gencow 0.1.247 → 0.1.249

package/bin/gencow.mjs

@@ -16,7 +16,7 @@
  *   gencow help        — show this help
  */
 
-import { execSync, spawn } from "child_process";
+import { execSync } from "child_process";
 import { existsSync, readFileSync, writeFileSync, unlinkSync, cpSync, symlinkSync, copyFileSync } from "fs";
 import { resolve, dirname } from "path";
 import { fileURLToPath } from "url";
@@ -146,7 +146,9 @@ const runDoctorCommand = createDoctorCommand({
   warnImpl: warn,
   errorImpl: error,
   successImpl: success,
-  exitImpl: (code) => process.exit(code),
+  exitImpl: (code) => {
+    process.exitCode = code;
+  },
   cwdImpl: () => process.cwd(),
   BOLD,
   CYAN,
@@ -546,19 +548,6 @@ ${BOLD}Examples:${RESET}
   // ── env — 환경변수 관리 (Cloud only) ─────────
   env: runEnvCommand,
 
-  async platform() {
-    log(`\n${BOLD}${CYAN}Gencow Platform${RESET}  ${DIM}— Control Plane${RESET}\n`);
-    info("Starting Control Plane on port 4000...");
-    const cwd = process.cwd();
-    const proc = spawn("pnpm", ["--filter", "@gencow/platform", "dev"], {
-      cwd,
-      stdio: "inherit",
-      shell: true,
-    });
-    proc.on("exit", (code) => process.exit(code ?? 0));
-    process.on("SIGINT", () => proc.kill());
-  },
-
   // ── dev:cloud (watch + auto-deploy + live log streaming) ──
   "dev:cloud": runDevCloudCommand,
 

package/core/index.js

@@ -2256,11 +2256,11 @@ async function countWorkflowV1Backlog(db, workflowName) {
     pendingByName: numberFrom(row?.pending_by_name)
   };
 }
-async function countWorkflowBacklog(db, workflowName) {
+async function countWorkflowBacklog(db, workflowName, requireV2 = false) {
   try {
     return await countWorkflowV2Backlog(db, workflowName);
   } catch (error) {
-    if (!isMissingWorkflowV2SchemaError(error)) throw error;
+    if (!isMissingWorkflowV2SchemaError(error) || requireV2) throw error;
     return countWorkflowV1Backlog(db, workflowName);
   }
 }
@@ -2301,7 +2301,7 @@ async function applyWorkflowStartAdmission(options) {
     });
   }
   await acquireWorkflowStartAdmissionLock(options.db);
-  const counts = await countWorkflowBacklog(options.db, options.workflowName);
+  const counts = await countWorkflowBacklog(options.db, options.workflowName, options.requireV2);
   if (counts.pending >= policy.pendingPerApp) {
     throw new JobAdmissionError("job_backlog_limit_exceeded", "workflow pending backlog limit exceeded", {
       details: { limit: policy.pendingPerApp, pending: counts.pending }
@@ -2949,11 +2949,13 @@ function parseJsonField(value) {
   }
 }
 function toIsoString(value) {
-  if (value instanceof Date) return value.toISOString();
+  if (typeof value === "number" && !Number.isFinite(value)) return String(/* @__PURE__ */ new Date(NaN));
+  if (value instanceof Date) return Number.isFinite(value.getTime()) ? value.toISOString() : String(value);
   const parsed = new Date(value);
   return Number.isFinite(parsed.getTime()) ? parsed.toISOString() : String(value);
 }
 function toOptionalIsoString(value) {
+  if (typeof value === "number" && !Number.isFinite(value)) return toIsoString(value);
   return value ? toIsoString(value) : null;
 }
 function publicV2Status(status) {
@@ -3628,6 +3630,7 @@ var RESERVED_TENANT_RUNTIME_ENV_KEYS = [
   "GENCOW_FUNCTIONS",
   "GENCOW_STORAGE",
   "GENCOW_STORAGE_REQUIRE_READ_GRANT",
+  "GENCOW_LOCAL_STORAGE_READ_GRANT_SECRET",
   "GENCOW_STORAGE_BACKEND",
   "GENCOW_STORAGE_LEGACY_LOCAL_FALLBACK",
   "GENCOW_STORAGE_QUOTA_BYTES",
@@ -4097,8 +4100,157 @@ import { pgTable } from "drizzle-orm/pg-core";
 var pgBaseTable = pgTable;
 
 // ../core/src/rls-db.ts
-import { AsyncLocalStorage } from "node:async_hooks";
 import { sql as sql7 } from "drizzle-orm";
+
+// ../core/src/rls-db-scoped-query.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+import { NoopCache } from "drizzle-orm/cache/core";
+import { RelationalQueryBuilder as PgRelationalQueryBuilder } from "drizzle-orm/pg-core/query-builders/query";
+import { PgDialect } from "drizzle-orm/pg-core/dialect";
+import { PgAsyncRelationalQuery } from "drizzle-orm/pg-core/async/query";
+var activeRlsExecution = new AsyncLocalStorage();
+function createRlsDiagnosticError(message, diagnostic) {
+  return Object.assign(new Error(message), diagnostic);
+}
+function createRlsScopeToken() {
+  return {};
+}
+function createRlsScopeConflictError() {
+  return createRlsDiagnosticError("A query cannot switch database scopes while an RLS operation is active.", {
+    code: "RLS_SCOPE_CONFLICT",
+    status: 409,
+    stage: "rls-query-execution",
+    capability: "rls-scoped-query",
+    stateImpact: "Rejected query executed no tenant SQL; enclosing operation may still finish independently",
+    retryable: false,
+    retryPrecondition: "Invoke only a database handle matching the active RLS scope, or wait until the active RLS execution completes.",
+    nextAction: "EDIT_AND_CHECK"
+  });
+}
+var unsupportedByReason = {
+  cache: {
+    message: "RLS-scoped queries do not support a shared Drizzle result cache.",
+    retryPrecondition: "Remove the shared Drizzle cache configuration before retrying; shared result caches are not supported by RLS-scoped queries."
+  },
+  relations: {
+    message: "This relational builder is not from the verified Drizzle v1 integration.",
+    retryPrecondition: "Check the installed version with `pnpm why drizzle-orm`; use verified drizzle-orm@1.0.0-rc.4 without custom relational builders before retrying."
+  },
+  session: {
+    message: "This Drizzle session cannot be safely bound to the transaction-scoped RLS client.",
+    retryPrecondition: "Check the installed version with `pnpm why drizzle-orm`; use a verified Drizzle driver and session before retrying."
+  }
+};
+function createRlsUnsupportedError(reason = "relations") {
+  return createRlsDiagnosticError(unsupportedByReason[reason].message, {
+    code: "RLS_DRIZZLE_INTEGRATION_UNSUPPORTED",
+    status: 409,
+    stage: "rls-query-setup",
+    capability: "rls-scoped-query",
+    stateImpact: "This rejected setup executed no tenant SQL and made no database state change",
+    retryable: false,
+    retryPrecondition: unsupportedByReason[reason].retryPrecondition,
+    nextAction: "EDIT_AND_CHECK"
+  });
+}
+function assertRlsScopeMayEnter(scope) {
+  const active = activeRlsExecution.getStore();
+  if (active?.active && active.scope !== scope) {
+    throw createRlsScopeConflictError();
+  }
+}
+function currentRlsExecution(scope) {
+  const active = activeRlsExecution.getStore();
+  if (!active?.active) return void 0;
+  if (active.scope !== scope) throw createRlsScopeConflictError();
+  return active;
+}
+function matchingRlsExecutionClient(scope) {
+  const active = activeRlsExecution.getStore();
+  return active?.active && active.scope === scope ? active.client : void 0;
+}
+async function runWithRlsScope(scope, client, work) {
+  const active = { scope, client, active: true };
+  return activeRlsExecution.run(active, async () => {
+    try {
+      return await work();
+    } finally {
+      active.active = false;
+    }
+  });
+}
+function runWithRlsTransactionScope(scope, tx, work) {
+  assertRlsScopeMayEnter(scope);
+  return runWithRlsScope(scope, tx.session?.client, work);
+}
+function createRlsRelationalQueryRegistry(query2, session, baseSession) {
+  const scopedRegistry = /* @__PURE__ */ Object.create(null);
+  for (const tableName of Reflect.ownKeys(query2)) {
+    const descriptor = Object.getOwnPropertyDescriptor(query2, tableName);
+    if (typeof tableName !== "string" || !descriptor || !descriptor.enumerable || !("value" in descriptor)) {
+      throw createRlsUnsupportedError("relations");
+    }
+    const builder = descriptor.value;
+    if (!builder || typeof builder !== "object" || builder.session !== baseSession || !builder.schema || typeof builder.schema !== "object" || !builder.table || typeof builder.table !== "object" || !builder.tableConfig || typeof builder.tableConfig !== "object" || !builder.dialect || typeof builder.dialect !== "object" || Object.getPrototypeOf(builder.dialect) !== PgDialect.prototype || Reflect.get(builder.dialect, "constructor") !== PgDialect || typeof builder.parseJson !== "boolean" || builder.builder !== PgAsyncRelationalQuery || Object.getPrototypeOf(builder) !== PgRelationalQueryBuilder.prototype || Reflect.get(builder, "constructor") !== PgRelationalQueryBuilder || Reflect.get(builder, "findMany") !== PgRelationalQueryBuilder.prototype.findMany || Reflect.get(builder, "findFirst") !== PgRelationalQueryBuilder.prototype.findFirst) {
+      throw createRlsUnsupportedError("relations");
+    }
+    const scopedBuilder = Reflect.construct(PgRelationalQueryBuilder, [
+      builder.schema,
+      builder.table,
+      builder.tableConfig,
+      builder.dialect,
+      session,
+      builder.parseJson,
+      PgAsyncRelationalQuery
+    ]);
+    const trustedFindMany = PgRelationalQueryBuilder.prototype.findMany;
+    const trustedFindFirst = PgRelationalQueryBuilder.prototype.findFirst;
+    Object.defineProperties(scopedBuilder, {
+      findMany: {
+        value: function(config) {
+          return Reflect.apply(trustedFindMany, this, [config]);
+        }
+      },
+      findFirst: {
+        value: function(config) {
+          return Reflect.apply(trustedFindFirst, this, [config]);
+        }
+      }
+    });
+    Object.freeze(scopedBuilder);
+    Object.defineProperty(scopedRegistry, tableName, {
+      value: scopedBuilder,
+      enumerable: true,
+      configurable: false,
+      writable: false
+    });
+  }
+  return Object.freeze(scopedRegistry);
+}
+function isVerifiedNoopCache(cache) {
+  if (!cache || typeof cache !== "object") return false;
+  const candidate = cache;
+  const ownKeys = Reflect.ownKeys(cache);
+  const ownPropertiesAreExpected = ownKeys.every((key) => {
+    if (key !== "invalidate") return false;
+    const descriptor = Object.getOwnPropertyDescriptor(cache, key);
+    return descriptor && "value" in descriptor && descriptor.value === NoopCache.prototype.onMutate;
+  });
+  return candidate.constructor === NoopCache && Object.getPrototypeOf(cache) === NoopCache.prototype && ownPropertiesAreExpected && candidate.strategy === NoopCache.prototype.strategy && candidate.get === NoopCache.prototype.get && candidate.put === NoopCache.prototype.put && candidate.onMutate === NoopCache.prototype.onMutate;
+}
+function hasUnpartitionedRlsCache(db, session) {
+  const databaseCache = db?.$cache;
+  const sessionCache = session?.cache;
+  const hasResultCacheSurface = (cache) => {
+    if (!cache || typeof cache !== "object") return false;
+    return ["strategy", "get", "put"].some((method) => typeof Reflect.get(cache, method) === "function");
+  };
+  const hasUnverifiedSessionCache = sessionCache !== void 0 && sessionCache !== null && !isVerifiedNoopCache(sessionCache);
+  const hasUnverifiedDatabaseCache = hasResultCacheSurface(databaseCache) && !isVerifiedNoopCache(databaseCache);
+  return hasUnverifiedSessionCache || hasUnverifiedDatabaseCache;
+}
+
+// ../core/src/rls-db.ts
 var TRANSACTION_ISOLATION_LEVELS = /* @__PURE__ */ new Set([
   "read uncommitted",
   "read committed",
@@ -4140,11 +4292,6 @@ async function forEachSetConfig(rls, setOne) {
     await setOne(name, value);
   }
 }
-var rlsExecClient = new AsyncLocalStorage();
-function isBunSqlSession(session) {
-  const name = session?.constructor?.name;
-  return typeof name === "string" && name.includes("BunSQLSession");
-}
 function isDrizzleTransactionDb(db) {
   const d = db;
   if (typeof d?.rollback === "function") {
@@ -4178,11 +4325,11 @@ async function injectRlsVarsOnTx(tx, rls, onTransactionContextFailure) {
     throw error;
   }
 }
-async function withRlsLeasedConnection(leased, rls, fn) {
+async function withRlsLeasedConnection(leased, rls, fn, scope) {
   try {
     await leased.query("begin");
     await applyRlsSessionVars(leased, rls);
-    const result = await rlsExecClient.run(leased, () => fn(leased));
+    const result = scope ? await runWithRlsScope(scope, leased, () => fn(leased)) : await fn(leased);
     await leased.query("commit");
     return result;
   } catch (e) {
@@ -4195,19 +4342,20 @@ async function withRlsLeasedConnection(leased, rls, fn) {
     leased.release();
   }
 }
-async function withRlsConnection(session, rls, reuseOuterConnection, fn) {
+async function withRlsConnection(session, rls, reuseOuterConnection, scope, fn) {
+  assertRlsScopeMayEnter(scope);
   if (reuseOuterConnection) {
     const c2 = session.client;
-    return rlsExecClient.run(c2, async () => {
+    return runWithRlsScope(scope, c2, async () => {
       await applyRlsSessionVars(c2, rls);
       return fn(c2);
     });
   }
   const c = session.client;
-  const runInner = async (client) => {
+  const runInner = async (client) => runWithRlsScope(scope, client, async () => {
     await applyRlsSessionVars(client, rls);
-    return rlsExecClient.run(client, () => fn(client));
-  };
+    return fn(client);
+  });
   if (typeof c.begin === "function") {
     return c.begin(runInner);
   }
@@ -4216,7 +4364,7 @@ async function withRlsConnection(session, rls, reuseOuterConnection, fn) {
   }
   if (typeof c.connect === "function" && typeof c.query === "function") {
     const leased = await c.connect();
-    return withRlsLeasedConnection(leased, rls, fn);
+    return withRlsLeasedConnection(leased, rls, fn, scope);
   }
   return runInner(c);
 }
@@ -4231,29 +4379,7 @@ function createClientBoundSession(session, client) {
     }
   });
 }
-async function withPreparedQueryClient(pq, client, fn) {
-  if (!("client" in pq)) {
-    return await fn();
-  }
-  const prevPq = pq.client;
-  pq.client = client;
-  try {
-    return await fn();
-  } finally {
-    pq.client = prevPq;
-  }
-}
-function createGenericPreparedQueryClientExecutors(pq) {
-  const origExecute = pq.execute.bind(pq);
-  const origAll = typeof pq.all === "function" ? pq.all.bind(pq) : null;
-  return {
-    execute(client, placeholderValues) {
-      return withPreparedQueryClient(pq, client, () => origExecute(placeholderValues));
-    },
-    all: origAll ? (client, placeholderValues) => withPreparedQueryClient(pq, client, () => origAll(placeholderValues)) : void 0
-  };
-}
-function createBunSqlPreparedQueryClientExecutors(baseSession, prepareQuery, prepareArgs) {
+function createSessionBoundPreparedQueryClientExecutors(pq, baseSession, prepareQuery, prepareArgs) {
   const reprepareOnClient = (client) => {
     const clientBoundSession = createClientBoundSession(baseSession, client);
     return Reflect.apply(prepareQuery, clientBoundSession, prepareArgs);
@@ -4262,60 +4388,74 @@ function createBunSqlPreparedQueryClientExecutors(baseSession, prepareQuery, pre
     execute(client, placeholderValues) {
       return reprepareOnClient(client).execute(placeholderValues);
     },
-    all(client, placeholderValues) {
+    all: typeof pq.all === "function" ? (client, placeholderValues) => {
       const txPreparedQuery = reprepareOnClient(client);
       if (typeof txPreparedQuery.all === "function") {
         return txPreparedQuery.all(placeholderValues);
       }
       return txPreparedQuery.execute(placeholderValues);
-    }
+    } : void 0
   };
 }
 function createPreparedQueryClientExecutors(params) {
-  if (isBunSqlSession(params.baseSession)) {
-    return createBunSqlPreparedQueryClientExecutors(
-      params.baseSession,
-      params.prepareQuery,
-      params.prepareArgs
-    );
-  }
-  return createGenericPreparedQueryClientExecutors(params.pq);
+  return createSessionBoundPreparedQueryClientExecutors(
+    params.pq,
+    params.baseSession,
+    params.prepareQuery,
+    params.prepareArgs
+  );
 }
-async function runPreparedQueryWithRls(session, rls, reuseOuterConnection, runOnClient, placeholderValues) {
-  const active = rlsExecClient.getStore();
+async function runPreparedQueryWithRls(session, rls, reuseOuterConnection, scope, runOnClient, placeholderValues) {
+  const active = currentRlsExecution(scope);
   if (active) {
-    return runOnClient(active, placeholderValues);
+    return runOnClient(active.client, placeholderValues);
   }
   return withRlsConnection(
     session,
     rls,
     reuseOuterConnection,
+    scope,
     (client) => runOnClient(client, placeholderValues)
   );
 }
-function wrapPreparedQuery(pq, session, baseSession, prepareQuery, prepareArgs, rls, reuseOuterConnection) {
+function wrapPreparedQuery(pq, session, baseSession, prepareQuery, prepareArgs, rls, reuseOuterConnection, scope) {
   const clientExecutors = createPreparedQueryClientExecutors({
     pq,
     baseSession,
     prepareQuery,
     prepareArgs
   });
-  pq.execute = (placeholderValues) => runPreparedQueryWithRls(session, rls, reuseOuterConnection, clientExecutors.execute, placeholderValues);
+  pq.execute = (placeholderValues) => runPreparedQueryWithRls(
+    session,
+    rls,
+    reuseOuterConnection,
+    scope,
+    clientExecutors.execute,
+    placeholderValues
+  );
   if (clientExecutors.all) {
-    pq.all = (placeholderValues) => runPreparedQueryWithRls(session, rls, reuseOuterConnection, clientExecutors.all, placeholderValues);
+    pq.all = (placeholderValues) => runPreparedQueryWithRls(
+      session,
+      rls,
+      reuseOuterConnection,
+      scope,
+      clientExecutors.all,
+      placeholderValues
+    );
   }
 }
-function wrapSession(session, rls, reuseOuterConnection) {
+function wrapSession(session, rls, reuseOuterConnection, scope) {
   return new Proxy(session, {
     get(sTarget, sProp, sRecv) {
       if (sProp === "client") {
-        return rlsExecClient.getStore() ?? Reflect.get(sTarget, sProp, sRecv);
+        return matchingRlsExecutionClient(scope) ?? Reflect.get(sTarget, sProp, sRecv);
       }
       if (sProp === "prepareQuery") {
         return (...args) => {
           const prepareQuery = Reflect.get(sTarget, sProp, sRecv);
+          if (typeof prepareQuery !== "function") throw createRlsUnsupportedError("session");
           const pq = Reflect.apply(prepareQuery, sRecv, args);
-          wrapPreparedQuery(pq, sRecv, sTarget, prepareQuery, args, rls, reuseOuterConnection);
+          wrapPreparedQuery(pq, sRecv, sTarget, prepareQuery, args, rls, reuseOuterConnection, scope);
           return pq;
         };
       }
@@ -4326,15 +4466,32 @@ function wrapSession(session, rls, reuseOuterConnection) {
 }
 function createRlsDb(db, rls, options = {}) {
   const reuseOuterConnection = isDrizzleTransactionDb(db);
-  const baseSession = db.session;
-  const wrappedSession = wrapSession(baseSession, rls, reuseOuterConnection);
+  const database = db;
+  const baseSession = database.session ?? database._?.session;
+  if (!baseSession || typeof baseSession !== "object") {
+    throw createRlsUnsupportedError("session");
+  }
+  if (hasUnpartitionedRlsCache(db, baseSession)) {
+    throw createRlsUnsupportedError("cache");
+  }
+  const scope = createRlsScopeToken();
+  const wrappedSession = wrapSession(baseSession, rls, reuseOuterConnection, scope);
+  const baseQuery = Reflect.get(db, "query", db);
+  const scopedQuery = baseQuery && typeof baseQuery === "object" ? createRlsRelationalQueryRegistry(baseQuery, wrappedSession, baseSession) : baseQuery;
   return new Proxy(db, {
     get(target, prop, receiver) {
+      if (prop === "query") {
+        return scopedQuery;
+      }
+      if (prop === "$client") {
+        return Reflect.get(target, prop, target);
+      }
       if (prop === "session") {
         return wrappedSession;
       }
       if (prop === "_") {
-        const inner = target._;
+        const inner = Reflect.get(target, prop, receiver);
+        if (!inner || typeof inner !== "object") return inner;
         return new Proxy(inner, {
           get(i, p, r) {
             if (p === "session") return wrappedSession;
@@ -4344,6 +4501,7 @@ function createRlsDb(db, rls, options = {}) {
       }
       if (prop === "transaction") {
         return async (callback, ...rest) => {
+          assertRlsScopeMayEnter(scope);
           let callbackStarted = false;
           const configStatement = transactionConfigSql(rest[0]);
           const transactionArgs = configStatement ? [] : rest;
@@ -4353,7 +4511,7 @@ function createRlsDb(db, rls, options = {}) {
                 if (configStatement) await tx.execute(configStatement);
                 await injectRlsVarsOnTx(tx, rls, options.onTransactionContextFailure);
                 callbackStarted = true;
-                return await callback(tx);
+                return await runWithRlsTransactionScope(scope, tx, () => callback(tx));
               },
               ...transactionArgs
             );
@@ -4371,13 +4529,14 @@ function createRlsDb(db, rls, options = {}) {
       }
       if (prop === "transactionWithCharacteristics") {
         return async (characteristics, callback) => {
+          assertRlsScopeMayEnter(scope);
           return await target.transaction(async (tx) => {
             await applyTransactionConfig(tx, {
               ...characteristics?.isolationLevel ? { isolationLevel: characteristics.isolationLevel } : {},
               ...characteristics?.readOnly ? { accessMode: "read only" } : {}
             });
             await injectRlsVarsOnTx(tx, rls, options.onTransactionContextFailure);
-            return callback(tx);
+            return runWithRlsTransactionScope(scope, tx, () => callback(tx));
           });
         };
       }
@@ -4401,6 +4560,7 @@ import {
   ilike,
   inArray,
   notInArray,
+  isNull,
   or,
   and,
   count as drizzleCount,
@@ -4451,6 +4611,13 @@ function detectOwnerMeta(table) {
   }
   try {
     const config = getTableConfig(table);
+    const declared = getOwnerRlsMeta(table);
+    if (declared) {
+      const propertyName = resolvePropertyName(table, declared.columnName);
+      const column = anyTable[propertyName];
+      if (column)
+        return { column, columnName: declared.columnName, propertyName, readPublic: declared.readPublic };
+    }
     if (config.policies && config.policies.length > 0) {
       const propName = anyTable["userId"] ? "userId" : anyTable["user_id"] ? "user_id" : null;
       if (propName) {
@@ -4571,7 +4738,7 @@ function crud(table, options) {
     const conditions = [];
     if (options?.softDelete) {
       const sdField = anyTable[options.softDelete.field];
-      conditions.push(eq(sdField, null));
+      conditions.push(isNull(sdField));
     }
     if (args?.search && options?.searchFields?.length) {
       const searchConds = options.searchFields.map(
@@ -4662,7 +4829,7 @@ function crud(table, options) {
       }
       if (options?.softDelete) {
         const sdField = anyTable[options.softDelete.field];
-        whereCond = and(whereCond, eq(sdField, null));
+        whereCond = and(whereCond, isNull(sdField));
       }
       return await inRlsOrPlainTx(ctx.db, async (tx) => {
         const [result] = await tx.select().from(anyTable).where(whereCond).limit(1);
@@ -4775,6 +4942,7 @@ import {
   ilike as ilike3,
   or as or3,
   and as and3,
+  isNull as isNull2,
   count as drizzleCount2,
   getTableName as getTableName4,
   getTableColumns as getTableColumns3
@@ -4956,6 +5124,13 @@ function detectOwnerMeta2(table) {
   }
   try {
     const config = getTableConfig2(table);
+    const declared = getOwnerRlsMeta(table);
+    if (declared) {
+      const propertyName = resolvePropertyName2(table, declared.columnName);
+      const column = anyTable[propertyName];
+      if (column)
+        return { column, columnName: declared.columnName, propertyName, readPublic: declared.readPublic };
+    }
     if (config.policies && config.policies.length > 0) {
       const propName = anyTable["userId"] ? "userId" : anyTable["user_id"] ? "user_id" : null;
       if (propName) {
@@ -5290,7 +5465,7 @@ function buildCrud(table, options, procedure) {
     const conditions = [];
     if (options?.softDelete) {
       const sdField = anyTable[options.softDelete.field];
-      conditions.push(eq3(sdField, null));
+      conditions.push(isNull2(sdField));
     }
     if (args.search && options?.searchFields?.length) {
       if (disableILike) {
@@ -5568,7 +5743,7 @@ function buildCrud(table, options, procedure) {
     }
     if (options?.softDelete) {
       const sdField = anyTable[options.softDelete.field];
-      whereCond = and3(whereCond, eq3(sdField, null));
+      whereCond = and3(whereCond, isNull2(sdField));
     }
     return whereCond;
   }
@@ -5677,15 +5852,18 @@ function buildCrud(table, options, procedure) {
     if (options?.hooks?.beforeUpdate) {
       updateData = await options.hooks.beforeUpdate(updateData);
     }
-    const { result, preRealtimeRow, postRealtimeRow } = await inRlsOrPlainTx(context.db, async (tx) => {
-      const preRow = crudRealtime.explicitScopedList ? await selectFullRowForRealtime(tx, updateWhere) : null;
-      const [updated] = listProjection !== void 0 ? await tx.update(anyTable).set(updateData).where(updateWhere).returning(listProjection) : await tx.update(anyTable).set(updateData).where(updateWhere).returning();
-      let postRow = updated ?? null;
-      if (crudRealtime.explicitScopedList && updated) {
-        postRow = await selectFullRowForRealtime(tx, eq3(pk, idVal));
+    const { result, preRealtimeRow, postRealtimeRow } = await inRlsOrPlainTx(
+      context.db,
+      async (tx) => {
+        const preRow = crudRealtime.explicitScopedList ? await selectFullRowForRealtime(tx, updateWhere) : null;
+        const [updated] = listProjection !== void 0 ? await tx.update(anyTable).set(updateData).where(updateWhere).returning(listProjection) : await tx.update(anyTable).set(updateData).where(updateWhere).returning();
+        let postRow = updated ?? null;
+        if (crudRealtime.explicitScopedList && updated) {
+          postRow = await selectFullRowForRealtime(tx, eq3(pk, idVal));
+        }
+        return { result: updated, preRealtimeRow: preRow, postRealtimeRow: postRow };
       }
-      return { result: updated, preRealtimeRow: preRow, postRealtimeRow: postRow };
-    });
+    );
     if (crudRealtime.enabled) {
       const mutationEventId = createCrudRealtimeEventId();
       let listInvalidationError;

package/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gencow/core",
-  "version": "0.1.45",
+  "version": "0.1.46",
   "type": "module",
   "main": "index.js"
 }