error" in value;
+}
+/**
+* Settles a handler's return value: `Result`s and `AsyncResult`s unwrap,
+* thrown `DbException`s (or errors whose `cause` is a `DbError`) become
+* errors, anything else is data. Other thrown
+* errors propagate.
+*/
+async function settle(run) {
+	try {
+		const value = await run();
+		if (!isResult(value)) return {
+			ok: true,
+			data: value
+		};
+		if (value.ok) return {
+			ok: true,
+			data: value.data
+		};
+		return {
+			ok: false,
+			error: isDbError(value.error) ? value.error : toDbError(value.error)
+		};
+	} catch (cause) {
+		const thrown = dbErrorOf(cause);
+		if (thrown) return {
+			ok: false,
+			error: thrown
+		};
+		throw cause;
+	}
+}
+/** A handler's value as a response: `Response` as is, data as JSON, errors as Problem Details. */
+async function respond(run, options = {}) {
+	const settled = await settle(run);
+	if (!settled.ok) return problemResponse(settled.error, options);
+	if (settled.data instanceof Response) return settled.data;
+	if (settled.data === void 0) return new Response(null, { status: 204 });
+	return Response.json(settled.data, { status: options.status ?? 200 });
+}
+/** Prefetching the JWKS would add a network call to every test that builds a server. */
+function defaultPrefetchJwks() {
+	return typeof process === "undefined" || process.env["NODE_ENV"] !== "test";
+}
+function defaultExpose() {
+	return typeof process !== "undefined" && process.env["NODE_ENV"] === "development";
+}
+//#endregion
 //#region src/server/server.ts
 const STATELESS = {
 	persistSession: false,
@@ -162,13 +234,19 @@ function withExtra(base, extra) {
 }
 /**
 * Server-side entry point for APIs, jobs, MCP servers and framework
-* adapters. Holds the secrets; `sb` stays isomorphic.
+* adapters. Holds the secrets; `betterSupabase` stays isomorphic.
 */
-function createServer(sb, options = {}) {
+function createServer(betterSupabase, options = {}) {
 	let loaded;
 	const env = () => loaded ??= options.env ?? loadEnv();
 	let adminClient;
 	let anonClient;
+	if ((options.prefetchJwks ?? defaultPrefetchJwks()) && options.auth?.jwks === void 0) try {
+		prefetchJwks({
+			...options.auth,
+			env: env()
+		});
+	} catch {}
 	const secretKey = () => {
 		const key = env().secretKey;
 		if (!key) throw new TypeError("admin() needs SUPABASE_SECRET_KEY; it is not set");
@@ -204,13 +282,38 @@ function createServer(sb, options = {}) {
 		}
 	};
 	const supabaseFor = (auth, headers = {}) => supabaseAt(env().url, auth, headers);
-	const dbFor = (auth, context = {}) => sb.connect(supabaseFor(auth), {
-		...authContext(auth),
-		...context
+	/**
+	* The client queries run on. A user's requests need only PostgREST, so they
+	* skip building Realtime, Storage and Auth clients per request; the shared
+	* service and anon clients are built once anyway.
+	*/
+	const restAt = (url, auth, headers = {}) => {
+		if (auth.kind !== "user") return supabaseAt(url, auth, headers);
+		const key = env().publishableKey;
+		return new PostgrestClient(new URL("rest/v1", url.endsWith("/") ? url : `${url}/`).href, { headers: {
+			...headers,
+			apikey: key,
+			Authorization: `Bearer ${auth.token}`
+		} });
+	};
+	/** `$client` stays the full Supabase client, built when first read. */
+	const withLazyClient = (db, client) => Object.defineProperty(db, "$client", {
+		get: client,
+		enumerable: true,
+		configurable: true
 	});
+	const dbFor = (auth, context = {}) => {
+		let supabase;
+		const rest = restAt(env().url, auth);
+		const db = betterSupabase.connect(rest, {
+			...authContext(auth),
+			...context
+		});
+		return withLazyClient(db, () => supabase ??= supabaseFor(auth));
+	};
 	const sqlFor = (claims, context, stats) => {
-		if (!options.postgres) throw new TypeError("Direct Postgres access needs createServer(sb, { postgres: createPostgres() })");
-		return sb.connect(postgresExecutor(options.postgres.asUser(claims)), context, stats ? { stats } : {});
+		if (!options.postgres) throw new TypeError("Direct Postgres access needs createServer(betterSupabase, { postgres: createPostgres() })");
+		return betterSupabase.connect(options.postgres.executorFor(claims), context, stats ? { stats } : {});
 	};
 	/** Clients and repositories are built on first access: most scopes use one of them. */
 	const contextFor = (resolution, headers, parent, until = 0) => {
@@ -237,10 +340,12 @@ function createServer(sb, options = {}) {
 			get db() {
 				if (db) return db;
 				const url = replicaUrl();
-				db = sb.connect(client(), context, {
+				const rest = supabase ?? restAt(env().url, auth, headers);
+				const connected = betterSupabase.connect(rest, context, {
 					stats: recorder,
-					...url && replica ? { executor: routedExecutor(postgrestExecutor(client()), postgrestExecutor(supabaseAt(url, auth, headers)), replica) } : {}
+					...url && replica ? { executor: routedExecutor(postgrestExecutor(rest), postgrestExecutor(restAt(url, auth, headers)), replica) } : {}
 				});
+				db = withLazyClient(connected, client);
 				return db;
 			},
 			get replica() {
@@ -255,11 +360,12 @@ function createServer(sb, options = {}) {
 			stats: () => recorder.snapshot()
 		};
 	};
+	const fromResolution = (resolution, request, contextOptions) => contextFor(resolution, options.headers?.(request) ?? {}, contextOptions.stats, contextOptions.pinnedUntil ?? (readUrl() ? pinnedUntil(resolution.requestCookies) : 0));
 	const resolve = async (request, resolveOptions = {}) => {
-		const claims = options.auth?.claims ?? sb.claimsSchema;
-		const userMetadata = sb.userMetadataSchema;
+		const claims = options.auth?.claims ?? betterSupabase.claimsSchema;
+		const userMetadata = betterSupabase.userMetadataSchema;
 		const resolution = await resolveAuth(request, {
-			logger: sb.events.logger,
+			logger: betterSupabase.events.logger,
 			...options.auth,
 			...claims ? { claims } : {},
 			...userMetadata ? { userMetadata } : {},
@@ -267,12 +373,12 @@ function createServer(sb, options = {}) {
 			...resolveOptions.refresh === void 0 ? {} : { refresh: resolveOptions.refresh },
 			onRefresh: (event) => {
 				options.auth?.onRefresh?.(event);
-				sb.events.emit("refresh", event);
+				betterSupabase.events.emit("refresh", event);
 			}
 		});
-		if (sb.events.has("auth")) {
+		if (betterSupabase.events.has("auth")) {
 			const { auth } = resolution;
-			sb.events.emit("auth", {
+			betterSupabase.events.emit("auth", {
 				source: auth.kind === "user" ? auth.source === "cookie" ? "cookie" : "bearer" : auth.kind === "service" ? "bearer" : "none",
 				ok: auth.kind !== "invalid",
 				...auth.kind === "user" ? { userId: auth.user.id } : {}
@@ -296,9 +402,10 @@ function createServer(sb, options = {}) {
 		}, {}, contextOptions.stats, contextOptions.pinnedUntil),
 		async context(request, contextOptions = {}) {
 			const resolution = await resolve(request, { refresh: contextOptions.refresh ?? false });
-			return contextFor(resolution, options.headers?.(request) ?? {}, contextOptions.stats, contextOptions.pinnedUntil ?? pinnedUntil(request.headers.get("cookie")));
+			return fromResolution(resolution, request, contextOptions);
 		},
-		admin: (context = {}) => sb.connect(serviceClient(), {
+		contextFromResolution: (resolution, request, contextOptions = {}) => fromResolution(resolution, request, contextOptions),
+		admin: (context = {}) => betterSupabase.connect(serviceClient(), {
 			actor: {
 				id: "service",
 				kind: "service",
@@ -307,7 +414,7 @@ function createServer(sb, options = {}) {
 			claims: { role: "service_role" },
 			...context
 		}),
-		deleteAccount: (userId, deleteOptions) => deleteAccount(sb, serviceClient, userId, deleteOptions),
+		deleteAccount: (userId, deleteOptions) => deleteAccount(betterSupabase, serviceClient, userId, deleteOptions),
 		actingAs: (userId, claims = {}, impersonation) => {
 			const full = {
 				role: "authenticated",
@@ -328,72 +435,4 @@ function createServer(sb, options = {}) {
 	};
 }
 //#endregion
-//#region src/server/respond.ts
-/** The scopes a delegated user token lacks; empty for the user's own session. */
-function missingScopes(auth, required) {
-	if (required.length === 0) return [];
-	const outcome = actorOf(auth.claims);
-	if (!outcome.ok || !outcome.actor) return [];
-	const granted = new Set(delegationOf(auth.claims)?.scopes);
-	return required.filter((scope) => !granted.has(scope));
-}
-/** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
-function guard(auth, allow = ["user"], aal = "aal1", scopes = []) {
-	if (auth.kind === "invalid") return auth.error;
-	if (allow.includes(auth.kind)) {
-		const denied = checkAal(auth, aal);
-		if (denied || auth.kind !== "user") return denied;
-		const missing = missingScopes(auth, scopes);
-		return missing.length > 0 ? dbError("forbidden", `The token lacks the scope ${missing.join(" ")}`, {
-			code: "INSUFFICIENT_SCOPE",
-			scopes
-		}) : void 0;
-	}
-	return auth.kind === "anon" ? dbError("unauthorized", "Sign in to continue", { code: "MISSING_CREDENTIALS" }) : dbError("forbidden", `A ${auth.kind} caller is not allowed here`);
-}
-function isResult(value) {
-	return typeof value === "object" && value !== null && "ok" in value && "data" in value && "error" in value;
-}
-/**
-* Settles a handler's return value: `Result`s and `AsyncResult`s unwrap,
-* thrown `DbException`s (or errors whose `cause` is a `DbError`) become
-* errors, anything else is data. Other thrown
-* errors propagate.
-*/
-async function settle(run) {
-	try {
-		const value = await run();
-		if (!isResult(value)) return {
-			ok: true,
-			data: value
-		};
-		if (value.ok) return {
-			ok: true,
-			data: value.data
-		};
-		return {
-			ok: false,
-			error: isDbError(value.error) ? value.error : toDbError(value.error)
-		};
-	} catch (cause) {
-		const thrown = dbErrorOf(cause);
-		if (thrown) return {
-			ok: false,
-			error: thrown
-		};
-		throw cause;
-	}
-}
-/** A handler's value as a response: `Response` as is, data as JSON, errors as Problem Details. */
-async function respond(run, options = {}) {
-	const settled = await settle(run);
-	if (!settled.ok) return problemResponse(settled.error, options);
-	if (settled.data instanceof Response) return settled.data;
-	if (settled.data === void 0) return new Response(null, { status: 204 });
-	return Response.json(settled.data, { status: options.status ?? 200 });
-}
-function defaultExpose() {
-	return typeof process !== "undefined" && process.env["NODE_ENV"] === "development";
-}
-//#endregion
-export { settle as a, withExtra as c, primaryCookie as d, respond as i, DEFAULT_PIN_MS as l, guard as n, createServer as o, isResult as r, extendServer as s, defaultExpose as t, PRIMARY_COOKIE as u };
+export { guard as a, settle as c, primaryCookie as d, defaultExpose as i, DEFAULT_PIN_MS as l, extendServer as n, isResult as o, withExtra as r, respond as s, createServer as t, PRIMARY_COOKIE as u };

package/dist/{shared-_6-uPL7E.js → shared-DnoCdMDr.js}

@@ -1,4 +1,5 @@
-import { n as dbError, t as DbException } from "./errors-Bl3rkOzo.js";
+import { n as dbError, t as DbException } from "./errors-L0xK41y_.js";
+import { t as lookupOf } from "./lookup-BaP5bI27.js";
 //#region src/plugins/shared.ts
 /** Database column name for an app column, or `undefined` if it is unknown. */
 function dbName(table, app) {
@@ -44,13 +45,13 @@ function forbidden(message) {
 /** Database-keyed row to app-keyed row. */
 function toApp(table, row) {
 	const out = {};
-	for (const [app, meta] of Object.entries(table.columns)) if (meta.db in row) out[app] = row[meta.db];
+	for (const [app, meta] of lookupOf(table).entries) if (meta.db in row) out[app] = row[meta.db];
 	return out;
 }
 /** App-keyed row to database-keyed row. Unknown keys are dropped. */
 function toDb(table, row) {
 	const out = {};
-	for (const [app, meta] of Object.entries(table.columns)) if (app in row) out[meta.db] = row[app];
+	for (const [app, meta] of lookupOf(table).entries) if (app in row) out[meta.db] = row[app];
 	return out;
 }
 //#endregion

package/dist/{simplify-LakqK1vH.js → simplify-Cqvfr9dj.js}

@@ -1,6 +1,7 @@
-import { n as dbError, t as DbException } from "./errors-Bl3rkOzo.js";
+import { n as dbError, t as DbException } from "./errors-L0xK41y_.js";
+import { t as lookupOf } from "./lookup-BaP5bI27.js";
 import { i as temporalText } from "./temporal-BwshQk0W.js";
-import { t as temporal } from "./temporal-required-CMxeSVPo.js";
+import { t as temporal } from "./temporal-required-CBNHT6ni.js";
 import { i as or, r as not, t as and } from "./types-6cYK9pbJ.js";
 //#region src/schema/define.ts
 /**
@@ -31,7 +32,7 @@ function relationMeta(meta, table, relation) {
 //#region src/ir/codec.ts
 /** Wire form of an app value: Temporal values to ISO text, `bigint` to decimal text. */
 function encodeValue(value) {
-	if (typeof value === "bigint") return value.toString();
+	if (typeof value !== "object" || value === null) return typeof value === "bigint" ? value.toString() : value;
 	const text = temporalText(value);
 	if (text !== void 0) return text;
 	if (Array.isArray(value)) return value.map(encodeValue);
@@ -52,6 +53,15 @@ function decode(codec, value) {
 }
 /** Whether decoding `selection` changes anything, so plain reads skip the walk. */
 function needsDecoding(selection) {
+	let needs = decodes.get(selection);
+	if (needs === void 0) {
+		needs = computeNeedsDecoding(selection);
+		decodes.set(selection, needs);
+	}
+	return needs;
+}
+const decodes = /* @__PURE__ */ new WeakMap();
+function computeNeedsDecoding(selection) {
 	return selection.aggregate !== void 0 || selection.columns.some((column) => column.codec !== void 0) || selection.includes.some((include) => include.count !== void 0 || include.aggregate !== void 0 || needsDecoding(include.selection));
 }
 /** PostgREST returns `[{ count }]` for a `(count)` embed; SQL returns the number. */
@@ -67,38 +77,51 @@ function measureOf(measure, value) {
 	return measure.codec ? decodeScalar(measure.codec, value) : value;
 }
 /** Adds `value` under `row[key][name]`, next to what is already there. */
-function fold(row, key, name, value) {
-	row[key] = {
-		...row[key] ?? {},
-		[name]: value
-	};
+function fold(row, folded, key, name, value) {
+	let target = folded.get(key);
+	if (!target) {
+		target = { ...row[key] };
+		folded.set(key, target);
+		row[key] = target;
+	}
+	target[name] = value;
+}
+const droppedKeys = /* @__PURE__ */ new WeakMap();
+/** Wire keys that decoding folds into `_count`, `_sum` and the rest. */
+function droppedOf(selection) {
+	let dropped = droppedKeys.get(selection);
+	if (!dropped) {
+		dropped = /* @__PURE__ */ new Set([...selection.aggregate?.measures.map((measure) => measure.key) ?? [], ...selection.includes.filter((include) => include.count !== void 0 || include.aggregate !== void 0).map((include) => include.alias)]);
+		droppedKeys.set(selection, dropped);
+	}
+	return dropped;
 }
 function decodeRow(selection, row) {
-	const out = { ...row };
+	const dropped = droppedOf(selection);
+	const out = {};
+	for (const key in row) if (!dropped.has(key) && Object.hasOwn(row, key)) out[key] = row[key];
+	const folded = /* @__PURE__ */ new Map();
 	for (const column of selection.columns) if (column.codec && column.alias in out) out[column.alias] = decode(column.codec, out[column.alias]);
 	if (selection.aggregate) {
 		if (selection.aggregate.count) out["_count"] = countOf(out["_count"]);
 		for (const measure of selection.aggregate.measures) {
-			const value = out[measure.key];
-			delete out[measure.key];
-			fold(out, `_${measure.fn}`, measure.alias, measureOf(measure, value));
+			const value = row[measure.key];
+			fold(out, folded, `_${measure.fn}`, measure.alias, measureOf(measure, value));
 		}
 	}
 	for (const include of selection.includes) {
-		const value = out[include.alias];
+		const value = row[include.alias];
 		if (include.count !== void 0) {
-			if (!(include.alias in out)) continue;
-			delete out[include.alias];
-			fold(out, "_count", include.count, countOf(value));
+			if (!(include.alias in row)) continue;
+			fold(out, folded, "_count", include.count, countOf(value));
 			continue;
 		}
 		if (include.aggregate !== void 0) {
-			if (!(include.alias in out)) continue;
-			delete out[include.alias];
+			if (!(include.alias in row)) continue;
 			const inner = Array.isArray(value) ? value[0] : value;
 			const measures = {};
 			for (const measure of include.selection.aggregate?.measures ?? []) measures[measure.alias] = measureOf(measure, inner?.[measure.key]);
-			fold(out, `_${include.aggregate.fn}`, include.aggregate.name, measures);
+			fold(out, folded, `_${include.aggregate.fn}`, include.aggregate.name, measures);
 			continue;
 		}
 		if (Array.isArray(value)) out[include.alias] = value.map((item) => decodeRow(include.selection, item));
@@ -107,8 +130,8 @@ function decodeRow(selection, row) {
 	return out;
 }
 /** Applies column codecs to returned rows, including embedded relations. */
-function decodeRows(selection, rows) {
-	if (!selection || !needsDecoding(selection)) return rows;
+function decodeRows(selection, rows, checked = false) {
+	if (!selection || !checked && !needsDecoding(selection)) return rows;
 	return rows.map((row) => decodeRow(selection, row));
 }
 //#endregion
@@ -176,8 +199,20 @@ function writable(meta, mode) {
 function escapeLike(value) {
 	return value.replaceAll(/[\\%_]/g, (char) => `\\${char}`);
 }
+const builders = /* @__PURE__ */ new WeakMap();
+/** The shared builder for a schema; a builder holds no per-call state. */
+function builderFor(meta) {
+	let builder = builders.get(meta);
+	if (!builder) {
+		builder = new IrBuilder(meta);
+		builders.set(meta, builder);
+	}
+	return builder;
+}
 var IrBuilder = class {
 	meta;
+	/** Every column of a table, the selection of reads without `select`. */
+	#allColumns = /* @__PURE__ */ new WeakMap();
 	constructor(meta) {
 		this.meta = meta;
 	}
@@ -323,7 +358,7 @@ var IrBuilder = class {
 		}
 	}
 	selection(table, select, include) {
-		const columns = (select ?? Object.keys(table.columns)).map((alias) => this.selectColumn(table, alias));
+		const columns = select?.map((alias) => this.selectColumn(table, alias)) ?? this.allColumns(table);
 		const includes = [];
 		if (include !== void 0) {
 			if (!isPlainObject(include)) invalidRequest(`"include" on "${table.key}" must be an object`, table.key);
@@ -424,6 +459,14 @@ var IrBuilder = class {
 			codec
 		};
 	}
+	allColumns(table) {
+		let columns = this.#allColumns.get(table);
+		if (!columns) {
+			columns = Object.keys(table.columns).map((alias) => this.selectColumn(table, alias));
+			this.#allColumns.set(table, columns);
+		}
+		return columns;
+	}
 	/** A selected column, with the cast and codec its metadata asks for. */
 	selectColumn(table, alias) {
 		const column = this.column(table, alias);
@@ -531,7 +574,7 @@ var IrBuilder = class {
 	uniqueKey(table, input) {
 		if (!isPlainObject(input)) invalidRequest(`"where" on "${table.key}" must be an object`, table.key);
 		const given = Object.keys(input).filter((key) => input[key] !== void 0);
-		const keys = [table.primaryKey, ...Object.values(table.uniqueKeys)];
+		const { keys } = lookupOf(table);
 		const match = keys.find((key) => key.length > 0 && key.length === given.length && key.every((column) => given.includes(column)));
 		if (!match) {
 			const names = keys.filter((key) => key.length > 0).map((key) => `{ ${key.join(", ")} }`).join(", ");
@@ -656,4 +699,4 @@ function simplifyOrFalse(condition) {
 	};
 }
 //#endregion
-export { invalidRequest as a, needsDecoding as c, escapeLike as i, defineSchema as l, simplifyOrFalse as n, decodeRows as o, IrBuilder as r, encodeValue as s, simplify as t, tableMeta as u };
+export { invalidRequest as a, needsDecoding as c, escapeLike as i, defineSchema as l, simplifyOrFalse as n, decodeRows as o, builderFor as r, encodeValue as s, simplify as t, tableMeta as u };

package/dist/sql/index.d.ts

@@ -1,5 +1,5 @@
 import { s as ClaimsMeta } from "../types-DONv9SHN.js";
-import { B as ReadSet } from "../define-DUbydmJa.js";
+import { B as ReadSet } from "../define-CRS2MRV3.js";
 import { b as ResolvedConfig } from "../config-C1CYcm6o.js";
 import { n as permdockKeys } from "../permdock-sql-DImJULY-.js";
 //#region src/sql/kit.d.ts

package/dist/sql/index.js

@@ -1,11 +1,11 @@
 import { i as temporalText } from "../temporal-BwshQk0W.js";
-import { i as ok } from "../result-DWXatkd6.js";
-import { a as hasPlaceholder, l as splitPlaceholders, s as placeholderOf } from "../read-set-D0qBcboM.js";
-import { t as DEFAULT_CLAIMS } from "../claims-CoTobNC-.js";
-import { i as resolveJsonSchema } from "../config-Be4GwsqI.js";
-import { t as compileSql } from "../sql-BIgk12ew.js";
-import { a as sqlIdent, n as permdockKeys, o as sqlString } from "../permdock-sql-Bta_G0v-.js";
-import { t as VERSION } from "../version-BfpG2gks.js";
+import { i as ok } from "../result-Bj6yt33D.js";
+import { a as hasPlaceholder, l as splitPlaceholders, s as placeholderOf } from "../read-set-FWK8qQ58.js";
+import { t as DEFAULT_CLAIMS } from "../claims-BAf6c7is.js";
+import { i as resolveJsonSchema } from "../config-BpxDfnbg.js";
+import { t as compileSql } from "../sql-B34HU2DI.js";
+import { a as sqlIdent, n as permdockKeys, o as sqlString } from "../permdock-sql-C4KFzLc9.js";
+import { t as VERSION } from "../version-Bmf7_FzM.js";
 //#region src/sql/kit.ts
 const requiresOf = (module, layout) => layout.permdock && module.permdockRequires ? module.permdockRequires : module.requires;
 function jwtClaim(name) {

package/dist/{sql-BIgk12ew.js → sql-B34HU2DI.js}

@@ -1,4 +1,5 @@
-import { a as invalidRequest, n as simplifyOrFalse } from "./simplify-LakqK1vH.js";
+import { a as invalidRequest, n as simplifyOrFalse } from "./simplify-Cqvfr9dj.js";
+import { t as lookupOf } from "./lookup-BaP5bI27.js";
 //#region src/compile/sql.ts
 const MAX_PARAMS = 65535;
 const MAX_PAIRS = 50;
@@ -14,7 +15,7 @@ function dbColumn(table, app) {
 	return meta.db;
 }
 function columnType(table, db) {
-	return Object.values(table.columns).find((meta) => meta.db === db)?.type;
+	return lookupOf(table).byDb.get(db)?.[1].type;
 }
 /**
 * `a > x or (a = x and b > y) or ...` as `(a, b) > (x, y)`, which an index

package/dist/ssr/index.d.ts

@@ -1,5 +1,5 @@
-import { _ as readSession, a as ResolveAuthOptions, b as writeSession, d as CookieOptions, f as CookieRecord, g as parseCookies, h as applyCookieWrites, l as resolveAuth, m as StoredSession, n as AuthResolver, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, v as serializeCookie, y as sessionCookieName } from "../resolve-BRciX2jK.js";
-import { n as toSession, t as AuthSession } from "../view-3Po_PVlr.js";
-import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-DvJXoI02.js";
-import { n as RefreshOutcome, r as refreshSession, t as RefreshOptions } from "../index-kpgopLNv.js";
+import { _ as readSession, a as ResolveAuthOptions, b as writeSession, d as CookieOptions, f as CookieRecord, g as parseCookies, h as applyCookieWrites, l as resolveAuth, m as StoredSession, n as AuthResolver, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, v as serializeCookie, y as sessionCookieName } from "../resolve-BAqQcwMW.js";
+import { n as toSession, t as AuthSession } from "../view-B64o81wp.js";
+import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-Dm-FHpNH.js";
+import { n as RefreshOutcome, r as refreshSession, t as RefreshOptions } from "../refresh-BwYkyNOQ.js";
 export { AUTH_CACHE_HEADERS, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type CookieOptions, type CookieRecord, type CookieWrite, type EntitlementKey, type MembershipClaim, type RefreshOptions, type RefreshOutcome, type ResolveAuthOptions, type StoredSession, applyCookieWrites, authContext, hasEntitlement, parseCookies, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, toSession, writeSession };

package/dist/ssr/index.js

@@ -1,4 +1,4 @@
 import { t as hasEntitlement } from "../entitlements-CTEBm7IB.js";
-import { c as applyCookieWrites, d as serializeCookie, f as sessionCookieName, i as authContext, l as parseCookies, m as refreshSession, o as resolveAuth, p as writeSession, s as AUTH_CACHE_HEADERS, u as readSession } from "../mfa-BxoR1RkN.js";
-import { t as toSession } from "../view-wZ-9qIUz.js";
+import { c as AUTH_CACHE_HEADERS, d as readSession, f as serializeCookie, h as refreshSession, i as authContext, l as applyCookieWrites, m as writeSession, p as sessionCookieName, s as resolveAuth, u as parseCookies } from "../mfa-byfjruR9.js";
+import { t as toSession } from "../view-BrJI2LKp.js";
 export { AUTH_CACHE_HEADERS, applyCookieWrites, authContext, hasEntitlement, parseCookies, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, toSession, writeSession };

package/dist/{standard-FUi3Z3-7.js → standard-BRyBGTtp.js}

@@ -1,5 +1,5 @@
-import { n as dbError } from "./errors-Bl3rkOzo.js";
-import { i as ok, n as err } from "./result-DWXatkd6.js";
+import { n as dbError } from "./errors-L0xK41y_.js";
+import { i as ok, n as err } from "./result-Bj6yt33D.js";
 //#region src/core/standard.ts
 /** Validates with any Standard Schema (zod, valibot, arktype, ...). */
 async function validate(schema, value, label = "value") {

package/dist/{standard-eudBiRk1.d.ts → standard-BsaCYQJc.d.ts}

@@ -1,4 +1,4 @@
-import { o as Result } from "./result-c2OYgCV2.js";
+import { o as Result } from "./result-CqEsbgYs.js";
 import { StandardSchemaV1 as StandardSchemaV1$1 } from "@standard-schema/spec";
 //#region src/core/standard.d.ts
 /** Validates with any Standard Schema (zod, valibot, arktype, ...). */