sumak 0.0.8 → 0.0.9

package/README.md

@@ -689,6 +689,38 @@ Available: `clearWhere()`, `clearOrderBy()`, `clearLimit()`, `clearOffset()`, `c
 
 ---
 
+## Cursor Pagination
+
+```ts
+// Forward pagination (after cursor)
+db.selectFrom("users")
+  .select("id", "name")
+  .cursorPaginate({ column: "id", after: 42, pageSize: 20 })
+  .toSQL()
+// SELECT "id", "name" FROM "users" WHERE ("id" > $1) ORDER BY "id" ASC LIMIT 21
+// params: [42] — pageSize + 1 for hasNextPage detection
+
+// Backward pagination (before cursor)
+db.selectFrom("users")
+  .select("id", "name")
+  .cursorPaginate({ column: "id", before: 100, pageSize: 20 })
+  .toSQL()
+// WHERE ("id" < $1) ORDER BY "id" DESC LIMIT 21
+
+// First page (no cursor)
+db.selectFrom("users").select("id", "name").cursorPaginate({ column: "id", pageSize: 20 }).toSQL()
+// LIMIT 21
+
+// With existing WHERE — ANDs together
+db.selectFrom("users")
+  .select("id", "name")
+  .where(({ active }) => active.eq(true))
+  .cursorPaginate({ column: "id", after: lastId, pageSize: 20 })
+  .toSQL()
+```
+
+---
+
 ## Raw SQL
 
 ### `sql` tagged template
@@ -982,14 +1014,145 @@ Modes: `as_of`, `from_to`, `between`, `contained_in`, `all`.
 
 ## Plugins
 
+### WithSchemaPlugin
+
 ```ts
-import { WithSchemaPlugin, SoftDeletePlugin, CamelCasePlugin } from "sumak"
+const db = sumak({
+  plugins: [new WithSchemaPlugin("public")],
+  ...
+})
+// SELECT * FROM "public"."users"
+```
+
+### SoftDeletePlugin
+
+```ts
+// Mode "convert" (default) — DELETE becomes UPDATE SET deleted_at = NOW()
+const db = sumak({
+  plugins: [new SoftDeletePlugin({ tables: ["users"], mode: "convert" })],
+  ...
+})
+
+db.deleteFrom("users").where(({ id }) => id.eq(1)).toSQL()
+// UPDATE "users" SET "deleted_at" = NOW() WHERE ("id" = $1) AND ("deleted_at" IS NULL)
+
+// Mode "filter" — just adds WHERE deleted_at IS NULL (no DELETE conversion)
+new SoftDeletePlugin({ tables: ["users"], mode: "filter" })
+```
 
+### AuditTimestampPlugin
+
+```ts
+// Auto-inject created_at/updated_at timestamps
+const db = sumak({
+  plugins: [new AuditTimestampPlugin({ tables: ["users"] })],
+  ...
+})
+
+db.insertInto("users").values({ name: "Alice" }).toSQL()
+// INSERT INTO "users" ("name", "created_at", "updated_at") VALUES ($1, NOW(), NOW())
+
+db.update("users").set({ name: "Bob" }).where(({ id }) => id.eq(1)).toSQL()
+// UPDATE "users" SET "name" = $1, "updated_at" = NOW() WHERE ...
+```
+
+### MultiTenantPlugin
+
+```ts
+// Auto-inject tenant_id on all queries
+// Use a callback for per-request tenant resolution:
+const db = sumak({
+  plugins: [
+    new MultiTenantPlugin({
+      tables: ["users", "posts"],
+      tenantId: () => getCurrentTenantId(),  // called per query
+    }),
+  ],
+  ...
+})
+
+db.selectFrom("users").select("id").toSQL()
+// SELECT "id" FROM "users" WHERE ("tenant_id" = $1)
+
+db.insertInto("users").values({ name: "Alice" }).toSQL()
+// INSERT INTO "users" ("name", "tenant_id") VALUES ($1, $2)
+```
+
+### QueryLimitPlugin
+
+```ts
+// Auto-inject LIMIT on unbounded SELECTs
+const db = sumak({
+  plugins: [new QueryLimitPlugin({ maxRows: 1000 })],
+  ...
+})
+
+db.selectFrom("users").select("id").toSQL()
+// SELECT "id" FROM "users" LIMIT 1000
+
+db.selectFrom("users").select("id").limit(5).toSQL()
+// SELECT "id" FROM "users" LIMIT 5  — explicit limit preserved
+```
+
+### CamelCasePlugin
+
+```ts
+// Transform snake_case result columns to camelCase
+const db = sumak({
+  plugins: [new CamelCasePlugin()],
+  ...
+})
+```
+
+### OptimisticLockPlugin
+
+```ts
+// Auto-inject WHERE version = N and SET version = version + 1 on UPDATE
+// Use a callback for per-row version:
+let rowVersion = 3
+const db = sumak({
+  plugins: [
+    new OptimisticLockPlugin({
+      tables: ["users"],
+      currentVersion: () => rowVersion,  // called per query
+    }),
+  ],
+  ...
+})
+
+rowVersion = fetchedRow.version  // set before each update
+db.update("users").set({ name: "Bob" }).where(({ id }) => id.eq(1)).toSQL()
+// UPDATE "users" SET "name" = $1, "version" = ("version" + 1)
+//   WHERE ("id" = $2) AND ("version" = $3)
+```
+
+### DataMaskingPlugin
+
+```ts
+// Mask sensitive data in query results
+const plugin = new DataMaskingPlugin({
+  rules: [
+    { column: "email", mask: "email" },    // "alice@example.com" → "al***@example.com"
+    { column: "phone", mask: "phone" },    // "+1234567890" → "***7890"
+    { column: "name", mask: "partial" },   // "John Doe" → "Jo***"
+    { column: "ssn", mask: (v) => `***-**-${String(v).slice(-4)}` },  // custom
+  ],
+})
+
+const db = sumak({ plugins: [plugin], ... })
+```
+
+### Combining Plugins
+
+```ts
 const db = sumak({
   dialect: pgDialect(),
   plugins: [
-    new WithSchemaPlugin("public"),      // auto "public"."users"
-    new SoftDeletePlugin({ tables: ["users"] }), // auto WHERE deleted_at IS NULL
+    new WithSchemaPlugin("public"),
+    new SoftDeletePlugin({ tables: ["users"] }),
+    new AuditTimestampPlugin({ tables: ["users", "posts"] }),
+    new MultiTenantPlugin({ tables: ["users", "posts"], tenantId: () => currentTenantId }),
+    new QueryLimitPlugin({ maxRows: 5000 }),
   ],
   tables: { ... },
 })

package/dist/builder/typed-delete.mjs

@@ -8,6 +8,8 @@ export class TypedDeleteBuilder {
 	_builder;
 	
 	_printer;
+	
+	_compile;
 	constructor(table) {
 		this._builder = new DeleteBuilder().from(table);
 	}
@@ -16,6 +18,7 @@ export class TypedDeleteBuilder {
 		const t = new TypedDeleteBuilder("");
 		t._builder = builder;
 		t._printer = this._printer;
+		t._compile = this._compile;
 		return t;
 	}
 	
@@ -77,6 +80,7 @@ export class TypedDeleteBuilder {
 	}
 	
 	toSQL() {
+		if (this._compile) return this._compile(this.build());
 		if (!this._printer) {
 			throw new Error("toSQL() requires a printer. Use db.deleteFrom() or pass a printer to compile().");
 		}

package/dist/builder/typed-insert.d.mts

@@ -73,7 +73,7 @@ export declare class TypedInsertBuilder<
 	$if(condition: boolean, fn: (qb: TypedInsertBuilder<DB, TB>) => TypedInsertBuilder<DB, TB>): TypedInsertBuilder<DB, TB>;
 	build(): InsertNode;
 	compile(printer: Printer): CompiledQuery;
-	/** Compile to SQL using the dialect's printer. */
+	/** Compile to SQL using the full pipeline. */
 	toSQL(): CompiledQuery;
 	/** EXPLAIN this query. */
 	explain(options?: {

package/dist/builder/typed-insert.mjs

@@ -8,6 +8,8 @@ export class TypedInsertBuilder {
 	_builder;
 	
 	_printer;
+	
+	_compile;
 	constructor(table) {
 		this._builder = new InsertBuilder().into(table);
 	}
@@ -16,6 +18,7 @@ export class TypedInsertBuilder {
 		const t = new TypedInsertBuilder("");
 		t._builder = builder;
 		t._printer = this._printer;
+		t._compile = this._compile;
 		return t;
 	}
 	
@@ -153,6 +156,7 @@ export class TypedInsertBuilder {
 	}
 	
 	toSQL() {
+		if (this._compile) return this._compile(this.build());
 		if (!this._printer) {
 			throw new Error("toSQL() requires a printer. Use db.insertInto() or pass a printer to compile().");
 		}

package/dist/builder/typed-select.d.mts

@@ -19,7 +19,7 @@ export declare class TypedSelectBuilder<
 > {
 	private _table;
 	private _printer?;
-	constructor(builder: SelectBuilder, table?: string, printer?: Printer);
+	constructor(builder: SelectBuilder, table?: string, printer?: Printer, compile?: (node: import("../ast/nodes.ts").ASTNode) => CompiledQuery);
 	/** Select specific columns. Narrows O. */
 	select<K extends keyof O & string>(...cols: K[]): TypedSelectBuilder<DB, TB, Pick<O, K>>;
 	/** Select all columns. */
@@ -165,6 +165,25 @@ export declare class TypedSelectBuilder<
 	$call<R>(fn: (qb: TypedSelectBuilder<DB, TB, O>) => R): R;
 	/** Conditionally apply a transformation. */
 	$if<O2>(condition: boolean, fn: (qb: TypedSelectBuilder<DB, TB, O>) => TypedSelectBuilder<DB, TB, O2>): TypedSelectBuilder<DB, TB, O | O2>;
+	/**
+	* Cursor-based (keyset) pagination.
+	*
+	* Adds WHERE column > cursor (ASC) or column < cursor (DESC),
+	* ORDER BY column, and LIMIT pageSize + 1 (for hasNextPage detection).
+	*
+	* ```ts
+	* db.selectFrom("users")
+	*   .select("id", "name")
+	*   .cursorPaginate({ column: "id", after: 42, pageSize: 20 })
+	*   .toSQL()
+	* ```
+	*/
+	cursorPaginate(options: {
+		column: keyof O & string;
+		after?: unknown;
+		before?: unknown;
+		pageSize: number;
+	}): TypedSelectBuilder<DB, TB, O>;
 	/** Build the AST node. */
 	build(): SelectNode;
 	/** Compile to SQL with explicit printer. */

package/dist/builder/typed-select.mjs

@@ -7,24 +7,27 @@ export class TypedSelectBuilder {
 	_builder;
 	_table;
 	_printer;
-	constructor(builder, table, printer) {
+	
+	_compile;
+	constructor(builder, table, printer, compile) {
 		this._builder = builder;
 		this._table = table ?? "";
 		this._printer = printer;
+		this._compile = compile;
 	}
 	
 	select(...cols) {
-		return new TypedSelectBuilder(this._builder.columns(...cols), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.columns(...cols), this._table, this._printer, this._compile);
 	}
 	
 	selectAll() {
-		return new TypedSelectBuilder(this._builder.allColumns(), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.allColumns(), this._table, this._printer, this._compile);
 	}
 	
 	selectExpr(expr, alias) {
 		const node = unwrap(expr);
 		const aliased = aliasExpr(node, alias);
-		return new TypedSelectBuilder(this._builder.columns(aliased), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.columns(aliased), this._table, this._printer, this._compile);
 	}
 	
 	selectExprs(exprs) {
@@ -34,22 +37,22 @@ export class TypedSelectBuilder {
 			const aliased = aliasExpr(node, alias);
 			builder = builder.columns(aliased);
 		}
-		return new TypedSelectBuilder(builder, this._table, this._printer);
+		return new TypedSelectBuilder(builder, this._table, this._printer, this._compile);
 	}
 	
 	distinct() {
-		return new TypedSelectBuilder(this._builder.distinct(), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.distinct(), this._table, this._printer, this._compile);
 	}
 	
 	distinctOn(...cols) {
-		return new TypedSelectBuilder(this._builder.distinctOn(...cols), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.distinctOn(...cols), this._table, this._printer, this._compile);
 	}
 	
 	where(exprOrCallback) {
 		if (typeof exprOrCallback === "function") {
 			const cols = createColumnProxies(this._table);
 			const result = exprOrCallback(cols);
-			return new TypedSelectBuilder(this._builder.where(unwrap(result)), this._table, this._printer);
+			return new TypedSelectBuilder(this._builder.where(unwrap(result)), this._table, this._printer, this._compile);
 		}
 		return new TypedSelectBuilder(this._builder.where(unwrap(exprOrCallback)), this._table, this._printer);
 	}
@@ -80,7 +83,7 @@ export class TypedSelectBuilder {
 	
 	groupBy(...cols) {
 		const resolved = cols.map((c) => typeof c === "string" ? c : unwrap(c));
-		return new TypedSelectBuilder(this._builder.groupBy(...resolved), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.groupBy(...resolved), this._table, this._printer, this._compile);
 	}
 	
 	having(exprOrCallback) {
@@ -112,31 +115,31 @@ export class TypedSelectBuilder {
 	}
 	
 	forSystemTime(clause) {
-		return new TypedSelectBuilder(this._builder.forSystemTime(clause), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.forSystemTime(clause), this._table, this._printer, this._compile);
 	}
 	
 	forUpdate() {
-		return new TypedSelectBuilder(this._builder.forUpdate(), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.forUpdate(), this._table, this._printer, this._compile);
 	}
 	
 	forShare() {
-		return new TypedSelectBuilder(this._builder.forShare(), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.forShare(), this._table, this._printer, this._compile);
 	}
 	
 	forNoKeyUpdate() {
-		return new TypedSelectBuilder(this._builder.forNoKeyUpdate(), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.forNoKeyUpdate(), this._table, this._printer, this._compile);
 	}
 	
 	forKeyShare() {
-		return new TypedSelectBuilder(this._builder.forKeyShare(), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.forKeyShare(), this._table, this._printer, this._compile);
 	}
 	
 	skipLocked() {
-		return new TypedSelectBuilder(this._builder.skipLocked(), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.skipLocked(), this._table, this._printer, this._compile);
 	}
 	
 	noWait() {
-		return new TypedSelectBuilder(this._builder.noWait(), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.noWait(), this._table, this._printer, this._compile);
 	}
 	
 	with(name, query, recursive = false) {
@@ -144,11 +147,11 @@ export class TypedSelectBuilder {
 	}
 	
 	union(query) {
-		return new TypedSelectBuilder(this._builder.union(query.build()), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.union(query.build()), this._table, this._printer, this._compile);
 	}
 	
 	unionAll(query) {
-		return new TypedSelectBuilder(this._builder.unionAll(query.build()), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.unionAll(query.build()), this._table, this._printer, this._compile);
 	}
 	
 	intersect(query) {
@@ -160,7 +163,7 @@ export class TypedSelectBuilder {
 	}
 	
 	except(query) {
-		return new TypedSelectBuilder(this._builder.except(query.build()), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.except(query.build()), this._table, this._printer, this._compile);
 	}
 	
 	exceptAll(query) {
@@ -219,7 +222,7 @@ export class TypedSelectBuilder {
 	}
 	
 	crossJoin(table) {
-		return new TypedSelectBuilder(this._builder.join("CROSS", table), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.join("CROSS", table), this._table, this._printer, this._compile);
 	}
 	
 	crossJoinLateral(subquery, alias) {
@@ -228,7 +231,7 @@ export class TypedSelectBuilder {
 			query: subquery.build(),
 			alias
 		};
-		return new TypedSelectBuilder(this._builder.crossJoinLateral(sub), this._table, this._printer);
+		return new TypedSelectBuilder(this._builder.crossJoinLateral(sub), this._table, this._printer, this._compile);
 	}
 	
 	clearWhere() {
@@ -291,6 +294,49 @@ export class TypedSelectBuilder {
 		return this;
 	}
 	
+	cursorPaginate(options) {
+		const { column, after, before, pageSize } = options;
+		let builder = this._builder;
+		if (after !== undefined) {
+			const condition = {
+				type: "binary_op",
+				op: ">",
+				left: {
+					type: "column_ref",
+					column
+				},
+				right: {
+					type: "param",
+					index: 0,
+					value: after
+				}
+			};
+			builder = builder.where(condition);
+			builder = builder.orderBy(column, "ASC");
+		} else if (before !== undefined) {
+			const condition = {
+				type: "binary_op",
+				op: "<",
+				left: {
+					type: "column_ref",
+					column
+				},
+				right: {
+					type: "param",
+					index: 0,
+					value: before
+				}
+			};
+			builder = builder.where(condition);
+			builder = builder.orderBy(column, "DESC");
+		}
+		builder = builder.limit({
+			type: "literal",
+			value: pageSize + 1
+		});
+		return new TypedSelectBuilder(builder, this._table, this._printer, this._compile);
+	}
+	
 	build() {
 		return this._builder.build();
 	}
@@ -300,6 +346,9 @@ export class TypedSelectBuilder {
 	}
 	
 	toSQL() {
+		if (this._compile) {
+			return this._compile(this.build());
+		}
 		if (!this._printer) {
 			throw new Error("toSQL() requires a printer. Use db.selectFrom() or pass a printer to compile().");
 		}

package/dist/builder/typed-update.mjs

@@ -8,6 +8,8 @@ export class TypedUpdateBuilder {
 	_builder;
 	
 	_printer;
+	
+	_compile;
 	constructor(table) {
 		this._builder = new UpdateBuilder().table(table);
 	}
@@ -16,6 +18,7 @@ export class TypedUpdateBuilder {
 		const t = new TypedUpdateBuilder("");
 		t._builder = builder;
 		t._printer = this._printer;
+		t._compile = this._compile;
 		return t;
 	}
 	
@@ -93,6 +96,7 @@ export class TypedUpdateBuilder {
 	}
 	
 	toSQL() {
+		if (this._compile) return this._compile(this.build());
 		if (!this._printer) {
 			throw new Error("toSQL() requires a printer. Use db.update() or pass a printer to compile().");
 		}

package/dist/index.d.mts

@@ -45,6 +45,11 @@ export { PluginManager } from "./plugin/plugin-manager.mjs";
 export { WithSchemaPlugin } from "./plugin/with-schema.mjs";
 export { SoftDeletePlugin } from "./plugin/soft-delete.mjs";
 export { CamelCasePlugin } from "./plugin/camel-case.mjs";
+export { AuditTimestampPlugin } from "./plugin/audit-timestamp.mjs";
+export { OptimisticLockPlugin } from "./plugin/optimistic-lock.mjs";
+export { DataMaskingPlugin } from "./plugin/data-masking.mjs";
+export { MultiTenantPlugin } from "./plugin/multi-tenant.mjs";
+export { QueryLimitPlugin } from "./plugin/query-limit.mjs";
 export { Hookable } from "./plugin/hooks.mjs";
 export type { HookContext, HookName, SumakHooks } from "./plugin/hooks.mjs";
 export { CreateTableBuilder, ColumnDefBuilder, ForeignKeyBuilder } from "./builder/ddl/create-table.mjs";

package/dist/index.mjs

@@ -42,6 +42,11 @@ export { PluginManager } from "./plugin/plugin-manager.mjs";
 export { WithSchemaPlugin } from "./plugin/with-schema.mjs";
 export { SoftDeletePlugin } from "./plugin/soft-delete.mjs";
 export { CamelCasePlugin } from "./plugin/camel-case.mjs";
+export { AuditTimestampPlugin } from "./plugin/audit-timestamp.mjs";
+export { OptimisticLockPlugin } from "./plugin/optimistic-lock.mjs";
+export { DataMaskingPlugin } from "./plugin/data-masking.mjs";
+export { MultiTenantPlugin } from "./plugin/multi-tenant.mjs";
+export { QueryLimitPlugin } from "./plugin/query-limit.mjs";
 
 export { Hookable } from "./plugin/hooks.mjs";
 

package/dist/plugin/audit-timestamp.d.mts

@@ -0,0 +1,31 @@
+import type { ASTNode } from "../ast/nodes.mjs";
+import type { SumakPlugin } from "./types.mjs";
+interface AuditTimestampConfig {
+	tables: string[];
+	createdAt?: string;
+	updatedAt?: string;
+}
+/**
+* Plugin that auto-injects created_at/updated_at timestamps.
+*
+* - INSERT: adds created_at and updated_at columns with NOW()
+* - UPDATE: adds updated_at = NOW() to the SET clause
+*
+* ```ts
+* const plugin = new AuditTimestampPlugin({ tables: ["users", "posts"] })
+* // INSERT INTO "users" ("name") VALUES ('Ada')
+* // → INSERT INTO "users" ("name", "created_at", "updated_at") VALUES ('Ada', NOW(), NOW())
+* ```
+*/
+export declare class AuditTimestampPlugin implements SumakPlugin {
+	readonly name = "audit-timestamp";
+	private tables;
+	private createdAt;
+	private updatedAt;
+	constructor(config: AuditTimestampConfig);
+	transformNode(node: ASTNode): ASTNode;
+	private isTargetTable;
+	private transformInsert;
+	private transformUpdate;
+}
+export {};

package/dist/plugin/audit-timestamp.mjs

@@ -0,0 +1,54 @@
+import { fn } from "../ast/expression.mjs";
+
+export class AuditTimestampPlugin {
+	name = "audit-timestamp";
+	tables;
+	createdAt;
+	updatedAt;
+	constructor(config) {
+		this.tables = new Set(config.tables);
+		this.createdAt = config.createdAt ?? "created_at";
+		this.updatedAt = config.updatedAt ?? "updated_at";
+	}
+	transformNode(node) {
+		switch (node.type) {
+			case "insert": return this.transformInsert(node);
+			case "update": return this.transformUpdate(node);
+			default: return node;
+		}
+	}
+	isTargetTable(tableName) {
+		return this.tables.has(tableName);
+	}
+	transformInsert(node) {
+		if (!this.isTargetTable(node.table.name)) return node;
+		const now = fn("NOW", []);
+		const columns = [
+			...node.columns,
+			this.createdAt,
+			this.updatedAt
+		];
+		const values = node.values.map((row) => [
+			...row,
+			now,
+			now
+		]);
+		return {
+			...node,
+			columns,
+			values
+		};
+	}
+	transformUpdate(node) {
+		if (!this.isTargetTable(node.table.name)) return node;
+		const now = fn("NOW", []);
+		const set = [...node.set, {
+			column: this.updatedAt,
+			value: now
+		}];
+		return {
+			...node,
+			set
+		};
+	}
+}

package/dist/plugin/data-masking.d.mts

@@ -0,0 +1,31 @@
+import type { SumakPlugin } from "./types.mjs";
+type MaskFunction = (value: unknown) => unknown;
+interface DataMaskingConfig {
+	rules: {
+		column: string;
+		mask: MaskFunction | "email" | "phone" | "partial";
+	}[];
+}
+/**
+* Result-transform plugin that masks sensitive data in query results.
+*
+* Supports built-in mask types (`"email"`, `"phone"`, `"partial"`) and
+* custom mask functions.
+*
+* ```ts
+* const plugin = new DataMaskingPlugin({
+*   rules: [
+*     { column: "email", mask: "email" },
+*     { column: "phone", mask: "phone" },
+*     { column: "name", mask: "partial" },
+*   ],
+* })
+* ```
+*/
+export declare class DataMaskingPlugin implements SumakPlugin {
+	readonly name = "data-masking";
+	private rules;
+	constructor(config: DataMaskingConfig);
+	transformResult(rows: Record<string, unknown>[]): Record<string, unknown>[];
+}
+export {};

package/dist/plugin/data-masking.mjs

@@ -0,0 +1,49 @@
+function maskEmail(value) {
+	if (typeof value !== "string") return value;
+	const atIndex = value.indexOf("@");
+	if (atIndex < 0) return value;
+	const local = value.slice(0, atIndex);
+	const domain = value.slice(atIndex);
+	const keep = local.slice(0, 2);
+	return `${keep}***${domain}`;
+}
+function maskPhone(value) {
+	if (typeof value !== "string") return value;
+	const last4 = value.slice(-4);
+	return `***${last4}`;
+}
+function maskPartial(value) {
+	if (typeof value !== "string") return value;
+	const keep = value.slice(0, 2);
+	return `${keep}***`;
+}
+const builtinMasks = {
+	email: maskEmail,
+	phone: maskPhone,
+	partial: maskPartial
+};
+
+export class DataMaskingPlugin {
+	name = "data-masking";
+	rules;
+	constructor(config) {
+		this.rules = new Map();
+		for (const rule of config.rules) {
+			const fn = typeof rule.mask === "string" ? builtinMasks[rule.mask] : rule.mask;
+			if (fn) {
+				this.rules.set(rule.column, fn);
+			}
+		}
+	}
+	transformResult(rows) {
+		return rows.map((row) => {
+			const masked = { ...row };
+			for (const [column, fn] of this.rules) {
+				if (column in masked) {
+					masked[column] = fn(masked[column]);
+				}
+			}
+			return masked;
+		});
+	}
+}

package/dist/plugin/multi-tenant.d.mts

@@ -0,0 +1,37 @@
+import type { ASTNode } from "../ast/nodes.mjs";
+import type { SumakPlugin } from "./types.mjs";
+/**
+* Plugin that auto-injects tenant_id filtering on all queries for configured tables.
+*
+* - SELECT/UPDATE/DELETE: adds `WHERE tenant_id = ?` (ANDed with existing WHERE)
+* - INSERT: adds tenant_id column and value to each row
+*
+* `tenantId` accepts a value OR a function that returns the value per-query.
+* Use a function for per-request tenant resolution (JWT, session, etc.):
+*
+* ```ts
+* new MultiTenantPlugin({
+*   tables: ["users", "posts"],
+*   tenantId: () => getCurrentTenantId(),
+* })
+* ```
+*/
+export declare class MultiTenantPlugin implements SumakPlugin {
+	readonly name = "multi-tenant";
+	private tables;
+	private column;
+	private getTenantId;
+	constructor(config: {
+		tables: string[];
+		column?: string;
+		tenantId: unknown | (() => unknown);
+	});
+	transformNode(node: ASTNode): ASTNode;
+	private isTargetTable;
+	private tenantCondition;
+	private addCondition;
+	private transformSelect;
+	private transformUpdate;
+	private transformDelete;
+	private transformInsert;
+}

package/dist/plugin/multi-tenant.mjs

@@ -0,0 +1,66 @@
+import { and, col, eq, param } from "../ast/expression.mjs";
+
+export class MultiTenantPlugin {
+	name = "multi-tenant";
+	tables;
+	column;
+	getTenantId;
+	constructor(config) {
+		this.tables = new Set(config.tables);
+		this.column = config.column ?? "tenant_id";
+		this.getTenantId = typeof config.tenantId === "function" ? config.tenantId : () => config.tenantId;
+	}
+	transformNode(node) {
+		switch (node.type) {
+			case "select": return this.transformSelect(node);
+			case "update": return this.transformUpdate(node);
+			case "delete": return this.transformDelete(node);
+			case "insert": return this.transformInsert(node);
+			default: return node;
+		}
+	}
+	isTargetTable(tableName) {
+		return this.tables.has(tableName);
+	}
+	tenantCondition() {
+		return eq(col(this.column), param(0, this.getTenantId()));
+	}
+	addCondition(existing) {
+		const condition = this.tenantCondition();
+		return existing ? and(existing, condition) : condition;
+	}
+	transformSelect(node) {
+		if (!node.from || node.from.type !== "table_ref" || !this.isTargetTable(node.from.name)) {
+			return node;
+		}
+		return {
+			...node,
+			where: this.addCondition(node.where)
+		};
+	}
+	transformUpdate(node) {
+		if (!this.isTargetTable(node.table.name)) return node;
+		return {
+			...node,
+			where: this.addCondition(node.where)
+		};
+	}
+	transformDelete(node) {
+		if (!this.isTargetTable(node.table.name)) return node;
+		return {
+			...node,
+			where: this.addCondition(node.where)
+		};
+	}
+	transformInsert(node) {
+		if (!this.isTargetTable(node.table.name)) return node;
+		const tenantId = this.getTenantId();
+		const columns = [...node.columns, this.column];
+		const values = node.values.map((row) => [...row, param(0, tenantId)]);
+		return {
+			...node,
+			columns,
+			values
+		};
+	}
+}

package/dist/plugin/optimistic-lock.d.mts

@@ -0,0 +1,38 @@
+import type { ASTNode } from "../ast/nodes.mjs";
+import type { SumakPlugin } from "./types.mjs";
+/**
+* Plugin that implements optimistic locking for configured tables.
+*
+* On UPDATE for configured tables:
+* 1. Adds `WHERE version = :currentVersion` (ANDed with existing WHERE)
+* 2. Adds `SET version = version + 1` to the SET clause
+*
+* `currentVersion` accepts a value OR a function that returns the value per-query.
+* Use a function when the version varies per row/request:
+*
+* ```ts
+* let rowVersion = 3
+* const plugin = new OptimisticLockPlugin({
+*   tables: ["users"],
+*   currentVersion: () => rowVersion,
+* })
+*
+* // Before each update, set rowVersion to the row's current version
+* rowVersion = fetchedRow.version
+* db.update("users").set({ name: "Bob" }).where(...).toSQL()
+* // UPDATE ... SET "version" = "version" + 1 WHERE ... AND "version" = $N
+* ```
+*/
+export declare class OptimisticLockPlugin implements SumakPlugin {
+	readonly name = "optimistic-lock";
+	private tables;
+	private column;
+	private getVersion;
+	constructor(config: {
+		tables: string[];
+		column?: string;
+		currentVersion: number | (() => number);
+	});
+	transformNode(node: ASTNode): ASTNode;
+	private transformUpdate;
+}

package/dist/plugin/optimistic-lock.mjs

@@ -0,0 +1,35 @@
+import { and, binOp, col, eq, param } from "../ast/expression.mjs";
+
+export class OptimisticLockPlugin {
+	name = "optimistic-lock";
+	tables;
+	column;
+	getVersion;
+	constructor(config) {
+		this.tables = new Set(config.tables);
+		this.column = config.column ?? "version";
+		this.getVersion = typeof config.currentVersion === "function" ? config.currentVersion : () => config.currentVersion;
+	}
+	transformNode(node) {
+		if (node.type !== "update") return node;
+		return this.transformUpdate(node);
+	}
+	transformUpdate(node) {
+		if (!this.tables.has(node.table.name)) return node;
+		const versionCondition = eq(col(this.column), param(0, this.getVersion()));
+		const where = node.where ? and(node.where, versionCondition) : versionCondition;
+		const versionIncrement = binOp("+", col(this.column), {
+			type: "literal",
+			value: 1
+		});
+		const set = [...node.set, {
+			column: this.column,
+			value: versionIncrement
+		}];
+		return {
+			...node,
+			set,
+			where
+		};
+	}
+}

package/dist/plugin/query-limit.d.mts

@@ -0,0 +1,20 @@
+import type { ASTNode } from "../ast/nodes.mjs";
+import type { SumakPlugin } from "./types.mjs";
+/**
+* Plugin that auto-injects a LIMIT on SELECT queries that don't already have one.
+*
+* ```ts
+* const plugin = new QueryLimitPlugin({ maxRows: 500 })
+* // SELECT * FROM "users"
+* // → SELECT * FROM "users" LIMIT 500
+* ```
+*/
+export declare class QueryLimitPlugin implements SumakPlugin {
+	readonly name = "query-limit";
+	private maxRows;
+	constructor(config?: {
+		maxRows?: number;
+	});
+	transformNode(node: ASTNode): ASTNode;
+	private transformSelect;
+}

package/dist/plugin/query-limit.mjs

@@ -0,0 +1,23 @@
+
+export class QueryLimitPlugin {
+	name = "query-limit";
+	maxRows;
+	constructor(config) {
+		this.maxRows = config?.maxRows ?? 1e3;
+	}
+	transformNode(node) {
+		if (node.type !== "select") return node;
+		return this.transformSelect(node);
+	}
+	transformSelect(node) {
+		if (node.limit) return node;
+		const limit = {
+			type: "literal",
+			value: this.maxRows
+		};
+		return {
+			...node,
+			limit
+		};
+	}
+}

package/dist/plugin/soft-delete.d.mts

@@ -1,21 +1,30 @@
 import type { ASTNode } from "../ast/nodes.mjs";
 import type { SumakPlugin } from "./types.mjs";
 /**
-* Plugin that automatically adds `WHERE deleted_at IS NULL` to
-* SELECT, UPDATE, and DELETE queries for configured tables.
+* Plugin that automatically handles soft deletes for configured tables.
+*
+* In "convert" mode (default):
+* - SELECT/UPDATE: adds `WHERE deleted_at IS NULL`
+* - DELETE: converts to `UPDATE SET deleted_at = NOW() WHERE ... AND deleted_at IS NULL`
+*
+* In "filter" mode:
+* - SELECT/UPDATE/DELETE: adds `WHERE deleted_at IS NULL`
 *
 * ```ts
-* const plugin = new SoftDeletePlugin({ tables: ["users", "posts"] });
-* // SELECT * FROM "users" → SELECT * FROM "users" WHERE "deleted_at" IS NULL
+* const plugin = new SoftDeletePlugin({ tables: ["users", "posts"] })
+* // DELETE FROM "users" WHERE id = 1
+* // → UPDATE "users" SET "deleted_at" = NOW() WHERE id = 1 AND "deleted_at" IS NULL
 * ```
 */
 export declare class SoftDeletePlugin implements SumakPlugin {
 	readonly name = "soft-delete";
 	private tables;
 	private column;
+	private mode;
 	constructor(config: {
 		tables: string[];
 		column?: string;
+		mode?: "filter" | "convert";
 	});
 	transformNode(node: ASTNode): ASTNode;
 	private isTargetTable;

package/dist/plugin/soft-delete.mjs

@@ -1,12 +1,14 @@
-import { and, col, isNull } from "../ast/expression.mjs";
+import { and, col, fn, isNull } from "../ast/expression.mjs";
 
 export class SoftDeletePlugin {
 	name = "soft-delete";
 	tables;
 	column;
+	mode;
 	constructor(config) {
 		this.tables = new Set(config.tables);
 		this.column = config.column ?? "deleted_at";
+		this.mode = config.mode ?? "convert";
 	}
 	transformNode(node) {
 		switch (node.type) {
@@ -44,9 +46,24 @@ export class SoftDeletePlugin {
 	}
 	transformDelete(node) {
 		if (!this.isTargetTable(node.table.name)) return node;
-		return {
-			...node,
-			where: this.addCondition(node.where)
+		if (this.mode === "filter") {
+			return {
+				...node,
+				where: this.addCondition(node.where)
+			};
+		}
+		const updateNode = {
+			type: "update",
+			table: node.table,
+			set: [{
+				column: this.column,
+				value: fn("NOW", [])
+			}],
+			where: this.addCondition(node.where),
+			returning: node.returning,
+			joins: node.joins,
+			ctes: node.ctes
 		};
+		return updateNode;
 	}
 }

package/dist/sumak.d.mts

@@ -78,6 +78,12 @@ export declare class Sumak<DB> {
 	selectFromSubquery<Alias extends string>(subquery: {
 		build(): import("./ast/nodes.ts").SelectNode;
 	}, alias: Alias): TypedSelectBuilder<DB, keyof DB & string, Record<string, unknown>>;
+	/**
+	* SELECT COUNT(*) FROM table — convenience shorthand.
+	*/
+	selectCount<T extends keyof DB & string>(table: T): TypedSelectBuilder<DB, T, {
+		count: number;
+	}>;
 	insertInto<T extends keyof DB & string>(table: T): TypedInsertBuilder<DB, T>;
 	update<T extends keyof DB & string>(table: T): TypedUpdateBuilder<DB, T>;
 	deleteFrom<T extends keyof DB & string>(table: T): TypedDeleteBuilder<DB, T>;

package/dist/sumak.mjs

@@ -35,7 +35,7 @@ export class Sumak {
 		return this._hooks.hook(name, handler);
 	}
 	selectFrom(table, alias) {
-		return new TypedSelectBuilder(new SelectBuilder().from(table, alias), table, this._dialect.createPrinter());
+		return new TypedSelectBuilder(new SelectBuilder().from(table, alias), table, this._dialect.createPrinter(), (node) => this.compile(node));
 	}
 	
 	selectFromSubquery(subquery, alias) {
@@ -46,19 +46,33 @@ export class Sumak {
 		};
 		return new TypedSelectBuilder(new SelectBuilder().from(sub), alias);
 	}
+	
+	selectCount(table) {
+		const star = { type: "star" };
+		const countFn = {
+			type: "function_call",
+			name: "COUNT",
+			args: [star],
+			alias: "count"
+		};
+		return new TypedSelectBuilder(new SelectBuilder().columns(countFn).from(table), table, this._dialect.createPrinter(), (node) => this.compile(node));
+	}
 	insertInto(table) {
 		const b = new TypedInsertBuilder(table);
 		b._printer = this._dialect.createPrinter();
+		b._compile = (node) => this.compile(node);
 		return b;
 	}
 	update(table) {
 		const b = new TypedUpdateBuilder(table);
 		b._printer = this._dialect.createPrinter();
+		b._compile = (node) => this.compile(node);
 		return b;
 	}
 	deleteFrom(table) {
 		const b = new TypedDeleteBuilder(table);
 		b._printer = this._dialect.createPrinter();
+		b._compile = (node) => this.compile(node);
 		return b;
 	}
 	

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sumak",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "description": "Type-safe SQL query builder with powerful SQL printers. Zero dependencies, tree-shakeable. Pure TypeScript.",
   "keywords": [
     "database",