better-supabase 0.4.0 → 0.5.0

package/dist/{config-C1CYcm6o.d.ts → config-T_ejwyd3.d.ts}

@@ -1,6 +1,150 @@
 /// <reference lib="esnext.temporal" />
-import { A as SchemaMeta, a as Casing, b as PermdockBucketPolicy, i as BucketPolicyName } from "./types-DONv9SHN.js";
+import { a as BucketPolicyName, j as SchemaMeta, o as Casing, t as AccessBucketPolicy, x as PermdockBucketPolicy } from "./types-Dnf_wRDz.js";
 import { GeneratorMetadata } from "@supabase/postgrest-typegen";
+//#region src/config/kits.d.ts
+/**
+ * `kits` in `better-supabase.config.ts`: how each SQL kit module maps onto
+ * the app's database. A module's contract (the functions other modules and
+ * the TypeScript side call) stays the same in every mode; only the tables
+ * behind it change.
+ */
+/**
+ * `managed`: the kit owns its tables. `adopt`: the kit writes its functions
+ * and views over tables the app already has (`tables` and `columns`), never
+ * `create table`. `custom`: the app implements the contract functions itself;
+ * the kit writes nothing and doctor checks the signatures (BS307).
+ */
+type KitMode = "managed" | "adopt" | "custom";
+/** Options every module takes. */
+interface KitModuleConfig {
+  readonly mode?: KitMode;
+  /** Schema of the module's functions and managed tables. Defaults to `better_supabase`. */
+  readonly schema?: string;
+  /**
+   * Logical table to `table` or `schema.table`, e.g.
+   * `{ memberships: 'public.organization_users' }`. An unqualified name is in
+   * `schema`. `null` marks an optional table the app doesn't have.
+   */
+  readonly tables?: Readonly<Record<string, string | null>>;
+  /**
+   * Logical table to logical column to column name, e.g.
+   * `{ memberships: { tenant: 'organization_id', role: 'role_id' } }`.
+   * `null` marks an optional column the adopted table doesn't have.
+   */
+  readonly columns?: Readonly<Record<string, Readonly<Record<string, string | null>>>>;
+  /** Type of tenant ids: `uuid` (default), `text`, `bigint` or `integer`. */
+  readonly idType?: string;
+  /**
+   * Kit action to permission key, checked through the access contract, e.g.
+   * `{ invite: 'organization.members.invite' }`.
+   */
+  readonly permissions?: Readonly<Record<string, string>>;
+  /** Module-specific options; each module's docs page lists them. */
+  readonly options?: Readonly<Record<string, unknown>>;
+  /**
+   * The app's optional `before_*` and `after_*` functions the module calls
+   * when they exist, e.g. `after_organization_create(org, user)`. They are
+   * looked up in `schema` (default `public`); `functions` maps a hook name
+   * to another function, e.g. `{ after_organization_create: 'app.seed_org' }`.
+   */
+  readonly hooks?: {
+    readonly schema?: string;
+    readonly functions?: Readonly<Record<string, string>>;
+  };
+  /**
+   * Whether the module writes its events to the outbox (`emit_event`) when
+   * the `outbox` module is installed. Defaults to true.
+   */
+  readonly events?: boolean;
+}
+/**
+ * Where the active tenant of a request comes from. Every source counts only
+ * while the caller is a member, so a stale claim or setting grants nothing.
+ */
+type ActiveTenantSource = "claim" | "resolver" | {
+  readonly profileColumn: string;
+  readonly key?: string;
+};
+/** URL tenancy: the tenant comes from the request (a slug), not a stored setting. */
+declare const DEFAULT_ACTIVE_TENANT: ActiveTenantSource;
+/**
+ * The access contract every kit checks permissions through:
+ * `can(scope, id, permission)`, `tenant_ids_with(permission)`,
+ * `is_platform(permission)` and `can_user(user, scope, id, permission)`.
+ */
+interface AccessKitConfig extends KitModuleConfig {
+  /**
+   * `roles`: a fixed role list from `roles` (the default). `catalog`: role,
+   * permission and override tables (`tables.roles`, `permissions`,
+   * `rolePermissions`, `overrides`, `platformAssignments`). `permdock`:
+   * PermDock's `permitted_<scope>_ids` and `permdock_has`. `custom`:
+   * expression templates in `functions`.
+   */
+  readonly model?: "roles" | "catalog" | "permdock" | "custom";
+  /**
+   * `roles` model: role name to permission keys. `*` grants everything and
+   * `prefix.*` a prefix. Defaults to owner, admin, member and viewer.
+   */
+  readonly roles?: Readonly<Record<string, readonly string[]>>;
+  /**
+   * `custom` model: SQL expressions with `{scope}`, `{id}`, `{permission}`
+   * and `{user}` placeholders, e.g.
+   * `{ can: 'public.authorize_scope({scope}::public.scope_type, {id}, {permission})' }`.
+   */
+  readonly functions?: {
+    readonly can?: string;
+    readonly tenantIdsWith?: string;
+    readonly isPlatform?: string;
+    readonly canUser?: string;
+    /** `{tenant}` and `{role}`: whether the caller may assign the role. Defaults to true. */
+    readonly canAssign?: string;
+    /** `{user}`: the permission claim for the access token hook. */
+    readonly permissionClaims?: string;
+  };
+  /**
+   * `roles` model: the JWT claim holding the caller's platform permission
+   * keys (an array). Defaults to `platform_permissions`.
+   */
+  readonly platformClaim?: string;
+  /**
+   * Columns that disable a tenant or a user when set, as
+   * `schema.table.column`, keyed by the table's `id` (tenant) or the column
+   * named in `userKey` (user). Disabled tenants and users get no permissions.
+   */
+  readonly disabled?: {
+    readonly tenant?: string;
+    readonly user?: string;
+    readonly userKey?: string;
+  };
+  readonly activeTenant?: ActiveTenantSource;
+  /** `permdock` model: PermDock's `rls.schema` and the scope tenants are. */
+  readonly permdock?: {
+    readonly schema?: string;
+    readonly scope?: string;
+  };
+}
+/** `kits` in the config, keyed by module name. */
+interface KitsConfig {
+  readonly access?: AccessKitConfig;
+  /** `AccessKitConfig` is listed so an `access` literal passes the excess-property check. */
+  readonly [module: string]: KitModuleConfig | AccessKitConfig | undefined;
+}
+/** A module's config with defaults applied. */
+interface ResolvedKitModule {
+  readonly mode: KitMode;
+  readonly schema: string;
+  readonly tables: Readonly<Record<string, string | null>>;
+  readonly columns: Readonly<Record<string, Readonly<Record<string, string | null>>>>;
+  readonly idType?: string;
+  readonly permissions: Readonly<Record<string, string>>;
+  readonly options: Readonly<Record<string, unknown>>;
+  readonly hooks: {
+    readonly schema: string;
+    readonly functions: Readonly<Record<string, string>>;
+  };
+  readonly events: boolean;
+}
+//#endregion
 //#region src/config/snapshot.d.ts
 /**
  * What `better-supabase introspect` reads from Postgres. `generator` is the
@@ -330,6 +474,8 @@ interface ClaimsConfig {
 interface ActorConfig {
   readonly createdBy?: string;
   readonly updatedBy?: string;
+  /** Defaults to `impersonated_by`, the column the SQL kit's `track_actor` fills. */
+  readonly impersonatedBy?: string;
 }
 interface PluginFlagsConfig {
   readonly timestamps?: boolean | TimestampsConfig;
@@ -342,8 +488,11 @@ interface BucketConfig {
   readonly public?: boolean;
   /** Path template with `{placeholders}`, e.g. `{orgId}/{customerId}/logo.webp`. */
   readonly path: string;
-  /** Generated storage policy, or a PermDock policy (`{ permdock, scope }`). */
-  readonly policy?: BucketPolicyName | PermdockBucketPolicy;
+  /**
+   * Generated storage policy, a PermDock policy (`{ permdock, scope }`) or
+   * an access contract policy (`{ access }`).
+   */
+  readonly policy?: BucketPolicyName | PermdockBucketPolicy | AccessBucketPolicy;
   readonly fileSizeLimit?: string;
   readonly allowedMimeTypes?: readonly string[];
 }
@@ -443,12 +592,19 @@ interface RealtimeConfig {
    * triggers with `better-supabase sql add realtime-tables`.
    */
   readonly tables?: readonly string[];
+  /**
+   * Tables in `tables` without a tenant column. They broadcast on one topic
+   * every signed-in user receives. With the `tenant` plugin, a table that
+   * lacks the tenant column and is not listed here fails to install.
+   */
+  readonly global?: readonly string[];
 }
 interface EntitlementsConfig {
   /**
    * `table.column` (or `schema.table.column`) holding each tenant's Stripe
-   * customer id, read by the `entitlements` SQL kit module. Defaults to
-   * `organizations.stripe_customer_id`.
+   * customer id, read by the `entitlements` SQL kit module. Required
+   * without the `organizations` module; with it, defaults to the
+   * `stripe_customer_id` column that module adds.
    */
   readonly customer?: string;
   /** The tenant id column of that table. Defaults to `id`. */
@@ -457,8 +613,9 @@ interface EntitlementsConfig {
    * With a PermDock manifest, `has_entitlement` and `feature_claims` read
    * PermDock's memberships (`member_<scope>_ids()` and
    * `member_<scope>_ids_for(user)`) instead of `better_supabase.memberships`.
-   * `scope` is the PermDock scope tenants are (default `organization`);
-   * `false` keeps the kit's memberships table.
+   * `scope` is the PermDock scope tenants are. It defaults to the manifest's
+   * root scope (the `rls.scopes` entry without `within`); `false` keeps the
+   * kit's memberships table.
    */
   readonly permdock?: false | {
     readonly scope?: string;
@@ -558,6 +715,12 @@ interface BetterSupabaseConfig {
    */
   readonly vectorSearch?: Readonly<Record<string, VectorSearchConfig>>;
   readonly sql?: SqlConfig;
+  /**
+   * How each SQL kit module maps onto the database: `managed` tables, or
+   * `adopt` and `custom` over the app's own, with table, column and
+   * permission names, keyed by module name.
+   */
+  readonly kits?: KitsConfig;
   readonly seed?: SeedConfig;
   readonly openapi?: OpenApiConfig;
   readonly doctor?: DoctorConfig;
@@ -589,11 +752,12 @@ interface ResolvedConfig {
   readonly claims: Required<ClaimsConfig>;
   readonly buckets: Readonly<Record<string, BucketConfig>>;
   readonly entitlements: {
-    readonly table: string;
-    readonly column: string;
+    /** Unset without `entitlements.customer`. */
+    readonly table?: string;
+    readonly column?: string;
     readonly key: string;
     readonly permdock: false | {
-      readonly scope: string;
+      readonly scope?: string;
     };
   };
   readonly permdock: Required<PermdockPathsConfig>;
@@ -605,6 +769,7 @@ interface ResolvedConfig {
   readonly topics: Readonly<Record<string, string>>;
   readonly realtime: Required<RealtimeConfig>;
   readonly sql: Required<SqlConfig>;
+  readonly kits: KitsConfig;
   readonly seed: Required<SeedConfig>;
   readonly openapi: Required<OpenApiConfig>;
   readonly doctor: Required<Omit<DoctorConfig, "claimsLimit">> & Pick<DoctorConfig, "claimsLimit">;
@@ -615,4 +780,4 @@ declare function defineConfig(config: BetterSupabaseConfig): BetterSupabaseConfi
 /** Applies defaults. Paths stay relative to `root`. */
 declare function resolveConfig(config: BetterSupabaseConfig, root: string): ResolvedConfig;
 //#endregion
-export { GeneratorMetadata as $, VectorSearchConfig as A, CatalogFunction as B, SoftDeleteConfig as C, TenantConfig as D, TableConfig as E, CatalogCheck as F, CatalogTable as G, CatalogGrant as H, CatalogColumn as I, ExtrasFunction as J, CatalogTrigger as K, CatalogColumnGrant as L, resolveConfig as M, resolveJsonSchema as N, TimestampsConfig as O, Catalog as P, ForeignKeyAction as Q, CatalogEnum as R, SeedConfig as S, SqlConfig as T, CatalogIndex as U, CatalogFunctionArg as V, CatalogPolicy as W, ExtrasHookFunction as X, ExtrasHook as Y, ExtrasTable as Z, PluginFlagsConfig as _, ClaimsConfig as a, ResolvedConfig as b, EntitlementsConfig as c, Generator as d, Snapshot as et, GeneratorInput as f, PermdockPathsConfig as g, OpenApiConfig as h, CONFIG_SCHEMA_URL as i, defineConfig as j, VectorDistance as k, ExposeConfig as l, JsonTypeConfig as m, BetterSupabaseConfig as n, SnapshotExtras as nt, CodecsConfig as o, JsonSchemaSource as p, CatalogUnique as q, BucketConfig as r, DoctorConfig as s, ActorConfig as t, SnapshotBucket as tt, GeneratedFile as u, Privilege as v, SourceConfig as w, ResolvedExpose as x, RealtimeConfig as y, CatalogForeignKey as z };
+export { GeneratorMetadata as $, VectorSearchConfig as A, CatalogFunction as B, SoftDeleteConfig as C, TenantConfig as D, TableConfig as E, CatalogCheck as F, CatalogTable as G, CatalogGrant as H, CatalogColumn as I, ExtrasFunction as J, CatalogTrigger as K, CatalogColumnGrant as L, resolveConfig as M, resolveJsonSchema as N, TimestampsConfig as O, Catalog as P, ForeignKeyAction as Q, CatalogEnum as R, SeedConfig as S, SqlConfig as T, CatalogIndex as U, CatalogFunctionArg as V, CatalogPolicy as W, ExtrasHookFunction as X, ExtrasHook as Y, ExtrasTable as Z, PluginFlagsConfig as _, ClaimsConfig as a, DEFAULT_ACTIVE_TENANT as at, ResolvedConfig as b, EntitlementsConfig as c, KitsConfig as ct, Generator as d, Snapshot as et, GeneratorInput as f, PermdockPathsConfig as g, OpenApiConfig as h, CONFIG_SCHEMA_URL as i, ActiveTenantSource as it, defineConfig as j, VectorDistance as k, ExposeConfig as l, ResolvedKitModule as lt, JsonTypeConfig as m, BetterSupabaseConfig as n, SnapshotExtras as nt, CodecsConfig as o, KitMode as ot, JsonSchemaSource as p, CatalogUnique as q, BucketConfig as r, AccessKitConfig as rt, DoctorConfig as s, KitModuleConfig as st, ActorConfig as t, SnapshotBucket as tt, GeneratedFile as u, Privilege as v, SourceConfig as w, ResolvedExpose as x, RealtimeConfig as y, CatalogForeignKey as z };

package/dist/{define-CRS2MRV3.d.ts → define-Bp_BZa5h.d.ts}

@@ -1,11 +1,10 @@
 /// <reference lib="esnext.temporal" />
-import { A as SchemaMeta, C as PrimaryKeyValue, D as Relations, E as RelationTypes, I as UniqueKeyName, L as UniqueWhere, N as TableKey, O as Row, P as TableMeta, R as Update, g as Insert, j as Simplify, k as Schema, n as AnyModels, t as AnyFunctions } from "./types-DONv9SHN.js";
-import { g as Operation, l as CountMode, r as Executor } from "./executor-B5IoUxLE.js";
-import { p as DbError, s as ThrowMapper, t as AsyncResult, v as ErrorMapper } from "./result-CqEsbgYs.js";
-import { a as EventHub, f as Logger, i as EventHandler, o as EventName, s as MutationNotice, u as RpcNotice } from "./events-B21UOhvP.js";
-import { a as ExtensionOf, g as WithExtension, h as RequestContext, n as AnyPlugin, r as ApplyExtension } from "./plugin-bNhvJwRh.js";
-import { t as StandardSchemaV1 } from "./standard-BsaCYQJc.js";
-import { i as PostgrestPlan } from "./postgrest-Bc-0Xw62.js";
+import { A as Schema, D as RelationTypes, F as TableMeta, L as UniqueKeyName, M as Simplify, O as Relations, P as TableKey, R as UniqueWhere, _ as Insert, j as SchemaMeta, k as Row, n as AnyFunctions, r as AnyModels, w as PrimaryKeyValue, z as Update } from "./types-Dnf_wRDz.js";
+import { I as CountMode, S as ErrorMapper, U as Operation, _ as DbError, a as AsyncResult, d as ThrowMapper, r as Executor } from "./executor-BunPOO-k.js";
+import { E as Logger, a as EventHub, i as EventHandler, o as EventName, s as MutationNotice, u as RpcNotice } from "./events-aIO7vsIk.js";
+import { _ as WithExtension, a as ExtensionOf, g as RequestContext, n as AnyPlugin, r as ApplyExtension } from "./plugin-o144f322.js";
+import { t as StandardSchemaV1 } from "./standard-J4YgMOLm.js";
+import { i as PostgrestPlan } from "./postgrest-CruYKAvV.js";
 //#region src/ir/args.d.ts
 interface BaseOps<V> {
   readonly eq?: V;
@@ -337,6 +336,11 @@ type DeleteExt<E, M extends AnyModels, T extends keyof M> = ApplyExtension<E, M,
 interface WriteArgs<M extends AnyModels, T extends keyof M> extends ReadArgs<M, T> {
   /** `false` skips `RETURNING` (needed when RLS hides the written row). */
   readonly returning?: boolean;
+  /**
+   * Keep caller-supplied values for columns that `timestamps()`, `actor()`
+   * and `softDelete()` fill (imports, backfills). Without it they are refused.
+   */
+  readonly override?: boolean;
 }
 interface UpdateArgs<M extends AnyModels, T extends keyof M> extends WriteArgs<M, T> {
   /**

package/dist/{define-Bh0AqTik.js → define-cNKzqwL_.js}

@@ -1,16 +1,18 @@
-import { n as dbError, t as DbException } from "./errors-L0xK41y_.js";
-import { a as invalidRequest, c as needsDecoding, o as decodeRows, r as builderFor, s as encodeValue } from "./simplify-Cqvfr9dj.js";
+import { t as cloneValue } from "./clone-BfgmLU90.js";
+import { n as dbError, t as DbException } from "./errors-DtwXa6b8.js";
+import { a as invalidRequest, r as builderFor } from "./simplify-_0oUKqCd.js";
 import { t as lookupOf } from "./lookup-BaP5bI27.js";
-import { n as nowInstant } from "./temporal-BwshQk0W.js";
 import { i as or, n as column, r as not, t as and } from "./types-6cYK9pbJ.js";
-import { i as ok, n as err, o as toDbError, s as withErrorMapper, t as AsyncResult } from "./result-Bj6yt33D.js";
+import { n as nowInstant } from "./temporal-CVlIV2DZ.js";
+import { n as decodeValue, r as encodeValue, t as decodeScalar } from "./wire-D2dT86vi.js";
+import { i as ok, n as err, o as toDbError, s as withErrorMapper, t as AsyncResult } from "./result-BKiliPY7.js";
 import { t as invalidationTargets } from "./tables-Cb-3_VWc.js";
 import { t as consoleLogger } from "./logger-glM28NVN.js";
-import { r as orderPlugins } from "./plugin-BqR6wKMB.js";
-import { a as postgrestExecutor, n as StatsRecorder, r as recordStats } from "./stats-C_YxA2r1.js";
-import { d as isQuerySpec, f as specTables, n as checkParams, o as isReadSet, r as containsPlaceholder, t as bindParams, u as createSpecs } from "./read-set-FWK8qQ58.js";
+import { i as orderPlugins, s as tenantOf } from "./plugin-DwARMuQp.js";
+import { a as postgrestExecutor, n as StatsRecorder, r as recordStats } from "./stats-Bqob3WqT.js";
+import { d as isQuerySpec, f as specTables, n as checkParams, o as isReadSet, r as containsPlaceholder, t as bindParams, u as createSpecs } from "./read-set-DQFt1N_Y.js";
 import { a as toBase64Url, t as base64ToText } from "./base64-D2gsioCY.js";
-import { t as validate } from "./standard-BRyBGTtp.js";
+import { t as validate } from "./standard-D7r6dMUu.js";
 //#region src/core/batch.ts
 /**
 * Holds operations until each of `readers` has either submitted one or
@@ -61,8 +63,9 @@ function rowKey(table, row) {
 }
 function cacheTargetOf(meta, notice) {
 	const table = meta.tables[notice.table];
-	const ids = table ? [...new Set(notice.rows.flatMap((row) => rowKey(table, row) ?? []))] : [];
-	const tenant = notice.context.tenant;
+	const rows = notice.rows.length > 0 ? notice.rows : notice.keys ?? [];
+	const ids = table ? [...new Set(rows.flatMap((row) => rowKey(table, row) ?? []))] : [];
+	const tenant = notice.tenant ?? notice.context.tenant;
 	return {
 		table: notice.table,
 		tables: notice.kind === "delete" ? invalidationTargets(meta, notice.table) : [notice.table],
@@ -108,6 +111,7 @@ function isDevelopment() {
 var EventHub = class {
 	#handlers = /* @__PURE__ */ new Map();
 	#warned = /* @__PURE__ */ new Set();
+	#pending = /* @__PURE__ */ new Set();
 	logger;
 	constructor(logger = consoleLogger) {
 		this.logger = logger;
@@ -130,6 +134,24 @@ var EventHub = class {
 	has(name) {
 		return (this.#handlers.get(name)?.size ?? 0) > 0;
 	}
+	/**
+	* Keeps async work a handler started (a sink send) until it settles, so
+	* adapters can hand it to `after()` or `waitUntil`. Its outcome is ignored:
+	* handlers report their own failures.
+	*/
+	track(work) {
+		const settled = Promise.resolve(work).then(() => void 0, () => void 0);
+		this.#pending.add(settled);
+		settled.then(() => this.#pending.delete(settled));
+	}
+	/** Whether tracked work is still running. */
+	get pending() {
+		return this.#pending.size > 0;
+	}
+	/** Resolves once the work tracked so far has settled. Never rejects. */
+	async settled() {
+		await Promise.all(this.#pending);
+	}
 	emit(name, event) {
 		const set = this.#handlers.get(name);
 		if (!set) return;
@@ -141,6 +163,99 @@ var EventHub = class {
 	}
 };
 //#endregion
+//#region src/ir/codec.ts
+/** Whether decoding `selection` changes anything, so plain reads skip the walk. */
+function needsDecoding(selection) {
+	let needs = decodes.get(selection);
+	if (needs === void 0) {
+		needs = computeNeedsDecoding(selection);
+		decodes.set(selection, needs);
+	}
+	return needs;
+}
+const decodes = /* @__PURE__ */ new WeakMap();
+function computeNeedsDecoding(selection) {
+	return selection.aggregate !== void 0 || selection.columns.some((column) => column.codec !== void 0) || selection.includes.some((include) => include.count !== void 0 || include.aggregate !== void 0 || needsDecoding(include.selection));
+}
+/** PostgREST returns `[{ count }]` for a `(count)` embed; SQL returns the number. */
+function countOf(value) {
+	if (Array.isArray(value)) {
+		const first = value[0];
+		return Number(first?.count ?? 0);
+	}
+	return Number(value ?? 0);
+}
+function measureOf(measure, value) {
+	if (value === void 0 || value === null) return null;
+	return measure.codec ? decodeScalar(measure.codec, value) : value;
+}
+/** Adds `value` under `row[key][name]`, next to what is already there. */
+function fold(row, folded, key, name, value) {
+	let target = folded.get(key);
+	if (!target) {
+		target = { ...row[key] };
+		folded.set(key, target);
+		row[key] = target;
+	}
+	target[name] = value;
+}
+const droppedKeys = /* @__PURE__ */ new WeakMap();
+/** Wire keys that decoding folds into `_count`, `_sum` and the rest. */
+function droppedOf(selection) {
+	let dropped = droppedKeys.get(selection);
+	if (!dropped) {
+		dropped = /* @__PURE__ */ new Set([...selection.aggregate?.measures.map((measure) => measure.key) ?? [], ...selection.includes.filter((include) => include.count !== void 0 || include.aggregate !== void 0).map((include) => include.alias)]);
+		droppedKeys.set(selection, dropped);
+	}
+	return dropped;
+}
+function decodeRow(selection, row) {
+	const dropped = droppedOf(selection);
+	const out = {};
+	for (const key in row) if (!dropped.has(key) && Object.hasOwn(row, key)) out[key] = row[key];
+	const folded = /* @__PURE__ */ new Map();
+	for (const column of selection.columns) {
+		if (!column.codec || !(column.alias in out)) continue;
+		try {
+			out[column.alias] = decodeValue(column.codec, out[column.alias]);
+		} catch (cause) {
+			if (!(cause instanceof DbException) || cause.error.kind !== "invalid_value") throw cause;
+			throw new DbException(dbError("invalid_value", `${column.alias}: ${cause.error.message}`, { column: column.alias }));
+		}
+	}
+	if (selection.aggregate) {
+		if (selection.aggregate.count) out["_count"] = countOf(out["_count"]);
+		for (const measure of selection.aggregate.measures) {
+			const value = row[measure.key];
+			fold(out, folded, `_${measure.fn}`, measure.alias, measureOf(measure, value));
+		}
+	}
+	for (const include of selection.includes) {
+		const value = row[include.alias];
+		if (include.count !== void 0) {
+			if (!(include.alias in row)) continue;
+			fold(out, folded, "_count", include.count, countOf(value));
+			continue;
+		}
+		if (include.aggregate !== void 0) {
+			if (!(include.alias in row)) continue;
+			const inner = Array.isArray(value) ? value[0] : value;
+			const measures = {};
+			for (const measure of include.selection.aggregate?.measures ?? []) measures[measure.alias] = measureOf(measure, inner?.[measure.key]);
+			fold(out, folded, `_${include.aggregate.fn}`, include.aggregate.name, measures);
+			continue;
+		}
+		if (Array.isArray(value)) out[include.alias] = value.map((item) => decodeRow(include.selection, item));
+		else if (value && typeof value === "object") out[include.alias] = decodeRow(include.selection, value);
+	}
+	return out;
+}
+/** Applies column codecs to returned rows, including embedded relations. */
+function decodeRows(selection, rows, checked = false) {
+	if (!selection || !checked && !needsDecoding(selection)) return rows;
+	return rows.map((row) => decodeRow(selection, row));
+}
+//#endregion
 //#region src/core/cursor.ts
 /** Opaque, URL-safe keyset cursor. */
 function encodeCursor(values) {
@@ -208,6 +323,42 @@ function signalOf(args) {
 	const signal = args?.["signal"];
 	return signal instanceof AbortSignal ? signal : void 0;
 }
+function cloneRows(rows) {
+	return rows.map((row) => cloneValue(row));
+}
+/** App-cased primary keys of `rows`, or of a `where` that pins the primary key. */
+function keysOf(op, rows) {
+	const { primaryKey } = op.table;
+	if (primaryKey.length === 0) return void 0;
+	const fromRows = rows.flatMap((row) => primaryKey.every((name) => row[name] !== void 0 && row[name] !== null) ? [Object.fromEntries(primaryKey.map((name) => [name, row[name]]))] : []);
+	if (fromRows.length > 0) return fromRows;
+	if (op.kind === "insert") return void 0;
+	return keysFromWhere(op.table, op.where);
+}
+function keysFromWhere(table, where) {
+	if (!where) return void 0;
+	const { byDb } = lookupOf(table);
+	const pinned = /* @__PURE__ */ new Map();
+	const items = [];
+	const flatten = (condition) => {
+		if (condition.kind === "and") condition.items.forEach(flatten);
+		else items.push(condition);
+	};
+	flatten(where);
+	for (const item of items) {
+		if (item.kind !== "column") continue;
+		const app = byDb.get(item.column)?.[0];
+		if (app === void 0 || !table.primaryKey.includes(app)) continue;
+		if (item.op === "eq") pinned.set(app, [item.value]);
+		else if (item.op === "in" && Array.isArray(item.value)) pinned.set(app, item.value);
+	}
+	if (pinned.size !== table.primaryKey.length) return void 0;
+	const [first, ...rest] = table.primaryKey;
+	if (first === void 0) return void 0;
+	if (rest.length === 0) return (pinned.get(first) ?? []).map((value) => ({ [first]: value }));
+	if ([...pinned.values()].some((values) => values.length !== 1)) return void 0;
+	return [Object.fromEntries(table.primaryKey.map((name) => [name, pinned.get(name)?.[0]]))];
+}
 function mutationKind(op) {
 	if (op.kind === "insert") return op.onConflict ? "upsert" : "insert";
 	return op.kind;
@@ -286,18 +437,25 @@ var OperationRunner = class {
 			truncated
 		});
 		if (!result.ok) return this.fail(op.table, result.error);
-		if (current.kind !== "select") await this.afterMutation(current, result.data);
+		if (current.kind !== "select") await this.afterMutation(op, current, result.data);
 		return result;
 	}
-	async afterMutation(op, data) {
+	async afterMutation(requested, op, data) {
 		const { runtime } = this;
 		const plugins = this.#hooks.afterMutation;
 		const listening = runtime.events.has("mutation");
 		if (plugins.length === 0 && !listening) return;
+		const kind = mutationKind(op);
+		const rows = cloneRows(data.rows);
+		const keys = keysOf(op, rows);
+		const tenant = tenantOf(runtime.context);
 		const event = {
 			table: op.table,
-			kind: mutationKind(op),
-			rows: data.rows,
+			kind,
+			intent: requested.kind === "delete" && op.kind === "update" ? "softDelete" : kind,
+			rows,
+			...keys ? { keys } : {},
+			...tenant === void 0 ? {} : { tenant },
 			context: runtime.context
 		};
 		for (const plugin of plugins) try {
@@ -309,7 +467,10 @@ var OperationRunner = class {
 		if (listening) runtime.events.emit("mutation", {
 			table: op.table.key,
 			kind: event.kind,
+			...event.intent ? { intent: event.intent } : {},
 			rows: event.rows,
+			...event.keys ? { keys: event.keys } : {},
+			...event.tenant === void 0 ? {} : { tenant: event.tenant },
 			context: event.context
 		});
 	}
@@ -325,9 +486,20 @@ var OperationRunner = class {
 		return err(withTable);
 	}
 };
+const sensitiveByTable = /* @__PURE__ */ new WeakMap();
+/** Database names of the table's `config.sensitive` columns. */
+function sensitiveColumnsOf(table) {
+	let sensitive = sensitiveByTable.get(table);
+	if (!sensitive) {
+		sensitive = new Set(lookupOf(table).entries.filter(([, column]) => column.sensitive).map(([, column]) => column.db));
+		sensitiveByTable.set(table, sensitive);
+	}
+	return sensitive;
+}
 /** Creates the runtime repository object for one table. */
 function createRepository(runner, table) {
 	const { builder } = runner.runtime;
+	const sensitiveDb = sensitiveColumnsOf(table);
 	const selection = (args) => builder.selection(table, args?.["select"], args?.["include"]);
 	const selectOp = (args, patch = {}) => ({
 		kind: "select",
@@ -342,7 +514,17 @@ function createRepository(runner, table) {
 		single: void 0,
 		...patch
 	});
-	const returning = (args) => args?.["returning"] === false ? void 0 : selection(args);
+	/** Writes return every column but the sensitive ones unless they are asked for. */
+	const returning = (args) => {
+		if (args?.["returning"] === false) return void 0;
+		const all = selection(args);
+		if (args?.["select"] !== void 0 || args?.["sensitive"] === true) return all;
+		const columns = all.columns.filter((entry) => !sensitiveDb.has(entry.column));
+		return columns.length === all.columns.length ? all : {
+			...all,
+			columns
+		};
+	};
 	const run = (op, args) => runner.run(op, optionsOf(args), signalOf(args));
 	let primaryOrder;
 	/** `primaryKey` holds app names; order terms take database names. */
@@ -579,8 +761,11 @@ function createRepository(runner, table) {
 		const number = args["page"] === void 0 ? 1 : Number(args["page"]);
 		if (!Number.isInteger(number) || number < 1) return runner.fail(table, dbError("invalid_request", "\"page\" must be a positive integer"));
 		const count = args["count"];
+		const orderBy = builder.orderBy(table, args["orderBy"]);
 		const op = selectOp(args, {
+			orderBy: orderBy.length > 0 || table.primaryKey.length === 0 ? orderBy : defaultOrder(),
 			limit: size + 1,
+			lookAhead: true,
 			offset: (number - 1) * size,
 			count: count === "exact" || count === "planned" || count === "estimated" ? count : void 0
 		});
@@ -616,6 +801,7 @@ function createRepository(runner, table) {
 			where: and(builder.where(table, args["where"]), after),
 			orderBy,
 			limit: size + 1,
+			lookAhead: true,
 			offset: void 0
 		});
 		const result = await run(op, args);
@@ -1169,4 +1355,4 @@ function defineSupabase(schema, options) {
 	return new BetterSupabase(schema, [], options);
 }
 //#endregion
-export { EventHub as a, rowKey as c, encodeCursor as i, rpcCacheTargets as l, defineSupabase as n, cacheTargetOf as o, decodeCursor as r, memoryCache as s, BetterSupabase as t };
+export { decodeRows as a, memoryCache as c, encodeCursor as i, rowKey as l, defineSupabase as n, EventHub as o, decodeCursor as r, cacheTargetOf as s, BetterSupabase as t, rpcCacheTargets as u };

package/dist/edge/index.d.ts

@@ -1,7 +1,7 @@
-import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
-import { t as BetterSupabase } from "../define-CRS2MRV3.js";
-import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-DgIbdrt8.js";
-import { a as ResourceRouteOptions } from "../resource-BJcaIfxi.js";
+import { P as TableKey, n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
+import { t as BetterSupabase } from "../define-Bp_BZa5h.js";
+import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-D2OQl62-.js";
+import { a as ResourceRouteOptions } from "../resource-D8iqWMr-.js";
 //#region src/edge/index.d.ts
 export interface CorsOptions {
   /** Allowed origins, or `*`. Defaults to `*`. */
@@ -16,8 +16,19 @@ export interface EdgeOptions extends ServerOptions {
   readonly cors?: boolean | CorsOptions;
   /** Include error details in problem responses. Defaults to `NODE_ENV === 'development'`. */
   readonly exposeErrors?: boolean;
+  /**
+   * Keeps the invocation alive for event sink sends a handler started, e.g.
+   * `EdgeRuntime.waitUntil` on Supabase. On Workers the `ctx` the runtime
+   * passes to `fetch` is used when this is unset.
+   */
+  readonly waitUntil?: (promise: Promise<unknown>) => void;
+}
+/** The platform context Workers pass as the third `fetch` argument. */
+export interface EdgeExecutionContext {
+  waitUntil(promise: Promise<unknown>): void;
 }
-export type EdgeHandler = (request: Request) => Promise<Response>;
+/** `Deno.serve` passes `(request, info)`, Workers `fetch` passes `(request, env, ctx)`. */
+export type EdgeHandler = (request: Request, env?: unknown, executionContext?: EdgeExecutionContext) => Promise<Response>;
 export type ResourceMap<M extends AnyModels> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T> | true; };
 export interface ResourcesOptions extends MiddlewareOptions {
   /** Path before the resources, e.g. `/api` (Supabase: `/<function-name>`). */