@protobase/server 0.26.5 → 0.26.7

package/dist/admin-options.d.ts

@@ -14,9 +14,9 @@ export type AdminOptions = {
   /** Default `/api/v1`. */
   basePath?: string;
   /**
-   * The app's publishable and secret keys, with which supabase-js calls the Realtime-compatible `/realtime/v1` (see
-   * `ApiKeysOptions`); default `PROTOBASE_PUBLISHABLE_KEY` and `PROTOBASE_SECRET_KEY`. Without either, or with
-   * `false`, the app serves no `/realtime/v1`.
+   * The app's publishable and secret keys, with which supabase-js calls the PostgREST-compatible `/rest/v1` and the
+   * Realtime-compatible `/realtime/v1` (see `ApiKeysOptions`); default `PROTOBASE_PUBLISHABLE_KEY` and
+   * `PROTOBASE_SECRET_KEY`. Without either, or with `false`, the app serves neither.
    */
   apiKeys?: ApiKeysOptions | false;
   /** Applied to every request's transaction with SET LOCAL. Default 15000. */

package/dist/api-cors.js

@@ -16,7 +16,10 @@ const allowHeaders = [
 	"authorization",
 	"content-type",
 	"if-match",
-	"if-none-match"
+	"if-none-match",
+	"apikey",
+	"x-client-info",
+	"x-supabase-api-version"
 ];
 const exposeHeaders = [
 	"location",

package/dist/create-admin.d.ts

@@ -60,7 +60,7 @@ export type CreateAdminInput = {
   formsDifficulty?: Difficulty;
   /** @internal The users comments name, mention and mail, which tests fake; from `auth` otherwise. */
   commentUsers?: CommentUsers;
-  /** @internal Verifies a user's token on `/realtime/v1` and gives its claims, which tests fake; those `/auth/v1` signs otherwise. */
+  /** @internal Verifies a user's token on `/rest/v1` and `/realtime/v1` and gives its claims, which tests fake; those `/auth/v1` signs otherwise. */
   verifyToken?: (token: string) => Promise<JWTPayload>;
   /**
    * The host's WebSocket upgrade, such as `@hono/node-server`'s, with which an app with keys and live resources serves

package/dist/create-admin.js

@@ -15,6 +15,7 @@ import { apiKeySettings } from "./api-keys/api-key-settings.js";
 import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtVerifier } from "./auth/jwt.js";
 import { realtimeApp } from "./realtime/realtime-app.js";
+import { restRoutes } from "./rest/rest-routes.js";
 import { readAppName } from "./app-name.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { authBasePath } from "./better-auth/auth-base-path.js";
@@ -223,11 +224,13 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	if (corsOrigins !== void 0 || ownOrigins.length > 1) {
 		const answering = [authBasePath, ...Object.entries(apiFunctions).filter(([, fn]) => fn.options.cors).map(([name]) => `${systemPath}/functions/${name}`)];
 		const skip = (path) => answering.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
-		app.use(`${systemPath}/*`, apiCors({
+		const cors = apiCors({
 			own: ownOrigins,
 			allowed: corsOrigins ?? [],
 			skip
-		}));
+		});
+		app.use(`${systemPath}/*`, cors);
+		if (auth && !"/auth/v1".startsWith(`${systemPath}/`)) app.use(`${goTruePath}/*`, cors);
 	}
 	if (auth) {
 		app.route(authBasePath, statusRoute(auth, {
@@ -277,16 +280,22 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		report
 	});
 	if (appModels.some((model) => model.live)) app.route(systemPath || "/", guarded((live) => void live.route("/", liveRoutes(feed, (session) => visibleNotices(deps, session))), withAnonymous(authenticate, options.roles)));
-	if (upgradeWebSocket && (apiKeys.publishable || apiKeys.secret)) {
+	if (apiKeys.publishable || apiKeys.secret) {
 		const verify = verifyToken ?? (auth ? jwtVerifier(goTrueTokens({ auth })) : () => Promise.reject(unauthorized("This app signs no user tokens")));
-		app.route("/realtime/v1", realtimeApp({
+		const caller = apiKeyCaller({
+			keys: apiKeys,
+			verify
+		});
+		app.route("/rest/v1", restRoutes({
+			deps,
+			caller,
+			report
+		}));
+		if (upgradeWebSocket) app.route("/realtime/v1", realtimeApp({
 			deps,
 			feed,
 			upgradeWebSocket,
-			caller: apiKeyCaller({
-				keys: apiKeys,
-				verify
-			}),
+			caller,
 			report
 		}));
 	}

package/dist/jobs/busy-database.js

@@ -0,0 +1,18 @@
+//#region src/jobs/busy-database.ts
+/** pg-boss's database, counting its statements under way: `idle()` says whether none is, such as a worker's fetch. */
+const busyDatabase = (database) => {
+	let running = 0;
+	return {
+		db: { executeSql: async (text, values) => {
+			running++;
+			try {
+				return await database.executeSql(text, values);
+			} finally {
+				running--;
+			}
+		} },
+		idle: () => running === 0
+	};
+};
+//#endregion
+export { busyDatabase };

package/dist/jobs/runtime.js

@@ -4,6 +4,7 @@ import "./schedule.js";
 import { runJob, validatePayload } from "./run-job.js";
 import { platformMailer } from "../mail/platform-mailer.js";
 import { runInBackground } from "../background-work.js";
+import { busyDatabase } from "./busy-database.js";
 import { jobsDatabase } from "./database.js";
 import { queueOptions, queueSettingsDiffer, sendOptions, workOptions } from "./options.js";
 import { createSchedules } from "./schedules.js";
@@ -11,7 +12,7 @@ import { sql } from "kysely";
 import { PgBoss } from "pg-boss";
 //#region src/jobs/runtime.ts
 const createBoss = (db, work) => new PgBoss({
-	db: jobsDatabase(db),
+	db,
 	schema: jobsSchema,
 	migrate: false,
 	createSchema: false,
@@ -29,7 +30,8 @@ const createBoss = (db, work) => new PgBoss({
 */
 const startJobs = async ({ db, jobs, work = true, pollSeconds = 2, shutdownSeconds = 30, onError, now = () => /* @__PURE__ */ new Date(), mailer }) => {
 	const mail = mailer === void 0 ? platformMailer() : mailer || void 0;
-	const boss = createBoss(db, work);
+	const database = busyDatabase(jobsDatabase(db));
+	const boss = createBoss(database.db, work);
 	boss.on("error", onError);
 	await boss.start();
 	const schedules = createSchedules(boss, db, now);
@@ -111,9 +113,11 @@ const startJobs = async ({ db, jobs, work = true, pollSeconds = 2, shutdownSecon
         or (j.state = 'active' and j.started_on + j.expire_seconds * interval '1s' > now()))`.execute(db);
 		return rows[0].count;
 	};
+	const settled = () => database.idle() && boss.getWipData().every((worker) => worker.count === 0);
 	const drain = async (seconds) => {
 		if (!work) throw new Error("This process runs no jobs, so it cannot drain them");
 		const deadline = Date.now() + seconds * 1e3;
+		const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 		for (;;) {
 			for (const worker of workers.values()) boss.notifyWorker(worker.id);
 			const remaining = await pending();
@@ -122,7 +126,8 @@ const startJobs = async ({ db, jobs, work = true, pollSeconds = 2, shutdownSecon
 				remaining,
 				nextDue: await nextDue()
 			};
-			await new Promise((resolve) => setTimeout(resolve, 100));
+			await sleep(100);
+			while (!settled() && Date.now() < deadline) await sleep(10);
 		}
 	};
 	const wake = (name) => {

package/dist/rest/content-range.js

@@ -0,0 +1,14 @@
+import { restError } from "./rest-error.js";
+//#region src/rest/content-range.ts
+const contentRange = (offset, page, total) => `${page === 0 ? "*" : `${offset}-${offset + page - 1}`}/${total ?? "*"}`;
+/**
+* The status of a counted read: 206 when the page holds fewer rows than there are, 416 (PGRST103) when it starts past
+* them, else 200; uncounted, always 200.
+*/
+const rangeStatus = (offset, page, total) => {
+	if (total === void 0) return 200;
+	if (offset > total) throw restError(416, "PGRST103", "Requested range not satisfiable", `An offset of ${offset} was requested, but there are only ${total} rows.`).withHeaders({ "content-range": contentRange(offset, 0, total) });
+	return page < total ? 206 : 200;
+};
+//#endregion
+export { contentRange, rangeStatus };

package/dist/rest/field-path.js

@@ -0,0 +1,25 @@
+import { parseError } from "./rest-error.js";
+//#region src/rest/field-path.ts
+/** Parses `column`, `column->key` or `column->a->>b`; `->` may not end it or follow a `->>`. */
+const parseFieldPath = (text) => {
+	const parts = text.trim().split(/(->>|->)/);
+	const column = parts[0].trim();
+	if (!column) throw parseError(`"${text}" names no column`);
+	const json = [];
+	for (let i = 1; i < parts.length; i += 2) {
+		const key = parts[i + 1].trim();
+		if (!key) throw parseError(`"${text}" ends in an arrow`);
+		json.push({
+			arrow: parts[i],
+			key: /^-?\d+$/.test(key) ? Number(key) : key
+		});
+	}
+	return {
+		column,
+		json
+	};
+};
+/** The name a JSON path's value goes by in a row: its last key, else the column. */
+const pathName = (path) => String(path.json.at(-1)?.key ?? path.column);
+//#endregion
+export { parseFieldPath, pathName };

package/dist/rest/filter-sql.js

@@ -0,0 +1,62 @@
+import { sql } from "kysely";
+//#region src/rest/filter-sql.ts
+/** A field of the row source named `source`: `"todos"."meta"->$1::text`. Every key is a parameter. */
+const fieldSql = (source, path) => path.json.reduce((value, step) => sql`(${value}${sql.raw(step.arrow)}${typeof step.key === "number" ? sql`${step.key}::integer` : sql`${step.key}::text`})`, sql`${sql.id(source, path.column)}`);
+const comparisons = {
+	eq: "=",
+	neq: "<>",
+	gt: ">",
+	gte: ">=",
+	lt: "<",
+	lte: "<=",
+	like: "like",
+	ilike: "ilike",
+	match: "~",
+	imatch: "~*",
+	isdistinct: "is distinct from",
+	cs: "@>",
+	cd: "<@",
+	ov: "&&",
+	sl: "<<",
+	sr: ">>",
+	nxr: "&<",
+	nxl: "&>",
+	adj: "-|-"
+};
+const tsQueries = {
+	fts: "to_tsquery",
+	plfts: "plainto_tsquery",
+	phfts: "phraseto_tsquery",
+	wfts: "websearch_to_tsquery"
+};
+const isTests = {
+	null: "is null",
+	not_null: "is not null",
+	true: "is true",
+	false: "is false",
+	unknown: "is unknown"
+};
+/** A Postgres array literal of the values, each quoted, so Postgres reads it as an array of the column's type. */
+const arrayLiteral = (values) => `{${values.map((value) => `"${value.replace(/[\\"]/g, "\\$&")}"`).join(",")}}`;
+const pattern = (operator, value) => operator === "like" || operator === "ilike" ? value.replaceAll("*", "%") : value;
+const conditionSql = (source, condition) => {
+	const field = fieldSql(source, condition.field);
+	const { operator, value } = condition;
+	if (operator === "in") return sql`${field} = any(${arrayLiteral(value)})`;
+	if (operator === "is") return sql`${field} ${sql.raw(isTests[value])}`;
+	const text = pattern(operator, value);
+	const tsQuery = tsQueries[operator];
+	if (tsQuery) return condition.language === void 0 ? sql`${field} @@ ${sql.raw(tsQuery)}(${text})` : sql`${field} @@ ${sql.raw(tsQuery)}(${condition.language}, ${text})`;
+	const comparison = sql.raw(comparisons[operator]);
+	if (condition.quantifier) return sql`${field} ${comparison} ${sql.raw(condition.quantifier)}(${text})`;
+	return sql`${field} ${comparison} ${text}`;
+};
+/** A filter as a condition on the rows of `source`; every value is a parameter, every name a quoted identifier. */
+const filterSql = (source, filter) => {
+	const condition = filter.kind === "condition" ? conditionSql(source, filter) : filter.args.length === 0 ? sql.raw(filter.kind === "and" ? "true" : "false") : sql`(${sql.join(filter.args.map((arg) => filterSql(source, arg)), sql.raw(` ${filter.kind} `))})`;
+	return filter.negated ? sql`not (${condition})` : condition;
+};
+/** ` where ...` for the filters, all of which hold; nothing without any. */
+const whereSql = (source, filters) => filters.length === 0 ? sql`` : sql` where ${sql.join(filters.map((filter) => filterSql(source, filter)), sql` and `)}`;
+//#endregion
+export { arrayLiteral, fieldSql, filterSql, whereSql };

package/dist/rest/functions.js

@@ -0,0 +1,92 @@
+import { restError } from "./rest-error.js";
+import { sql } from "kysely";
+//#region src/rest/functions.ts
+/** The functions of the `public` schema called `name`, every overload. */
+const findFunctions = async (db, name) => {
+	const { rows } = await sql`
+    select p.proname as name, p.proargnames as arg_names, p.proargmodes::text[] as arg_modes, p.pronargdefaults::int as defaults,
+      array(select format_type(t.oid, null) from unnest(p.proargtypes::oid[]) with ordinality as t(oid, i) order by t.i) as input_types,
+      format_type(p.prorettype, null) as returns, r.typtype as return_kind, p.proretset as set
+    from pg_proc p join pg_namespace n on n.oid = p.pronamespace join pg_type r on r.oid = p.prorettype
+    where n.nspname = 'public' and p.proname = ${name} and p.prokind = 'f'
+    order by p.oid
+  `.execute(db);
+	return rows.map((row) => {
+		const names = (row.arg_names ?? []).filter((_, i) => !row.arg_modes || [
+			"i",
+			"b",
+			"v"
+		].includes(row.arg_modes[i]));
+		const returns = row.returns === "void" ? "void" : row.return_kind === "c" || row.returns === "record" ? "row" : "scalar";
+		return {
+			name: row.name,
+			inputs: row.input_types.map((type, i) => ({
+				name: names[i] ?? "",
+				type
+			})),
+			defaults: row.defaults,
+			returns,
+			set: row.set
+		};
+	});
+};
+const takesBody = (info) => info.inputs.length === 1 && info.inputs[0].name === "" && ["json", "jsonb"].includes(info.inputs[0].type);
+const listed = (names) => [...names].sort().join(", ");
+/**
+* The overload a call with these argument names reaches: one whose inputs include every name and whose inputs without
+* a default are all given; else one that takes the body as its single unnamed json or jsonb argument. None is 404
+* (PGRST202) and more than one 300 (PGRST203), worded as PostgREST words them.
+*/
+const chooseFunction = (name, candidates, given) => {
+	const byName = candidates.filter((info) => {
+		const inputs = info.inputs.map((input) => input.name);
+		const required = inputs.slice(0, inputs.length - info.defaults);
+		return given.every((arg) => inputs.includes(arg)) && required.every((arg) => given.includes(arg));
+	});
+	const matches = byName.length > 0 ? byName.map((info) => ({
+		info,
+		by: "name",
+		args: info.inputs.map((input) => input.name).filter((arg) => given.includes(arg))
+	})) : candidates.filter(takesBody).map((info) => ({
+		info,
+		by: "body"
+	}));
+	if (matches.length === 1) return matches[0];
+	const signature = given.length === 0 ? `public.${name} without parameters` : `public.${name}(${listed(given)})`;
+	if (matches.length > 1) {
+		const overloads = matches.map((match) => `public.${name}(${match.info.inputs.map((input) => `${input.name} => ${input.type}`.trim()).join(", ")})`);
+		throw restError(300, "PGRST203", `Could not choose the best candidate function between: ${overloads.join(", ")}`, null, "Try renaming the parameters or the function itself in the database so function overloading can be resolved");
+	}
+	const searched = given.length === 0 ? `public.${name} without parameters` : `public.${name} with parameters ${listed(given)}`;
+	const hint = candidates[0] ? `Perhaps you meant to call the function public.${name}(${candidates[0].inputs.map((input) => input.name).join(", ")})` : null;
+	throw restError(404, "PGRST202", `Could not find the function ${signature} in the schema cache`, `Searched for the function ${searched} or with a single unnamed json/jsonb parameter, but no matches were found in the schema cache.`, hint);
+};
+/**
+* The call in FROM, its rows named after the function: arguments read by name from the JSON object `args` as the types
+* the catalog gives them, so Postgres converts them as it reads JSON into a row; or `args` itself as the one argument.
+* Types come from the catalog, never from the request.
+*/
+const callSource = (call, args) => {
+	const fn = sql.id("public", call.info.name);
+	const alias = call.info.name;
+	const scalar = call.info.returns !== "row";
+	if (call.by === "body") return {
+		from: sql`${fn}(cast(${JSON.stringify(args)} as ${sql.raw(call.info.inputs[0].type)})) as ${sql.id(alias)}`,
+		alias,
+		scalar
+	};
+	if (call.args.length === 0) return {
+		from: sql`${fn}() as ${sql.id(alias)}`,
+		alias,
+		scalar
+	};
+	const types = call.info.inputs.filter((input) => call.args.includes(input.name)).map((input) => sql`${sql.id(input.name)} ${sql.raw(input.type)}`);
+	const named = sql.join(call.args.map((arg) => sql`${sql.id(arg)} := pgrst_args.${sql.id(arg)}`));
+	return {
+		from: sql`json_to_record(${JSON.stringify(args)}::json) as pgrst_args(${sql.join(types)}) cross join lateral ${fn}(${named}) as ${sql.id(alias)}`,
+		alias,
+		scalar
+	};
+};
+//#endregion
+export { callSource, chooseFunction, findFunctions };

package/dist/rest/parse-filter.js

@@ -0,0 +1,131 @@
+import { parseError } from "./rest-error.js";
+import { parseFieldPath } from "./field-path.js";
+import { splitList, unquote } from "./split-list.js";
+//#region src/rest/parse-filter.ts
+const operators = [
+	"eq",
+	"neq",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"like",
+	"ilike",
+	"match",
+	"imatch",
+	"in",
+	"is",
+	"isdistinct",
+	"fts",
+	"plfts",
+	"phfts",
+	"wfts",
+	"cs",
+	"cd",
+	"ov",
+	"sl",
+	"sr",
+	"nxr",
+	"nxl",
+	"adj"
+];
+/** The operators that compare with `any` or `all` of a list, `eq(any).{1,2}`. */
+const quantifiable = /* @__PURE__ */ new Set([
+	"eq",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"like",
+	"ilike",
+	"match",
+	"imatch"
+]);
+/** The full text search operators, which take a language, `fts(english).cat`. */
+const textSearch = /* @__PURE__ */ new Set([
+	"fts",
+	"plfts",
+	"phfts",
+	"wfts"
+]);
+const isValues = [
+	"null",
+	"not_null",
+	"true",
+	"false",
+	"unknown"
+];
+const isOperator = (name) => operators.includes(name);
+const inList = (text) => {
+	if (!text.startsWith("(") || !text.endsWith(")")) throw parseError(`"failed to parse filter (in.${text})"`, "in takes a list in parentheses, such as in.(1,2)");
+	const inner = text.slice(1, -1);
+	return inner.trim() === "" ? [] : splitList(inner).map(unquote);
+};
+/**
+* Parses what a filter says of `field`: `[not.]operator[(modifier)].value`. In a logic tree a value in double quotes
+* loses them, so it may hold commas and parentheses.
+*/
+const parseCondition = (field, text, inTree = false) => {
+	const negated = text.startsWith("not.");
+	const rest = negated ? text.slice(4) : text;
+	const match = /^(\w+)(?:\((\w+)\))?\.([\s\S]*)$/.exec(rest);
+	const [, name = "", modifier, value = ""] = match ?? [];
+	if (!match || !isOperator(name)) throw parseError(`"failed to parse filter (${text})"`, `"${name || text}" is not an operator`);
+	const condition = {
+		kind: "condition",
+		field,
+		negated,
+		operator: name
+	};
+	if (name === "in") return {
+		...condition,
+		value: inList(value)
+	};
+	if (name === "is") {
+		if (!isValues.includes(value)) throw parseError(`"failed to parse filter (${text})"`, `is takes one of ${isValues.join(", ")}`);
+		return {
+			...condition,
+			value
+		};
+	}
+	const plain = inTree ? unquote(value) : value;
+	if (modifier === void 0) return {
+		...condition,
+		value: plain
+	};
+	if (textSearch.has(name)) return {
+		...condition,
+		language: modifier,
+		value: plain
+	};
+	if ((modifier === "any" || modifier === "all") && quantifiable.has(name)) return {
+		...condition,
+		quantifier: modifier,
+		value: plain
+	};
+	throw parseError(`"failed to parse filter (${text})"`, `${name} takes no "${modifier}"`);
+};
+const treeItem = (text) => {
+	const nested = /^(not\.)?(and|or)(\([\s\S]*\))$/.exec(text);
+	if (nested) return parseLogic(nested[2], Boolean(nested[1]), nested[3]);
+	const dot = text.indexOf(".");
+	if (dot <= 0) throw parseError(`"failed to parse logic tree (${text})"`, "Each condition is field.operator.value");
+	return parseCondition(parseFieldPath(text.slice(0, dot)), text.slice(dot + 1), true);
+};
+/** Parses the value of `or=`, `and=`, `not.or=` or `not.and=`: `(item,item,...)`, items nesting `and(...)` and `or(...)`. */
+const parseLogic = (kind, negated, text) => {
+	if (!text.startsWith("(") || !text.endsWith(")")) throw parseError(`"failed to parse logic tree (${text})"`, "A logic tree is a list in parentheses");
+	return {
+		kind,
+		negated,
+		args: splitList(text.slice(1, -1)).map((item) => treeItem(item.trim()))
+	};
+};
+/** The filter of one query parameter: `column=op.value`, or a logic tree under `or`, `and`, `not.or` or `not.and`. */
+const parseFilter = (key, value) => {
+	const logic = /^(not\.)?(and|or)$/.exec(key);
+	if (logic) return parseLogic(logic[2], Boolean(logic[1]), value);
+	return parseCondition(parseFieldPath(key), value);
+};
+//#endregion
+export { isValues, operators, parseCondition, parseFilter, parseLogic, textSearch };

package/dist/rest/parse-order.js

@@ -0,0 +1,18 @@
+import { parseError } from "./rest-error.js";
+import { parseFieldPath } from "./field-path.js";
+import { splitList } from "./split-list.js";
+//#region src/rest/parse-order.ts
+const directions = /* @__PURE__ */ new Set(["asc", "desc"]);
+const nulls = /* @__PURE__ */ new Set(["nullsfirst", "nullslast"]);
+const parseTerm = (text) => {
+	const [fieldText = "", ...modifiers] = text.trim().split(".");
+	const term = { field: parseFieldPath(fieldText) };
+	for (const modifier of modifiers) if (directions.has(modifier) && !term.direction && !term.nulls) term.direction = modifier;
+	else if (nulls.has(modifier) && !term.nulls) term.nulls = modifier === "nullsfirst" ? "first" : "last";
+	else throw parseError(`"failed to parse order (${text})"`, `"${modifier}" is neither asc, desc, nullsfirst nor nullslast`);
+	return term;
+};
+/** Parses `order`: terms separated by commas, such as `priority.desc.nullslast,id`. */
+const parseOrder = (text) => splitList(text).map(parseTerm);
+//#endregion
+export { parseOrder };

package/dist/rest/parse-prefer.js

@@ -0,0 +1,26 @@
+//#region src/rest/parse-prefer.ts
+const known = {
+	return: [
+		"minimal",
+		"representation",
+		"headers-only"
+	],
+	count: [
+		"exact",
+		"planned",
+		"estimated"
+	],
+	resolution: ["merge-duplicates", "ignore-duplicates"],
+	missing: ["default", "null"]
+};
+/** Reads `Prefer: return=representation, count=exact`, in one header or several; the first of each kind counts. */
+const parsePrefer = (header) => {
+	const preferences = {};
+	for (const part of header?.split(",") ?? []) {
+		const [name = "", value = ""] = part.trim().split("=").map((text) => text.trim());
+		if (name in known && !(name in preferences) && known[name].includes(value)) preferences[name] = value;
+	}
+	return preferences;
+};
+//#endregion
+export { parsePrefer };

package/dist/rest/parse-query.js

@@ -0,0 +1,63 @@
+import { parseError } from "./rest-error.js";
+import { splitList, unquote } from "./split-list.js";
+import { parseFilter } from "./parse-filter.js";
+import { parseOrder } from "./parse-order.js";
+import { parseSelect } from "./parse-select.js";
+//#region src/rest/parse-query.ts
+const reserved = /* @__PURE__ */ new Set([
+	"select",
+	"order",
+	"limit",
+	"offset",
+	"on_conflict",
+	"columns"
+]);
+const count = (name, text) => {
+	if (!/^\d+$/.test(text)) throw parseError(`"failed to parse ${name} (${text})"`, `${name} takes a whole number`);
+	return Number(text);
+};
+const names = (text) => splitList(text).map((name) => unquote(name.trim()));
+/** `Range: 2-4` or `Range: 5-`, in items; anything else asks for every row, as PostgREST takes it. */
+const rangeHeader = (header) => {
+	const match = header === null ? null : /^\s*(\d+)-(\d*)\s*$/.exec(header);
+	if (!match) return { offset: 0 };
+	const offset = Number(match[1]);
+	return match[2] === "" ? { offset } : {
+		offset,
+		limit: Math.max(0, Number(match[2]) - offset + 1)
+	};
+};
+const intersect = (a, b) => {
+	const offset = Math.max(a.offset, b.offset);
+	const ends = [a, b].flatMap((range) => range.limit === void 0 ? [] : [range.offset + range.limit]);
+	return ends.length === 0 ? { offset } : {
+		offset,
+		limit: Math.max(0, Math.min(...ends) - offset)
+	};
+};
+/**
+* Parses a request's query parameters. The ones in `args` are a function's arguments, not filters. `select`, `order`,
+* `limit`, `offset`, `on_conflict` and `columns` count once, the first time; every other parameter is a filter.
+*/
+const parseQuery = (params, rangeText = null, args = /* @__PURE__ */ new Set()) => {
+	const first = (name) => params.find(([key]) => key === name)?.[1];
+	const limit = first("limit");
+	const offset = first("offset");
+	const order = first("order");
+	const onConflict = first("on_conflict");
+	const columns = first("columns");
+	const fromParams = {
+		offset: offset === void 0 ? 0 : count("offset", offset),
+		...limit !== void 0 && { limit: count("limit", limit) }
+	};
+	return {
+		select: parseSelect(first("select")),
+		filters: params.filter(([key]) => !reserved.has(key) && !args.has(key)).map(([key, value]) => parseFilter(key, value)),
+		order: order === void 0 ? [] : parseOrder(order),
+		range: intersect(fromParams, rangeHeader(rangeText)),
+		...onConflict !== void 0 && { onConflict: names(onConflict) },
+		...columns !== void 0 && { columns: names(columns) }
+	};
+};
+//#endregion
+export { parseQuery };

package/dist/rest/parse-select.js

@@ -0,0 +1,24 @@
+import { parseError, restError } from "./rest-error.js";
+import { parseFieldPath } from "./field-path.js";
+import { splitList } from "./split-list.js";
+//#region src/rest/parse-select.ts
+const typeName = /^[A-Za-z_][A-Za-z0-9_]*(\[\])?$/;
+const parseItem = (text) => {
+	const item = text.trim();
+	if (item === "*") return { kind: "all" };
+	if (item.includes("(")) throw restError(400, "PGRST100", `"${item}" embeds a resource or calls an aggregate, which /rest/v1 does not support yet`);
+	const aliased = /^([^:]+):(?!:)([\s\S]*)$/.exec(item);
+	const alias = aliased?.[1]?.trim();
+	const [fieldText = "", cast, ...more] = (aliased ? aliased[2] : item).split("::");
+	if (more.length > 0 || cast !== void 0 && !typeName.test(cast.trim())) throw parseError(`"failed to parse select parameter (${item})"`, `"${cast}" is not a type name`);
+	return {
+		kind: "field",
+		field: parseFieldPath(fieldText),
+		...alias && { alias },
+		...cast !== void 0 && { cast: cast.trim() }
+	};
+};
+/** Parses `select`: items separated by commas, `*` for every column. Missing or empty, it is `*`. */
+const parseSelect = (text) => text === void 0 || text.trim() === "" ? [{ kind: "all" }] : splitList(text).map(parseItem);
+//#endregion
+export { parseSelect };

package/dist/rest/read-rows.js

@@ -0,0 +1,39 @@
+import { whereSql } from "./filter-sql.js";
+import { orderSql, rangeSql, selectSql } from "./shape-sql.js";
+import { sql } from "kysely";
+//#region src/rest/read-rows.ts
+/** The most rows a read returns, as Supabase's `db-max-rows` default. */
+const maxRows = 1e3;
+const plannedRows = async (trx, source, query) => {
+	const { rows } = await sql`explain (format json) select 1 from ${source.from}${whereSql(source.alias, query.filters)}`.execute(trx);
+	return rows[0]["QUERY PLAN"][0].Plan["Plan Rows"];
+};
+/**
+* Reads the rows of `source` the query asks for: filtered, shaped by `select`, sorted, in its range and never more than
+* `maxRows`, as one JSON array built by Postgres, so values reach the client exactly as Postgres writes them. `count`
+* counts the matching rows: `exact` by counting, `planned` by the planner's estimate, `estimated` by counting up to
+* `maxRows` and estimating beyond.
+*/
+const readRows = async (trx, source, query, count) => {
+	const where = whereSql(source.alias, query.filters);
+	const range = {
+		offset: query.range.offset,
+		limit: Math.min(query.range.limit ?? 1e3, maxRows)
+	};
+	const columns = source.scalar ? sql`${sql.id(source.alias)} as pgrst_scalar` : selectSql(source.alias, query.select);
+	const rows = sql`select ${columns} from ${source.from}${where}${orderSql(source.alias, query.order)}${rangeSql(range)}`;
+	const counted = count === "exact" || count === "estimated" ? sql`(select count(*) from ${source.from}${where})` : sql`null::bigint`;
+	const aggregate = source.scalar ? sql`json_agg(pgrst_rows.pgrst_scalar)` : sql`json_agg(pgrst_rows)`;
+	const { rows: [result] } = await sql`
+    select coalesce(${aggregate}, '[]')::text as body, count(*) as page, ${counted} as total from (${rows}) as pgrst_rows
+  `.execute(trx);
+	const exact = result.total === null ? void 0 : Number(result.total);
+	const total = count === "planned" || count === "estimated" && exact > 1e3 ? await plannedRows(trx, source, query) : exact;
+	return {
+		body: result.body,
+		page: Number(result.page),
+		...total !== void 0 && { total }
+	};
+};
+//#endregion
+export { maxRows, readRows };