better-supabase 0.3.0 → 0.5.0

package/dist/plugins/actor/index.js

@@ -1,5 +1,5 @@
-import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
-import { i as insertsOnly, l as withDefault, t as dbName } from "../../shared-_6-uPL7E.js";
+import { r as definePlugin } from "../../plugin-DwARMuQp.js";
+import { a as insertsOnly, i as guardManaged, t as dbName, u as withDefault } from "../../shared-D1dRUrAg.js";
 //#region src/plugins/actor/index.ts
 function defaultActor(context) {
 	const actor = context.actor;
@@ -8,30 +8,44 @@ function defaultActor(context) {
 /**
 * Stamps the columns generated as `Flags.actor`: `createdBy` on insert and
 * `updatedBy` on insert and update. Soft deletes are updates, so they record
-* who deleted the row. Without an actor (anonymous requests) nothing is set.
+* who deleted the row. `impersonatedBy` gets `context.actor.impersonator` on
+* an impersonated insert or update and is left alone otherwise, so a user's
+* own update keeps the stamp, like the SQL kit's `track_actor`. Without an
+* actor (anonymous requests) nothing is set.
 */
 function actor(options = {}) {
 	const resolve = options.resolve ?? defaultActor;
 	return definePlugin({
 		name: "actor",
-		beforeMutation(op, { table, context }) {
+		beforeMutation(op, { table, context, options }) {
 			const flags = table.flags.actor;
 			if (!flags) return op;
-			const id = resolve(context);
-			if (id === void 0) return op;
 			const created = dbName(table, flags.createdBy);
 			const updated = dbName(table, flags.updatedBy);
+			const impersonated = dbName(table, flags.impersonatedBy);
+			guardManaged(op, [
+				created,
+				updated,
+				impersonated
+			], "actor", options);
+			const id = resolve(context);
+			if (id === void 0) return op;
+			const impersonator = context.actor?.impersonator;
+			const stamp = (row) => {
+				const stamped = withDefault(row, updated, id);
+				return impersonator === void 0 ? stamped : withDefault(stamped, impersonated, impersonator);
+			};
 			switch (op.kind) {
 				case "insert": {
 					const stampCreated = insertsOnly(op);
 					return {
 						...op,
-						rows: op.rows.map((row) => withDefault(stampCreated ? withDefault(row, created, id) : row, updated, id))
+						rows: op.rows.map((row) => stamp(stampCreated ? withDefault(row, created, id) : row))
 					};
 				}
 				case "update": return {
 					...op,
-					set: withDefault(op.set, updated, id)
+					set: stamp(op.set)
 				};
 				case "delete": return op;
 				default: return op;

package/dist/plugins/rules/index.d.ts

@@ -1,5 +1,5 @@
-import { g as Operation } from "../../executor-DynmIWhq.js";
-import { f as Plugin, m as RepositoryExtension } from "../../plugin-DVRB8qNE.js";
+import { U as Operation } from "../../executor-BunPOO-k.js";
+import { h as RepositoryExtension, p as Plugin } from "../../plugin-o144f322.js";
 //#region src/plugins/rules/index.d.ts
 export type RuleLevel = "off" | "warn" | "error";
 /** A level, or a level with the rule's option: `['error', 500]`. */

package/dist/plugins/rules/index.js

@@ -1,6 +1,7 @@
-import { n as dbError, t as DbException } from "../../errors-Bl3rkOzo.js";
-import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
-import { n as claimAt, r as claimsOf } from "../../claims-CoTobNC-.js";
+import { n as dbError, t as DbException } from "../../errors-DtwXa6b8.js";
+import { t as lookupOf } from "../../lookup-BaP5bI27.js";
+import { r as definePlugin } from "../../plugin-DwARMuQp.js";
+import { i as tenantClaimPaths, n as claimAt, r as claimsOf } from "../../claims-BAf6c7is.js";
 //#region src/plugins/rules/index.ts
 /** Catches data-exposure and correctness mistakes; everything else off. */
 function safe() {
@@ -40,17 +41,37 @@ function levelOf(setting) {
 function optionOf(setting, fallback) {
 	return Array.isArray(setting) ? setting[1] : fallback;
 }
+const depths = /* @__PURE__ */ new WeakMap();
 function includeDepth(selection) {
+	let depth = depths.get(selection);
+	if (depth === void 0) {
+		depth = computeIncludeDepth(selection);
+		depths.set(selection, depth);
+	}
+	return depth;
+}
+function computeIncludeDepth(selection) {
 	let depth = 0;
 	for (const include of selection.includes) if (include.count !== void 0 || include.aggregate !== void 0) depth = Math.max(depth, 1);
 	else depth = Math.max(depth, 1 + includeDepth(include.selection));
 	return depth;
 }
+const sensitiveByTable = /* @__PURE__ */ new WeakMap();
+function sensitiveOf(table) {
+	let sensitive = sensitiveByTable.get(table);
+	if (!sensitive) {
+		sensitive = new Set(lookupOf(table).entries.filter(([, column]) => column.sensitive).map(([, column]) => column.db));
+		sensitiveByTable.set(table, sensitive);
+	}
+	return sensitive;
+}
 function sensitiveColumns(selection, table) {
 	const found = [];
-	const sensitive = new Set(Object.values(table.columns).filter((column) => column.sensitive).map((column) => column.db));
-	const columns = [...selection.columns, ...selection.aggregate?.measures ?? []];
-	for (const column of columns) if (sensitive.has(column.column)) found.push(`${table.key}.${column.column}`);
+	const sensitive = sensitiveOf(table);
+	if (sensitive.size > 0) {
+		for (const column of selection.columns) if (sensitive.has(column.column)) found.push(`${table.key}.${column.column}`);
+		for (const measure of selection.aggregate?.measures ?? []) if (sensitive.has(measure.column)) found.push(`${table.key}.${measure.column}`);
+	}
 	for (const include of selection.includes) found.push(...sensitiveColumns(include.selection, include.target));
 	return found;
 }
@@ -73,11 +94,21 @@ function bucketTemplates(schema) {
 	}
 	return templates;
 }
+const urlColumnsByTable = /* @__PURE__ */ new WeakMap();
+/** Scalar text columns named `*_url`, the only ones the rule inspects. */
+function urlColumns(table) {
+	let columns = urlColumnsByTable.get(table);
+	if (!columns) {
+		columns = lookupOf(table).entries.map(([, column]) => column).filter((column) => column.db.endsWith("_url") && !column.array && TEXT_TYPES.has(column.type));
+		urlColumnsByTable.set(table, columns);
+	}
+	return columns;
+}
 function storedObjectColumn(op, schema) {
 	const rows = op.kind === "insert" ? op.rows : op.kind === "update" ? [op.set] : [];
 	if (rows.length === 0) return void 0;
-	for (const column of Object.values(op.table.columns)) {
-		if (!rows.some((row) => column.db in row) || !column.db.endsWith("_url") || column.array || !TEXT_TYPES.has(column.type)) continue;
+	for (const column of urlColumns(op.table)) {
+		if (!rows.some((row) => column.db in row)) continue;
 		const path = `${column.db.slice(0, -4)}_path`;
 		if (column.storage !== void 0) return `"${column.db}" holds paths in bucket "${column.storage}"; name it "${path}"`;
 		if (rows.some((row) => {
@@ -87,29 +118,33 @@ function storedObjectColumn(op, schema) {
 	}
 }
 function checks(rules) {
+	const maxLimit = optionOf(rules.maxLimit, 1e3);
+	const maxDepth = optionOf(rules.maxIncludeDepth, 3);
 	return {
-		noUnboundedFindMany: (op) => op.kind === "select" && op.single === void 0 && !op.head && op.limit === void 0 ? "findMany without limit reads every visible row" : void 0,
+		noUnboundedFindMany: (op) => op.kind === "select" && op.single === void 0 && !op.head && op.limit === void 0 && op.selection.aggregate === void 0 ? "findMany without limit reads every visible row" : void 0,
 		maxLimit: (op) => {
-			const max = optionOf(rules.maxLimit, 1e3);
-			return op.kind === "select" && op.limit !== void 0 && op.limit > max ? `limit ${op.limit} is above the maximum of ${max}` : void 0;
+			if (op.kind !== "select" || op.limit === void 0) return;
+			const limit = op.lookAhead === true ? op.limit - 1 : op.limit;
+			return limit > maxLimit ? `limit ${limit} is above the maximum of ${maxLimit}` : void 0;
 		},
 		requireOrderByForCursor: (op) => op.kind === "select" && !op.head && op.orderBy.length === 0 && (op.offset !== void 0 || op.limit !== void 0 && op.limit > 1) ? "paging without orderBy returns rows in no stable order" : void 0,
 		maxIncludeDepth: (op) => {
-			const max = optionOf(rules.maxIncludeDepth, 3);
+			const max = maxDepth;
 			const selection = op.kind === "select" ? op.selection : op.returning;
 			const depth = selection ? includeDepth(selection) : 0;
 			return depth > max ? `includes nest ${depth} levels deep (maximum ${max})` : void 0;
 		},
 		requireTenantContext: (op, { context, schema }) => {
 			if (!op.table.flags.tenant || context.actor?.kind === "service") return;
-			const claim = optionOf(rules.requireTenantContext, claimsOf(schema).tenant);
-			return context.tenant === void 0 && claimAt(context.claims, claim) === void 0 ? `"${op.table.key}" is tenant-scoped but the request has no tenant (context.tenant or claim "${claim}")` : void 0;
+			if (typeof context.tenant === "string") return;
+			const claim = optionOf(rules.requireTenantContext, void 0);
+			const paths = claim === void 0 ? tenantClaimPaths(claimsOf(schema).tenant) : [claim];
+			return paths.some((path) => claimAt(context.claims, path) !== void 0) ? void 0 : `"${op.table.key}" is tenant-scoped but the request has no tenant (context.tenant or claim ${paths.map((path) => `"${path}"`).join(" or ")})`;
 		},
 		noAdminInBrowser: (_op, { context }) => context.actor?.kind === "service" && isBrowser() ? "a service-role connection is running in a browser" : void 0,
 		noSensitiveSelect: (op, { options }) => {
-			if (options["sensitive"] === true) return;
-			const selection = op.kind === "select" ? op.selection : op.returning;
-			const columns = selection ? sensitiveColumns(selection, op.table) : [];
+			if (options["sensitive"] === true || op.kind !== "select") return;
+			const columns = sensitiveColumns(op.selection, op.table);
 			return columns.length > 0 ? `reads sensitive column(s) ${columns.join(", ")}; pass { sensitive: true } to allow` : void 0;
 		},
 		noDeleteManyWithoutWhere: (op) => op.kind === "delete" && op.where === void 0 ? "delete without where removes every visible row" : void 0,

package/dist/plugins/soft-delete/index.d.ts

@@ -1,6 +1,6 @@
-import { C as PrimaryKeyValue } from "../../types-DONv9SHN.js";
-import { t as AsyncResult } from "../../result-c2OYgCV2.js";
-import { f as Plugin, m as RepositoryExtension, o as HasFlag } from "../../plugin-DVRB8qNE.js";
+import { w as PrimaryKeyValue } from "../../types-Dnf_wRDz.js";
+import { a as AsyncResult } from "../../executor-BunPOO-k.js";
+import { h as RepositoryExtension, o as HasFlag, p as Plugin } from "../../plugin-o144f322.js";
 //#region src/plugins/soft-delete/index.d.ts
 export interface SoftDeleteFindArgs {
   /** Include soft-deleted rows of the queried table. */

package/dist/plugins/soft-delete/index.js

@@ -1,8 +1,8 @@
 import { t as and } from "../../types-6cYK9pbJ.js";
-import { i as ok, t as AsyncResult } from "../../result-DWXatkd6.js";
-import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
+import { i as ok, t as AsyncResult } from "../../result-BKiliPY7.js";
+import { r as definePlugin } from "../../plugin-DwARMuQp.js";
 import { n as scopeOperation } from "../../scope-CDHcS7dE.js";
-import { a as isNotNull, o as isNull, t as dbName } from "../../shared-_6-uPL7E.js";
+import { a as insertsOnly, i as guardManaged, o as isNotNull, s as isNull, t as dbName, u as withDefault } from "../../shared-D1dRUrAg.js";
 //#region src/plugins/soft-delete/index.ts
 function deletedColumn(table) {
 	return dbName(table, table.flags.softDelete);
@@ -39,9 +39,17 @@ function softDelete() {
 			};
 		},
 		beforeMutation(op, { table, options, now }) {
-			if (op.kind !== "delete" || options["hard"] === true) return op;
 			const column = deletedColumn(table);
 			if (!column) return op;
+			guardManaged(op, [column], "softDelete", options);
+			if (op.kind === "insert") {
+				if (insertsOnly(op)) return op;
+				return {
+					...op,
+					rows: op.rows.map((row) => withDefault(row, column, null))
+				};
+			}
+			if (op.kind !== "delete" || options["hard"] === true) return op;
 			return {
 				kind: "update",
 				table,
@@ -58,7 +66,8 @@ function softDelete() {
 				const result = await update(key, { [flag]: null }, {
 					...args,
 					withDeleted: true,
-					returning: false
+					returning: false,
+					override: true
 				});
 				return result.ok ? ok(void 0) : result;
 			}) };

package/dist/plugins/tenant/index.d.ts

@@ -1,5 +1,5 @@
-import { A as SchemaMeta } from "../../types-DONv9SHN.js";
-import { f as Plugin, h as RequestContext, m as RepositoryExtension, o as HasFlag } from "../../plugin-DVRB8qNE.js";
+import { j as SchemaMeta } from "../../types-Dnf_wRDz.js";
+import { g as RequestContext, h as RepositoryExtension, o as HasFlag, p as Plugin } from "../../plugin-o144f322.js";
 //#region src/plugins/tenant/index.d.ts
 /**
  * Dotted paths to the string claims of `C` (up to three levels), e.g.
@@ -7,7 +7,7 @@ import { f as Plugin, h as RequestContext, m as RepositoryExtension, o as HasFla
  */
 export type ClaimPath<C> = unknown extends C ? string : StringPaths<C, [1, 2, 3]>;
 type StringPaths<T, Depth extends readonly unknown[]> = T extends object ? T extends readonly unknown[] ? never : { [K in keyof T & string]-?: (NonNullable<T[K]> extends string ? K : never) | (Depth extends readonly [unknown, ...infer Rest] ? `${K}.${StringPaths<NonNullable<T[K]>, Rest>}` : never); }[keyof T & string] : never;
-/** `C` is the claims type (`sb.claims(schema)`'s output); it types `claim`. */
+/** `C` is the claims type (`betterSupabase.claims(schema)`'s output); it types `claim`. */
 export interface TenantOptions<C = unknown> {
   /**
    * JWT claim path(s) holding the tenant id when `context.tenant` is not set.

package/dist/plugins/tenant/index.js

@@ -1,8 +1,8 @@
-import { n as dbError, t as DbException } from "../../errors-Bl3rkOzo.js";
-import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
+import { n as dbError, t as DbException } from "../../errors-DtwXa6b8.js";
+import { a as recordTenant, o as spansAllTenants, r as definePlugin } from "../../plugin-DwARMuQp.js";
 import { n as scopeOperation } from "../../scope-CDHcS7dE.js";
-import { i as tenantClaimPaths, n as claimAt, r as claimsOf } from "../../claims-CoTobNC-.js";
-import { n as equals, r as forbidden, t as dbName } from "../../shared-_6-uPL7E.js";
+import { i as tenantClaimPaths, n as claimAt, r as claimsOf } from "../../claims-BAf6c7is.js";
+import { a as insertsOnly, n as equals, r as forbidden, t as dbName } from "../../shared-D1dRUrAg.js";
 //#region src/plugins/tenant/index.ts
 /**
 * The tenant for a request: `context.tenant`, then the configured claim.
@@ -18,6 +18,11 @@ function resolveTenant(context, options = {}, schema) {
 		if (value !== void 0) return value;
 	}
 }
+/** Tenant columns may be numeric; the resolved tenant is always a string. */
+function sameTenant(value, id) {
+	if (value === id) return true;
+	return (typeof value === "number" || typeof value === "bigint") && String(value) === id;
+}
 function tenantColumn(table) {
 	return dbName(table, table.flags.tenant);
 }
@@ -30,17 +35,34 @@ function tenantColumn(table) {
 */
 function tenant(options = {}) {
 	const onMissing = options.onMissing ?? "error";
+	/** A context is fixed for a connection, so its tenant is resolved once. */
+	const resolved = /* @__PURE__ */ new WeakMap();
+	const resolvedFor = (context, schema) => {
+		let id = resolved.get(context);
+		if (id === void 0 && !resolved.has(context)) {
+			id = resolveTenant(context, options, schema);
+			resolved.set(context, id);
+			if (id !== void 0) recordTenant(context, id);
+		}
+		return id;
+	};
+	const missing = (table) => {
+		throw new DbException(dbError("forbidden", `No tenant in the request context for "${table.key}"`));
+	};
 	const current = (table, context, schema) => {
-		const id = resolveTenant(context, options, schema);
-		if (id === void 0 && onMissing === "error" && tenantColumn(table)) throw new DbException(dbError("forbidden", `No tenant in the request context for "${table.key}"`));
+		const id = resolvedFor(context, schema);
+		if (id === void 0 && onMissing === "error" && tenantColumn(table)) missing(table);
 		return id;
 	};
 	return definePlugin({
 		name: "tenant",
 		transformQuery(op, { context, schema, options: call }) {
-			if (call["allTenants"] === true) return op;
-			const id = current(op.table, context, schema);
-			if (id === void 0) return op;
+			if (call["allTenants"] === true || spansAllTenants(context)) return op;
+			const id = resolvedFor(context, schema);
+			if (id === void 0) {
+				if (onMissing === "error") scopeOperation(op, (table) => tenantColumn(table) ? missing(table) : void 0);
+				return op;
+			}
 			return scopeOperation(op, (table) => {
 				const column = tenantColumn(table);
 				return column ? equals(column, id) : void 0;
@@ -48,22 +70,24 @@ function tenant(options = {}) {
 		},
 		beforeMutation(op, { table, context, schema, options: call }) {
 			const column = tenantColumn(table);
-			if (!column || call["allTenants"] === true) return op;
+			if (!column || call["allTenants"] === true || spansAllTenants(context)) return op;
 			const id = current(table, context, schema);
 			if (id === void 0) return op;
 			switch (op.kind) {
-				case "insert": return {
-					...op,
-					rows: op.rows.map((row) => {
-						if (column in row && row[column] !== id) forbidden(`Cannot write a ${table.key} row for another tenant`);
-						return {
-							...row,
-							[column]: id
-						};
-					})
-				};
+				case "insert":
+					if (!insertsOnly(op) && !op.onConflict?.columns.includes(column)) forbidden(`An upsert on ${table.key} that updates on conflict needs the tenant column "${column}" in its conflict target`);
+					return {
+						...op,
+						rows: op.rows.map((row) => {
+							if (column in row && !sameTenant(row[column], id)) forbidden(`Cannot write a ${table.key} row for another tenant`);
+							return {
+								...row,
+								[column]: id
+							};
+						})
+					};
 				case "update":
-					if (column in op.set && op.set[column] !== id) forbidden(`Cannot move a ${table.key} row to another tenant`);
+					if (column in op.set && !sameTenant(op.set[column], id)) forbidden(`Cannot move a ${table.key} row to another tenant`);
 					return op;
 				case "delete": return op;
 				default: return op;

package/dist/plugins/timestamps/index.d.ts

@@ -1,4 +1,4 @@
-import { f as Plugin } from "../../plugin-DVRB8qNE.js";
+import { p as Plugin } from "../../plugin-o144f322.js";
 //#region src/plugins/timestamps/index.d.ts
 /**
  * Stamps the columns generated as `Flags.timestamps`: `createdAt` on insert,

package/dist/plugins/timestamps/index.js

@@ -1,5 +1,5 @@
-import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
-import { i as insertsOnly, l as withDefault, t as dbName } from "../../shared-_6-uPL7E.js";
+import { r as definePlugin } from "../../plugin-DwARMuQp.js";
+import { a as insertsOnly, i as guardManaged, t as dbName, u as withDefault } from "../../shared-D1dRUrAg.js";
 //#region src/plugins/timestamps/index.ts
 /**
 * Stamps the columns generated as `Flags.timestamps`: `createdAt` on insert,
@@ -9,11 +9,12 @@ import { i as insertsOnly, l as withDefault, t as dbName } from "../../shared-_6
 function timestamps() {
 	return definePlugin({
 		name: "timestamps",
-		beforeMutation(op, { table, now }) {
+		beforeMutation(op, { table, now, options }) {
 			const flags = table.flags.timestamps;
 			if (!flags) return op;
 			const created = dbName(table, flags.createdAt);
 			const updated = dbName(table, flags.updatedAt);
+			guardManaged(op, [created, updated], "timestamps", options);
 			const stamp = now().toString();
 			switch (op.kind) {
 				case "insert": {

package/dist/plugins/validation/index.d.ts

@@ -1,5 +1,5 @@
-import { f as Plugin } from "../../plugin-DVRB8qNE.js";
-import { t as StandardSchemaV1 } from "../../standard-eudBiRk1.js";
+import { p as Plugin } from "../../plugin-o144f322.js";
+import { t as StandardSchemaV1 } from "../../standard-J4YgMOLm.js";
 //#region src/plugins/validation/index.d.ts
 export interface TableValidators {
   /** Validates inserts and upserts, with app-cased keys. */

package/dist/plugins/validation/index.js

@@ -1,13 +1,33 @@
-import { n as dbError, t as DbException } from "../../errors-Bl3rkOzo.js";
-import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
-import { t as validate } from "../../standard-FUi3Z3-7.js";
-import { c as toDb, s as toApp } from "../../shared-_6-uPL7E.js";
+import { n as dbError, t as DbException } from "../../errors-DtwXa6b8.js";
+import { n as decodeValue, r as encodeValue } from "../../wire-D2dT86vi.js";
+import { r as definePlugin } from "../../plugin-DwARMuQp.js";
+import { t as validate } from "../../standard-D7r6dMUu.js";
+import { c as toApp, l as toDb } from "../../shared-D1dRUrAg.js";
 //#region src/plugins/validation/index.ts
+/**
+* Rows reach plugins in wire form (ISO text, decimal text), while generated
+* validators expect the column codecs' app values (Temporal, `bigint`).
+*/
+function decoded(table, row) {
+	const app = toApp(table, row);
+	for (const [name, value] of Object.entries(app)) {
+		const codec = table.columns[name]?.codec;
+		if (codec === void 0 || typeof value !== "string") continue;
+		try {
+			app[name] = decodeValue(codec, value);
+		} catch {}
+	}
+	return app;
+}
+function encoded(row) {
+	for (const [name, value] of Object.entries(row)) row[name] = encodeValue(value);
+	return row;
+}
 async function check(schema, table, row, label, index) {
-	const result = await validate(schema, toApp(table, row), label);
+	const result = await validate(schema, decoded(table, row), label);
 	if (result.ok) {
 		const output = result.data;
-		return typeof output === "object" && output !== null ? toDb(table, output) : { ...row };
+		return typeof output === "object" && output !== null ? encoded(toDb(table, output)) : { ...row };
 	}
 	const error = result.error;
 	if (index === void 0 || error.kind !== "validation") throw new DbException(error);

package/dist/{pool-B9qsLyFR.d.ts → pool-C9voM4Kw.d.ts}

@@ -1,4 +1,5 @@
-import { t as SqlClient } from "./executor-B26lgbHD.js";
+import { r as Executor } from "./executor-BunPOO-k.js";
+import { t as SqlClient } from "./executor-Cghdstwu.js";
 //#region src/postgres/pool.d.ts
 /** The part of a `pg` pool client `createPostgres` uses. */
 interface PgPoolClient {
@@ -47,17 +48,34 @@ interface SqlClaims {
   readonly role?: string;
   readonly [claim: string]: unknown;
 }
-interface Postgres {
+/** What every transaction of a user session sets besides the claims and role. */
+interface SessionOptions {
+  /**
+   * Transaction-local settings, e.g. `{ 'better_supabase.tenant': id }`.
+   * Names need a dot (custom settings); `role` and `request.jwt.claims` are
+   * set from the claims.
+   */
+  readonly settings?: Readonly<Record<string, string>>;
+  /** Runs every transaction with `begin read only`: writes fail with 25006. */
+  readonly readOnly?: boolean;
+}
+interface BetterPostgres {
   /** Connects as the connection-string role. On Supabase that bypasses RLS. */
   readonly admin: SqlClient;
   /** Runs every query as the given user, with RLS, like PostgREST does. */
-  asUser(claims: SqlClaims): SqlClient;
+  asUser(claims: SqlClaims, options?: SessionOptions): SqlClient;
   /** Runs every query as `anon`. */
   readonly anon: SqlClient;
+  /**
+   * Repositories' executor as the given user (`postgresExecutor(asUser(claims))`).
+   * `createServer` calls it for `ctx.sql`, so only apps that pass `postgres`
+   * bundle the SQL compiler.
+   */
+  executorFor(claims: SqlClaims, options?: SessionOptions): Executor;
   /** Runs `fn` in one transaction. Pass claims to run it as a user. */
   transaction<T>(fn: (client: SqlClient) => Promise<T>, options?: {
     readonly claims?: SqlClaims;
-  }): Promise<T>;
+  } & SessionOptions): Promise<T>;
   end(): Promise<void>;
   [Symbol.asyncDispose](): Promise<void>;
 }
@@ -66,6 +84,6 @@ interface Postgres {
  * transaction) runs in its own transaction; claims and role are
  * transaction-local, so nothing leaks back into the pool.
  */
-declare function createPostgres(options?: PostgresOptions): Postgres;
+declare function createPostgres(options?: PostgresOptions): BetterPostgres;
 //#endregion
-export { PostgresTimeouts as a, PostgresOptions as i, PgPoolClient as n, SqlClaims as o, Postgres as r, createPostgres as s, PgPool as t };
+export { PostgresTimeouts as a, createPostgres as c, PostgresOptions as i, PgPool as n, SessionOptions as o, PgPoolClient as r, SqlClaims as s, BetterPostgres as t };

package/dist/postgres/index.d.ts

@@ -1,7 +1,7 @@
-import { g as Operation } from "../executor-DynmIWhq.js";
-import { n as fromPgError, r as postgresExecutor, t as SqlClient } from "../executor-B26lgbHD.js";
-import { a as PostgresTimeouts, i as PostgresOptions, n as PgPoolClient, o as SqlClaims, r as Postgres, s as createPostgres, t as PgPool } from "../pool-B9qsLyFR.js";
-import { t as Compiler } from "../compiler-2zqGzxVZ.js";
+import { U as Operation } from "../executor-BunPOO-k.js";
+import { n as fromPgError, r as postgresExecutor, t as SqlClient } from "../executor-Cghdstwu.js";
+import { a as PostgresTimeouts, c as createPostgres, i as PostgresOptions, n as PgPool, o as SessionOptions, r as PgPoolClient, s as SqlClaims, t as BetterPostgres } from "../pool-C9voM4Kw.js";
+import { t as Compiler } from "../compiler-BXH_aZ7N.js";
 //#region src/compile/sql.d.ts
 interface SqlQuery {
   readonly text: string;
@@ -30,4 +30,4 @@ export declare function compileSql(op: Operation): SqlPlan;
 //#region src/postgres/compiler.d.ts
 export declare const sqlCompiler: Compiler<SqlPlan>;
 //#endregion
-export { type PgPool, type PgPoolClient, type Postgres, type PostgresOptions, type PostgresTimeouts, type SqlClaims, type SqlClient, type SqlPlan, type SqlQuery, createPostgres, fromPgError, postgresExecutor };
+export { type BetterPostgres, type PgPool, type PgPoolClient, type PostgresOptions, type PostgresTimeouts, type SessionOptions, type SqlClaims, type SqlClient, type SqlPlan, type SqlQuery, createPostgres, fromPgError, postgresExecutor };

package/dist/postgres/index.js

@@ -1,5 +1,5 @@
-import { n as quoteIdent, t as compileSql } from "../sql-BIgk12ew.js";
-import { n as postgresExecutor, t as fromPgError } from "../executor-C57jx2pn.js";
+import { n as quoteIdent, t as compileSql } from "../sql-Coh6n4cC.js";
+import { n as postgresExecutor, t as fromPgError } from "../executor-XycESQPH.js";
 import { Pool } from "pg";
 //#region src/postgres/pool.ts
 const DEFAULT_TIMEOUTS = {
@@ -22,6 +22,10 @@ function openPool(options) {
 		idleTimeoutMillis: options.idleTimeout ?? 1e4
 	});
 }
+const RESERVED_SETTINGS = /* @__PURE__ */ new Set(["role", "request.jwt.claims"]);
+function checkSettings(settings = {}) {
+	for (const name of Object.keys(settings)) if (!name.includes(".") || RESERVED_SETTINGS.has(name)) throw new TypeError(`Session setting "${name}": use a custom setting with a dot, such as better_supabase.tenant`);
+}
 /**
 * A pooled Postgres connection for jobs, scripts and tests. Each query (or
 * transaction) runs in its own transaction; claims and role are
@@ -39,8 +43,8 @@ function createPostgres(options = {}) {
 	};
 	/** Opens the transaction, then sets the timeouts, claims and role in one round trip. */
 	async function begin(client, session) {
-		await client.query("begin");
-		const settings = [];
+		await client.query(session?.readOnly ? "begin read only" : "begin");
+		const settings = Object.entries(session?.settings ?? {});
 		const timeout = session?.role === "authenticated" ? timeouts.authenticated : session?.role === "anon" ? timeouts.anon : timeouts.admin;
 		if (timeout !== void 0) settings.push(["statement_timeout", String(Math.trunc(timeout))]);
 		if (options.idleInTransactionTimeout !== void 0) settings.push(["idle_in_transaction_session_timeout", String(Math.trunc(options.idleInTransactionTimeout))]);
@@ -73,18 +77,24 @@ function createPostgres(options = {}) {
 		queryRaw: (text, params) => transaction(session, (client) => client.queryRaw(text, params)),
 		transaction: (fn) => transaction(session, fn)
 	});
-	const sessionFor = (claims) => ({
-		claims,
-		role: roleOf(claims)
-	});
+	const sessionFor = (claims, sessionOptions = {}) => {
+		checkSettings(sessionOptions.settings);
+		return {
+			claims,
+			role: roleOf(claims),
+			...sessionOptions.settings ? { settings: sessionOptions.settings } : {},
+			...sessionOptions.readOnly ? { readOnly: true } : {}
+		};
+	};
 	return {
 		admin: clientFor(void 0),
 		anon: clientFor({
 			claims: { role: "anon" },
 			role: "anon"
 		}),
-		asUser: (claims) => clientFor(sessionFor(claims)),
-		transaction: (fn, txOptions) => transaction(txOptions?.claims ? sessionFor(txOptions.claims) : void 0, fn),
+		asUser: (claims, sessionOptions) => clientFor(sessionFor(claims, sessionOptions)),
+		executorFor: (claims, sessionOptions) => postgresExecutor(clientFor(sessionFor(claims, sessionOptions))),
+		transaction: (fn, txOptions) => transaction(txOptions?.claims ? sessionFor(txOptions.claims, txOptions) : void 0, fn),
 		end: () => pool.end(),
 		[Symbol.asyncDispose]: () => pool.end()
 	};

package/dist/{postgrest-DmBlevh-.d.ts → postgrest-CruYKAvV.d.ts}

@@ -1,4 +1,4 @@
-import { g as Operation } from "./executor-DynmIWhq.js";
+import { U as Operation } from "./executor-BunPOO-k.js";
 //#region src/compile/postgrest.d.ts
 /**
  * A compiled PostgREST request, expressed as calls on the public

package/dist/{problem-CGt1ADix.js → problem-BW1KhzSG.js}

@@ -1,4 +1,4 @@
-import { n as dbError } from "./errors-Bl3rkOzo.js";
+import { n as dbError } from "./errors-DtwXa6b8.js";
 //#region src/core/problem.ts
 const PROBLEM_TYPE_BASE = "https://bettersupabase.com/problems/";
 const PROBLEM_CONTENT_TYPE = "application/problem+json";
@@ -12,6 +12,7 @@ const TITLES = {
 	not_null: "Required value missing",
 	exclusion: "Exclusion constraint violated",
 	invalid_input: "Invalid input",
+	invalid_value: "Stored value not representable",
 	raised: "Request rejected",
 	timeout: "Timed out",
 	serialization: "Concurrent update, retry",

package/dist/{problem-Z2RTQjZD.d.ts → problem-Blxe8S31.d.ts}

@@ -1,4 +1,4 @@
-import { b as ValidationIssue, m as DbErrorKind, p as DbError } from "./result-c2OYgCV2.js";
+import { _ as DbError, v as DbErrorKind, w as ValidationIssue } from "./executor-BunPOO-k.js";
 //#region src/core/problem.d.ts
 /** RFC 9457 Problem Details, with the `DbError` fields as extension members. */
 interface ProblemDetails {

package/dist/query/index.d.ts

@@ -1,2 +1,2 @@
-import { a as QueryHelpers, c as TableQueries, d as queryCache, f as BetterQueryMeta, i as Queries, l as createQueries, n as InfiniteOptionsOf, o as QueryKeyOf, p as invalidateTables, r as MutationOptionsOf, s as QueryOptionsOf, t as CreateQueriesOptions, u as invalidateOnMutation } from "../index-CriFFJ_p.js";
-export { type BetterQueryMeta, type CreateQueriesOptions, type InfiniteOptionsOf, type MutationOptionsOf, type Queries, type QueryHelpers, type QueryKeyOf, type QueryOptionsOf, type TableQueries, createQueries, invalidateOnMutation, invalidateTables, queryCache };
+import { a as MutationOptionsOf, c as QueryKeyOf, d as createQueries, f as invalidateOnMutation, h as invalidateTables, i as InfiniteOptionsOf, l as QueryOptionsOf, m as BetterQueryMeta, n as clearOnUserChange, o as QueriesOptions, p as queryCache, r as BetterQueries, s as QueryHelpers, t as UserChangeSource, u as TableQueries } from "../index-DgILJRXj.js";
+export { type BetterQueries, type BetterQueryMeta, type InfiniteOptionsOf, type MutationOptionsOf, type QueriesOptions, type QueryHelpers, type QueryKeyOf, type QueryOptionsOf, type TableQueries, type UserChangeSource, clearOnUserChange, createQueries, invalidateOnMutation, invalidateTables, queryCache };

package/dist/query/index.js

@@ -1,3 +1,3 @@
-import { t as invalidateTables } from "../invalidate-DbxuL2jL.js";
-import { n as invalidateOnMutation, r as queryCache, t as createQueries } from "../query-BdKLTPlj.js";
-export { createQueries, invalidateOnMutation, invalidateTables, queryCache };
+import { n as invalidateTables, t as clearOnUserChange } from "../user-change-CHFEUro1.js";
+import { n as invalidateOnMutation, r as queryCache, t as createQueries } from "../query-CCbo44lG.js";
+export { clearOnUserChange, createQueries, invalidateOnMutation, invalidateTables, queryCache };