postgresdk 0.10.4 → 0.12.0

package/README.md

@@ -160,7 +160,7 @@ const authors = await sdk.authors.list({
 ### Filtering & Pagination
 
 ```typescript
-// Simple equality filtering
+// Simple equality filtering with single-column sorting
 const users = await sdk.users.list({
   where: { status: "active" },
   orderBy: "created_at",
@@ -169,6 +169,12 @@ const users = await sdk.users.list({
   offset: 40
 });
 
+// Multi-column sorting
+const sorted = await sdk.users.list({
+  orderBy: ["status", "created_at"],
+  order: ["asc", "desc"]  // or use single direction: order: "asc"
+});
+
 // Advanced WHERE operators
 const filtered = await sdk.users.list({
   where: {
@@ -285,6 +291,41 @@ const pool = new Pool({ connectionString: process.env.DATABASE_URL });
 const apiRouter = createRouter({ pg: pool });
 ```
 
+### Request-Level Middleware (onRequest Hook)
+
+The `onRequest` hook executes before every endpoint operation, enabling:
+- Setting PostgreSQL session variables for audit logging
+- Configuring Row-Level Security (RLS) based on authenticated user
+- Request-level logging or monitoring
+
+```typescript
+import { createRouter } from "./api/server/router";
+
+const apiRouter = createRouter({
+  pg,
+  onRequest: async (c, pg) => {
+    // Access Hono context - fully type-safe
+    const auth = c.get('auth');
+
+    // Set PostgreSQL session variable for audit triggers
+    if (auth?.kind === 'jwt' && auth.claims?.sub) {
+      await pg.query(`SET LOCAL app.user_id = '${auth.claims.sub}'`);
+    }
+
+    // Or configure RLS policies
+    if (auth?.tenant_id) {
+      await pg.query(`SET LOCAL app.tenant_id = '${auth.tenant_id}'`);
+    }
+  }
+});
+```
+
+The hook receives:
+- `c` - Hono Context object with full type safety and IDE autocomplete
+- `pg` - PostgreSQL client for setting session variables
+
+**Note:** The router works with or without the `onRequest` hook - fully backward compatible.
+
 ## Server Integration
 
 postgresdk generates Hono-compatible routes:

package/dist/cli.js

@@ -793,9 +793,9 @@ const items = await sdk.${tableName}.list();
 const filtered = await sdk.${tableName}.list({
   limit: 20,
   offset: 0,
-  ${table.columns[0]?.name || "field"}_like: 'search',
-  order_by: '${table.columns[0]?.name || "created_at"}',
-  order_dir: 'desc'
+  where: { ${table.columns[0]?.name || "field"}: { $like: '%search%' } },
+  orderBy: '${table.columns[0]?.name || "created_at"}',
+  order: 'desc'
 });`,
     correspondsTo: `GET ${basePath}`
   });
@@ -1058,8 +1058,8 @@ function generateQueryParams(table) {
   const params = {
     limit: "number - Max records to return (default: 50)",
     offset: "number - Records to skip",
-    order_by: "string - Field to sort by",
-    order_dir: "'asc' | 'desc' - Sort direction"
+    orderBy: "string | string[] - Field(s) to sort by",
+    order: "'asc' | 'desc' | ('asc' | 'desc')[] - Sort direction(s)"
   };
   let filterCount = 0;
   for (const col of table.columns) {
@@ -1351,6 +1351,64 @@ function generateUnifiedContractMarkdown(contract) {
   lines.push("");
   lines.push("**Note:** The WHERE clause types are fully type-safe. TypeScript will only allow operators that are valid for each field type.");
   lines.push("");
+  lines.push("## Sorting");
+  lines.push("");
+  lines.push("Sort query results using the `orderBy` and `order` parameters. Supports both single and multi-column sorting.");
+  lines.push("");
+  lines.push("### Single Column Sorting");
+  lines.push("");
+  lines.push("```typescript");
+  lines.push("// Sort by one column ascending");
+  lines.push("const users = await sdk.users.list({");
+  lines.push("  orderBy: 'created_at',");
+  lines.push("  order: 'asc'");
+  lines.push("});");
+  lines.push("");
+  lines.push("// Sort descending");
+  lines.push("const latest = await sdk.users.list({");
+  lines.push("  orderBy: 'created_at',");
+  lines.push("  order: 'desc'");
+  lines.push("});");
+  lines.push("");
+  lines.push("// Order defaults to 'asc' if not specified");
+  lines.push("const sorted = await sdk.users.list({");
+  lines.push("  orderBy: 'name'");
+  lines.push("});");
+  lines.push("```");
+  lines.push("");
+  lines.push("### Multi-Column Sorting");
+  lines.push("");
+  lines.push("```typescript");
+  lines.push("// Sort by multiple columns (all same direction)");
+  lines.push("const users = await sdk.users.list({");
+  lines.push("  orderBy: ['status', 'created_at'],");
+  lines.push("  order: 'desc'");
+  lines.push("});");
+  lines.push("");
+  lines.push("// Different direction per column");
+  lines.push("const sorted = await sdk.users.list({");
+  lines.push("  orderBy: ['status', 'created_at'],");
+  lines.push("  order: ['asc', 'desc']  // status ASC, created_at DESC");
+  lines.push("});");
+  lines.push("```");
+  lines.push("");
+  lines.push("### Combining Sorting with Filters");
+  lines.push("");
+  lines.push("```typescript");
+  lines.push("const results = await sdk.users.list({");
+  lines.push("  where: {");
+  lines.push("    status: 'active',");
+  lines.push("    age: { $gte: 18 }");
+  lines.push("  },");
+  lines.push("  orderBy: 'created_at',");
+  lines.push("  order: 'desc',");
+  lines.push("  limit: 50,");
+  lines.push("  offset: 0");
+  lines.push("});");
+  lines.push("```");
+  lines.push("");
+  lines.push("**Note:** Column names are validated by Zod schemas. Only valid table columns are accepted, preventing SQL injection.");
+  lines.push("");
   lines.push("## Resources");
   lines.push("");
   for (const resource of contract.resources) {
@@ -2625,6 +2683,7 @@ function emitHonoRoutes(table, _graph, opts) {
   const hasAuth = opts.authStrategy && opts.authStrategy !== "none";
   const ext = opts.useJsExtensions ? ".js" : "";
   const authImport = hasAuth ? `import { authMiddleware } from "../auth${ext}";` : "";
+  const columnNames = table.columns.map((c) => `"${c.name}"`).join(", ");
   return `/**
  * AUTO-GENERATED FILE - DO NOT EDIT
  *
@@ -2634,21 +2693,25 @@ function emitHonoRoutes(table, _graph, opts) {
  * To make changes, modify your schema or configuration and regenerate.
  */
 import { Hono } from "hono";
+import type { Context } from "hono";
 import { z } from "zod";
 import { Insert${Type}Schema, Update${Type}Schema } from "../zod/${fileTableName}${ext}";
 import { loadIncludes } from "../include-loader${ext}";
 import * as coreOps from "../core/operations${ext}";
 ${authImport}
 
+const columnEnum = z.enum([${columnNames}]);
+
 const listSchema = z.object({
   where: z.any().optional(),
   include: z.any().optional(),
   limit: z.number().int().positive().max(100).optional(),
   offset: z.number().int().min(0).optional(),
-  orderBy: z.any().optional()
+  orderBy: z.union([columnEnum, z.array(columnEnum)]).optional(),
+  order: z.union([z.enum(["asc", "desc"]), z.array(z.enum(["asc", "desc"]))]).optional()
 });
 
-export function register${Type}Routes(app: Hono, deps: { pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> } }) {
+export function register${Type}Routes(app: Hono, deps: { pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> }, onRequest?: (c: Context, pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> }) => Promise<void> }) {
   const base = "/v1/${fileTableName}";
   
   // Create operation context
@@ -2668,12 +2731,16 @@ ${hasAuth ? `
   app.post(base, async (c) => {
     const body = await c.req.json().catch(() => ({}));
     const parsed = Insert${Type}Schema.safeParse(body);
-    
+
     if (!parsed.success) {
       const issues = parsed.error.flatten();
       return c.json({ error: "Invalid body", issues }, 400);
     }
-    
+
+    if (deps.onRequest) {
+      await deps.onRequest(c, deps.pg);
+    }
+
     const result = await coreOps.createRecord(ctx, parsed.data);
     
     if (result.error) {
@@ -2686,6 +2753,11 @@ ${hasAuth ? `
   // GET BY PK
   app.get(\`\${base}/${pkPath}\`, async (c) => {
     ${getPkParams}
+
+    if (deps.onRequest) {
+      await deps.onRequest(c, deps.pg);
+    }
+
     const result = await coreOps.getByPk(ctx, pkValues);
     
     if (result.error) {
@@ -2698,12 +2770,16 @@ ${hasAuth ? `
   // LIST
   app.post(\`\${base}/list\`, async (c) => {
     const body = listSchema.safeParse(await c.req.json().catch(() => ({})));
-    
+
     if (!body.success) {
       const issues = body.error.flatten();
       return c.json({ error: "Invalid body", issues }, 400);
     }
-    
+
+    if (deps.onRequest) {
+      await deps.onRequest(c, deps.pg);
+    }
+
     const result = await coreOps.listRecords(ctx, body.data);
     
     if (result.error) {
@@ -2749,12 +2825,16 @@ ${hasAuth ? `
     ${getPkParams}
     const body = await c.req.json().catch(() => ({}));
     const parsed = Update${Type}Schema.safeParse(body);
-    
+
     if (!parsed.success) {
       const issues = parsed.error.flatten();
       return c.json({ error: "Invalid body", issues }, 400);
     }
-    
+
+    if (deps.onRequest) {
+      await deps.onRequest(c, deps.pg);
+    }
+
     const result = await coreOps.updateRecord(ctx, pkValues, parsed.data);
     
     if (result.error) {
@@ -2767,6 +2847,11 @@ ${hasAuth ? `
   // DELETE
   app.delete(\`\${base}/${pkPath}\`, async (c) => {
     ${getPkParams}
+
+    if (deps.onRequest) {
+      await deps.onRequest(c, deps.pg);
+    }
+
     const result = await coreOps.deleteRecord(ctx, pkValues);
     
     if (result.error) {
@@ -2812,7 +2897,7 @@ function emitClient(table, graph, opts, model) {
   let includeMethodsCode = "";
   for (const method of includeMethods) {
     const isGetByPk = method.name.startsWith("getByPk");
-    const baseParams = isGetByPk ? "" : `params?: Omit<{ limit?: number; offset?: number; where?: Where<Select${Type}>; orderBy?: string; order?: "asc" | "desc"; }, "include">`;
+    const baseParams = isGetByPk ? "" : `params?: Omit<{ limit?: number; offset?: number; where?: Where<Select${Type}>; orderBy?: string | string[]; order?: "asc" | "desc" | ("asc" | "desc")[]; }, "include">`;
     if (isGetByPk) {
       const pkWhere = hasCompositePk ? `{ ${safePk.map((col) => `${col}: pk.${col}`).join(", ")} }` : `{ ${safePk[0] || "id"}: pk }`;
       const baseReturnType = method.returnType.replace(" | null", "");
@@ -2868,8 +2953,8 @@ export class ${Type}Client extends BaseClient {
     limit?: number;
     offset?: number;
     where?: Where<Select${Type}>;
-    orderBy?: string;
-    order?: "asc" | "desc";
+    orderBy?: string | string[];
+    order?: "asc" | "desc" | ("asc" | "desc")[];
   }): Promise<Select${Type}[]> {
     return this.post<Select${Type}[]>(\`\${this.resource}/list\`, params ?? {});
   }
@@ -3777,6 +3862,7 @@ function emitHonoRouter(tables, hasAuth, useJsExtensions) {
  * To make changes, modify your schema or configuration and regenerate.
  */
 import { Hono } from "hono";
+import type { Context } from "hono";
 import { SDK_MANIFEST } from "./sdk-bundle${ext}";
 import { getContract } from "./contract${ext}";
 ${imports}
@@ -3784,32 +3870,46 @@ ${hasAuth ? `export { authMiddleware } from "./auth${ext}";` : ""}
 
 /**
  * Creates a Hono router with all generated routes that can be mounted into your existing app.
- * 
+ *
  * @example
  * import { Hono } from "hono";
  * import { createRouter } from "./generated/server/router";
- * 
+ *
  * // Using pg driver (Node.js)
  * import { Client } from "pg";
  * const pg = new Client({ connectionString: process.env.DATABASE_URL });
  * await pg.connect();
- * 
+ *
  * // OR using Neon driver (Edge-compatible)
  * import { Pool } from "@neondatabase/serverless";
  * const pool = new Pool({ connectionString: process.env.DATABASE_URL! });
  * const pg = pool; // Pool already has the compatible query method
- * 
+ *
  * // Mount all generated routes
  * const app = new Hono();
  * const apiRouter = createRouter({ pg });
  * app.route("/api", apiRouter);
- * 
+ *
  * // Or mount directly at root
  * const router = createRouter({ pg });
  * app.route("/", router);
+ *
+ * // With onRequest hook for audit logging or session variables
+ * const router = createRouter({
+ *   pg,
+ *   onRequest: async (c, pg) => {
+ *     const auth = c.get('auth'); // Type-safe! IDE autocomplete works
+ *     if (auth?.kind === 'jwt' && auth.claims?.sub) {
+ *       await pg.query(\`SET LOCAL app.user_id = '\${auth.claims.sub}'\`);
+ *     }
+ *   }
+ * });
  */
 export function createRouter(
-  deps: { pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> } }
+  deps: {
+    pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> },
+    onRequest?: (c: Context, pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> }) => Promise<void>
+  }
 ): Hono {
   const router = new Hono();
   
@@ -3868,22 +3968,36 @@ ${registrations}
 
 /**
  * Register all generated routes directly on an existing Hono app.
- * 
+ *
  * @example
  * import { Hono } from "hono";
  * import { registerAllRoutes } from "./generated/server/router";
- * 
+ *
  * const app = new Hono();
- * 
+ *
  * // Setup database connection (see createRouter example for both pg and Neon options)
  * const pg = yourDatabaseClient;
- * 
+ *
  * // Register all routes at once
  * registerAllRoutes(app, { pg });
+ *
+ * // With onRequest hook
+ * registerAllRoutes(app, {
+ *   pg,
+ *   onRequest: async (c, pg) => {
+ *     const auth = c.get('auth'); // Type-safe!
+ *     if (auth?.kind === 'jwt' && auth.claims?.sub) {
+ *       await pg.query(\`SET LOCAL app.user_id = '\${auth.claims.sub}'\`);
+ *     }
+ *   }
+ * });
  */
 export function registerAllRoutes(
   app: Hono,
-  deps: { pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> } }
+  deps: {
+    pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> },
+    onRequest?: (c: Context, pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> }) => Promise<void>
+  }
 ) {
 ${registrations.replace(/router/g, "app")}
 }
@@ -4174,10 +4288,10 @@ function buildWhereClause(
  */
 export async function listRecords(
   ctx: OperationContext,
-  params: { where?: any; limit?: number; offset?: number; include?: any }
+  params: { where?: any; limit?: number; offset?: number; include?: any; orderBy?: string | string[]; order?: "asc" | "desc" | ("asc" | "desc")[] }
 ): Promise<{ data?: any; error?: string; issues?: any; needsIncludes?: boolean; includeSpec?: any; status: number }> {
   try {
-    const { where: whereClause, limit = 50, offset = 0, include } = params;
+    const { where: whereClause, limit = 50, offset = 0, include, orderBy, order } = params;
 
     // Build WHERE clause
     let paramIndex = 1;
@@ -4201,12 +4315,26 @@ export async function listRecords(
 
     const whereSQL = whereParts.length > 0 ? \`WHERE \${whereParts.join(" AND ")}\` : "";
 
+    // Build ORDER BY clause
+    let orderBySQL = "";
+    if (orderBy) {
+      const columns = Array.isArray(orderBy) ? orderBy : [orderBy];
+      const directions = Array.isArray(order) ? order : (order ? Array(columns.length).fill(order) : Array(columns.length).fill("asc"));
+
+      const orderParts = columns.map((col, i) => {
+        const dir = (directions[i] || "asc").toUpperCase();
+        return \`"\${col}" \${dir}\`;
+      });
+
+      orderBySQL = \`ORDER BY \${orderParts.join(", ")}\`;
+    }
+
     // Add limit and offset params
     const limitParam = \`$\${paramIndex}\`;
     const offsetParam = \`$\${paramIndex + 1}\`;
     const allParams = [...whereParams, limit, offset];
 
-    const text = \`SELECT * FROM "\${ctx.table}" \${whereSQL} LIMIT \${limitParam} OFFSET \${offsetParam}\`;
+    const text = \`SELECT * FROM "\${ctx.table}" \${whereSQL} \${orderBySQL} LIMIT \${limitParam} OFFSET \${offsetParam}\`;
     log.debug(\`LIST \${ctx.table} SQL:\`, text, "params:", allParams);
 
     const { rows } = await ctx.pg.query(text, allParams);

package/dist/core/operations.d.ts

@@ -39,6 +39,8 @@ export declare function listRecords(ctx: OperationContext, params: {
     limit?: number;
     offset?: number;
     include?: any;
+    orderBy?: string | string[];
+    order?: "asc" | "desc" | ("asc" | "desc")[];
 }): Promise<{
     data?: any;
     error?: string;

package/dist/index.js

@@ -792,9 +792,9 @@ const items = await sdk.${tableName}.list();
 const filtered = await sdk.${tableName}.list({
   limit: 20,
   offset: 0,
-  ${table.columns[0]?.name || "field"}_like: 'search',
-  order_by: '${table.columns[0]?.name || "created_at"}',
-  order_dir: 'desc'
+  where: { ${table.columns[0]?.name || "field"}: { $like: '%search%' } },
+  orderBy: '${table.columns[0]?.name || "created_at"}',
+  order: 'desc'
 });`,
     correspondsTo: `GET ${basePath}`
   });
@@ -1057,8 +1057,8 @@ function generateQueryParams(table) {
   const params = {
     limit: "number - Max records to return (default: 50)",
     offset: "number - Records to skip",
-    order_by: "string - Field to sort by",
-    order_dir: "'asc' | 'desc' - Sort direction"
+    orderBy: "string | string[] - Field(s) to sort by",
+    order: "'asc' | 'desc' | ('asc' | 'desc')[] - Sort direction(s)"
   };
   let filterCount = 0;
   for (const col of table.columns) {
@@ -1350,6 +1350,64 @@ function generateUnifiedContractMarkdown(contract) {
   lines.push("");
   lines.push("**Note:** The WHERE clause types are fully type-safe. TypeScript will only allow operators that are valid for each field type.");
   lines.push("");
+  lines.push("## Sorting");
+  lines.push("");
+  lines.push("Sort query results using the `orderBy` and `order` parameters. Supports both single and multi-column sorting.");
+  lines.push("");
+  lines.push("### Single Column Sorting");
+  lines.push("");
+  lines.push("```typescript");
+  lines.push("// Sort by one column ascending");
+  lines.push("const users = await sdk.users.list({");
+  lines.push("  orderBy: 'created_at',");
+  lines.push("  order: 'asc'");
+  lines.push("});");
+  lines.push("");
+  lines.push("// Sort descending");
+  lines.push("const latest = await sdk.users.list({");
+  lines.push("  orderBy: 'created_at',");
+  lines.push("  order: 'desc'");
+  lines.push("});");
+  lines.push("");
+  lines.push("// Order defaults to 'asc' if not specified");
+  lines.push("const sorted = await sdk.users.list({");
+  lines.push("  orderBy: 'name'");
+  lines.push("});");
+  lines.push("```");
+  lines.push("");
+  lines.push("### Multi-Column Sorting");
+  lines.push("");
+  lines.push("```typescript");
+  lines.push("// Sort by multiple columns (all same direction)");
+  lines.push("const users = await sdk.users.list({");
+  lines.push("  orderBy: ['status', 'created_at'],");
+  lines.push("  order: 'desc'");
+  lines.push("});");
+  lines.push("");
+  lines.push("// Different direction per column");
+  lines.push("const sorted = await sdk.users.list({");
+  lines.push("  orderBy: ['status', 'created_at'],");
+  lines.push("  order: ['asc', 'desc']  // status ASC, created_at DESC");
+  lines.push("});");
+  lines.push("```");
+  lines.push("");
+  lines.push("### Combining Sorting with Filters");
+  lines.push("");
+  lines.push("```typescript");
+  lines.push("const results = await sdk.users.list({");
+  lines.push("  where: {");
+  lines.push("    status: 'active',");
+  lines.push("    age: { $gte: 18 }");
+  lines.push("  },");
+  lines.push("  orderBy: 'created_at',");
+  lines.push("  order: 'desc',");
+  lines.push("  limit: 50,");
+  lines.push("  offset: 0");
+  lines.push("});");
+  lines.push("```");
+  lines.push("");
+  lines.push("**Note:** Column names are validated by Zod schemas. Only valid table columns are accepted, preventing SQL injection.");
+  lines.push("");
   lines.push("## Resources");
   lines.push("");
   for (const resource of contract.resources) {
@@ -1865,6 +1923,7 @@ function emitHonoRoutes(table, _graph, opts) {
   const hasAuth = opts.authStrategy && opts.authStrategy !== "none";
   const ext = opts.useJsExtensions ? ".js" : "";
   const authImport = hasAuth ? `import { authMiddleware } from "../auth${ext}";` : "";
+  const columnNames = table.columns.map((c) => `"${c.name}"`).join(", ");
   return `/**
  * AUTO-GENERATED FILE - DO NOT EDIT
  *
@@ -1874,21 +1933,25 @@ function emitHonoRoutes(table, _graph, opts) {
  * To make changes, modify your schema or configuration and regenerate.
  */
 import { Hono } from "hono";
+import type { Context } from "hono";
 import { z } from "zod";
 import { Insert${Type}Schema, Update${Type}Schema } from "../zod/${fileTableName}${ext}";
 import { loadIncludes } from "../include-loader${ext}";
 import * as coreOps from "../core/operations${ext}";
 ${authImport}
 
+const columnEnum = z.enum([${columnNames}]);
+
 const listSchema = z.object({
   where: z.any().optional(),
   include: z.any().optional(),
   limit: z.number().int().positive().max(100).optional(),
   offset: z.number().int().min(0).optional(),
-  orderBy: z.any().optional()
+  orderBy: z.union([columnEnum, z.array(columnEnum)]).optional(),
+  order: z.union([z.enum(["asc", "desc"]), z.array(z.enum(["asc", "desc"]))]).optional()
 });
 
-export function register${Type}Routes(app: Hono, deps: { pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> } }) {
+export function register${Type}Routes(app: Hono, deps: { pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> }, onRequest?: (c: Context, pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> }) => Promise<void> }) {
   const base = "/v1/${fileTableName}";
   
   // Create operation context
@@ -1908,12 +1971,16 @@ ${hasAuth ? `
   app.post(base, async (c) => {
     const body = await c.req.json().catch(() => ({}));
     const parsed = Insert${Type}Schema.safeParse(body);
-    
+
     if (!parsed.success) {
       const issues = parsed.error.flatten();
       return c.json({ error: "Invalid body", issues }, 400);
     }
-    
+
+    if (deps.onRequest) {
+      await deps.onRequest(c, deps.pg);
+    }
+
     const result = await coreOps.createRecord(ctx, parsed.data);
     
     if (result.error) {
@@ -1926,6 +1993,11 @@ ${hasAuth ? `
   // GET BY PK
   app.get(\`\${base}/${pkPath}\`, async (c) => {
     ${getPkParams}
+
+    if (deps.onRequest) {
+      await deps.onRequest(c, deps.pg);
+    }
+
     const result = await coreOps.getByPk(ctx, pkValues);
     
     if (result.error) {
@@ -1938,12 +2010,16 @@ ${hasAuth ? `
   // LIST
   app.post(\`\${base}/list\`, async (c) => {
     const body = listSchema.safeParse(await c.req.json().catch(() => ({})));
-    
+
     if (!body.success) {
       const issues = body.error.flatten();
       return c.json({ error: "Invalid body", issues }, 400);
     }
-    
+
+    if (deps.onRequest) {
+      await deps.onRequest(c, deps.pg);
+    }
+
     const result = await coreOps.listRecords(ctx, body.data);
     
     if (result.error) {
@@ -1989,12 +2065,16 @@ ${hasAuth ? `
     ${getPkParams}
     const body = await c.req.json().catch(() => ({}));
     const parsed = Update${Type}Schema.safeParse(body);
-    
+
     if (!parsed.success) {
       const issues = parsed.error.flatten();
       return c.json({ error: "Invalid body", issues }, 400);
     }
-    
+
+    if (deps.onRequest) {
+      await deps.onRequest(c, deps.pg);
+    }
+
     const result = await coreOps.updateRecord(ctx, pkValues, parsed.data);
     
     if (result.error) {
@@ -2007,6 +2087,11 @@ ${hasAuth ? `
   // DELETE
   app.delete(\`\${base}/${pkPath}\`, async (c) => {
     ${getPkParams}
+
+    if (deps.onRequest) {
+      await deps.onRequest(c, deps.pg);
+    }
+
     const result = await coreOps.deleteRecord(ctx, pkValues);
     
     if (result.error) {
@@ -2052,7 +2137,7 @@ function emitClient(table, graph, opts, model) {
   let includeMethodsCode = "";
   for (const method of includeMethods) {
     const isGetByPk = method.name.startsWith("getByPk");
-    const baseParams = isGetByPk ? "" : `params?: Omit<{ limit?: number; offset?: number; where?: Where<Select${Type}>; orderBy?: string; order?: "asc" | "desc"; }, "include">`;
+    const baseParams = isGetByPk ? "" : `params?: Omit<{ limit?: number; offset?: number; where?: Where<Select${Type}>; orderBy?: string | string[]; order?: "asc" | "desc" | ("asc" | "desc")[]; }, "include">`;
     if (isGetByPk) {
       const pkWhere = hasCompositePk ? `{ ${safePk.map((col) => `${col}: pk.${col}`).join(", ")} }` : `{ ${safePk[0] || "id"}: pk }`;
       const baseReturnType = method.returnType.replace(" | null", "");
@@ -2108,8 +2193,8 @@ export class ${Type}Client extends BaseClient {
     limit?: number;
     offset?: number;
     where?: Where<Select${Type}>;
-    orderBy?: string;
-    order?: "asc" | "desc";
+    orderBy?: string | string[];
+    order?: "asc" | "desc" | ("asc" | "desc")[];
   }): Promise<Select${Type}[]> {
     return this.post<Select${Type}[]>(\`\${this.resource}/list\`, params ?? {});
   }
@@ -3017,6 +3102,7 @@ function emitHonoRouter(tables, hasAuth, useJsExtensions) {
  * To make changes, modify your schema or configuration and regenerate.
  */
 import { Hono } from "hono";
+import type { Context } from "hono";
 import { SDK_MANIFEST } from "./sdk-bundle${ext}";
 import { getContract } from "./contract${ext}";
 ${imports}
@@ -3024,32 +3110,46 @@ ${hasAuth ? `export { authMiddleware } from "./auth${ext}";` : ""}
 
 /**
  * Creates a Hono router with all generated routes that can be mounted into your existing app.
- * 
+ *
  * @example
  * import { Hono } from "hono";
  * import { createRouter } from "./generated/server/router";
- * 
+ *
  * // Using pg driver (Node.js)
  * import { Client } from "pg";
  * const pg = new Client({ connectionString: process.env.DATABASE_URL });
  * await pg.connect();
- * 
+ *
  * // OR using Neon driver (Edge-compatible)
  * import { Pool } from "@neondatabase/serverless";
  * const pool = new Pool({ connectionString: process.env.DATABASE_URL! });
  * const pg = pool; // Pool already has the compatible query method
- * 
+ *
  * // Mount all generated routes
  * const app = new Hono();
  * const apiRouter = createRouter({ pg });
  * app.route("/api", apiRouter);
- * 
+ *
  * // Or mount directly at root
  * const router = createRouter({ pg });
  * app.route("/", router);
+ *
+ * // With onRequest hook for audit logging or session variables
+ * const router = createRouter({
+ *   pg,
+ *   onRequest: async (c, pg) => {
+ *     const auth = c.get('auth'); // Type-safe! IDE autocomplete works
+ *     if (auth?.kind === 'jwt' && auth.claims?.sub) {
+ *       await pg.query(\`SET LOCAL app.user_id = '\${auth.claims.sub}'\`);
+ *     }
+ *   }
+ * });
  */
 export function createRouter(
-  deps: { pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> } }
+  deps: {
+    pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> },
+    onRequest?: (c: Context, pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> }) => Promise<void>
+  }
 ): Hono {
   const router = new Hono();
   
@@ -3108,22 +3208,36 @@ ${registrations}
 
 /**
  * Register all generated routes directly on an existing Hono app.
- * 
+ *
  * @example
  * import { Hono } from "hono";
  * import { registerAllRoutes } from "./generated/server/router";
- * 
+ *
  * const app = new Hono();
- * 
+ *
  * // Setup database connection (see createRouter example for both pg and Neon options)
  * const pg = yourDatabaseClient;
- * 
+ *
  * // Register all routes at once
  * registerAllRoutes(app, { pg });
+ *
+ * // With onRequest hook
+ * registerAllRoutes(app, {
+ *   pg,
+ *   onRequest: async (c, pg) => {
+ *     const auth = c.get('auth'); // Type-safe!
+ *     if (auth?.kind === 'jwt' && auth.claims?.sub) {
+ *       await pg.query(\`SET LOCAL app.user_id = '\${auth.claims.sub}'\`);
+ *     }
+ *   }
+ * });
  */
 export function registerAllRoutes(
   app: Hono,
-  deps: { pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> } }
+  deps: {
+    pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> },
+    onRequest?: (c: Context, pg: { query: (text: string, params?: any[]) => Promise<{ rows: any[] }> }) => Promise<void>
+  }
 ) {
 ${registrations.replace(/router/g, "app")}
 }
@@ -3414,10 +3528,10 @@ function buildWhereClause(
  */
 export async function listRecords(
   ctx: OperationContext,
-  params: { where?: any; limit?: number; offset?: number; include?: any }
+  params: { where?: any; limit?: number; offset?: number; include?: any; orderBy?: string | string[]; order?: "asc" | "desc" | ("asc" | "desc")[] }
 ): Promise<{ data?: any; error?: string; issues?: any; needsIncludes?: boolean; includeSpec?: any; status: number }> {
   try {
-    const { where: whereClause, limit = 50, offset = 0, include } = params;
+    const { where: whereClause, limit = 50, offset = 0, include, orderBy, order } = params;
 
     // Build WHERE clause
     let paramIndex = 1;
@@ -3441,12 +3555,26 @@ export async function listRecords(
 
     const whereSQL = whereParts.length > 0 ? \`WHERE \${whereParts.join(" AND ")}\` : "";
 
+    // Build ORDER BY clause
+    let orderBySQL = "";
+    if (orderBy) {
+      const columns = Array.isArray(orderBy) ? orderBy : [orderBy];
+      const directions = Array.isArray(order) ? order : (order ? Array(columns.length).fill(order) : Array(columns.length).fill("asc"));
+
+      const orderParts = columns.map((col, i) => {
+        const dir = (directions[i] || "asc").toUpperCase();
+        return \`"\${col}" \${dir}\`;
+      });
+
+      orderBySQL = \`ORDER BY \${orderParts.join(", ")}\`;
+    }
+
     // Add limit and offset params
     const limitParam = \`$\${paramIndex}\`;
     const offsetParam = \`$\${paramIndex + 1}\`;
     const allParams = [...whereParams, limit, offset];
 
-    const text = \`SELECT * FROM "\${ctx.table}" \${whereSQL} LIMIT \${limitParam} OFFSET \${offsetParam}\`;
+    const text = \`SELECT * FROM "\${ctx.table}" \${whereSQL} \${orderBySQL} LIMIT \${limitParam} OFFSET \${offsetParam}\`;
     log.debug(\`LIST \${ctx.table} SQL:\`, text, "params:", allParams);
 
     const { rows } = await ctx.pg.query(text, allParams);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postgresdk",
-  "version": "0.10.4",
+  "version": "0.12.0",
   "description": "Generate a typed server/client SDK from a Postgres schema (includes, Zod, Hono).",
   "type": "module",
   "bin": {