gencow 0.1.172 → 0.1.174

package/bin/gencow.mjs

@@ -341,7 +341,7 @@ ${BOLD}Commands (login required):${RESET}
                      ${DIM}--prod      Push to production DB (confirmation required)${RESET}
   ${GREEN}db:generate${RESET}      Generate SQL migration files from schema.ts
   ${GREEN}db:seed${RESET}          Run gencow/seed.ts on cloud app
-                     ${DIM}--prod      Seed production app${RESET}
+                     ${DIM}--prod      Seed production app (confirmation required)${RESET}
   ${GREEN}static [dir]${RESET}     Deploy static files only ${DIM}(dist/, out/, build/)${RESET}
                      ${DIM}--prod          Deploy to production app${RESET}
                      ${DIM}--force, -f     Skip optional dependency scan${RESET}

package/core/index.js

@@ -1016,6 +1016,26 @@ function buildRealtimeCtx(options) {
         eventId: input.eventId ?? createRealtimeEventId()
       });
     },
+    invalidateCrudQuery(input) {
+      _hasEmitted = true;
+      const subscriptionKey = input.subscriptionKey ?? resolveRealtimeQuerySubscriptionKey({ query: input.query, args: input.args });
+      if (!subscriptionKey)
+        throw new Error(`Realtime query "${input.query}" resolved to an invalid subscriptionKey`);
+      const scopeHash = input.scopeHash ?? resolveRealtimeQueryScopeHash({
+        query: input.query,
+        args: input.args,
+        subscriptionKey
+      });
+      dispatchEvent({
+        type: "query_invalidate",
+        query: input.query,
+        subscriptionKey,
+        scopeHash,
+        eventId: input.eventId ?? createRealtimeEventId(),
+        legacyQueryKey: input.legacyQueryKey,
+        crudRealtimeEmitMode: input.crudRealtimeEmitMode ?? options.generatedCrudRealtimeEmitMode ?? "dual"
+      });
+    },
     get _hasEmitted() {
       return _hasEmitted;
     },
@@ -1601,16 +1621,28 @@ function resolveTtlMs3(ttlSeconds) {
 function randomNonce3() {
   return randomBytes3(16).toString("base64url");
 }
+function resolveRealtimeCapabilityNegotiation(value) {
+  const record = value && typeof value === "object" ? value : null;
+  return {
+    crudRealtimeMode: record?.crudRealtimeMode === "scoped" ? "scoped" : "legacy"
+  };
+}
 function createRealtimeTicket(input) {
   validateRequiredString3(input.appName, "appName");
   validateRequiredString3(input.userId, "userId");
   validateRequiredString3(input.secret, "secret");
   const nowMs = input.nowMs ?? Date.now();
+  const realtime = resolveRealtimeCapabilityNegotiation({
+    crudRealtimeMode: input.realtime?.crudRealtimeMode
+  });
   const payload = {
     v: 1,
     appName: input.appName,
     userId: input.userId,
     sessionId: input.sessionId ?? null,
+    rt: {
+      crudRealtimeMode: realtime.crudRealtimeMode
+    },
     iat: nowMs,
     exp: nowMs + resolveTtlMs3(input.ttlSeconds),
     nonce: input.nonce ?? randomNonce3()
@@ -1653,7 +1685,8 @@ function verifyRealtimeTicket(ticket, input) {
     sessionId: typeof record.sessionId === "string" ? record.sessionId : null,
     nonce: record.nonce,
     issuedAt: record.iat,
-    expiresAt: record.exp
+    expiresAt: record.exp,
+    realtime: resolveRealtimeCapabilityNegotiation(record.rt)
   };
 }
 
@@ -2807,6 +2840,9 @@ var RESERVED_TENANT_RUNTIME_ENV_KEYS = /* @__PURE__ */ new Set([
   "GENCOW_STORAGE_REQUIRE_READ_GRANT",
   "GENCOW_STORAGE_BACKEND",
   "GENCOW_STORAGE_LEGACY_LOCAL_FALLBACK",
+  "GENCOW_STORAGE_QUOTA_BYTES",
+  "GENCOW_STORAGE_MAX_FILE_SIZE_BYTES",
+  "GENCOW_STORAGE_API_UPLOAD_MAX_FILE_SIZE_BYTES",
   "GENCOW_MIGRATIONS",
   "GENCOW_APP_NAME",
   "GENCOW_APP_DATA_DIR",
@@ -4051,6 +4087,144 @@ function detectOwnerMeta2(table) {
   return null;
 }
 
+// ../core/src/createCrud.realtime.ts
+import { getTableConfig as getTableConfig3 } from "drizzle-orm/pg-core";
+var CRUD_LIST_BUCKET_QUERY = "__gencow.crud.list";
+var FORBIDDEN_SCOPE_KEYS = /* @__PURE__ */ new Set(["query", "subscriptionKey", "scopeHash", "__gencow"]);
+function createCrudRealtimeEventId() {
+  const randomUUID = globalThis.crypto?.randomUUID;
+  if (typeof randomUUID === "function") return `evt_${randomUUID.call(globalThis.crypto)}`;
+  return `evt_${Date.now().toString(36)}_${Math.random().toString(36).slice(2)}`;
+}
+function resolveDefaultResourceIdentity(table, tableName) {
+  try {
+    const config = getTableConfig3(table);
+    const schema = typeof config.schema === "string" && config.schema.trim().length > 0 ? config.schema.trim() : "public";
+    return `${schema}.${config.name}`;
+  } catch {
+    return tableName.includes(".") ? tableName : `public.${tableName}`;
+  }
+}
+function isPlainObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function assertJsonScopeValue(value, path) {
+  if (value === void 0) return;
+  if (value === null) return;
+  if (typeof value === "string" || typeof value === "boolean") return;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error(`[createCrud] realtime scope "${path}" must be finite`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) => {
+      if (entry === void 0) throw new Error(`[createCrud] realtime scope "${path}[${index}]" cannot be undefined`);
+      assertJsonScopeValue(entry, `${path}[${index}]`);
+    });
+    return;
+  }
+  if (isPlainObject(value)) {
+    for (const [key, child] of Object.entries(value)) {
+      assertJsonScopeValue(child, path ? `${path}.${key}` : key);
+    }
+    return;
+  }
+  throw new Error(`[createCrud] realtime scope "${path}" must be JSON-serializable`);
+}
+function normalizeCrudScope(value, label) {
+  if (!isPlainObject(value)) {
+    throw new Error(`[createCrud] ${label} must return a non-null plain object scope`);
+  }
+  for (const key of Object.keys(value)) {
+    if (FORBIDDEN_SCOPE_KEYS.has(key)) {
+      throw new Error(`[createCrud] ${label} scope key "${key}" is reserved`);
+    }
+  }
+  assertJsonScopeValue(value, "");
+  return value;
+}
+function buildCrudListSubscriptionKey(input) {
+  return buildQuerySubscriptionKey(CRUD_LIST_BUCKET_QUERY, {
+    policy: input.policy,
+    resourceIdentity: input.resourceIdentity,
+    scope: input.scope
+  });
+}
+function buildCrudListScopeHash(input) {
+  const subscriptionKey = buildCrudListSubscriptionKey(input);
+  return buildRealtimeQueryScopeHash({
+    query: CRUD_LIST_BUCKET_QUERY,
+    subscriptionKey,
+    scope: {
+      policy: input.policy,
+      resourceIdentity: input.resourceIdentity,
+      scope: input.scope
+    }
+  });
+}
+function resolveCrudRealtimeConfig(input) {
+  const resourceIdentity = resolveDefaultResourceIdentity(input.table, input.tableName);
+  const config = input.realtime;
+  if (config === false) {
+    return {
+      enabled: false,
+      listEnabled: false,
+      listPolicy: false,
+      resourceIdentity,
+      explicitScopedList: false
+    };
+  }
+  if (config === void 0) {
+    return {
+      enabled: true,
+      listEnabled: true,
+      listPolicy: input.defaultListPolicy,
+      resourceIdentity,
+      explicitScopedList: false,
+      scope: () => ({}),
+      scopeFromRow: async () => ({})
+    };
+  }
+  if (!isPlainObject(config)) {
+    throw new Error(`[createCrud] realtime must be false or an object`);
+  }
+  if (config.listRealtime === false) {
+    return {
+      enabled: true,
+      listEnabled: false,
+      listPolicy: false,
+      resourceIdentity,
+      explicitScopedList: false
+    };
+  }
+  const policy = config.policy;
+  if (policy !== "public" && policy !== "authorized") {
+    throw new Error(`[createCrud] realtime.policy must be "public" or "authorized" when list realtime is enabled`);
+  }
+  const scope = config.scope;
+  const scopeFromRow = config.scopeFromRow;
+  if (typeof scope !== "function" || typeof scopeFromRow !== "function") {
+    throw new Error(`[createCrud] realtime scope and scopeFromRow are required when list realtime is enabled`);
+  }
+  const authorize = config.authorize;
+  if (policy === "authorized" && typeof authorize !== "function") {
+    throw new Error(`[createCrud] realtime.authorize is required for authorized list realtime`);
+  }
+  const explicitResourceIdentity = typeof config.resourceIdentity === "string" && config.resourceIdentity.trim().length > 0 ? config.resourceIdentity.trim() : resourceIdentity;
+  return {
+    enabled: true,
+    listEnabled: true,
+    listPolicy: policy,
+    resourceIdentity: explicitResourceIdentity,
+    explicitScopedList: true,
+    authorize,
+    scope: (args) => normalizeCrudScope(scope(args), "realtime.scope"),
+    scopeFromRow: async ({ row, ctx }) => normalizeCrudScope(await scopeFromRow({ row, ctx }), "realtime.scopeFromRow")
+  };
+}
+
 // ../core/src/createCrud.validators.ts
 function detectIdType2(column) {
   const colType = column.dataType;
@@ -4183,7 +4357,6 @@ function buildCrud(table, options, procedure) {
   const tableName = getTableName4(drizzleTable);
   const prefix = options?.prefix || tableName;
   const allowAnonymous = options?.allowAnonymous ?? false;
-  const useRealtime = options?.realtime ?? true;
   const defaultLimit = options?.defaultLimit ?? 20;
   const maxLimit = options?.maxLimit ?? 100;
   const pk = anyTable["id"];
@@ -4196,6 +4369,14 @@ function buildCrud(table, options, procedure) {
   const defaultOrderCol = createdAtCol || pk;
   const userIdCol = anyTable["userId"];
   const ownerMeta = detectOwnerMeta2(drizzleTable);
+  const listNeedsAuth = !allowAnonymous || ownerMeta && !ownerMeta.readPublic;
+  const defaultListRealtimePolicy = listNeedsAuth ? "authorized" : "public";
+  const crudRealtime = resolveCrudRealtimeConfig({
+    realtime: options?.realtime,
+    defaultListPolicy: defaultListRealtimePolicy,
+    table: drizzleTable,
+    tableName
+  });
   const disableILike = options?.disableILike === true;
   const cursorPropNames = options?.cursor ? [...options.cursor].map((c) => String(c)) : void 0;
   let sortablePropNames = options?.sortable && options.sortable.length > 0 ? new Set(options.sortable.map((c) => String(c))) : void 0;
@@ -4254,17 +4435,102 @@ function buildCrud(table, options, procedure) {
     }
     return await fn(db);
   }
-  function invalidateListRealtime(ctx) {
-    ctx.realtime.invalidate(`${prefix}.list`);
+  function resolveListRealtimeBucket(scope) {
+    if (!crudRealtime.listEnabled) return null;
+    return {
+      policy: crudRealtime.listPolicy,
+      resourceIdentity: crudRealtime.resourceIdentity,
+      scope,
+      subscriptionKey: buildCrudListSubscriptionKey({
+        policy: crudRealtime.listPolicy,
+        resourceIdentity: crudRealtime.resourceIdentity,
+        scope
+      }),
+      scopeHash: buildCrudListScopeHash({
+        policy: crudRealtime.listPolicy,
+        resourceIdentity: crudRealtime.resourceIdentity,
+        scope
+      })
+    };
   }
-  function invalidateGetRealtime(ctx, id) {
-    ctx.realtime.invalidate(buildQuerySubscriptionKey(`${prefix}.get`, { id }));
+  async function invalidateListRealtimeForScopes(ctx, input) {
+    if (!crudRealtime.listEnabled || !enabledMethods.has("list")) return;
+    const seen = /* @__PURE__ */ new Set();
+    let firstError;
+    for (const row of input.rows) {
+      if (row == null) continue;
+      let scope;
+      try {
+        scope = await crudRealtime.scopeFromRow({ row, ctx });
+      } catch (error) {
+        firstError ??= error;
+        continue;
+      }
+      const bucket = resolveListRealtimeBucket(scope);
+      if (!bucket || seen.has(bucket.scopeHash)) continue;
+      seen.add(bucket.scopeHash);
+      invalidateCrudRealtime(ctx, {
+        legacyQueryKey: `${prefix}.list`,
+        query: `${prefix}.list`,
+        subscriptionKey: bucket.subscriptionKey,
+        scopeHash: bucket.scopeHash,
+        eventId: input.eventId
+      });
+    }
+    if (firstError) throw firstError;
+  }
+  function reportCrudRealtimeInvalidationError(input) {
+    console.error("[createCrud] realtime invalidation failed after mutation commit", {
+      prefix,
+      tableName,
+      operation: input.operation,
+      ...input.id !== void 0 ? { id: input.id } : {},
+      error: input.error
+    });
+  }
+  function invalidateGetRealtime(ctx, id, eventId) {
+    invalidateCrudRealtime(ctx, {
+      legacyQueryKey: buildQuerySubscriptionKey(`${prefix}.get`, { id }),
+      query: `${prefix}.get`,
+      args: { id },
+      eventId
+    });
+  }
+  function invalidateCrudRealtime(ctx, input) {
+    const realtime = ctx.realtime;
+    if (typeof realtime.invalidateCrudQuery === "function") {
+      realtime.invalidateCrudQuery(input);
+      return;
+    }
+    if (input.subscriptionKey && input.scopeHash && typeof realtime.invalidateScoped === "function") {
+      realtime.invalidateScoped({
+        query: input.query,
+        args: input.args,
+        subscriptionKey: input.subscriptionKey,
+        scopeHash: input.scopeHash,
+        eventId: input.eventId
+      });
+      return;
+    }
+    realtime.invalidate(input.legacyQueryKey);
+  }
+  async function selectFullRowForRealtime(tx, whereCond) {
+    const [row] = await tx.select().from(anyTable).where(whereCond).limit(1);
+    return row ?? null;
   }
   const pickCols = options?.columns?.pick;
   const omitCols = options?.columns?.omit;
   const listProjection = buildSelectProjection(drizzleCols, pickCols, omitCols);
   const getProjection = listProjection;
   const projectedColumns = listProjection !== void 0 ? listProjection : drizzleCols;
+  function projectResultRow(row) {
+    if (listProjection === void 0 || !row || typeof row !== "object") return row;
+    const projected = {};
+    for (const key of Object.keys(listProjection)) {
+      projected[key] = row[key];
+    }
+    return projected;
+  }
   const listRowOutput = buildRowOutputValidator(projectedColumns);
   const updateOutputSchema = v.nullable(listRowOutput);
   const getOutput = v.nullable(listRowOutput);
@@ -4289,7 +4555,10 @@ function buildCrud(table, options, procedure) {
     cursor: cursorPropNames,
     ...disableILike ? { disableILike: true } : {},
     allowAnonymous,
-    realtime: useRealtime
+    realtime: crudRealtime.enabled,
+    listRealtime: crudRealtime.listEnabled,
+    realtimePolicy: crudRealtime.listPolicy,
+    resourceIdentity: crudRealtime.resourceIdentity
   };
   function assertOrderBy(orderByProp) {
     if (!orderByProp) return;
@@ -4310,8 +4579,7 @@ function buildCrud(table, options, procedure) {
     })
   ).output(listOutput).handler(async ({ context, input }) => {
     await assertReadAccess(context);
-    const needsAuth = !allowAnonymous || ownerMeta && !ownerMeta.readPublic;
-    const user = needsAuth ? context.auth.requireAuth() : null;
+    const user = listNeedsAuth ? context.auth.requireAuth() : null;
     let whereClause = buildWhereConditions(input);
     if (ownerMeta && !ownerMeta.readPublic && user) {
       const ownerFilter = eq3(ownerMeta.column, user.id);
@@ -4370,11 +4638,44 @@ function buildCrud(table, options, procedure) {
       return { data: results, total, nextCursor };
     });
   });
-  const getDef = !enabledMethods.has("get") ? void 0 : (allowAnonymous ? query2.allowAnonymous() : query2).name(`${prefix}.get`).input(v.object({ id: idValidator })).output(getOutput).handler(async ({ context, input }) => {
-    await assertReadAccess(context);
-    const needsAuth = !allowAnonymous || ownerMeta && !ownerMeta.readPublic;
-    const user = needsAuth ? context.auth.requireAuth() : null;
-    let whereCond = eq3(pk, input.id);
+  if (listDef) {
+    listDef.realtimePolicy = crudRealtime.listEnabled ? crudRealtime.listPolicy : false;
+  }
+  if (listDef && crudRealtime.listEnabled) {
+    defineRealtimeSubscriptions({
+      [listDef.name]: {
+        policy: crudRealtime.listPolicy,
+        args: listDef.inputSchema,
+        subscriptionKey: (args) => {
+          const scope = crudRealtime.scope(args);
+          return buildCrudListSubscriptionKey({
+            policy: crudRealtime.listPolicy,
+            resourceIdentity: crudRealtime.resourceIdentity,
+            scope
+          });
+        },
+        scope: (args) => {
+          const scope = crudRealtime.scope(args);
+          return {
+            policy: crudRealtime.listPolicy,
+            resourceIdentity: crudRealtime.resourceIdentity,
+            scope
+          };
+        },
+        authorize: async (ctx, args) => {
+          if (crudRealtime.explicitScopedList) {
+            await crudRealtime.authorize?.({ args, ctx });
+          } else {
+            await assertReadAccess(ctx);
+          }
+        }
+      }
+    });
+  }
+  const getNeedsAuth = !allowAnonymous || ownerMeta && !ownerMeta.readPublic;
+  const getRealtimePolicy = getNeedsAuth ? "authorized" : "public";
+  function buildGetWhereCondition(id, user) {
+    let whereCond = eq3(pk, id);
     if (ownerMeta && !ownerMeta.readPublic && user) {
       whereCond = and3(whereCond, eq3(ownerMeta.column, user.id));
     }
@@ -4382,12 +4683,46 @@ function buildCrud(table, options, procedure) {
       const sdField = anyTable[options.softDelete.field];
       whereCond = and3(whereCond, eq3(sdField, null));
     }
+    return whereCond;
+  }
+  async function canAuthorizeGeneratedGetRealtime(ctx, id) {
+    await assertReadAccess(ctx);
+    const user = getNeedsAuth ? ctx.auth.requireAuth() : null;
+    const whereCond = buildGetWhereCondition(id, user);
+    const row = await inRlsOrPlainTx(ctx.db, async (tx) => {
+      const [result] = await tx.select({ id: pk }).from(anyTable).where(whereCond).limit(1);
+      return result ?? null;
+    });
+    return row !== null;
+  }
+  const getDef = !enabledMethods.has("get") ? void 0 : (allowAnonymous ? query2.allowAnonymous() : query2).name(`${prefix}.get`).input(v.object({ id: idValidator })).output(getOutput).handler(async ({ context, input }) => {
+    await assertReadAccess(context);
+    const user = getNeedsAuth ? context.auth.requireAuth() : null;
+    const whereCond = buildGetWhereCondition(input.id, user);
     return await inRlsOrPlainTx(context.db, async (tx) => {
       const qb = getProjection !== void 0 ? tx.select(getProjection).from(anyTable) : tx.select().from(anyTable);
       const [result] = await qb.where(whereCond).limit(1);
       return result ?? null;
     });
   });
+  if (getDef) {
+    getDef.realtimePolicy = crudRealtime.enabled ? getRealtimePolicy : false;
+  }
+  if (getDef && crudRealtime.enabled) {
+    defineRealtimeSubscriptions({
+      [getDef.name]: {
+        policy: getRealtimePolicy,
+        args: getDef.inputSchema,
+        authorize: async (ctx, args) => {
+          const allowed = await canAuthorizeGeneratedGetRealtime(
+            ctx,
+            args.id
+          );
+          return allowed ? void 0 : false;
+        }
+      }
+    });
+  }
   const createDef = !enabledMethods.has("create") ? void 0 : (allowAnonymous ? mutation2.allowAnonymous() : mutation2).name(`${prefix}.create`).input(createInputValidator).output(listRowOutput).handler(async ({ context, input }) => {
     await denyUnless(options?.access?.create, context);
     const user = ownerMeta || !allowAnonymous ? context.auth.requireAuth() : null;
@@ -4406,12 +4741,31 @@ function buildCrud(table, options, procedure) {
     if (options?.hooks?.beforeCreate) {
       insertData = await options.hooks.beforeCreate(insertData);
     }
-    const [result] = await inRlsOrPlainTx(
-      context.db,
-      async (tx) => listProjection !== void 0 ? tx.insert(anyTable).values(insertData).returning(listProjection) : tx.insert(anyTable).values(insertData).returning()
-    );
-    if (useRealtime && enabledMethods.has("list")) {
-      invalidateListRealtime(context);
+    const { result, realtimeRow } = await inRlsOrPlainTx(context.db, async (tx) => {
+      if (crudRealtime.explicitScopedList) {
+        const [insertedFullRow] = await tx.insert(anyTable).values(insertData).returning();
+        return {
+          result: projectResultRow(insertedFullRow),
+          realtimeRow: insertedFullRow ?? null
+        };
+      }
+      const [inserted] = listProjection !== void 0 ? await tx.insert(anyTable).values(insertData).returning(listProjection) : await tx.insert(anyTable).values(insertData).returning();
+      return { result: inserted, realtimeRow: inserted ?? null };
+    });
+    if (crudRealtime.enabled && realtimeRow) {
+      const mutationEventId = createCrudRealtimeEventId();
+      try {
+        await invalidateListRealtimeForScopes(context, {
+          rows: [realtimeRow],
+          eventId: mutationEventId
+        });
+      } catch (error) {
+        reportCrudRealtimeInvalidationError({
+          operation: "create",
+          id: realtimeRow?.[pkPropName],
+          error
+        });
+      }
     }
     return result;
   });
@@ -4436,18 +4790,35 @@ function buildCrud(table, options, procedure) {
     if (options?.hooks?.beforeUpdate) {
       updateData = await options.hooks.beforeUpdate(updateData);
     }
-    const [result] = await inRlsOrPlainTx(
-      context.db,
-      async (tx) => listProjection !== void 0 ? tx.update(anyTable).set(updateData).where(updateWhere).returning(listProjection) : tx.update(anyTable).set(updateData).where(updateWhere).returning()
-    );
-    if (useRealtime) {
-      if (enabledMethods.has("list")) {
-        invalidateListRealtime(context);
+    const { result, preRealtimeRow, postRealtimeRow } = await inRlsOrPlainTx(context.db, async (tx) => {
+      const preRow = crudRealtime.explicitScopedList ? await selectFullRowForRealtime(tx, updateWhere) : null;
+      const [updated] = listProjection !== void 0 ? await tx.update(anyTable).set(updateData).where(updateWhere).returning(listProjection) : await tx.update(anyTable).set(updateData).where(updateWhere).returning();
+      let postRow = updated ?? null;
+      if (crudRealtime.explicitScopedList && updated) {
+        postRow = await selectFullRowForRealtime(tx, eq3(pk, idVal));
+      }
+      return { result: updated, preRealtimeRow: preRow, postRealtimeRow: postRow };
+    });
+    if (crudRealtime.enabled) {
+      const mutationEventId = createCrudRealtimeEventId();
+      let listInvalidationError;
+      try {
+        await invalidateListRealtimeForScopes(context, {
+          rows: [preRealtimeRow, postRealtimeRow].filter(Boolean),
+          eventId: mutationEventId
+        });
+      } catch (error) {
+        listInvalidationError = error;
       }
       if (enabledMethods.has("get")) {
-        const getKey = buildQuerySubscriptionKey(`${prefix}.get`, { id: idVal });
-        if (allowAnonymous && !ownerMeta) context.realtime.emit(getKey, result);
-        else invalidateGetRealtime(context, idVal);
+        invalidateGetRealtime(context, idVal, mutationEventId);
+      }
+      if (listInvalidationError) {
+        reportCrudRealtimeInvalidationError({
+          operation: "update",
+          id: idVal,
+          error: listInvalidationError
+        });
       }
     }
     return result ?? null;
@@ -4459,16 +4830,37 @@ function buildCrud(table, options, procedure) {
     if (ownerMeta && user) {
       deleteWhere = and3(eq3(pk, input.id), eq3(ownerMeta.column, user.id));
     }
-    await inRlsOrPlainTx(context.db, async (tx) => {
+    const preRealtimeRow = await inRlsOrPlainTx(context.db, async (tx) => {
+      const preRow = crudRealtime.explicitScopedList ? await selectFullRowForRealtime(tx, deleteWhere) : null;
       if (options?.softDelete) {
         const sdField = options.softDelete.field;
         await tx.update(anyTable).set({ [sdField]: /* @__PURE__ */ new Date() }).where(deleteWhere);
       } else {
         await tx.delete(anyTable).where(deleteWhere);
       }
+      return preRow;
     });
-    if (useRealtime && enabledMethods.has("list")) {
-      invalidateListRealtime(context);
+    if (crudRealtime.enabled) {
+      const mutationEventId = createCrudRealtimeEventId();
+      let listInvalidationError;
+      try {
+        await invalidateListRealtimeForScopes(context, {
+          rows: crudRealtime.explicitScopedList ? [preRealtimeRow] : [{ [pkPropName]: input.id }],
+          eventId: mutationEventId
+        });
+      } catch (error) {
+        listInvalidationError = error;
+      }
+      if (enabledMethods.has("get")) {
+        invalidateGetRealtime(context, input.id, mutationEventId);
+      }
+      if (listInvalidationError) {
+        reportCrudRealtimeInvalidationError({
+          operation: "remove",
+          id: input.id,
+          error: listInvalidationError
+        });
+      }
     }
     return { success: true };
   });