@zeno-lib/db 0.3.2 → 0.5.0

package/dist/clients-BlUEH7QJ.d.mts

@@ -0,0 +1,58 @@
+import { AnyRelations, EmptyRelations } from "drizzle-orm";
+import { DrizzlePgConfig } from "drizzle-orm/pg-core";
+import { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import { JwtPayload, SupabaseClient } from "@supabase/supabase-js";
+//#region src/clients.d.ts
+type CloseFn = (options?: {
+  timeout?: number;
+}) => Promise<void>;
+type CreateClientConfig<TRelations extends AnyRelations = EmptyRelations> = DrizzlePgConfig<TRelations> & {
+  /** Overrides `process.env.SUPABASE_DATABASE_URL`. */
+  connectionString?: string;
+  /**
+   * Require the Supabase transaction pooler: port 6543 on a non-local host.
+   * Pass `true` in production (e.g. `process.env.VERCEL_ENV === "production"`)
+   * to fail at client creation rather than exhaust connections under load.
+   * Default `false`, which checks only that a URL is present.
+   */
+  requirePooler?: boolean;
+};
+type ResolveDatabaseUrlOptions = Pick<CreateClientConfig, "connectionString" | "requirePooler">;
+/**
+ * The connection string every factory uses: `connectionString`, else
+ * `SUPABASE_DATABASE_URL`. Throws when neither is set, and with
+ * `requirePooler` also when the URL is not the transaction pooler. Read per
+ * call, never at import, so a build without server secrets does not fail.
+ * Errors never echo the URL, which carries the password.
+ */
+declare function resolveDatabaseUrl({ connectionString, requirePooler }?: ResolveDatabaseUrlOptions): string;
+type DrizzleClient<TRelations extends AnyRelations = EmptyRelations> = PostgresJsDatabase<TRelations> & {
+  close: CloseFn;
+};
+type SupabaseToken = Pick<JwtPayload, "role" | "sub">;
+/**
+ * RLS-bypassing client (the docs' `admin`). Connects with
+ * `SUPABASE_DATABASE_URL` and queries drizzle directly. Use for webhooks,
+ * background jobs, and seeding, never for user-scoped reads/writes.
+ */
+declare function createAdminClient<TRelations extends AnyRelations = EmptyRelations>(config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
+/**
+ * RLS client scoped to an already-verified, decoded token (e.g. from
+ * `supabase.auth.getClaims()`). The role is clamped to the allowlist.
+ */
+declare function createSupabaseClient<TRelations extends AnyRelations = EmptyRelations>(accessToken: SupabaseToken, config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
+/**
+ * RLS client bound to a Supabase client. Verified claims are resolved via
+ * `supabase.auth.getClaims()` on every query, so it always reflects the live
+ * session.
+ */
+declare function createAuthClient<TRelations extends AnyRelations = EmptyRelations>(supabase: SupabaseClient, config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
+/** RLS client that runs every query as the `anon` role. */
+declare function createAnonClient<TRelations extends AnyRelations = EmptyRelations>(config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
+/**
+ * Client that runs every query as `service_role`, which bypasses RLS via
+ * Supabase's BYPASSRLS grant. Use for trusted server-side work.
+ */
+declare function createServiceClient<TRelations extends AnyRelations = EmptyRelations>(config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
+//#endregion
+export { createAdminClient as a, createServiceClient as c, SupabaseToken as i, createSupabaseClient as l, DrizzleClient as n, createAnonClient as o, ResolveDatabaseUrlOptions as r, createAuthClient as s, CreateClientConfig as t, resolveDatabaseUrl as u };

package/dist/clients-CdPr3mCZ.mjs

@@ -0,0 +1,197 @@
+import { sql } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+//#region src/rls-query-client.ts
+function replayAsUserChain(tx, path) {
+	let receiver = tx;
+	let current = tx;
+	for (const step of path) if (step.kind === "get") {
+		receiver = current;
+		current = current[step.prop];
+	} else current = current.apply(receiver, step.args);
+	return current;
+}
+const PROMISE_METHODS = /* @__PURE__ */ new Set([
+	"then",
+	"catch",
+	"finally"
+]);
+function replayPromiseMethod(prop, path, runTransaction) {
+	return (...promiseArgs) => {
+		const promise = runTransaction((tx) => replayAsUserChain(tx, path));
+		return promise[prop].apply(promise, promiseArgs);
+	};
+}
+function createRlsQueryClient(runTransaction, close) {
+	const build = (path, isRoot) => {
+		const target = () => void 0;
+		return new Proxy(target, {
+			apply(_target, _thisArg, args) {
+				if (isRoot) throw new Error("The createSupabaseDrizzle() client is queried directly (e.g. db.select().from(table)). Use db.transaction(cb) to run multiple statements in one RLS transaction.");
+				return build([...path, {
+					args,
+					kind: "apply"
+				}], false);
+			},
+			get(_target, prop) {
+				if (isRoot && prop === "transaction") return runTransaction;
+				if (isRoot && prop === "close") return close;
+				if (PROMISE_METHODS.has(prop)) return isRoot ? void 0 : replayPromiseMethod(prop, path, runTransaction);
+				if (typeof prop === "symbol") return;
+				return build([...path, {
+					kind: "get",
+					prop
+				}], false);
+			}
+		});
+	};
+	return build([], true);
+}
+//#endregion
+//#region src/clients.ts
+const ALLOWED_RLS_ROLES = /* @__PURE__ */ new Set(["anon", "authenticated"]);
+const POOLER_PORT = "6543";
+const LOCAL_HOSTS = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]",
+	"0.0.0.0"
+]);
+/**
+* The connection string every factory uses: `connectionString`, else
+* `SUPABASE_DATABASE_URL`. Throws when neither is set, and with
+* `requirePooler` also when the URL is not the transaction pooler. Read per
+* call, never at import, so a build without server secrets does not fail.
+* Errors never echo the URL, which carries the password.
+*/
+function resolveDatabaseUrl({ connectionString, requirePooler = false } = {}) {
+	const url = connectionString ?? process.env.SUPABASE_DATABASE_URL ?? "";
+	if (!url) throw new Error("Missing SUPABASE_DATABASE_URL environment variable");
+	if (!requirePooler) return url;
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error("SUPABASE_DATABASE_URL is not a valid URL");
+	}
+	if (parsed.protocol !== "postgresql:" && parsed.protocol !== "postgres:") throw new Error(`SUPABASE_DATABASE_URL must be a postgresql:// URL, got ${parsed.protocol}//`);
+	if (LOCAL_HOSTS.has(parsed.hostname)) throw new Error("SUPABASE_DATABASE_URL points at a local database, but the transaction pooler is required");
+	if (parsed.port !== POOLER_PORT) throw new Error(`SUPABASE_DATABASE_URL must use the transaction pooler (port ${POOLER_PORT}), got port ${parsed.port || "(default)"}. Session mode holds one connection per instance for its whole lifetime.`);
+	return url;
+}
+function clampClaims(token) {
+	const role = token.role && ALLOWED_RLS_ROLES.has(token.role) ? token.role : "anon";
+	return {
+		claims: JSON.stringify({
+			...token,
+			role
+		}),
+		role,
+		sub: token.sub ?? ""
+	};
+}
+function fixedContext(role) {
+	return {
+		claims: JSON.stringify({ role }),
+		role,
+		sub: ""
+	};
+}
+const poolCache = /* @__PURE__ */ new Map();
+function acquirePool(connectionString, kind) {
+	const key = `${kind} ${connectionString}`;
+	let entry = poolCache.get(key);
+	if (!entry) {
+		entry = {
+			client: postgres(connectionString, { prepare: false }),
+			ended: false,
+			key,
+			refCount: 0
+		};
+		poolCache.set(key, entry);
+	}
+	entry.refCount += 1;
+	return entry;
+}
+function makeClose(entry) {
+	let released = false;
+	return async (options) => {
+		if (released) return;
+		released = true;
+		entry.refCount -= 1;
+		if (entry.refCount <= 0 && !entry.ended) {
+			entry.ended = true;
+			if (poolCache.get(entry.key) === entry) poolCache.delete(entry.key);
+			await entry.client.end(options);
+		}
+	};
+}
+function buildDrizzle(kind, config) {
+	const { connectionString, requirePooler, ...drizzleConfig } = config ?? {};
+	const entry = acquirePool(resolveDatabaseUrl({
+		connectionString,
+		requirePooler
+	}), kind);
+	const db = drizzle({
+		client: entry.client,
+		...drizzleConfig
+	});
+	return {
+		close: makeClose(entry),
+		db
+	};
+}
+function buildRlsClient(resolveContext, config) {
+	const { close, db } = buildDrizzle("rls", config);
+	const runTransaction = async (transaction) => {
+		const { claims, role, sub } = await resolveContext();
+		return db.transaction(async (tx) => {
+			await tx.execute(sql`select set_config('request.jwt.claims', ${claims}, true), set_config('request.jwt.claim.sub', ${sub}, true)`);
+			await tx.execute(sql`set local role ${sql.raw(role)}`);
+			return transaction(tx);
+		});
+	};
+	return createRlsQueryClient(runTransaction, close);
+}
+/**
+* RLS-bypassing client (the docs' `admin`). Connects with
+* `SUPABASE_DATABASE_URL` and queries drizzle directly. Use for webhooks,
+* background jobs, and seeding, never for user-scoped reads/writes.
+*/
+function createAdminClient(config) {
+	const { close, db } = buildDrizzle("admin", config);
+	return Object.assign(db, { close });
+}
+/**
+* RLS client scoped to an already-verified, decoded token (e.g. from
+* `supabase.auth.getClaims()`). The role is clamped to the allowlist.
+*/
+function createSupabaseClient(accessToken, config) {
+	const context = clampClaims(accessToken);
+	return buildRlsClient(() => Promise.resolve(context), config);
+}
+/**
+* RLS client bound to a Supabase client. Verified claims are resolved via
+* `supabase.auth.getClaims()` on every query, so it always reflects the live
+* session.
+*/
+function createAuthClient(supabase, config) {
+	return buildRlsClient(async () => {
+		const { data, error } = await supabase.auth.getClaims();
+		if (error) throw error;
+		return clampClaims(data?.claims ?? {});
+	}, config);
+}
+/** RLS client that runs every query as the `anon` role. */
+function createAnonClient(config) {
+	return buildRlsClient(() => Promise.resolve(fixedContext("anon")), config);
+}
+/**
+* Client that runs every query as `service_role`, which bypasses RLS via
+* Supabase's BYPASSRLS grant. Use for trusted server-side work.
+*/
+function createServiceClient(config) {
+	return buildRlsClient(() => Promise.resolve(fixedContext("service_role")), config);
+}
+//#endregion
+export { createSupabaseClient as a, createServiceClient as i, createAnonClient as n, resolveDatabaseUrl as o, createAuthClient as r, createAdminClient as t };

package/dist/errors.d.mts

@@ -0,0 +1,70 @@
+import { PostgresError } from "postgres";
+//#region src/errors.d.ts
+/**
+ * SQLSTATE codes worth naming. The full list is Postgres's "Error Codes"
+ * appendix; these are the ones an application branches on.
+ */
+declare const SqlState: {
+  /** `check_violation`. */
+  readonly checkViolation: "23514";
+  /** `exclusion_violation`. */
+  readonly exclusionViolation: "23P01";
+  /** `foreign_key_violation`. */
+  readonly foreignKeyViolation: "23503";
+  /** `insufficient_privilege`: an RLS policy or a missing grant refused it. */
+  readonly insufficientPrivilege: "42501";
+  /**
+   * `invalid_column_reference`, which is what an `ON CONFLICT` target that no
+   * unique index can arbitrate raises. It is raised while the statement is
+   * planned, so it fires on the first insert, not on the first conflict.
+   */
+  readonly invalidColumnReference: "42P10";
+  /** `not_null_violation`. */
+  readonly notNullViolation: "23502";
+  /** `undefined_function`: a function missing, or called with the wrong signature. */
+  readonly undefinedFunction: "42883";
+  /** `unique_violation`. */
+  readonly uniqueViolation: "23505";
+};
+type SqlStateCode = (typeof SqlState)[keyof typeof SqlState];
+/**
+ * The postgres.js error underneath whatever Drizzle threw, or `undefined`.
+ *
+ * Drizzle wraps **every** driver error in a `DrizzleQueryError` whose own
+ * `code` is `undefined`, so `error.code === "23505"` is always false:
+ *
+ * ```
+ * depth 0: DrizzleQueryError  code=undefined  "Failed query: insert into …"
+ * depth 1: PostgresError      code=23505      "duplicate key value violates …"
+ * ```
+ *
+ * Matched by `name` rather than `instanceof`, so a second copy of `postgres`
+ * in the tree cannot make it miss.
+ */
+declare const toPostgresError: (error: unknown) => PostgresError | undefined;
+type ConstraintViolationOptions = {
+  /**
+   * The SQLSTATE to require, e.g. `SqlState.uniqueViolation`. Defaults to any
+   * code in class 23 (`integrity_constraint_violation`).
+   */
+  code?: string;
+};
+/**
+ * Whether `error` is an integrity-constraint violation, optionally one of the
+ * named constraints. Returns the `PostgresError` so a caller can read its
+ * `constraint_name` or `detail`, or `undefined` when it does not match.
+ *
+ * ```ts
+ * try {
+ *   await db.insert(contacts).values(row)
+ * } catch (error) {
+ *   if (isConstraintViolation(error, ["contacts_email_key"], { code: SqlState.uniqueViolation })) {
+ *     return { error: "That email is already a contact" }
+ *   }
+ *   throw error
+ * }
+ * ```
+ */
+declare const isConstraintViolation: (error: unknown, constraints?: Iterable<string>, { code }?: ConstraintViolationOptions) => PostgresError | undefined;
+//#endregion
+export { ConstraintViolationOptions, SqlState, SqlStateCode, isConstraintViolation, toPostgresError };

package/dist/errors.mjs

@@ -0,0 +1,78 @@
+//#region src/errors.ts
+/**
+* SQLSTATE codes worth naming. The full list is Postgres's "Error Codes"
+* appendix; these are the ones an application branches on.
+*/
+const SqlState = {
+	/** `check_violation`. */
+	checkViolation: "23514",
+	/** `exclusion_violation`. */
+	exclusionViolation: "23P01",
+	/** `foreign_key_violation`. */
+	foreignKeyViolation: "23503",
+	/** `insufficient_privilege`: an RLS policy or a missing grant refused it. */
+	insufficientPrivilege: "42501",
+	/**
+	* `invalid_column_reference`, which is what an `ON CONFLICT` target that no
+	* unique index can arbitrate raises. It is raised while the statement is
+	* planned, so it fires on the first insert, not on the first conflict.
+	*/
+	invalidColumnReference: "42P10",
+	/** `not_null_violation`. */
+	notNullViolation: "23502",
+	/** `undefined_function`: a function missing, or called with the wrong signature. */
+	undefinedFunction: "42883",
+	/** `unique_violation`. */
+	uniqueViolation: "23505"
+};
+/** SQLSTATE class 23, every `integrity_constraint_violation`. */
+const INTEGRITY_CONSTRAINT_CLASS = "23";
+const MAX_CAUSE_DEPTH = 5;
+/**
+* The postgres.js error underneath whatever Drizzle threw, or `undefined`.
+*
+* Drizzle wraps **every** driver error in a `DrizzleQueryError` whose own
+* `code` is `undefined`, so `error.code === "23505"` is always false:
+*
+* ```
+* depth 0: DrizzleQueryError  code=undefined  "Failed query: insert into …"
+* depth 1: PostgresError      code=23505      "duplicate key value violates …"
+* ```
+*
+* Matched by `name` rather than `instanceof`, so a second copy of `postgres`
+* in the tree cannot make it miss.
+*/
+const toPostgresError = (error) => {
+	let current = error;
+	for (let depth = 0; current instanceof Error && depth < MAX_CAUSE_DEPTH; depth += 1) {
+		if (current.name === "PostgresError") return current;
+		current = current.cause;
+	}
+};
+/**
+* Whether `error` is an integrity-constraint violation, optionally one of the
+* named constraints. Returns the `PostgresError` so a caller can read its
+* `constraint_name` or `detail`, or `undefined` when it does not match.
+*
+* ```ts
+* try {
+*   await db.insert(contacts).values(row)
+* } catch (error) {
+*   if (isConstraintViolation(error, ["contacts_email_key"], { code: SqlState.uniqueViolation })) {
+*     return { error: "That email is already a contact" }
+*   }
+*   throw error
+* }
+* ```
+*/
+const isConstraintViolation = (error, constraints, { code } = {}) => {
+	const postgresError = toPostgresError(error);
+	if (!postgresError) return;
+	if (!(code ? postgresError.code === code : postgresError.code.startsWith(INTEGRITY_CONSTRAINT_CLASS))) return;
+	if (constraints === void 0) return postgresError;
+	const name = postgresError.constraint_name;
+	if (name === void 0) return;
+	for (const constraint of constraints) if (constraint === name) return postgresError;
+};
+//#endregion
+export { SqlState, isConstraintViolation, toPostgresError };

package/dist/function-names-BDc-AuFm.mjs

@@ -0,0 +1,10 @@
+//#region src/function-names.ts
+const FUNCTION_POLICY_OPERATIONS = [
+	"select",
+	"insert",
+	"update",
+	"delete"
+];
+const functionPolicyName = (prefix, operation, tableName) => `${prefix}_${operation}_${tableName}`;
+//#endregion
+export { functionPolicyName as n, FUNCTION_POLICY_OPERATIONS as t };

package/dist/function-names-hv2mj_x1.d.mts

@@ -0,0 +1,5 @@
+//#region src/function-names.d.ts
+declare const FUNCTION_POLICY_OPERATIONS: readonly ["select", "insert", "update", "delete"];
+type FunctionPolicyOperation = (typeof FUNCTION_POLICY_OPERATIONS)[number];
+//#endregion
+export { FunctionPolicyOperation as t };

package/dist/index.d.mts

@@ -1,42 +1,2 @@
-import { AnyRelations, EmptyRelations } from "drizzle-orm";
-import { DrizzlePgConfig } from "drizzle-orm/pg-core";
-import { PostgresJsDatabase } from "drizzle-orm/postgres-js";
-import { JwtPayload, SupabaseClient } from "@supabase/supabase-js";
-//#region src/clients.d.ts
-type CloseFn = (options?: {
-  timeout?: number;
-}) => Promise<void>;
-type CreateClientConfig<TRelations extends AnyRelations = EmptyRelations> = DrizzlePgConfig<TRelations> & {
-  /** Overrides `process.env.SUPABASE_DATABASE_URL`. */
-  connectionString?: string;
-};
-type DrizzleClient<TRelations extends AnyRelations = EmptyRelations> = PostgresJsDatabase<TRelations> & {
-  close: CloseFn;
-};
-type SupabaseToken = Pick<JwtPayload, "role" | "sub">;
-/**
- * RLS-bypassing client (the docs' `admin`). Connects with
- * `SUPABASE_DATABASE_URL` and queries drizzle directly. Use for webhooks,
- * background jobs, and seeding, never for user-scoped reads/writes.
- */
-declare function createAdminClient<TRelations extends AnyRelations = EmptyRelations>(config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
-/**
- * RLS client scoped to an already-verified, decoded token (e.g. from
- * `supabase.auth.getClaims()`). The role is clamped to the allowlist.
- */
-declare function createSupabaseClient<TRelations extends AnyRelations = EmptyRelations>(accessToken: SupabaseToken, config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
-/**
- * RLS client bound to a Supabase client. Verified claims are resolved via
- * `supabase.auth.getClaims()` on every query, so it always reflects the live
- * session.
- */
-declare function createAuthClient<TRelations extends AnyRelations = EmptyRelations>(supabase: SupabaseClient, config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
-/** RLS client that runs every query as the `anon` role. */
-declare function createAnonClient<TRelations extends AnyRelations = EmptyRelations>(config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
-/**
- * Client that runs every query as `service_role`, which bypasses RLS via
- * Supabase's BYPASSRLS grant. Use for trusted server-side work.
- */
-declare function createServiceClient<TRelations extends AnyRelations = EmptyRelations>(config?: CreateClientConfig<TRelations>): DrizzleClient<TRelations>;
-//#endregion
-export { type CreateClientConfig, type DrizzleClient, type SupabaseToken, createAdminClient, createAnonClient, createAuthClient, createServiceClient, createSupabaseClient };
+import { a as createAdminClient, c as createServiceClient, i as SupabaseToken, l as createSupabaseClient, n as DrizzleClient, o as createAnonClient, r as ResolveDatabaseUrlOptions, s as createAuthClient, t as CreateClientConfig, u as resolveDatabaseUrl } from "./clients-BlUEH7QJ.mjs";
+export { type CreateClientConfig, type DrizzleClient, type ResolveDatabaseUrlOptions, type SupabaseToken, createAdminClient, createAnonClient, createAuthClient, createServiceClient, createSupabaseClient, resolveDatabaseUrl };

package/dist/index.mjs

@@ -1,167 +1,2 @@
-import { sql } from "drizzle-orm";
-import { drizzle } from "drizzle-orm/postgres-js";
-import postgres from "postgres";
-//#region src/rls-query-client.ts
-function replayAsUserChain(tx, path) {
-	let receiver = tx;
-	let current = tx;
-	for (const step of path) if (step.kind === "get") {
-		receiver = current;
-		current = current[step.prop];
-	} else current = current.apply(receiver, step.args);
-	return current;
-}
-const PROMISE_METHODS = /* @__PURE__ */ new Set([
-	"then",
-	"catch",
-	"finally"
-]);
-function replayPromiseMethod(prop, path, runTransaction) {
-	return (...promiseArgs) => {
-		const promise = runTransaction((tx) => replayAsUserChain(tx, path));
-		return promise[prop].apply(promise, promiseArgs);
-	};
-}
-function createRlsQueryClient(runTransaction, close) {
-	const build = (path, isRoot) => {
-		const target = () => void 0;
-		return new Proxy(target, {
-			apply(_target, _thisArg, args) {
-				if (isRoot) throw new Error("The createSupabaseDrizzle() client is queried directly (e.g. db.select().from(table)). Use db.transaction(cb) to run multiple statements in one RLS transaction.");
-				return build([...path, {
-					args,
-					kind: "apply"
-				}], false);
-			},
-			get(_target, prop) {
-				if (isRoot && prop === "transaction") return runTransaction;
-				if (isRoot && prop === "close") return close;
-				if (PROMISE_METHODS.has(prop)) return isRoot ? void 0 : replayPromiseMethod(prop, path, runTransaction);
-				if (typeof prop === "symbol") return;
-				return build([...path, {
-					kind: "get",
-					prop
-				}], false);
-			}
-		});
-	};
-	return build([], true);
-}
-//#endregion
-//#region src/clients.ts
-const ALLOWED_RLS_ROLES = /* @__PURE__ */ new Set(["anon", "authenticated"]);
-function clampClaims(token) {
-	const role = token.role && ALLOWED_RLS_ROLES.has(token.role) ? token.role : "anon";
-	return {
-		claims: JSON.stringify({
-			...token,
-			role
-		}),
-		role,
-		sub: token.sub ?? ""
-	};
-}
-function fixedContext(role) {
-	return {
-		claims: JSON.stringify({ role }),
-		role,
-		sub: ""
-	};
-}
-const poolCache = /* @__PURE__ */ new Map();
-function acquirePool(connectionString, kind) {
-	const key = `${kind} ${connectionString}`;
-	let entry = poolCache.get(key);
-	if (!entry) {
-		entry = {
-			client: postgres(connectionString, { prepare: false }),
-			ended: false,
-			key,
-			refCount: 0
-		};
-		poolCache.set(key, entry);
-	}
-	entry.refCount += 1;
-	return entry;
-}
-function makeClose(entry) {
-	let released = false;
-	return async (options) => {
-		if (released) return;
-		released = true;
-		entry.refCount -= 1;
-		if (entry.refCount <= 0 && !entry.ended) {
-			entry.ended = true;
-			if (poolCache.get(entry.key) === entry) poolCache.delete(entry.key);
-			await entry.client.end(options);
-		}
-	};
-}
-function buildDrizzle(kind, config) {
-	const { connectionString, ...drizzleConfig } = config ?? {};
-	const url = connectionString ?? process.env.SUPABASE_DATABASE_URL ?? "";
-	if (!url) throw new Error("Missing SUPABASE_DATABASE_URL environment variable");
-	const entry = acquirePool(url, kind);
-	const db = drizzle({
-		client: entry.client,
-		...drizzleConfig
-	});
-	return {
-		close: makeClose(entry),
-		db
-	};
-}
-function buildRlsClient(resolveContext, config) {
-	const { close, db } = buildDrizzle("rls", config);
-	const runTransaction = async (transaction) => {
-		const { claims, role, sub } = await resolveContext();
-		return db.transaction(async (tx) => {
-			await tx.execute(sql`select set_config('request.jwt.claims', ${claims}, true), set_config('request.jwt.claim.sub', ${sub}, true)`);
-			await tx.execute(sql`set local role ${sql.raw(role)}`);
-			return transaction(tx);
-		});
-	};
-	return createRlsQueryClient(runTransaction, close);
-}
-/**
-* RLS-bypassing client (the docs' `admin`). Connects with
-* `SUPABASE_DATABASE_URL` and queries drizzle directly. Use for webhooks,
-* background jobs, and seeding, never for user-scoped reads/writes.
-*/
-function createAdminClient(config) {
-	const { close, db } = buildDrizzle("admin", config);
-	return Object.assign(db, { close });
-}
-/**
-* RLS client scoped to an already-verified, decoded token (e.g. from
-* `supabase.auth.getClaims()`). The role is clamped to the allowlist.
-*/
-function createSupabaseClient(accessToken, config) {
-	const context = clampClaims(accessToken);
-	return buildRlsClient(() => Promise.resolve(context), config);
-}
-/**
-* RLS client bound to a Supabase client. Verified claims are resolved via
-* `supabase.auth.getClaims()` on every query, so it always reflects the live
-* session.
-*/
-function createAuthClient(supabase, config) {
-	return buildRlsClient(async () => {
-		const { data, error } = await supabase.auth.getClaims();
-		if (error) throw error;
-		return clampClaims(data?.claims ?? {});
-	}, config);
-}
-/** RLS client that runs every query as the `anon` role. */
-function createAnonClient(config) {
-	return buildRlsClient(() => Promise.resolve(fixedContext("anon")), config);
-}
-/**
-* Client that runs every query as `service_role`, which bypasses RLS via
-* Supabase's BYPASSRLS grant. Use for trusted server-side work.
-*/
-function createServiceClient(config) {
-	return buildRlsClient(() => Promise.resolve(fixedContext("service_role")), config);
-}
-//#endregion
-export { createAdminClient, createAnonClient, createAuthClient, createServiceClient, createSupabaseClient };
+import { a as createSupabaseClient, i as createServiceClient, n as createAnonClient, o as resolveDatabaseUrl, r as createAuthClient, t as createAdminClient } from "./clients-CdPr3mCZ.mjs";
+export { createAdminClient, createAnonClient, createAuthClient, createServiceClient, createSupabaseClient, resolveDatabaseUrl };