@zeno-lib/db 0.3.1 → 0.4.0

package/dist/clients-CdPr3mCZ.mjs

@@ -0,0 +1,197 @@
+import { sql } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+//#region src/rls-query-client.ts
+function replayAsUserChain(tx, path) {
+	let receiver = tx;
+	let current = tx;
+	for (const step of path) if (step.kind === "get") {
+		receiver = current;
+		current = current[step.prop];
+	} else current = current.apply(receiver, step.args);
+	return current;
+}
+const PROMISE_METHODS = /* @__PURE__ */ new Set([
+	"then",
+	"catch",
+	"finally"
+]);
+function replayPromiseMethod(prop, path, runTransaction) {
+	return (...promiseArgs) => {
+		const promise = runTransaction((tx) => replayAsUserChain(tx, path));
+		return promise[prop].apply(promise, promiseArgs);
+	};
+}
+function createRlsQueryClient(runTransaction, close) {
+	const build = (path, isRoot) => {
+		const target = () => void 0;
+		return new Proxy(target, {
+			apply(_target, _thisArg, args) {
+				if (isRoot) throw new Error("The createSupabaseDrizzle() client is queried directly (e.g. db.select().from(table)). Use db.transaction(cb) to run multiple statements in one RLS transaction.");
+				return build([...path, {
+					args,
+					kind: "apply"
+				}], false);
+			},
+			get(_target, prop) {
+				if (isRoot && prop === "transaction") return runTransaction;
+				if (isRoot && prop === "close") return close;
+				if (PROMISE_METHODS.has(prop)) return isRoot ? void 0 : replayPromiseMethod(prop, path, runTransaction);
+				if (typeof prop === "symbol") return;
+				return build([...path, {
+					kind: "get",
+					prop
+				}], false);
+			}
+		});
+	};
+	return build([], true);
+}
+//#endregion
+//#region src/clients.ts
+const ALLOWED_RLS_ROLES = /* @__PURE__ */ new Set(["anon", "authenticated"]);
+const POOLER_PORT = "6543";
+const LOCAL_HOSTS = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]",
+	"0.0.0.0"
+]);
+/**
+* The connection string every factory uses: `connectionString`, else
+* `SUPABASE_DATABASE_URL`. Throws when neither is set, and with
+* `requirePooler` also when the URL is not the transaction pooler. Read per
+* call, never at import, so a build without server secrets does not fail.
+* Errors never echo the URL, which carries the password.
+*/
+function resolveDatabaseUrl({ connectionString, requirePooler = false } = {}) {
+	const url = connectionString ?? process.env.SUPABASE_DATABASE_URL ?? "";
+	if (!url) throw new Error("Missing SUPABASE_DATABASE_URL environment variable");
+	if (!requirePooler) return url;
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error("SUPABASE_DATABASE_URL is not a valid URL");
+	}
+	if (parsed.protocol !== "postgresql:" && parsed.protocol !== "postgres:") throw new Error(`SUPABASE_DATABASE_URL must be a postgresql:// URL, got ${parsed.protocol}//`);
+	if (LOCAL_HOSTS.has(parsed.hostname)) throw new Error("SUPABASE_DATABASE_URL points at a local database, but the transaction pooler is required");
+	if (parsed.port !== POOLER_PORT) throw new Error(`SUPABASE_DATABASE_URL must use the transaction pooler (port ${POOLER_PORT}), got port ${parsed.port || "(default)"}. Session mode holds one connection per instance for its whole lifetime.`);
+	return url;
+}
+function clampClaims(token) {
+	const role = token.role && ALLOWED_RLS_ROLES.has(token.role) ? token.role : "anon";
+	return {
+		claims: JSON.stringify({
+			...token,
+			role
+		}),
+		role,
+		sub: token.sub ?? ""
+	};
+}
+function fixedContext(role) {
+	return {
+		claims: JSON.stringify({ role }),
+		role,
+		sub: ""
+	};
+}
+const poolCache = /* @__PURE__ */ new Map();
+function acquirePool(connectionString, kind) {
+	const key = `${kind} ${connectionString}`;
+	let entry = poolCache.get(key);
+	if (!entry) {
+		entry = {
+			client: postgres(connectionString, { prepare: false }),
+			ended: false,
+			key,
+			refCount: 0
+		};
+		poolCache.set(key, entry);
+	}
+	entry.refCount += 1;
+	return entry;
+}
+function makeClose(entry) {
+	let released = false;
+	return async (options) => {
+		if (released) return;
+		released = true;
+		entry.refCount -= 1;
+		if (entry.refCount <= 0 && !entry.ended) {
+			entry.ended = true;
+			if (poolCache.get(entry.key) === entry) poolCache.delete(entry.key);
+			await entry.client.end(options);
+		}
+	};
+}
+function buildDrizzle(kind, config) {
+	const { connectionString, requirePooler, ...drizzleConfig } = config ?? {};
+	const entry = acquirePool(resolveDatabaseUrl({
+		connectionString,
+		requirePooler
+	}), kind);
+	const db = drizzle({
+		client: entry.client,
+		...drizzleConfig
+	});
+	return {
+		close: makeClose(entry),
+		db
+	};
+}
+function buildRlsClient(resolveContext, config) {
+	const { close, db } = buildDrizzle("rls", config);
+	const runTransaction = async (transaction) => {
+		const { claims, role, sub } = await resolveContext();
+		return db.transaction(async (tx) => {
+			await tx.execute(sql`select set_config('request.jwt.claims', ${claims}, true), set_config('request.jwt.claim.sub', ${sub}, true)`);
+			await tx.execute(sql`set local role ${sql.raw(role)}`);
+			return transaction(tx);
+		});
+	};
+	return createRlsQueryClient(runTransaction, close);
+}
+/**
+* RLS-bypassing client (the docs' `admin`). Connects with
+* `SUPABASE_DATABASE_URL` and queries drizzle directly. Use for webhooks,
+* background jobs, and seeding, never for user-scoped reads/writes.
+*/
+function createAdminClient(config) {
+	const { close, db } = buildDrizzle("admin", config);
+	return Object.assign(db, { close });
+}
+/**
+* RLS client scoped to an already-verified, decoded token (e.g. from
+* `supabase.auth.getClaims()`). The role is clamped to the allowlist.
+*/
+function createSupabaseClient(accessToken, config) {
+	const context = clampClaims(accessToken);
+	return buildRlsClient(() => Promise.resolve(context), config);
+}
+/**
+* RLS client bound to a Supabase client. Verified claims are resolved via
+* `supabase.auth.getClaims()` on every query, so it always reflects the live
+* session.
+*/
+function createAuthClient(supabase, config) {
+	return buildRlsClient(async () => {
+		const { data, error } = await supabase.auth.getClaims();
+		if (error) throw error;
+		return clampClaims(data?.claims ?? {});
+	}, config);
+}
+/** RLS client that runs every query as the `anon` role. */
+function createAnonClient(config) {
+	return buildRlsClient(() => Promise.resolve(fixedContext("anon")), config);
+}
+/**
+* Client that runs every query as `service_role`, which bypasses RLS via
+* Supabase's BYPASSRLS grant. Use for trusted server-side work.
+*/
+function createServiceClient(config) {
+	return buildRlsClient(() => Promise.resolve(fixedContext("service_role")), config);
+}
+//#endregion
+export { createSupabaseClient as a, createServiceClient as i, createAnonClient as n, resolveDatabaseUrl as o, createAuthClient as r, createAdminClient as t };

package/dist/config.d.mts

@@ -0,0 +1,20 @@
+import { Config, defineConfig } from "drizzle-kit";
+//#region src/config.d.ts
+/**
+ * Roles a Supabase project ships that drizzle-kit's `provider: "supabase"` does
+ * not already exclude. That provider covers eight names (`anon`,
+ * `authenticator`, `authenticated`, `service_role`, `supabase_auth_admin`,
+ * `supabase_storage_admin`, `dashboard_user`, `supabase_admin`); a real
+ * instance has these too, and drizzle-kit manages every role it finds but
+ * cannot see declared, which means a `DROP ROLE` for each.
+ *
+ * The alternative is every consumer keeping a generated `roles.ts` nobody
+ * reads, or its own copy of this list, which rots as Supabase adds roles. That
+ * is the argument for it living in a versioned dependency.
+ *
+ * Verified against Supabase CLI 2.84.1 / Postgres 17.
+ */
+declare const supabaseManagedRoles: readonly ["pg_checkpoint", "pg_database_owner", "pg_execute_server_program", "pg_monitor", "pg_read_all_data", "pg_read_all_settings", "pg_read_all_stats", "pg_read_server_files", "pg_signal_backend", "pg_stat_scan_tables", "pg_write_all_data", "pg_write_server_files", "pgbouncer", "postgres", "supabase_functions_admin", "supabase_read_only_user", "supabase_realtime_admin", "supabase_replication_admin"];
+declare function defineDrizzleConfig(overrides?: Partial<Config>): ReturnType<typeof defineConfig>;
+//#endregion
+export { defineDrizzleConfig, supabaseManagedRoles };

package/dist/config.mjs

@@ -0,0 +1,64 @@
+import { defineConfig } from "drizzle-kit";
+//#region src/config.ts
+/**
+* Roles a Supabase project ships that drizzle-kit's `provider: "supabase"` does
+* not already exclude. That provider covers eight names (`anon`,
+* `authenticator`, `authenticated`, `service_role`, `supabase_auth_admin`,
+* `supabase_storage_admin`, `dashboard_user`, `supabase_admin`); a real
+* instance has these too, and drizzle-kit manages every role it finds but
+* cannot see declared, which means a `DROP ROLE` for each.
+*
+* The alternative is every consumer keeping a generated `roles.ts` nobody
+* reads, or its own copy of this list, which rots as Supabase adds roles. That
+* is the argument for it living in a versioned dependency.
+*
+* Verified against Supabase CLI 2.84.1 / Postgres 17.
+*/
+const supabaseManagedRoles = [
+	"pg_checkpoint",
+	"pg_database_owner",
+	"pg_execute_server_program",
+	"pg_monitor",
+	"pg_read_all_data",
+	"pg_read_all_settings",
+	"pg_read_all_stats",
+	"pg_read_server_files",
+	"pg_signal_backend",
+	"pg_stat_scan_tables",
+	"pg_write_all_data",
+	"pg_write_server_files",
+	"pgbouncer",
+	"postgres",
+	"supabase_functions_admin",
+	"supabase_read_only_user",
+	"supabase_realtime_admin",
+	"supabase_replication_admin"
+];
+/**
+* Schemas drizzle-kit is allowed to diff. Supabase owns `auth`, `storage`,
+* `realtime` and the rest, and changes them on upgrades, so migrating them is
+* never right. Add your own schemas here rather than dropping the filter.
+*/
+const DEFAULT_SCHEMA_FILTER = ["public"];
+function defineDrizzleConfig(overrides = {}) {
+	const { entities, ...configOverrides } = overrides;
+	const roleOverrides = typeof entities?.roles === "object" ? entities.roles : {};
+	return defineConfig({
+		dbCredentials: { url: process.env.SUPABASE_DATABASE_URL ?? "" },
+		dialect: "postgresql",
+		entities: {
+			...entities,
+			roles: {
+				...roleOverrides,
+				exclude: [...roleOverrides.exclude ?? [], ...supabaseManagedRoles],
+				provider: "supabase"
+			}
+		},
+		out: "./supabase/migrations",
+		schema: "./src/schema.ts",
+		schemaFilter: DEFAULT_SCHEMA_FILTER,
+		...configOverrides
+	});
+}
+//#endregion
+export { defineDrizzleConfig, supabaseManagedRoles };

package/dist/errors.d.mts

@@ -0,0 +1,70 @@
+import { PostgresError } from "postgres";
+//#region src/errors.d.ts
+/**
+ * SQLSTATE codes worth naming. The full list is Postgres's "Error Codes"
+ * appendix; these are the ones an application branches on.
+ */
+declare const SqlState: {
+  /** `check_violation`. */
+  readonly checkViolation: "23514";
+  /** `exclusion_violation`. */
+  readonly exclusionViolation: "23P01";
+  /** `foreign_key_violation`. */
+  readonly foreignKeyViolation: "23503";
+  /** `insufficient_privilege`: an RLS policy or a missing grant refused it. */
+  readonly insufficientPrivilege: "42501";
+  /**
+   * `invalid_column_reference`, which is what an `ON CONFLICT` target that no
+   * unique index can arbitrate raises. It is raised while the statement is
+   * planned, so it fires on the first insert, not on the first conflict.
+   */
+  readonly invalidColumnReference: "42P10";
+  /** `not_null_violation`. */
+  readonly notNullViolation: "23502";
+  /** `undefined_function`: a function missing, or called with the wrong signature. */
+  readonly undefinedFunction: "42883";
+  /** `unique_violation`. */
+  readonly uniqueViolation: "23505";
+};
+type SqlStateCode = (typeof SqlState)[keyof typeof SqlState];
+/**
+ * The postgres.js error underneath whatever Drizzle threw, or `undefined`.
+ *
+ * Drizzle wraps **every** driver error in a `DrizzleQueryError` whose own
+ * `code` is `undefined`, so `error.code === "23505"` is always false:
+ *
+ * ```
+ * depth 0: DrizzleQueryError  code=undefined  "Failed query: insert into …"
+ * depth 1: PostgresError      code=23505      "duplicate key value violates …"
+ * ```
+ *
+ * Matched by `name` rather than `instanceof`, so a second copy of `postgres`
+ * in the tree cannot make it miss.
+ */
+declare const toPostgresError: (error: unknown) => PostgresError | undefined;
+type ConstraintViolationOptions = {
+  /**
+   * The SQLSTATE to require, e.g. `SqlState.uniqueViolation`. Defaults to any
+   * code in class 23 (`integrity_constraint_violation`).
+   */
+  code?: string;
+};
+/**
+ * Whether `error` is an integrity-constraint violation, optionally one of the
+ * named constraints. Returns the `PostgresError` so a caller can read its
+ * `constraint_name` or `detail`, or `undefined` when it does not match.
+ *
+ * ```ts
+ * try {
+ *   await db.insert(contacts).values(row)
+ * } catch (error) {
+ *   if (isConstraintViolation(error, ["contacts_email_key"], { code: SqlState.uniqueViolation })) {
+ *     return { error: "That email is already a contact" }
+ *   }
+ *   throw error
+ * }
+ * ```
+ */
+declare const isConstraintViolation: (error: unknown, constraints?: Iterable<string>, { code }?: ConstraintViolationOptions) => PostgresError | undefined;
+//#endregion
+export { ConstraintViolationOptions, SqlState, SqlStateCode, isConstraintViolation, toPostgresError };

package/dist/errors.mjs

@@ -0,0 +1,78 @@
+//#region src/errors.ts
+/**
+* SQLSTATE codes worth naming. The full list is Postgres's "Error Codes"
+* appendix; these are the ones an application branches on.
+*/
+const SqlState = {
+	/** `check_violation`. */
+	checkViolation: "23514",
+	/** `exclusion_violation`. */
+	exclusionViolation: "23P01",
+	/** `foreign_key_violation`. */
+	foreignKeyViolation: "23503",
+	/** `insufficient_privilege`: an RLS policy or a missing grant refused it. */
+	insufficientPrivilege: "42501",
+	/**
+	* `invalid_column_reference`, which is what an `ON CONFLICT` target that no
+	* unique index can arbitrate raises. It is raised while the statement is
+	* planned, so it fires on the first insert, not on the first conflict.
+	*/
+	invalidColumnReference: "42P10",
+	/** `not_null_violation`. */
+	notNullViolation: "23502",
+	/** `undefined_function`: a function missing, or called with the wrong signature. */
+	undefinedFunction: "42883",
+	/** `unique_violation`. */
+	uniqueViolation: "23505"
+};
+/** SQLSTATE class 23, every `integrity_constraint_violation`. */
+const INTEGRITY_CONSTRAINT_CLASS = "23";
+const MAX_CAUSE_DEPTH = 5;
+/**
+* The postgres.js error underneath whatever Drizzle threw, or `undefined`.
+*
+* Drizzle wraps **every** driver error in a `DrizzleQueryError` whose own
+* `code` is `undefined`, so `error.code === "23505"` is always false:
+*
+* ```
+* depth 0: DrizzleQueryError  code=undefined  "Failed query: insert into …"
+* depth 1: PostgresError      code=23505      "duplicate key value violates …"
+* ```
+*
+* Matched by `name` rather than `instanceof`, so a second copy of `postgres`
+* in the tree cannot make it miss.
+*/
+const toPostgresError = (error) => {
+	let current = error;
+	for (let depth = 0; current instanceof Error && depth < MAX_CAUSE_DEPTH; depth += 1) {
+		if (current.name === "PostgresError") return current;
+		current = current.cause;
+	}
+};
+/**
+* Whether `error` is an integrity-constraint violation, optionally one of the
+* named constraints. Returns the `PostgresError` so a caller can read its
+* `constraint_name` or `detail`, or `undefined` when it does not match.
+*
+* ```ts
+* try {
+*   await db.insert(contacts).values(row)
+* } catch (error) {
+*   if (isConstraintViolation(error, ["contacts_email_key"], { code: SqlState.uniqueViolation })) {
+*     return { error: "That email is already a contact" }
+*   }
+*   throw error
+* }
+* ```
+*/
+const isConstraintViolation = (error, constraints, { code } = {}) => {
+	const postgresError = toPostgresError(error);
+	if (!postgresError) return;
+	if (!(code ? postgresError.code === code : postgresError.code.startsWith(INTEGRITY_CONSTRAINT_CLASS))) return;
+	if (constraints === void 0) return postgresError;
+	const name = postgresError.constraint_name;
+	if (name === void 0) return;
+	for (const constraint of constraints) if (constraint === name) return postgresError;
+};
+//#endregion
+export { SqlState, isConstraintViolation, toPostgresError };

package/dist/function-names-BDc-AuFm.mjs

@@ -0,0 +1,10 @@
+//#region src/function-names.ts
+const FUNCTION_POLICY_OPERATIONS = [
+	"select",
+	"insert",
+	"update",
+	"delete"
+];
+const functionPolicyName = (prefix, operation, tableName) => `${prefix}_${operation}_${tableName}`;
+//#endregion
+export { functionPolicyName as n, FUNCTION_POLICY_OPERATIONS as t };

package/dist/function-names-hv2mj_x1.d.mts

@@ -0,0 +1,5 @@
+//#region src/function-names.d.ts
+declare const FUNCTION_POLICY_OPERATIONS: readonly ["select", "insert", "update", "delete"];
+type FunctionPolicyOperation = (typeof FUNCTION_POLICY_OPERATIONS)[number];
+//#endregion
+export { FunctionPolicyOperation as t };

package/dist/index.d.mts

@@ -0,0 +1,2 @@
+import { a as createAdminClient, c as createServiceClient, i as SupabaseToken, l as createSupabaseClient, n as DrizzleClient, o as createAnonClient, r as ResolveDatabaseUrlOptions, s as createAuthClient, t as CreateClientConfig, u as resolveDatabaseUrl } from "./clients-BlUEH7QJ.mjs";
+export { type CreateClientConfig, type DrizzleClient, type ResolveDatabaseUrlOptions, type SupabaseToken, createAdminClient, createAnonClient, createAuthClient, createServiceClient, createSupabaseClient, resolveDatabaseUrl };

package/dist/index.mjs

@@ -0,0 +1,2 @@
+import { a as createSupabaseClient, i as createServiceClient, n as createAnonClient, o as resolveDatabaseUrl, r as createAuthClient, t as createAdminClient } from "./clients-CdPr3mCZ.mjs";
+export { createAdminClient, createAnonClient, createAuthClient, createServiceClient, createSupabaseClient, resolveDatabaseUrl };

package/dist/next.d.mts

@@ -0,0 +1,87 @@
+import { n as DrizzleClient, t as CreateClientConfig } from "./clients-BlUEH7QJ.mjs";
+import { AnyRelations, EmptyRelations } from "drizzle-orm";
+import { JwtPayload, SupabaseClient } from "@supabase/supabase-js";
+//#region src/define-action.d.ts
+/**
+ * The slice of a schema `defineAction` needs: a throwing `parse`, plus the
+ * Standard Schema `types` marker it reads the caller-facing input type from.
+ * Zod 4 schemas satisfy it as they are; so does anything else that implements
+ * Standard Schema and exposes `parse`.
+ */
+interface ActionSchema<TInput, TOutput> {
+  readonly "~standard": {
+    readonly types?: {
+      readonly input: TInput;
+      readonly output: TOutput;
+    } | undefined;
+  };
+  parse(input: unknown): TOutput;
+}
+/** What a request context must carry for `defineAction` to hand it over. */
+interface ActionContext<TDb> {
+  readonly db: TDb;
+}
+/** An action's body: the RLS-bound `db`, the parsed input, and the context. */
+type ActionHandler<TContext extends ActionContext<unknown>, TOutput, TResult> = (db: TContext["db"], input: TOutput, context: TContext) => TResult | Promise<TResult>;
+/**
+ * `defineAction(schema, handler)` returns the server action itself: an async
+ * function that parses its argument, resolves the request context, then calls
+ * `handler(db, input, context)`.
+ */
+type DefineAction<TContext extends ActionContext<unknown>> = <TInput, TOutput, TResult>(schema: ActionSchema<TInput, TOutput>, handler: ActionHandler<TContext, TOutput, TResult>) => (input: TInput) => Promise<TResult>;
+//#endregion
+//#region src/next.d.ts
+/**
+ * Thrown when a request carries no verified session. A named class so a caller
+ * with a legitimate answer for that case (a permission check, where "not signed
+ * in" means "no") can tell it apart from a real failure with `instanceof`.
+ */
+declare class UnauthenticatedError extends Error {
+  constructor(message?: string);
+}
+/** The only part of a Supabase client the request context reads. */
+type ClaimsSource = {
+  auth: Pick<SupabaseClient["auth"], "getClaims">;
+};
+/** A verified request: the full `getClaims()` payload and the RLS client. */
+type RequestContext<TRelations extends AnyRelations = EmptyRelations> = {
+  readonly claims: JwtPayload;
+  readonly db: DrizzleClient<TRelations>;
+};
+type CreateRequestDbOptions<TRelations extends AnyRelations = EmptyRelations> = Omit<CreateClientConfig<TRelations>, "connectionString"> & {
+  /**
+   * Builds the request's Supabase client, e.g. `createClient` from
+   * `@zeno-lib/supabase/next-server` (cookie session via `next/headers`).
+   */
+  supabase: () => ClaimsSource | Promise<ClaimsSource>;
+  /**
+   * Overrides `SUPABASE_DATABASE_URL`. A function is resolved per request, not
+   * at import, so a build without server secrets can still import the module.
+   */
+  connectionString?: string | (() => string);
+};
+type RequestDb<TRelations extends AnyRelations = EmptyRelations> = {
+  /** Memoised per render: `{ claims, db }` for the verified caller. */
+  getRequestContext: () => Promise<RequestContext<TRelations>>;
+  /** The common case: just the RLS-bound client. */
+  getRequestDb: () => Promise<DrizzleClient<TRelations>>;
+  /** Wraps a handler into a `"use server"` export; see `DefineAction`. */
+  defineAction: DefineAction<RequestContext<TRelations>>;
+};
+/**
+ * Request-scoped, RLS-bound Drizzle access for Next.js. Verifies the session
+ * with `getClaims()` (which checks the signature) and installs the **whole**
+ * claims object, so custom claims reach `auth.jwt()` in policies. There is no
+ * fallback to `anon`: a caller without a verified `sub` gets
+ * `UnauthenticatedError` rather than the empty result of a policy it never
+ * satisfied.
+ *
+ * `getRequestContext` is wrapped in React's `cache`, so one server render shares
+ * one verification and one handle. A server action invoked from the browser
+ * runs outside a render and resolves afresh on every call.
+ *
+ * Do not `close()` the handle: pools are shared and reference-counted.
+ */
+declare function createRequestDb<TRelations extends AnyRelations = EmptyRelations>(options: CreateRequestDbOptions<TRelations>): RequestDb<TRelations>;
+//#endregion
+export { type ActionContext, type ActionHandler, type ActionSchema, ClaimsSource, CreateRequestDbOptions, type DefineAction, RequestContext, RequestDb, UnauthenticatedError, createRequestDb };

package/dist/next.mjs

@@ -0,0 +1,69 @@
+import { a as createSupabaseClient } from "./clients-CdPr3mCZ.mjs";
+import { cache } from "react";
+//#region src/define-action.ts
+/**
+* Binds `defineAction` to a request-context resolver. Deliberately not a
+* `"use server"` module: it only returns a function, and the app file that
+* exports the result is the one that carries the directive.
+*
+* Input is parsed before the context is resolved, so a malformed call fails
+* without a session round trip, and the handler never sees an unparsed value.
+*/
+function createDefineAction(getContext) {
+	return (schema, handler) => async (input) => {
+		const parsed = schema.parse(input);
+		const context = await getContext();
+		return await handler(context.db, parsed, context);
+	};
+}
+//#endregion
+//#region src/next.ts
+/**
+* Thrown when a request carries no verified session. A named class so a caller
+* with a legitimate answer for that case (a permission check, where "not signed
+* in" means "no") can tell it apart from a real failure with `instanceof`.
+*/
+var UnauthenticatedError = class extends Error {
+	constructor(message = "Unauthorized: no verified session on this request") {
+		super(message);
+		this.name = "UnauthenticatedError";
+	}
+};
+/**
+* Request-scoped, RLS-bound Drizzle access for Next.js. Verifies the session
+* with `getClaims()` (which checks the signature) and installs the **whole**
+* claims object, so custom claims reach `auth.jwt()` in policies. There is no
+* fallback to `anon`: a caller without a verified `sub` gets
+* `UnauthenticatedError` rather than the empty result of a policy it never
+* satisfied.
+*
+* `getRequestContext` is wrapped in React's `cache`, so one server render shares
+* one verification and one handle. A server action invoked from the browser
+* runs outside a render and resolves afresh on every call.
+*
+* Do not `close()` the handle: pools are shared and reference-counted.
+*/
+function createRequestDb(options) {
+	const { connectionString, supabase, ...config } = options;
+	const getRequestContext = cache(async () => {
+		const { data, error } = await (await supabase()).auth.getClaims();
+		if (error) throw error;
+		if (!data?.claims.sub) throw new UnauthenticatedError();
+		const url = typeof connectionString === "function" ? connectionString() : connectionString;
+		const db = createSupabaseClient(data.claims, url === void 0 ? config : {
+			...config,
+			connectionString: url
+		});
+		return {
+			claims: data.claims,
+			db
+		};
+	});
+	return {
+		defineAction: createDefineAction(getRequestContext),
+		getRequestContext,
+		getRequestDb: async () => (await getRequestContext()).db
+	};
+}
+//#endregion
+export { UnauthenticatedError, createRequestDb };