better-supabase 0.4.0 → 0.5.0

package/dist/permdock-sql-DgOfeixi.js

@@ -0,0 +1,51 @@
+import { i as sqlString, r as sqlIdent } from "./template-TxrGI5jR.js";
+//#region src/core/permdock-sql.ts
+const SCOPE = /^[a-z][a-z0-9_]*$/;
+/** PermDock's default `rls.schema`, a schema the Data API does not expose. */
+const PERMDOCK_SCHEMA = "permdock";
+/** PermDock splits a key with row conditions into `key#1`, `key#2`, ...: those need its own policies. */
+const SPLIT_KEY = /#\d+$/;
+function permdockKeyStatus(catalog, key) {
+	const entry = catalog.permissions.find((permission) => permission.key === key);
+	if (!entry) return "missing";
+	if (entry.rowConditions === true) return "row-conditions";
+	if (entry.rowConditions === false) return "scope-only";
+	return "no-flag";
+}
+const REGENERATE = "Regenerate permissions.catalog.json with a current `permdock catalog`, which writes rowConditions for every permission.";
+/**
+* The SQL condition for one PermDock permission key. `id` is the text
+* expression holding the scope id; it is compared as text, so a malformed
+* path never raises a cast error.
+*
+* The helpers check role and scope, not a permission's row conditions, so
+* the condition is only correct for permissions whose grants have none
+* beyond the scope. `#n` keys are refused. With a catalog, only keys it marks
+* `rowConditions: false` are accepted: `true`, a missing flag and a key the
+* catalog doesn't list are refused.
+*/
+function permdockCheck(where, target, key, id, catalog) {
+	if (key === "") throw new TypeError(`${where}: a PermDock permission key is empty`);
+	if (SPLIT_KEY.test(key)) throw new TypeError(`${where}: "${key}" is one part of a permission PermDock splits by row condition. Use PermDock's generated policies for it.`);
+	if (catalog) {
+		const status = permdockKeyStatus(catalog, key);
+		switch (status) {
+			case "scope-only": break;
+			case "row-conditions": throw new TypeError(`${where}: "${key}" has row conditions in PermDock's catalog (rowConditions: true), which the SQL helpers don't check. Use PermDock's generated policies for it.`);
+			case "no-flag": throw new TypeError(`${where}: "${key}" has no rowConditions flag in PermDock's catalog, so whether the SQL helpers check it fully is unknown. ${REGENERATE}`);
+			case "missing": throw new TypeError(`${where}: "${key}" is not in PermDock's catalog. ${REGENERATE}`);
+			default: return status;
+		}
+	}
+	const schema = sqlIdent(target.schema ?? "permdock");
+	if (target.scope === "global") return `(select ${schema}.permdock_has(${sqlString(key)}))`;
+	if (!SCOPE.test(target.scope)) throw new TypeError(`${where}: invalid PermDock scope "${target.scope}"`);
+	if (id === void 0) throw new TypeError(`${where}: scope "${target.scope}" needs a segment`);
+	return `${id} in (select t.id::text from ${schema}.${sqlIdent(`permitted_${target.scope}_ids`)}(${sqlString(key)}) as t(id))`;
+}
+/** The keys a bucket or topic PermDock policy names. */
+function permdockKeys(policy) {
+	return Object.values(policy.permdock).filter((key) => typeof key === "string");
+}
+//#endregion
+export { permdockKeys as i, permdockCheck as n, permdockKeyStatus as r, PERMDOCK_SCHEMA as t };

package/dist/plugin-DwARMuQp.js

@@ -0,0 +1,59 @@
+//#region src/core/plugin.ts
+const PLUGIN_API_VERSION = 1;
+const RANK = {
+	pre: 0,
+	normal: 1,
+	post: 2
+};
+/**
+* `rules()` checks the query as the caller wrote it, so it runs before every
+* other `pre` plugin (soft delete turns deletes into updates, tenant adds
+* filters).
+*/
+function rankOf(plugin) {
+	return plugin.name === "rules" ? -1 : RANK[plugin.enforce ?? "normal"];
+}
+/**
+* Plugins in hook order: `rules`, then `pre`, then unmarked in `use()` order,
+* then `post`.
+*/
+function orderPlugins(plugins) {
+	return plugins.map((plugin, index) => ({
+		plugin,
+		index
+	})).sort((a, b) => rankOf(a.plugin) - rankOf(b.plugin) || a.index - b.index).map(({ plugin }) => plugin);
+}
+/** Identity helper that fixes `apiVersion` and infers the plugin types. */
+function definePlugin(plugin) {
+	return {
+		...plugin,
+		apiVersion: 1
+	};
+}
+/** Tenants that `tenant()` resolved from claims, per connection context. */
+const resolvedTenants = /* @__PURE__ */ new WeakMap();
+/** Records the tenant a plugin resolved for `context`, so mutation notices carry it. */
+function recordTenant(context, tenant) {
+	resolvedTenants.set(context, tenant);
+}
+/** `context.tenant`, else the tenant a plugin resolved for this connection. */
+function tenantOf(context) {
+	return context.tenant ?? resolvedTenants.get(context);
+}
+/**
+* A symbol key, so JSON, claims and spread request data can't set it, while
+* `$with` copies it to the derived context.
+*/
+const ALL_TENANTS = Symbol("better-supabase.allTenants");
+/** `context`, marked so `tenant()` and tenant buckets skip their tenant scope. */
+function allTenantsContext(context) {
+	return {
+		...context,
+		[ALL_TENANTS]: true
+	};
+}
+function spansAllTenants(context) {
+	return Object.hasOwn(context, ALL_TENANTS);
+}
+//#endregion
+export { recordTenant as a, orderPlugins as i, allTenantsContext as n, spansAllTenants as o, definePlugin as r, tenantOf as s, PLUGIN_API_VERSION as t };

package/dist/{plugin-bNhvJwRh.d.ts → plugin-o144f322.d.ts}

@@ -1,7 +1,6 @@
 /// <reference lib="esnext.temporal" />
-import { A as SchemaMeta, P as TableMeta, n as AnyModels } from "./types-DONv9SHN.js";
-import { g as Operation, h as MutationOp, r as Executor } from "./executor-B5IoUxLE.js";
-import { v as ErrorMapper } from "./result-CqEsbgYs.js";
+import { F as TableMeta, j as SchemaMeta, r as AnyModels } from "./types-Dnf_wRDz.js";
+import { H as MutationOp, S as ErrorMapper, U as Operation, r as Executor } from "./executor-BunPOO-k.js";
 //#region src/core/plugin.d.ts
 /** Who is making the request. */
 interface Actor {
@@ -32,11 +31,24 @@ interface HookArgs {
   readonly now: () => Temporal.Instant;
 }
 type MutationKind = "insert" | "upsert" | "update" | "delete";
+/** What the caller asked for: `softDelete` is a `delete` that a plugin turned into an update. */
+type MutationIntent = MutationKind | "softDelete";
 interface MutationEvent {
   readonly table: TableMeta;
+  /** The statement that ran. */
   readonly kind: MutationKind;
-  /** App-cased rows returned by the mutation. */
+  /** What the caller asked for; differs from `kind` when a plugin rewrote the mutation. */
+  readonly intent?: MutationIntent;
+  /** App-cased rows returned by the mutation. A copy: changing it never changes the result. */
   readonly rows: readonly Readonly<Record<string, unknown>>[];
+  /**
+   * App-cased primary keys of the changed rows, when they are known: from
+   * the returned rows, or from a `where` on the primary key when nothing is
+   * returned (soft deletes, `returning: false`).
+   */
+  readonly keys?: readonly Readonly<Record<string, unknown>>[];
+  /** The tenant of the write: `context.tenant`, or the one `tenant()` resolved. */
+  readonly tenant?: string;
   readonly context: RequestContext;
 }
 /** Runtime handle passed to `Plugin.repository`. */
@@ -116,4 +128,4 @@ declare function definePlugin<const Name extends string, Ext extends RepositoryE
   readonly apiVersion?: 1;
 }): Plugin<Name, Ext>;
 //#endregion
-export { definePlugin as _, ExtensionOf as a, MutationEvent as c, PLUGIN_API_VERSION as d, Plugin as f, WithExtension as g, RequestContext as h, CallOptions as i, MutationKind as l, RepositoryExtension as m, AnyPlugin as n, HasFlag as o, RepositoryApi as p, ApplyExtension as r, HookArgs as s, Actor as t, NoExtension as u };
+export { WithExtension as _, ExtensionOf as a, MutationEvent as c, NoExtension as d, PLUGIN_API_VERSION as f, RequestContext as g, RepositoryExtension as h, CallOptions as i, MutationIntent as l, RepositoryApi as m, AnyPlugin as n, HasFlag as o, Plugin as p, ApplyExtension as r, HookArgs as s, Actor as t, MutationKind as u, definePlugin as v };

package/dist/plugins/actor/index.d.ts

@@ -1,4 +1,4 @@
-import { f as Plugin, h as RequestContext } from "../../plugin-bNhvJwRh.js";
+import { g as RequestContext, p as Plugin } from "../../plugin-o144f322.js";
 //#region src/plugins/actor/index.d.ts
 export interface ActorOptions {
   /** Custom actor id resolution. Defaults to `context.actor.id` for users and services. */
@@ -7,7 +7,10 @@ export interface ActorOptions {
 /**
  * Stamps the columns generated as `Flags.actor`: `createdBy` on insert and
  * `updatedBy` on insert and update. Soft deletes are updates, so they record
- * who deleted the row. Without an actor (anonymous requests) nothing is set.
+ * who deleted the row. `impersonatedBy` gets `context.actor.impersonator` on
+ * an impersonated insert or update and is left alone otherwise, so a user's
+ * own update keeps the stamp, like the SQL kit's `track_actor`. Without an
+ * actor (anonymous requests) nothing is set.
  */
 export declare function actor(options?: ActorOptions): Plugin<"actor">;
 //#endregion

package/dist/plugins/actor/index.js

@@ -1,5 +1,5 @@
-import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
-import { i as insertsOnly, l as withDefault, t as dbName } from "../../shared-DnoCdMDr.js";
+import { r as definePlugin } from "../../plugin-DwARMuQp.js";
+import { a as insertsOnly, i as guardManaged, t as dbName, u as withDefault } from "../../shared-D1dRUrAg.js";
 //#region src/plugins/actor/index.ts
 function defaultActor(context) {
 	const actor = context.actor;
@@ -8,30 +8,44 @@ function defaultActor(context) {
 /**
 * Stamps the columns generated as `Flags.actor`: `createdBy` on insert and
 * `updatedBy` on insert and update. Soft deletes are updates, so they record
-* who deleted the row. Without an actor (anonymous requests) nothing is set.
+* who deleted the row. `impersonatedBy` gets `context.actor.impersonator` on
+* an impersonated insert or update and is left alone otherwise, so a user's
+* own update keeps the stamp, like the SQL kit's `track_actor`. Without an
+* actor (anonymous requests) nothing is set.
 */
 function actor(options = {}) {
 	const resolve = options.resolve ?? defaultActor;
 	return definePlugin({
 		name: "actor",
-		beforeMutation(op, { table, context }) {
+		beforeMutation(op, { table, context, options }) {
 			const flags = table.flags.actor;
 			if (!flags) return op;
-			const id = resolve(context);
-			if (id === void 0) return op;
 			const created = dbName(table, flags.createdBy);
 			const updated = dbName(table, flags.updatedBy);
+			const impersonated = dbName(table, flags.impersonatedBy);
+			guardManaged(op, [
+				created,
+				updated,
+				impersonated
+			], "actor", options);
+			const id = resolve(context);
+			if (id === void 0) return op;
+			const impersonator = context.actor?.impersonator;
+			const stamp = (row) => {
+				const stamped = withDefault(row, updated, id);
+				return impersonator === void 0 ? stamped : withDefault(stamped, impersonated, impersonator);
+			};
 			switch (op.kind) {
 				case "insert": {
 					const stampCreated = insertsOnly(op);
 					return {
 						...op,
-						rows: op.rows.map((row) => withDefault(stampCreated ? withDefault(row, created, id) : row, updated, id))
+						rows: op.rows.map((row) => stamp(stampCreated ? withDefault(row, created, id) : row))
 					};
 				}
 				case "update": return {
 					...op,
-					set: withDefault(op.set, updated, id)
+					set: stamp(op.set)
 				};
 				case "delete": return op;
 				default: return op;

package/dist/plugins/rules/index.d.ts

@@ -1,5 +1,5 @@
-import { g as Operation } from "../../executor-B5IoUxLE.js";
-import { f as Plugin, m as RepositoryExtension } from "../../plugin-bNhvJwRh.js";
+import { U as Operation } from "../../executor-BunPOO-k.js";
+import { h as RepositoryExtension, p as Plugin } from "../../plugin-o144f322.js";
 //#region src/plugins/rules/index.d.ts
 export type RuleLevel = "off" | "warn" | "error";
 /** A level, or a level with the rule's option: `['error', 500]`. */

package/dist/plugins/rules/index.js

@@ -1,7 +1,7 @@
-import { n as dbError, t as DbException } from "../../errors-L0xK41y_.js";
+import { n as dbError, t as DbException } from "../../errors-DtwXa6b8.js";
 import { t as lookupOf } from "../../lookup-BaP5bI27.js";
-import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
-import { n as claimAt, r as claimsOf } from "../../claims-BAf6c7is.js";
+import { r as definePlugin } from "../../plugin-DwARMuQp.js";
+import { i as tenantClaimPaths, n as claimAt, r as claimsOf } from "../../claims-BAf6c7is.js";
 //#region src/plugins/rules/index.ts
 /** Catches data-exposure and correctness mistakes; everything else off. */
 function safe() {
@@ -121,8 +121,12 @@ function checks(rules) {
 	const maxLimit = optionOf(rules.maxLimit, 1e3);
 	const maxDepth = optionOf(rules.maxIncludeDepth, 3);
 	return {
-		noUnboundedFindMany: (op) => op.kind === "select" && op.single === void 0 && !op.head && op.limit === void 0 ? "findMany without limit reads every visible row" : void 0,
-		maxLimit: (op) => op.kind === "select" && op.limit !== void 0 && op.limit > maxLimit ? `limit ${op.limit} is above the maximum of ${maxLimit}` : void 0,
+		noUnboundedFindMany: (op) => op.kind === "select" && op.single === void 0 && !op.head && op.limit === void 0 && op.selection.aggregate === void 0 ? "findMany without limit reads every visible row" : void 0,
+		maxLimit: (op) => {
+			if (op.kind !== "select" || op.limit === void 0) return;
+			const limit = op.lookAhead === true ? op.limit - 1 : op.limit;
+			return limit > maxLimit ? `limit ${limit} is above the maximum of ${maxLimit}` : void 0;
+		},
 		requireOrderByForCursor: (op) => op.kind === "select" && !op.head && op.orderBy.length === 0 && (op.offset !== void 0 || op.limit !== void 0 && op.limit > 1) ? "paging without orderBy returns rows in no stable order" : void 0,
 		maxIncludeDepth: (op) => {
 			const max = maxDepth;
@@ -132,14 +136,15 @@ function checks(rules) {
 		},
 		requireTenantContext: (op, { context, schema }) => {
 			if (!op.table.flags.tenant || context.actor?.kind === "service") return;
-			const claim = optionOf(rules.requireTenantContext, claimsOf(schema).tenant);
-			return context.tenant === void 0 && claimAt(context.claims, claim) === void 0 ? `"${op.table.key}" is tenant-scoped but the request has no tenant (context.tenant or claim "${claim}")` : void 0;
+			if (typeof context.tenant === "string") return;
+			const claim = optionOf(rules.requireTenantContext, void 0);
+			const paths = claim === void 0 ? tenantClaimPaths(claimsOf(schema).tenant) : [claim];
+			return paths.some((path) => claimAt(context.claims, path) !== void 0) ? void 0 : `"${op.table.key}" is tenant-scoped but the request has no tenant (context.tenant or claim ${paths.map((path) => `"${path}"`).join(" or ")})`;
 		},
 		noAdminInBrowser: (_op, { context }) => context.actor?.kind === "service" && isBrowser() ? "a service-role connection is running in a browser" : void 0,
 		noSensitiveSelect: (op, { options }) => {
-			if (options["sensitive"] === true) return;
-			const selection = op.kind === "select" ? op.selection : op.returning;
-			const columns = selection ? sensitiveColumns(selection, op.table) : [];
+			if (options["sensitive"] === true || op.kind !== "select") return;
+			const columns = sensitiveColumns(op.selection, op.table);
 			return columns.length > 0 ? `reads sensitive column(s) ${columns.join(", ")}; pass { sensitive: true } to allow` : void 0;
 		},
 		noDeleteManyWithoutWhere: (op) => op.kind === "delete" && op.where === void 0 ? "delete without where removes every visible row" : void 0,

package/dist/plugins/soft-delete/index.d.ts

@@ -1,6 +1,6 @@
-import { C as PrimaryKeyValue } from "../../types-DONv9SHN.js";
-import { t as AsyncResult } from "../../result-CqEsbgYs.js";
-import { f as Plugin, m as RepositoryExtension, o as HasFlag } from "../../plugin-bNhvJwRh.js";
+import { w as PrimaryKeyValue } from "../../types-Dnf_wRDz.js";
+import { a as AsyncResult } from "../../executor-BunPOO-k.js";
+import { h as RepositoryExtension, o as HasFlag, p as Plugin } from "../../plugin-o144f322.js";
 //#region src/plugins/soft-delete/index.d.ts
 export interface SoftDeleteFindArgs {
   /** Include soft-deleted rows of the queried table. */

package/dist/plugins/soft-delete/index.js

@@ -1,8 +1,8 @@
 import { t as and } from "../../types-6cYK9pbJ.js";
-import { i as ok, t as AsyncResult } from "../../result-Bj6yt33D.js";
-import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
+import { i as ok, t as AsyncResult } from "../../result-BKiliPY7.js";
+import { r as definePlugin } from "../../plugin-DwARMuQp.js";
 import { n as scopeOperation } from "../../scope-CDHcS7dE.js";
-import { a as isNotNull, o as isNull, t as dbName } from "../../shared-DnoCdMDr.js";
+import { a as insertsOnly, i as guardManaged, o as isNotNull, s as isNull, t as dbName, u as withDefault } from "../../shared-D1dRUrAg.js";
 //#region src/plugins/soft-delete/index.ts
 function deletedColumn(table) {
 	return dbName(table, table.flags.softDelete);
@@ -39,9 +39,17 @@ function softDelete() {
 			};
 		},
 		beforeMutation(op, { table, options, now }) {
-			if (op.kind !== "delete" || options["hard"] === true) return op;
 			const column = deletedColumn(table);
 			if (!column) return op;
+			guardManaged(op, [column], "softDelete", options);
+			if (op.kind === "insert") {
+				if (insertsOnly(op)) return op;
+				return {
+					...op,
+					rows: op.rows.map((row) => withDefault(row, column, null))
+				};
+			}
+			if (op.kind !== "delete" || options["hard"] === true) return op;
 			return {
 				kind: "update",
 				table,
@@ -58,7 +66,8 @@ function softDelete() {
 				const result = await update(key, { [flag]: null }, {
 					...args,
 					withDeleted: true,
-					returning: false
+					returning: false,
+					override: true
 				});
 				return result.ok ? ok(void 0) : result;
 			}) };

package/dist/plugins/tenant/index.d.ts

@@ -1,5 +1,5 @@
-import { A as SchemaMeta } from "../../types-DONv9SHN.js";
-import { f as Plugin, h as RequestContext, m as RepositoryExtension, o as HasFlag } from "../../plugin-bNhvJwRh.js";
+import { j as SchemaMeta } from "../../types-Dnf_wRDz.js";
+import { g as RequestContext, h as RepositoryExtension, o as HasFlag, p as Plugin } from "../../plugin-o144f322.js";
 //#region src/plugins/tenant/index.d.ts
 /**
  * Dotted paths to the string claims of `C` (up to three levels), e.g.

package/dist/plugins/tenant/index.js

@@ -1,8 +1,8 @@
-import { n as dbError, t as DbException } from "../../errors-L0xK41y_.js";
-import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
+import { n as dbError, t as DbException } from "../../errors-DtwXa6b8.js";
+import { a as recordTenant, o as spansAllTenants, r as definePlugin } from "../../plugin-DwARMuQp.js";
 import { n as scopeOperation } from "../../scope-CDHcS7dE.js";
 import { i as tenantClaimPaths, n as claimAt, r as claimsOf } from "../../claims-BAf6c7is.js";
-import { n as equals, r as forbidden, t as dbName } from "../../shared-DnoCdMDr.js";
+import { a as insertsOnly, n as equals, r as forbidden, t as dbName } from "../../shared-D1dRUrAg.js";
 //#region src/plugins/tenant/index.ts
 /**
 * The tenant for a request: `context.tenant`, then the configured claim.
@@ -18,6 +18,11 @@ function resolveTenant(context, options = {}, schema) {
 		if (value !== void 0) return value;
 	}
 }
+/** Tenant columns may be numeric; the resolved tenant is always a string. */
+function sameTenant(value, id) {
+	if (value === id) return true;
+	return (typeof value === "number" || typeof value === "bigint") && String(value) === id;
+}
 function tenantColumn(table) {
 	return dbName(table, table.flags.tenant);
 }
@@ -32,21 +37,32 @@ function tenant(options = {}) {
 	const onMissing = options.onMissing ?? "error";
 	/** A context is fixed for a connection, so its tenant is resolved once. */
 	const resolved = /* @__PURE__ */ new WeakMap();
-	const current = (table, context, schema) => {
+	const resolvedFor = (context, schema) => {
 		let id = resolved.get(context);
 		if (id === void 0 && !resolved.has(context)) {
 			id = resolveTenant(context, options, schema);
 			resolved.set(context, id);
+			if (id !== void 0) recordTenant(context, id);
 		}
-		if (id === void 0 && onMissing === "error" && tenantColumn(table)) throw new DbException(dbError("forbidden", `No tenant in the request context for "${table.key}"`));
+		return id;
+	};
+	const missing = (table) => {
+		throw new DbException(dbError("forbidden", `No tenant in the request context for "${table.key}"`));
+	};
+	const current = (table, context, schema) => {
+		const id = resolvedFor(context, schema);
+		if (id === void 0 && onMissing === "error" && tenantColumn(table)) missing(table);
 		return id;
 	};
 	return definePlugin({
 		name: "tenant",
 		transformQuery(op, { context, schema, options: call }) {
-			if (call["allTenants"] === true) return op;
-			const id = current(op.table, context, schema);
-			if (id === void 0) return op;
+			if (call["allTenants"] === true || spansAllTenants(context)) return op;
+			const id = resolvedFor(context, schema);
+			if (id === void 0) {
+				if (onMissing === "error") scopeOperation(op, (table) => tenantColumn(table) ? missing(table) : void 0);
+				return op;
+			}
 			return scopeOperation(op, (table) => {
 				const column = tenantColumn(table);
 				return column ? equals(column, id) : void 0;
@@ -54,22 +70,24 @@ function tenant(options = {}) {
 		},
 		beforeMutation(op, { table, context, schema, options: call }) {
 			const column = tenantColumn(table);
-			if (!column || call["allTenants"] === true) return op;
+			if (!column || call["allTenants"] === true || spansAllTenants(context)) return op;
 			const id = current(table, context, schema);
 			if (id === void 0) return op;
 			switch (op.kind) {
-				case "insert": return {
-					...op,
-					rows: op.rows.map((row) => {
-						if (column in row && row[column] !== id) forbidden(`Cannot write a ${table.key} row for another tenant`);
-						return {
-							...row,
-							[column]: id
-						};
-					})
-				};
+				case "insert":
+					if (!insertsOnly(op) && !op.onConflict?.columns.includes(column)) forbidden(`An upsert on ${table.key} that updates on conflict needs the tenant column "${column}" in its conflict target`);
+					return {
+						...op,
+						rows: op.rows.map((row) => {
+							if (column in row && !sameTenant(row[column], id)) forbidden(`Cannot write a ${table.key} row for another tenant`);
+							return {
+								...row,
+								[column]: id
+							};
+						})
+					};
 				case "update":
-					if (column in op.set && op.set[column] !== id) forbidden(`Cannot move a ${table.key} row to another tenant`);
+					if (column in op.set && !sameTenant(op.set[column], id)) forbidden(`Cannot move a ${table.key} row to another tenant`);
 					return op;
 				case "delete": return op;
 				default: return op;

package/dist/plugins/timestamps/index.d.ts

@@ -1,4 +1,4 @@
-import { f as Plugin } from "../../plugin-bNhvJwRh.js";
+import { p as Plugin } from "../../plugin-o144f322.js";
 //#region src/plugins/timestamps/index.d.ts
 /**
  * Stamps the columns generated as `Flags.timestamps`: `createdAt` on insert,

package/dist/plugins/timestamps/index.js

@@ -1,5 +1,5 @@
-import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
-import { i as insertsOnly, l as withDefault, t as dbName } from "../../shared-DnoCdMDr.js";
+import { r as definePlugin } from "../../plugin-DwARMuQp.js";
+import { a as insertsOnly, i as guardManaged, t as dbName, u as withDefault } from "../../shared-D1dRUrAg.js";
 //#region src/plugins/timestamps/index.ts
 /**
 * Stamps the columns generated as `Flags.timestamps`: `createdAt` on insert,
@@ -9,11 +9,12 @@ import { i as insertsOnly, l as withDefault, t as dbName } from "../../shared-Dn
 function timestamps() {
 	return definePlugin({
 		name: "timestamps",
-		beforeMutation(op, { table, now }) {
+		beforeMutation(op, { table, now, options }) {
 			const flags = table.flags.timestamps;
 			if (!flags) return op;
 			const created = dbName(table, flags.createdAt);
 			const updated = dbName(table, flags.updatedAt);
+			guardManaged(op, [created, updated], "timestamps", options);
 			const stamp = now().toString();
 			switch (op.kind) {
 				case "insert": {

package/dist/plugins/validation/index.d.ts

@@ -1,5 +1,5 @@
-import { f as Plugin } from "../../plugin-bNhvJwRh.js";
-import { t as StandardSchemaV1 } from "../../standard-BsaCYQJc.js";
+import { p as Plugin } from "../../plugin-o144f322.js";
+import { t as StandardSchemaV1 } from "../../standard-J4YgMOLm.js";
 //#region src/plugins/validation/index.d.ts
 export interface TableValidators {
   /** Validates inserts and upserts, with app-cased keys. */

package/dist/plugins/validation/index.js

@@ -1,13 +1,33 @@
-import { n as dbError, t as DbException } from "../../errors-L0xK41y_.js";
-import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
-import { t as validate } from "../../standard-BRyBGTtp.js";
-import { c as toDb, s as toApp } from "../../shared-DnoCdMDr.js";
+import { n as dbError, t as DbException } from "../../errors-DtwXa6b8.js";
+import { n as decodeValue, r as encodeValue } from "../../wire-D2dT86vi.js";
+import { r as definePlugin } from "../../plugin-DwARMuQp.js";
+import { t as validate } from "../../standard-D7r6dMUu.js";
+import { c as toApp, l as toDb } from "../../shared-D1dRUrAg.js";
 //#region src/plugins/validation/index.ts
+/**
+* Rows reach plugins in wire form (ISO text, decimal text), while generated
+* validators expect the column codecs' app values (Temporal, `bigint`).
+*/
+function decoded(table, row) {
+	const app = toApp(table, row);
+	for (const [name, value] of Object.entries(app)) {
+		const codec = table.columns[name]?.codec;
+		if (codec === void 0 || typeof value !== "string") continue;
+		try {
+			app[name] = decodeValue(codec, value);
+		} catch {}
+	}
+	return app;
+}
+function encoded(row) {
+	for (const [name, value] of Object.entries(row)) row[name] = encodeValue(value);
+	return row;
+}
 async function check(schema, table, row, label, index) {
-	const result = await validate(schema, toApp(table, row), label);
+	const result = await validate(schema, decoded(table, row), label);
 	if (result.ok) {
 		const output = result.data;
-		return typeof output === "object" && output !== null ? toDb(table, output) : { ...row };
+		return typeof output === "object" && output !== null ? encoded(toDb(table, output)) : { ...row };
 	}
 	const error = result.error;
 	if (index === void 0 || error.kind !== "validation") throw new DbException(error);

package/dist/{pool-DFwEQwmN.d.ts → pool-C9voM4Kw.d.ts}

@@ -1,5 +1,5 @@
-import { r as Executor } from "./executor-B5IoUxLE.js";
-import { t as SqlClient } from "./executor-CZ7ImRiD.js";
+import { r as Executor } from "./executor-BunPOO-k.js";
+import { t as SqlClient } from "./executor-Cghdstwu.js";
 //#region src/postgres/pool.d.ts
 /** The part of a `pg` pool client `createPostgres` uses. */
 interface PgPoolClient {
@@ -48,11 +48,22 @@ interface SqlClaims {
   readonly role?: string;
   readonly [claim: string]: unknown;
 }
+/** What every transaction of a user session sets besides the claims and role. */
+interface SessionOptions {
+  /**
+   * Transaction-local settings, e.g. `{ 'better_supabase.tenant': id }`.
+   * Names need a dot (custom settings); `role` and `request.jwt.claims` are
+   * set from the claims.
+   */
+  readonly settings?: Readonly<Record<string, string>>;
+  /** Runs every transaction with `begin read only`: writes fail with 25006. */
+  readonly readOnly?: boolean;
+}
 interface BetterPostgres {
   /** Connects as the connection-string role. On Supabase that bypasses RLS. */
   readonly admin: SqlClient;
   /** Runs every query as the given user, with RLS, like PostgREST does. */
-  asUser(claims: SqlClaims): SqlClient;
+  asUser(claims: SqlClaims, options?: SessionOptions): SqlClient;
   /** Runs every query as `anon`. */
   readonly anon: SqlClient;
   /**
@@ -60,11 +71,11 @@ interface BetterPostgres {
    * `createServer` calls it for `ctx.sql`, so only apps that pass `postgres`
    * bundle the SQL compiler.
    */
-  executorFor(claims: SqlClaims): Executor;
+  executorFor(claims: SqlClaims, options?: SessionOptions): Executor;
   /** Runs `fn` in one transaction. Pass claims to run it as a user. */
   transaction<T>(fn: (client: SqlClient) => Promise<T>, options?: {
     readonly claims?: SqlClaims;
-  }): Promise<T>;
+  } & SessionOptions): Promise<T>;
   end(): Promise<void>;
   [Symbol.asyncDispose](): Promise<void>;
 }
@@ -75,4 +86,4 @@ interface BetterPostgres {
  */
 declare function createPostgres(options?: PostgresOptions): BetterPostgres;
 //#endregion
-export { PostgresTimeouts as a, PostgresOptions as i, PgPool as n, SqlClaims as o, PgPoolClient as r, createPostgres as s, BetterPostgres as t };
+export { PostgresTimeouts as a, createPostgres as c, PostgresOptions as i, PgPool as n, SessionOptions as o, PgPoolClient as r, SqlClaims as s, BetterPostgres as t };

package/dist/postgres/index.d.ts

@@ -1,7 +1,7 @@
-import { g as Operation } from "../executor-B5IoUxLE.js";
-import { n as fromPgError, r as postgresExecutor, t as SqlClient } from "../executor-CZ7ImRiD.js";
-import { a as PostgresTimeouts, i as PostgresOptions, n as PgPool, o as SqlClaims, r as PgPoolClient, s as createPostgres, t as BetterPostgres } from "../pool-DFwEQwmN.js";
-import { t as Compiler } from "../compiler-DB3aSFOA.js";
+import { U as Operation } from "../executor-BunPOO-k.js";
+import { n as fromPgError, r as postgresExecutor, t as SqlClient } from "../executor-Cghdstwu.js";
+import { a as PostgresTimeouts, c as createPostgres, i as PostgresOptions, n as PgPool, o as SessionOptions, r as PgPoolClient, s as SqlClaims, t as BetterPostgres } from "../pool-C9voM4Kw.js";
+import { t as Compiler } from "../compiler-BXH_aZ7N.js";
 //#region src/compile/sql.d.ts
 interface SqlQuery {
   readonly text: string;
@@ -30,4 +30,4 @@ export declare function compileSql(op: Operation): SqlPlan;
 //#region src/postgres/compiler.d.ts
 export declare const sqlCompiler: Compiler<SqlPlan>;
 //#endregion
-export { type BetterPostgres, type PgPool, type PgPoolClient, type PostgresOptions, type PostgresTimeouts, type SqlClaims, type SqlClient, type SqlPlan, type SqlQuery, createPostgres, fromPgError, postgresExecutor };
+export { type BetterPostgres, type PgPool, type PgPoolClient, type PostgresOptions, type PostgresTimeouts, type SessionOptions, type SqlClaims, type SqlClient, type SqlPlan, type SqlQuery, createPostgres, fromPgError, postgresExecutor };