gencow 0.1.118 → 0.1.119

package/bin/gencow.mjs

@@ -1808,15 +1808,20 @@ ${BOLD}BaaS commands (login required):${RESET}
   ${GREEN}deploy${RESET}           Bundle gencow/ and deploy to platform
                      ${DIM}--static [dir]  Deploy static files (dist/, out/, build/)${RESET}
                      ${DIM}--no-backend    Skip backend auto-deploy in --static mode${RESET}
+                     ${DIM}--prod          Deploy to production app (Pro+, auto-creates)${RESET}
+                     ${DIM}--rollback      Rollback to previous deployment${RESET}
                      ${DIM}--force, -f     Skip dependency audit${RESET}
-  ${GREEN}env list${RESET}         List cloud env vars
+  ${GREEN}env list${RESET}         List cloud env vars ${DIM}(--prod for production)${RESET}
   ${GREEN}env set K=V${RESET}      Set cloud env var ${DIM}(hot-reload, no restart)${RESET}
   ${GREEN}env unset KEY${RESET}    Remove cloud env var
-  ${GREEN}env push${RESET}         Push .env to cloud
+  ${GREEN}env push${RESET}         Push .env to cloud ${DIM}(--prod reads .env.production)${RESET}
   ${GREEN}files upload${RESET}     Upload files to app storage ${DIM}(--recursive for dirs)${RESET}
   ${GREEN}files list${RESET}       List uploaded files
   ${GREEN}files delete${RESET}     Delete uploaded file ${DIM}(--yes to skip confirm)${RESET}
   ${GREEN}files url${RESET}        Get serving URL for a file
+  ${GREEN}config set${RESET}       Set app config ${DIM}(image.maxWidth, image.quality)${RESET}
+  ${GREEN}config get${RESET}       Show current app config
+  ${GREEN}config reset${RESET}     Reset app config to tier defaults
   ${GREEN}domain set${RESET}       Connect custom domain ${DIM}(myapp.com)${RESET}
   ${GREEN}domain status${RESET}    Check domain DNS/TLS status
   ${GREEN}domain remove${RESET}    Disconnect custom domain
@@ -1992,6 +1997,7 @@ ${BOLD}Examples:${RESET}
             let isStatic = false;
             let forceDeploy = false; // --force: skip dependency audit
             let noBackend = false; // --no-backend: skip backend auto-deploy in --static mode
+            let isRollback = false; // --rollback: rollback to previous deploy
 
             // ── subcommand 분기 (logs / status) ───────────────────
             const knownSubcmds = new Set(["logs", "status"]);
@@ -2058,6 +2064,7 @@ ${BOLD}Examples:${RESET}
                 if (a === "--prod") envTarget = "prod";
                 else if (a === "--force" || a === "-f") forceDeploy = true;
                 else if (a === "--no-backend") noBackend = true;
+                else if (a === "--rollback") isRollback = true;
                 else if (a === "--app" || a === "-a") appId = deployArgs[++i];
                 else if (a === "--static") {
                     isStatic = true;
@@ -2075,6 +2082,7 @@ ${BOLD}Examples:${RESET}
                     info(`사용법: gencow deploy [옵션]`);
                     info(`  gencow deploy              백엔드 배포`);
                     info(`  gencow deploy --static     정적 파일 배포`);
+                    info(`  gencow deploy --rollback   이전 버전으로 롤백`);
                     info(`  gencow deploy --prod       프로덕션 배포`);
                     info(`  gencow deploy logs         서버 로그 조회`);
                     info(`  gencow deploy status       앱 상태 확인`);
@@ -2083,11 +2091,16 @@ ${BOLD}Examples:${RESET}
                 }
             }
 
-            // gencow.json에서 appId 로드
+            // gencow.json에서 appId + prodApp 로드
             const gencowJsonPath = resolve(process.cwd(), "gencow.json");
+            let prodAppId = null;
             if (!appId && existsSync(gencowJsonPath)) {
                 const gencowJson = JSON.parse(readFileSync(gencowJsonPath, "utf8"));
                 appId = gencowJson.appId || gencowJson.appName; // 하위 호환
+                prodAppId = gencowJson.prodApp || null;
+            } else if (existsSync(gencowJsonPath)) {
+                const gencowJson = JSON.parse(readFileSync(gencowJsonPath, "utf8"));
+                prodAppId = gencowJson.prodApp || null;
             }
 
             // 프로젝트명은 display용으로만 사용 (appId가 아님)
@@ -2099,9 +2112,124 @@ ${BOLD}Examples:${RESET}
             }
             if (!displayName) displayName = basename(process.cwd());
 
+            // ── Rollback 분기 ─────────────────────────────────────
+            if (isRollback) {
+                // prodApp이 있으면 prod 대상 롤백, 없으면 dev 대상 롤백
+                const rollbackTarget = prodAppId || appId;
+                if (!rollbackTarget) {
+                    error("앱 ID를 찾을 수 없습니다. gencow.json이 있는 프로젝트 루트에서 실행하세요.");
+                    process.exit(1);
+                }
+
+                log(`\n${BOLD}${CYAN}Gencow Rollback${RESET}\n`);
+                info(`앱: ${rollbackTarget}${prodAppId ? " (prod)" : ""}`);
+                log("");
+
+                const rollbackStartTime = Date.now();
+                const spinnerFrames = ["⣾", "⣽", "⣻", "⢿", "⡿", "⣟", "⣯", "⣷"];
+                let spinnerIdx = 0;
+                const spinner = setInterval(() => {
+                    const elapsed = ((Date.now() - rollbackStartTime) / 1000).toFixed(0);
+                    process.stdout.write(`\r  ${CYAN}${spinnerFrames[spinnerIdx++ % spinnerFrames.length]}${RESET} 롤백 중... ${DIM}(${elapsed}s)${RESET}  `);
+                }, 120);
+
+                const rollbackRes = await platformFetch(creds, `/platform/apps/${rollbackTarget}/rollback`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                });
+
+                clearInterval(spinner);
+                process.stdout.write("\r" + " ".repeat(50) + "\r");
+
+                if (!rollbackRes.ok) {
+                    const errData = await rollbackRes.json().catch(() => ({}));
+                    error(`롤백 실패: ${errData.error || rollbackRes.statusText}`);
+                    process.exit(1);
+                }
+
+                const rollbackData = await rollbackRes.json();
+                const rollbackElapsed = ((Date.now() - rollbackStartTime) / 1000).toFixed(1);
+
+                log("");
+                success(`🔄 롤백 완료! (${rollbackElapsed}s)`);
+                info(`롤백: #${rollbackData.rolledBackFrom} → #${rollbackData.rolledBackTo}`);
+                info(`번들:  ${rollbackData.bundleHash}`);
+                info(`URL:   ${rollbackData.url}`);
+                log("");
+                warn(`ℹ️  코드만 롤백되었습니다. 데이터베이스는 변경되지 않았습니다.`);
+                log("");
+                return;
+            }
+
             // ── Static Deploy 분기 ────────────────────────────────
             if (isStatic) {
-                return await this._deployStatic(creds, appId, displayName, staticDir, gencowJsonPath, { forceDeploy, noBackend, envTarget });
+                // prod 모드면 prodApp 대상으로 정적 배포
+                const staticTarget = (envTarget === "prod" && prodAppId) ? prodAppId : appId;
+                return await this._deployStatic(creds, staticTarget, displayName, staticDir, gencowJsonPath, { forceDeploy, noBackend, envTarget });
+            }
+
+            // ── Prod 앱 자동 생성 + 배포 대상 전환 (Pro+) ──────────
+            if (envTarget === "prod" && appId) {
+                if (!prodAppId) {
+                    // prod 앱이 없음 — 첫 프로덕션 배포
+                    const ciMode = process.env.CI === "true" || deployArgs.includes("--yes");
+                    if (!ciMode) {
+                        const { createInterface } = await import("readline");
+                        const rl = createInterface({ input: process.stdin, output: process.stdout });
+                        log("");
+                        log(`  ${BOLD}🚀 First production deployment!${RESET}`);
+                        log(`  This will create a production app: ${CYAN}${appId}-prod${RESET}`);
+                        log("");
+                        const answer = await new Promise(resolve => {
+                            rl.question(`  ${YELLOW}⚠${RESET} Proceed? (y/N) `, resolve);
+                        });
+                        rl.close();
+                        if (answer.toLowerCase() !== "y") {
+                            info("배포 취소됨.");
+                            return;
+                        }
+                    }
+
+                    info("Prod 앱 생성 중...");
+                    const createProdRes = await platformFetch(creds, `/platform/apps/${appId}/create-prod`, {
+                        method: "POST",
+                        headers: { "Content-Type": "application/json" },
+                    });
+
+                    if (!createProdRes.ok) {
+                        const errData = await createProdRes.json().catch(() => ({}));
+                        if (createProdRes.status === 403) {
+                            error(errData.error || "Production deploys require Pro plan or higher.");
+                            info("Run: gencow upgrade");
+                        } else {
+                            error(`Prod 앱 생성 실패: ${errData.error || createProdRes.statusText}`);
+                        }
+                        process.exit(1);
+                    }
+
+                    const createProdData = await createProdRes.json();
+                    prodAppId = createProdData.prodApp;
+
+                    // gencow.json 업데이트
+                    const gencowJson = existsSync(gencowJsonPath)
+                        ? JSON.parse(readFileSync(gencowJsonPath, "utf8"))
+                        : {};
+                    gencowJson.prodApp = prodAppId;
+                    writeFileSync(gencowJsonPath, JSON.stringify(gencowJson, null, 2));
+
+                    if (createProdData.alreadyExists) {
+                        info(`Prod 앱 확인: ${prodAppId}`);
+                    } else {
+                        success(`Prod 앱 생성 완료: ${prodAppId}`);
+                        info(`URL: ${createProdData.url}`);
+                        // 프로비저닝 대기
+                        await new Promise(r => setTimeout(r, 3000));
+                    }
+                }
+
+                // 배포 대상을 prod 앱으로 전환
+                appId = prodAppId;
+                info(`배포 대상: ${CYAN}${appId}${RESET} (production)`);
             }
 
             log(`\n${BOLD}${CYAN}Gencow Deploy${RESET}\n`);
@@ -2114,20 +2242,6 @@ ${BOLD}Examples:${RESET}
             info(`포맷:  tar.gz`);
             log("");
 
-            // 프로덕션 배포 확인
-            if (envTarget === "prod") {
-                const { createInterface } = await import("readline");
-                const rl = createInterface({ input: process.stdin, output: process.stdout });
-                const answer = await new Promise(resolve => {
-                    rl.question(`  ${YELLOW}⚠${RESET} 프로덕션 배포를 진행하시겠습니까? (y/N) `, resolve);
-                });
-                rl.close();
-                if (answer.toLowerCase() !== "y") {
-                    info("배포 취소됨.");
-                    return;
-                }
-            }
-
             // 0-1. drizzle-kit generate 자동 실행 (번들링 전 migrations/ 최신화)
             {
                 const { execSync: execGen } = await import("child_process");
@@ -2946,9 +3060,19 @@ ${BOLD}Examples:${RESET}
                 if (existsSync(gencowJsonPath)) {
                     const gencowJson = JSON.parse(readFileSync(gencowJsonPath, "utf8"));
                     appId = gencowJson.appId || gencowJson.appName; // 하위 호환
+                    // --prod 시 prod 앱으로 대상 전환
+                    if (envTarget === "prod" && gencowJson.prodApp) {
+                        appId = gencowJson.prodApp;
+                    }
                 }
             }
 
+            // --prod인데 prod 앱이 없는 경우
+            if (envTarget === "prod" && appId && !appId.endsWith("-prod")) {
+                error("Prod 앱이 아직 없습니다. gencow deploy --prod를 먼저 실행하세요.");
+                return;
+            }
+
             if (!appId) {
                 error("앱 ID를 찾을 수 없습니다. gencow deploy를 먼저 실행하세요.");
                 return;
@@ -3083,6 +3207,138 @@ ${BOLD}Examples:${RESET}
             }
         },
 
+    // ── config ────────────────────────────────────────────
+    async config(...configArgs) {
+            const creds = requireCreds();
+            const subCmd = configArgs[0] || "help";
+            const restArgs = configArgs.slice(1);
+
+            // 앱 ID 결정
+            let appId = null;
+            for (let i = 0; i < restArgs.length; i++) {
+                if (restArgs[i] === "--app" || restArgs[i] === "-a") appId = restArgs[++i];
+            }
+
+            if (!appId) {
+                const gencowJsonPath = resolve(process.cwd(), "gencow.json");
+                if (existsSync(gencowJsonPath)) {
+                    const gencowJson = JSON.parse(readFileSync(gencowJsonPath, "utf8"));
+                    appId = gencowJson.appId || gencowJson.appName;
+                }
+            }
+
+            if (subCmd === "help" || subCmd === "--help" || subCmd === "-h") {
+                log(`\n${BOLD}${CYAN}gencow config${RESET} — 앱 설정 관리\n`);
+                log(`  ${CYAN}set${RESET} image.maxWidth <값>   Auto WebP 최대 폭 (px)`);
+                log(`  ${CYAN}set${RESET} image.quality <값>    Auto WebP 품질 (1-100)`);
+                log(`  ${CYAN}get${RESET} image                 현재 이미지 설정 조회`);
+                log(`  ${CYAN}reset${RESET} image               이미지 설정 초기화 (Tier 기본값)\n`);
+                log(`  ${DIM}옵션:${RESET}`);
+                log(`    ${DIM}--app, -a <앱이름>  대상 앱 지정 (기본: gencow.json)${RESET}\n`);
+                return;
+            }
+
+            if (!appId) {
+                error("앱 ID를 찾을 수 없습니다. gencow deploy를 먼저 실행하세요.");
+                return;
+            }
+
+            switch (subCmd) {
+                case "set": {
+                    const key = restArgs.find((a, i) => !a.startsWith("-") && !(restArgs[i - 1] === "--app" || restArgs[i - 1] === "-a"));
+                    const val = restArgs[restArgs.indexOf(key) + 1];
+
+                    if (!key || val === undefined) {
+                        error("사용법: gencow config set image.maxWidth <값>");
+                        return;
+                    }
+
+                    const imageConfig = {};
+                    if (key === "image.maxWidth" || key === "image.max-width") {
+                        const v = parseInt(val);
+                        if (isNaN(v) || v < 0 || v > 10000) {
+                            error("maxWidth는 0~10000 사이의 값이어야 합니다. (0 = 리셋)");
+                            return;
+                        }
+                        imageConfig.autoMaxWidth = v;
+                    } else if (key === "image.quality") {
+                        const v = parseInt(val);
+                        if (isNaN(v) || v < 0 || v > 100) {
+                            error("quality는 0~100 사이의 값이어야 합니다. (0 = 리셋)");
+                            return;
+                        }
+                        imageConfig.autoQuality = v;
+                    } else {
+                        error(`알 수 없는 설정 키: ${key}`);
+                        info("사용 가능: image.maxWidth, image.quality");
+                        return;
+                    }
+
+                    const res = await rpcMutation(creds, "apps.updateImageConfig", { name: appId, imageConfig });
+                    if (res.ok) {
+                        const data = await res.json();
+                        success(`${key} = ${val} 설정 완료`);
+                        if (data.imageConfig) {
+                            info(`현재 설정: ${JSON.stringify(data.imageConfig)}`);
+                        }
+                        info(`${DIM}※ 다음 이미지 요청부터 적용됩니다. 기존 캐시는 별도 키로 저장됩니다.${RESET}`);
+                    } else {
+                        const errData = await res.json().catch(() => ({}));
+                        error(`설정 실패: ${errData.error || res.statusText}`);
+                    }
+                    break;
+                }
+
+                case "get": {
+                    const key = restArgs.find(a => !a.startsWith("-"));
+                    if (key && key !== "image") {
+                        error(`알 수 없는 설정 키: ${key}`);
+                        info("사용 가능: image");
+                        return;
+                    }
+
+                    const res = await rpcQuery(creds, "apps.getImageConfig", { name: appId });
+                    if (res.ok) {
+                        const config = await res.json();
+                        log(`\n${BOLD}${CYAN}이미지 설정${RESET} — ${appId}\n`);
+                        if (Object.keys(config).length === 0) {
+                            info("커스텀 설정 없음 (Tier 기본값 사용)");
+                        } else {
+                            if (config.autoMaxWidth) log(`  ${GREEN}autoMaxWidth${RESET}  ${config.autoMaxWidth} px`);
+                            if (config.autoQuality) log(`  ${GREEN}autoQuality${RESET}   ${config.autoQuality}`);
+                        }
+                        log("");
+                    } else {
+                        error("설정 조회 실패");
+                    }
+                    break;
+                }
+
+                case "reset": {
+                    const key = restArgs.find(a => !a.startsWith("-"));
+                    if (key && key !== "image") {
+                        error(`알 수 없는 설정 키: ${key}`);
+                        return;
+                    }
+
+                    // autoMaxWidth=0 + autoQuality=0 → 둘 다 리셋
+                    const res = await rpcMutation(creds, "apps.updateImageConfig", {
+                        name: appId,
+                        imageConfig: { autoMaxWidth: 0, autoQuality: 0 },
+                    });
+                    if (res.ok) {
+                        success("이미지 설정 초기화 완료 (Tier 기본값 사용)");
+                    } else {
+                        error("초기화 실패");
+                    }
+                    break;
+                }
+
+                default:
+                    error(`알 수 없는 하위 명령: ${subCmd}`);
+                    info("사용법: gencow config [set|get|reset] ...");
+            }
+        },
 
     // ── files ─────────────────────────────────────────────
     async files(...filesArgs) {

package/core/index.js

@@ -1914,14 +1914,32 @@ function defineAuth(config) {
 // ../core/src/rls.ts
 import { sql } from "drizzle-orm";
 import { pgPolicy } from "drizzle-orm/pg-core";
+var _ownerRlsRegistry = /* @__PURE__ */ new WeakMap();
+function getOwnerRlsMeta(table) {
+  return _ownerRlsRegistry.get(table);
+}
+function registerOwnerRls(table, meta) {
+  _ownerRlsRegistry.set(table, meta);
+}
 function ownerRls(userIdColumn, options) {
+  const colName = userIdColumn.name;
+  if (!colName) {
+    throw new Error(
+      "[ownerRls] userIdColumn must have a .name property. Ensure you pass a valid Drizzle column reference (e.g. t.userId)."
+    );
+  }
   const isOwner = sql`${userIdColumn} = current_setting('app.current_user_id')`;
-  return [
+  const meta = {
+    columnName: colName,
+    readPublic: options?.read === "public"
+  };
+  const policies = [
     pgPolicy("rls-select", { for: "select", using: options?.read === "public" ? sql`true` : isOwner }),
     pgPolicy("rls-insert", { for: "insert", withCheck: isOwner }),
     pgPolicy("rls-update", { for: "update", using: isOwner, withCheck: isOwner }),
     pgPolicy("rls-delete", { for: "delete", using: isOwner })
   ];
+  return policies;
 }
 
 // ../core/src/rls-db.ts
@@ -1946,12 +1964,48 @@ function createRlsDb(db, userId) {
 }
 
 // ../core/src/crud.ts
-import { eq, ne, gt, gte, lt, lte, desc, asc, like, ilike, inArray, notInArray, or, and, count as drizzleCount, getTableName } from "drizzle-orm";
+import { eq, ne, gt, gte, lt, lte, desc, asc, like, ilike, inArray, notInArray, or, and, count as drizzleCount, getTableName, getTableColumns } from "drizzle-orm";
+import { getTableConfig } from "drizzle-orm/pg-core";
 function detectIdType(column) {
   const colType = column.dataType;
   if (colType === "string") return v.string();
   return v.number();
 }
+function resolvePropertyName(table, columnName) {
+  try {
+    const columns = getTableColumns(table);
+    for (const [propName, col] of Object.entries(columns)) {
+      if (col.name === columnName) return propName;
+    }
+  } catch {
+  }
+  return columnName;
+}
+function detectOwnerMeta(table) {
+  const anyTable = table;
+  const meta = getOwnerRlsMeta(table);
+  if (meta) {
+    const propName = resolvePropertyName(table, meta.columnName);
+    const col = anyTable[propName];
+    if (col) {
+      return { column: col, columnName: meta.columnName, propertyName: propName, readPublic: meta.readPublic };
+    }
+  }
+  try {
+    const config = getTableConfig(table);
+    if (config.policies && config.policies.length > 0) {
+      const propName = anyTable["userId"] ? "userId" : anyTable["user_id"] ? "user_id" : null;
+      if (propName) {
+        const userIdCol = anyTable[propName];
+        const colName = userIdCol.name || "user_id";
+        registerOwnerRls(table, { columnName: colName, readPublic: false });
+        return { column: userIdCol, columnName: colName, propertyName: propName, readPublic: false };
+      }
+    }
+  } catch {
+  }
+  return null;
+}
 var MAX_FILTER_DEPTH = 5;
 var FILTER_OPS = ["eq", "ne", "gt", "gte", "lt", "lte", "in", "nin", "like", "ilike"];
 function isValidFilterOp(op) {
@@ -2033,6 +2087,12 @@ function crud(table, options) {
   const createdAtCol = anyTable["createdAt"];
   const defaultOrderCol = createdAtCol || pk;
   const userIdCol = anyTable["userId"];
+  const ownerMeta = detectOwnerMeta(table);
+  if (ownerMeta && isPublic && !ownerMeta.readPublic) {
+    console.warn(
+      `[crud] \u26A0\uFE0F Table "${tableName}": ownerRls detected but public=true. CUD operations will still enforce ownerRls (auth required). Consider removing { public: true } or using ownerRls(col, { read: "public" }).`
+    );
+  }
   function buildWhereConditions(args) {
     const conditions = [];
     if (options?.softDelete) {
@@ -2056,9 +2116,14 @@ function crud(table, options) {
     }
     return conditions.length > 0 ? and(...conditions) : void 0;
   }
-  async function fetchListWithTotal(db, whereClause) {
-    const data = await db.select().from(anyTable).where(whereClause).orderBy(desc(defaultOrderCol));
-    const countResult = await db.select({ count: drizzleCount() }).from(anyTable).where(whereClause);
+  async function fetchListWithTotal(db, whereClause, userId) {
+    let effectiveWhere = whereClause;
+    if (ownerMeta && userId && !ownerMeta.readPublic) {
+      const ownerFilter = eq(ownerMeta.column, userId);
+      effectiveWhere = effectiveWhere ? and(effectiveWhere, ownerFilter) : ownerFilter;
+    }
+    const data = await db.select().from(anyTable).where(effectiveWhere).orderBy(desc(defaultOrderCol));
+    const countResult = await db.select({ count: drizzleCount() }).from(anyTable).where(effectiveWhere);
     return { data, total: Number(countResult[0]?.count ?? 0) };
   }
   const enabledMethods = new Set(options?.methods ?? ["list", "get", "create", "update", "remove"]);
@@ -2073,11 +2138,16 @@ function crud(table, options) {
       filters: v.optional(v.any())
     },
     handler: async (ctx, args) => {
-      if (!isPublic) ctx.auth.requireAuth();
+      const needsAuth = !isPublic || ownerMeta && !ownerMeta.readPublic;
+      const user = needsAuth ? ctx.auth.requireAuth() : null;
       const page = Math.max(1, args?.page || 1);
       const limit = Math.min(Math.max(1, args?.limit || defaultLimit), maxLimit);
       const offset = (page - 1) * limit;
-      const whereClause = buildWhereConditions(args);
+      let whereClause = buildWhereConditions(args);
+      if (ownerMeta && !ownerMeta.readPublic && user) {
+        const ownerFilter = eq(ownerMeta.column, user.id);
+        whereClause = whereClause ? and(whereClause, ownerFilter) : ownerFilter;
+      }
       let orderByClause;
       if (args?.orderBy && anyTable[args.orderBy]) {
         const col = anyTable[args.orderBy];
@@ -2097,8 +2167,12 @@ function crud(table, options) {
     public: isPublic,
     args: { id: idValidator },
     handler: async (ctx, args) => {
-      if (!isPublic) ctx.auth.requireAuth();
+      const needsAuth = !isPublic || ownerMeta && !ownerMeta.readPublic;
+      const user = needsAuth ? ctx.auth.requireAuth() : null;
       let whereCond = eq(pk, args.id);
+      if (ownerMeta && !ownerMeta.readPublic && user) {
+        whereCond = and(whereCond, eq(ownerMeta.column, user.id));
+      }
       if (options?.softDelete) {
         const sdField = anyTable[options.softDelete.field];
         whereCond = and(whereCond, eq(sdField, null));
@@ -2110,9 +2184,11 @@ function crud(table, options) {
   const createDef = !enabledMethods.has("create") ? void 0 : mutation(`${prefix}.create`, {
     public: isPublic,
     handler: async (ctx, args) => {
-      const user = isPublic ? null : ctx.auth.requireAuth();
+      const user = ownerMeta || !isPublic ? ctx.auth.requireAuth() : null;
       let insertData = { ...args };
-      if (userIdCol && user && !insertData.userId) {
+      if (ownerMeta && user) {
+        insertData[ownerMeta.propertyName] = user.id;
+      } else if (userIdCol && user && !insertData.userId) {
         insertData.userId = user.id;
       }
       if (options?.hooks?.beforeCreate) {
@@ -2120,7 +2196,8 @@ function crud(table, options) {
       }
       const [result] = await ctx.db.insert(anyTable).values(insertData).returning();
       if (useRealtime && enabledMethods.has("list")) {
-        const listResult = await fetchListWithTotal(ctx.db);
+        const currentUserId = user?.id;
+        const listResult = await fetchListWithTotal(ctx.db, void 0, currentUserId);
         ctx.realtime.emit(`${prefix}.list`, listResult);
       }
       return result;
@@ -2129,19 +2206,28 @@ function crud(table, options) {
   const updateDef = !enabledMethods.has("update") ? void 0 : mutation(`${prefix}.update`, {
     public: isPublic,
     handler: async (ctx, args) => {
-      if (!isPublic) ctx.auth.requireAuth();
+      const user = ownerMeta || !isPublic ? ctx.auth.requireAuth() : null;
       const { id, ...updates } = args;
       let updateData = { ...updates };
+      let updateWhere = eq(pk, id);
+      if (ownerMeta && user) {
+        updateWhere = and(eq(pk, id), eq(ownerMeta.column, user.id));
+        delete updateData[ownerMeta.propertyName];
+        if (ownerMeta.propertyName !== ownerMeta.columnName) {
+          delete updateData[ownerMeta.columnName];
+        }
+      }
       if (anyTable["updatedAt"]) {
         updateData.updatedAt = /* @__PURE__ */ new Date();
       }
       if (options?.hooks?.beforeUpdate) {
         updateData = await options.hooks.beforeUpdate(updateData);
       }
-      const [result] = await ctx.db.update(anyTable).set(updateData).where(eq(pk, id)).returning();
+      const [result] = await ctx.db.update(anyTable).set(updateData).where(updateWhere).returning();
       if (useRealtime) {
+        const currentUserId = ownerMeta ? user?.id : void 0;
         if (enabledMethods.has("list")) {
-          const listResult = await fetchListWithTotal(ctx.db);
+          const listResult = await fetchListWithTotal(ctx.db, void 0, currentUserId);
           ctx.realtime.emit(`${prefix}.list`, listResult);
         }
         if (enabledMethods.has("get")) {
@@ -2154,15 +2240,20 @@ function crud(table, options) {
   const removeDef = !enabledMethods.has("remove") ? void 0 : mutation(`${prefix}.remove`, {
     public: isPublic,
     handler: async (ctx, args) => {
-      if (!isPublic) ctx.auth.requireAuth();
+      const user = ownerMeta || !isPublic ? ctx.auth.requireAuth() : null;
+      let deleteWhere = eq(pk, args.id);
+      if (ownerMeta && user) {
+        deleteWhere = and(eq(pk, args.id), eq(ownerMeta.column, user.id));
+      }
       if (options?.softDelete) {
         const sdField = options.softDelete.field;
-        await ctx.db.update(anyTable).set({ [sdField]: /* @__PURE__ */ new Date() }).where(eq(pk, args.id));
+        await ctx.db.update(anyTable).set({ [sdField]: /* @__PURE__ */ new Date() }).where(deleteWhere);
       } else {
-        await ctx.db.delete(anyTable).where(eq(pk, args.id));
+        await ctx.db.delete(anyTable).where(deleteWhere);
       }
       if (useRealtime && enabledMethods.has("list")) {
-        const listResult = await fetchListWithTotal(ctx.db);
+        const currentUserId = ownerMeta ? user?.id : void 0;
+        const listResult = await fetchListWithTotal(ctx.db, void 0, currentUserId);
         ctx.realtime.emit(`${prefix}.list`, listResult);
       }
       return { success: true };
@@ -2187,6 +2278,7 @@ export {
   defineAuth,
   deregisterClient,
   crud as gencowCrud,
+  getOwnerRlsMeta,
   getQueryDef,
   getQueryHandler,
   getRegisteredHttpActions,
@@ -2201,6 +2293,7 @@ export {
   parseFilterNode,
   query,
   registerClient,
+  registerOwnerRls,
   subscribe,
   unsubscribe,
   v,