better-supabase 0.0.0 → 0.1.0

package/dist/next/index.d.ts

@@ -0,0 +1,210 @@
+import { n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
+import { p as DbError } from "../result-CTkCZ6JA.js";
+import { B as ReadSet, P as DbStats, Z as QuerySpec, l as CacheAdapter, t as BetterSupabase } from "../define-CTfWw-SS.js";
+import { n as AmrEntry, s as Impersonator, t as Aal } from "../mfa-TVia554c.js";
+import { r as AuthState } from "../resolve-DW8h9NPm.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions, t as AuthKind } from "../respond-PoTpy5DT.js";
+import { n as toSession, t as AuthSession } from "../view-B0ltUmTi.js";
+import { r as LiveCountSeed, t as CountRunner } from "../live-6b9i72Ux.js";
+import { n as hasEntitlement, t as EntitlementKey } from "../entitlements-BBg61DQZ.js";
+import { NextRequest } from "next/server.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/next/collector.d.ts
+/** Forwarded by the proxy so every scope of one render shares an id. */
+export declare const REQUEST_ID_HEADER = "x-bs-request-id";
+interface DbBudget {
+  readonly calls?: number;
+  readonly waves?: number;
+}
+//#endregion
+//#region src/next/index.d.ts
+export interface NextOptions extends ServerOptions {
+  /** Invalidate `tagFor(table)` cache tags after mutations. Defaults to true. */
+  readonly cacheTags?: boolean;
+  /** Include internal error messages in Problem Details. Defaults to development only. */
+  readonly exposeErrors?: boolean;
+  /** Per-request database call counts. See the Budget docs. */
+  readonly debug?: NextDebugOptions;
+}
+export interface NextDebugOptions {
+  /** Collect outside development too, e.g. for e2e runs against `next start`. */
+  readonly enabled?: boolean;
+  /** Header with `calls;waves;ms` on route handler responses. Defaults to `x-bs-db-calls`. */
+  readonly header?: string;
+  /** Warns in development when one render goes over it. */
+  readonly budget?: DbBudget;
+  /** Where `next.debugRoute()` is mounted. Defaults to `/api/bs-stats`. */
+  readonly route?: string;
+}
+/** Response header with the URL of the request's totals on `next.debugRoute()`. */
+export declare const STATS_URL_HEADER = "x-bs-stats";
+export interface ProxyOptions<C = unknown> {
+  /**
+   * Another middleware to compose with, such as next-intl's. It runs on the
+   * original request, alongside auth; its rewrite, redirect or request
+   * headers are kept, and refreshed cookies are merged into its response.
+   */
+  readonly before?: (request: NextRequest) => Response | undefined | Promise<Response | undefined>;
+  /** Answer before rendering, e.g. redirect signed-out users. Refreshed cookies are kept. */
+  readonly protect?: (auth: AuthState<C>, request: NextRequest) => Response | undefined | Promise<Response | undefined>;
+  /** Post-processes the final response; return a new one to replace it. */
+  readonly after?: (response: Response, auth: AuthState<C>) => Response | undefined | void | Promise<Response | undefined | void>;
+  /**
+   * Adds `Server-Timing: bs-proxy;dur=..., bs-verify;dur=...` (ms): the whole
+   * proxy, and resolving the session (a local verify, or a refresh).
+   */
+  readonly serverTiming?: boolean;
+}
+export type ActionResult<T> = {
+  readonly ok: true;
+  readonly data: T;
+  readonly error: null;
+} | {
+  readonly ok: false;
+  readonly data: null;
+  readonly error: DbError;
+};
+export interface ActionOptions<S extends StandardSchemaV1 | undefined> extends GuardOptions {
+  /** Validates the input (plain object or `FormData`) with any Standard Schema. */
+  readonly input?: S;
+}
+type ActionInput<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferInput<S> | FormData : unknown;
+type ActionParsed<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferOutput<S> : unknown;
+type Unwrapped<T> = T extends {
+  readonly ok: true;
+  readonly data: infer D;
+} | {
+  readonly ok: false;
+} ? D : T;
+export interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown> extends BetterServer<M, F, E, C> {
+  /** `proxy.ts`: refreshes sessions for page loads and server actions. */
+  proxy(request: NextRequest, options?: ProxyOptions<C>): Promise<Response>;
+  /** Server Components and actions: the caller's context, memoized per request. */
+  server(): Promise<ServerContext<M, F, E, C>>;
+  /**
+   * The verified caller as serializable data (no token, no clients), memoized
+   * per request. Wrap it in a `'use cache: private'` function with Cache
+   * Components and pass the promise to `<SessionProvider>`.
+   */
+  session(): Promise<AuthSession<C>>;
+  /**
+   * The context for a session and its token, without reading the request.
+   * The token is verified again (memoized, no network call); a token for
+   * another user than `session` gives an `invalid` context.
+   */
+  serverFor(session: AuthSession<C>, options: {
+    readonly token: string | null;
+  }): Promise<ServerContext<M, F, E, C>>;
+  /**
+   * First statement of an app-authored `'use cache: private'` function: sets
+   * `cacheLife` from the session's expiry (`sessionStale`), tags the entry
+   * `bs:session:<user id>` and returns the caller's context plus `session`.
+   *
+   * ```ts
+   * async function getCustomers() {
+   *   'use cache: private';
+   *   const { db } = await next.cached();
+   *   return db.customers.findMany().orThrow();
+   * }
+   * ```
+   */
+  cached(options?: CachedOptions): Promise<CachedContext<M, F, E, C>>;
+  /** Drops every `next.cached()` entry of a user, e.g. after a role change. */
+  invalidateSession(userId: string): void;
+  /**
+   * Counts on the server and returns a serializable seed for
+   * `useLiveCount(seed)`, so the badge renders with a number and the client
+   * only refetches on changes. Pass `db` inside `'use cache: private'`
+   * (from `next.cached()`); otherwise it uses `next.server()`. A failed
+   * count gives `count: null` instead of throwing.
+   */
+  liveCount<T extends Extract<keyof M, string>>(spec: QuerySpec<T, "count", number>, db?: CountRunner): Promise<LiveCountSeed<T>>;
+  /** Route handler with auth, Result unwrapping and Problem Details errors. */
+  route<P = Record<string, string | string[]>>(handler: (request: NextRequest, ctx: ServerContext<M, F, E, C> & {
+    readonly params: P;
+  }) => unknown, options?: GuardOptions): (request: NextRequest, segment: {
+    readonly params: Promise<P>;
+  }) => Promise<Response>;
+  /** Server action returning a serializable `ActionResult`. */
+  action<S extends StandardSchemaV1 | undefined, T>(options: ActionOptions<S>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+  /** Tags the current `"use cache"` scope with a table (and row) tag. */
+  cacheTag(table: Extract<keyof M, string>, id?: string | number): void;
+  /**
+   * Tags the current `"use cache"` scope with every table the specs (or a
+   * read set) read, plus the row of each `findById`, so any mutation that
+   * changes one revalidates it.
+   */
+  cacheTags(target: QuerySpec<Extract<keyof M, string>> | readonly QuerySpec<Extract<keyof M, string>>[] | ReadSet): void;
+  /**
+   * GET handler serving a request's database totals (`?id=<request id>`) for
+   * `expectDbBudget`. Answers 404 unless `debug` is on.
+   */
+  debugRoute(): (request: Request) => Promise<Response>;
+}
+export interface SessionStaleOptions {
+  /** Below this, the result would not be prefetched anyway. Defaults to 30. */
+  readonly min?: number;
+  /** 300 (5 minutes) joins the route's App Shell. Defaults to 300. */
+  readonly max?: number;
+}
+/**
+ * `cacheLife` `stale` seconds for a view of `session`: `max`, but never past
+ * the token's expiry, and at least `min`.
+ */
+export declare function sessionStale(session: AuthSession, options?: SessionStaleOptions, now?: number): number;
+export interface CachedOptions {
+  /** `cacheLife` for the entry. `stale` comes from `sessionStale`. */
+  readonly life?: SessionStaleOptions & {
+    readonly revalidate?: number;
+    readonly expire?: number;
+  };
+}
+export type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown> = ServerContext<M, F, E, C> & {
+  readonly session: AuthSession<C>;
+};
+/** The tag `next.cached()` puts on a user's entries. */
+export declare function sessionTag(userId: string): string;
+/** `bs:<table>` or `bs:<table>:<id>`. Mutations invalidate both. */
+export declare function tagFor(table: string, id?: string | number): string;
+/**
+ * Invalidates `bs:<table>` for every table in the target and
+ * `bs:<table>:<id>` for the changed rows. `createNext` attaches it unless
+ * `cacheTags: false`.
+ */
+export declare function nextCache(): CacheAdapter;
+export interface RequireAalOptions {
+  /**
+   * Page that enrolls or challenges a second factor. Signed-in users below
+   * the level are redirected there with `?next=<path>`; without it they get
+   * a 403 Problem Details response.
+   */
+  readonly redirect?: string;
+  /** Paths that need the level. Defaults to every path but `redirect`. */
+  readonly match?: (pathname: string) => boolean;
+}
+/**
+ * A `proxy` `protect` that keeps signed-in users below `level` out of the
+ * matched paths. The JWT carries no factor list, so this also sends users
+ * without a factor to `redirect` to enroll one. Anonymous callers pass;
+ * combine it with your sign-in redirect.
+ *
+ * ```ts
+ * next.proxy(request, {
+ *   protect: requireAal('aal2', { redirect: '/mfa', match: (path) => path.startsWith('/settings') }),
+ * });
+ * ```
+ */
+export declare function requireAal(level: Aal, options?: RequireAalOptions): (auth: AuthState, request: NextRequest) => Response | undefined;
+/** Page loads, client navigations and server actions; never prefetches or assets. */
+export declare function shouldRefresh(request: Request): boolean;
+/**
+ * The Next.js adapter: proxy, Server Components, route handlers, server
+ * actions and cache tags, on top of `createServer`.
+ *
+ * ```ts
+ * export const next = createNext(sb);
+ * ```
+ */
+export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown>(sb: BetterSupabase<M, D, F, E, C>, options?: NextOptions): BetterNext<M, F, E, C>;
+//#endregion
+export { type Aal, type AmrEntry, type AuthKind, type AuthSession, type DbBudget, type DbStats, type EntitlementKey, type GuardOptions, type Impersonator, hasEntitlement, toSession };

package/dist/next/index.js

@@ -0,0 +1,426 @@
+import { n as dbError } from "../errors-Bl3rkOzo.js";
+import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-3iy8u3_P.js";
+import { o as isReadSet } from "../read-set-DhX2d04c.js";
+import { t as validate } from "../standard-FUi3Z3-7.js";
+import { a as problemResponse } from "../problem-DPu6Fh-t.js";
+import { t as hasEntitlement } from "../entitlements-BC_khwRy.js";
+import { a as settle, c as withExtra, d as primaryCookie, i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose, u as PRIMARY_COOKIE } from "../respond-4-dhoV7x.js";
+import { r as checkAal } from "../mfa-CpogP66z.js";
+import { t as toSession } from "../view-B6F9QbG-.js";
+import { cache } from "react";
+import { cacheLife, cacheTag, revalidateTag, updateTag } from "next/cache.js";
+import { cookies, headers } from "next/headers.js";
+import { NextResponse } from "next/server.js";
+//#region src/next/collector.ts
+/** Forwarded by the proxy so every scope of one render shares an id. */
+const REQUEST_ID_HEADER = "x-bs-request-id";
+var CollectedRecorder = class extends StatsRecorder {
+	#onIdle;
+	constructor(onIdle) {
+		super();
+		this.#onIdle = onIdle;
+	}
+	begin(table) {
+		const end = super.begin(table);
+		return () => {
+			end();
+			this.#onIdle();
+		};
+	}
+};
+/** Request totals keyed by request id, bounded by age and count. */
+var StatsCollector = class {
+	#entries = /* @__PURE__ */ new Map();
+	#options;
+	constructor(options) {
+		this.#options = options;
+	}
+	/** The recorder for a request id, created on first use. */
+	recorderFor(id) {
+		const existing = this.#entries.get(id);
+		if (existing) return existing.recorder;
+		this.#prune();
+		const entry = {
+			created: Date.now(),
+			recorder: new CollectedRecorder(() => this.#schedule(id))
+		};
+		this.#entries.set(id, entry);
+		return entry.recorder;
+	}
+	get(id) {
+		return this.#entries.get(id)?.recorder.snapshot();
+	}
+	#schedule(id) {
+		const { budget, warn } = this.#options;
+		const entry = this.#entries.get(id);
+		if (!entry || !warn || !budget) return;
+		if (entry.timer) clearTimeout(entry.timer);
+		entry.timer = setTimeout(() => {
+			entry.timer = void 0;
+			const stats = entry.recorder.snapshot();
+			if (!overBudget(stats, budget)) return;
+			this.#options.logger.warn(`request ${id} made ${stats.calls} database calls in ${stats.waves} waves, over the budget of ${describeBudget(budget)}`, {
+				requestId: id,
+				...stats
+			});
+		}, this.#options.idleMs ?? 250);
+	}
+	#prune() {
+		const cutoff = Date.now() - (this.#options.ttlMs ?? 6e4);
+		const max = this.#options.maxEntries ?? 500;
+		for (const [id, entry] of this.#entries) {
+			if (entry.created >= cutoff && this.#entries.size < max) break;
+			if (entry.timer) clearTimeout(entry.timer);
+			this.#entries.delete(id);
+		}
+	}
+};
+const SHARED = Symbol.for("better-supabase.next.stats-collector");
+/**
+* One collector per process. Next.js can load the proxy, pages and route
+* handlers as separate module instances, and they must see the same totals.
+*/
+function sharedCollector(options) {
+	const scope = globalThis;
+	scope[SHARED] ??= new StatsCollector(options);
+	return scope[SHARED];
+}
+function overBudget(stats, budget) {
+	return budget.calls !== void 0 && stats.calls > budget.calls || budget.waves !== void 0 && stats.waves > budget.waves;
+}
+function describeBudget(budget) {
+	return [budget.calls === void 0 ? void 0 : `${budget.calls} calls`, budget.waves === void 0 ? void 0 : `${budget.waves} waves`].filter(Boolean).join(" and ");
+}
+/** `calls;waves;ms`, the value of the debug header. */
+function formatStats(stats) {
+	return `${stats.calls};${stats.waves};${stats.ms}`;
+}
+//#endregion
+//#region src/next/proxy.ts
+const OVERRIDE = "x-middleware-override-headers";
+const REQUEST_PREFIX = "x-middleware-request-";
+/** A response whose headers can be changed (`Response.redirect()`'s cannot). */
+function mutableResponse(response) {
+	try {
+		response.headers.append("x-bs-probe", "1");
+		response.headers.delete("x-bs-probe");
+		return response;
+	} catch {
+		return new NextResponse(response.body, {
+			status: response.status,
+			statusText: response.statusText,
+			headers: new Headers(response.headers)
+		});
+	}
+}
+const isRedirect = (response) => response.status >= 300 && response.status < 400 && response.headers.has("location");
+/**
+* Sets request headers the rest of the request sees, the way
+* `NextResponse.next({ request: { headers } })` does, on a response that may
+* already override some (next-intl sets its locale this way). Next.js keeps
+* only the headers listed in `x-middleware-override-headers`, so the full set
+* is written back.
+*/
+function overrideRequestHeaders(response, request, set) {
+	const listed = response.headers.get(OVERRIDE);
+	const current = new Headers();
+	if (listed === null) for (const [name, value] of request.headers) current.set(name, value);
+	else for (const name of listed.split(",")) {
+		const value = response.headers.get(`${REQUEST_PREFIX}${name.trim()}`);
+		if (name.trim() && value !== null) current.set(name.trim(), value);
+	}
+	for (const [name, value] of Object.entries(set)) current.set(name, value);
+	for (const name of [...response.headers.keys()]) if (name.startsWith(REQUEST_PREFIX)) response.headers.delete(name);
+	response.headers.set(OVERRIDE, [...current.keys()].join(","));
+	for (const [name, value] of current) response.headers.set(`${REQUEST_PREFIX}${name}`, value);
+}
+/** `bs-proxy;dur=1.2, bs-verify;dur=0.4`, per W3C Server Timing. */
+function serverTimingValue(metrics) {
+	return Object.entries(metrics).map(([name, ms]) => `${name};dur=${ms.toFixed(1)}`).join(", ");
+}
+//#endregion
+//#region src/next/index.ts
+/** Response header with the URL of the request's totals on `next.debugRoute()`. */
+const STATS_URL_HEADER = "x-bs-stats";
+/**
+* `cacheLife` `stale` seconds for a view of `session`: `max`, but never past
+* the token's expiry, and at least `min`.
+*/
+function sessionStale(session, options = {}, now = Date.now()) {
+	const min = options.min ?? 30;
+	const max = options.max ?? 300;
+	if (session.kind !== "user" || session.expiresAt === null) return max;
+	const remaining = session.expiresAt - Math.floor(now / 1e3);
+	return Math.min(max, Math.max(min, remaining));
+}
+/** The tag `next.cached()` puts on a user's entries. */
+function sessionTag(userId) {
+	return `bs:session:${userId}`;
+}
+/** `bs:<table>` or `bs:<table>:<id>`. Mutations invalidate both. */
+function tagFor(table, id) {
+	return id === void 0 ? `bs:${table}` : `bs:${table}:${String(id)}`;
+}
+function invalidate(tag) {
+	try {
+		updateTag(tag);
+	} catch {
+		try {
+			revalidateTag(tag, "max");
+		} catch {}
+	}
+}
+/**
+* Invalidates `bs:<table>` for every table in the target and
+* `bs:<table>:<id>` for the changed rows. `createNext` attaches it unless
+* `cacheTags: false`.
+*/
+function nextCache() {
+	return {
+		name: "next",
+		invalidate: (target) => {
+			for (const table of target.tables) invalidate(tagFor(table));
+			for (const id of target.ids) invalidate(tagFor(target.table, id));
+		}
+	};
+}
+function formDataObject(form) {
+	const out = {};
+	for (const key of new Set(form.keys())) {
+		const values = form.getAll(key);
+		out[key] = values.length > 1 ? values : values[0];
+	}
+	return out;
+}
+/**
+* A `proxy` `protect` that keeps signed-in users below `level` out of the
+* matched paths. The JWT carries no factor list, so this also sends users
+* without a factor to `redirect` to enroll one. Anonymous callers pass;
+* combine it with your sign-in redirect.
+*
+* ```ts
+* next.proxy(request, {
+*   protect: requireAal('aal2', { redirect: '/mfa', match: (path) => path.startsWith('/settings') }),
+* });
+* ```
+*/
+function requireAal(level, options = {}) {
+	return (auth, request) => {
+		const { pathname, search } = request.nextUrl;
+		if (options.redirect !== void 0 && pathname === options.redirect) return void 0;
+		if (options.match && !options.match(pathname)) return void 0;
+		const denied = checkAal(auth, level);
+		if (!denied) return void 0;
+		if (options.redirect === void 0) return problemResponse(denied);
+		const target = new URL(options.redirect, request.url);
+		target.searchParams.set("next", `${pathname}${search}`);
+		return NextResponse.redirect(target);
+	};
+}
+/** Page loads, client navigations and server actions; never prefetches or assets. */
+function shouldRefresh(request) {
+	const h = request.headers;
+	if (request.method !== "GET" && request.method !== "HEAD") return h.has("next-action");
+	if (h.has("next-router-prefetch") || h.get("purpose") === "prefetch" || h.get("sec-purpose")?.includes("prefetch")) return false;
+	if (h.get("rsc") === "1") return true;
+	const dest = h.get("sec-fetch-dest");
+	if (dest) return dest === "document";
+	return h.get("accept")?.includes("text/html") ?? false;
+}
+/**
+* The Next.js adapter: proxy, Server Components, route handlers, server
+* actions and cache tags, on top of `createServer`.
+*
+* ```ts
+* export const next = createNext(sb);
+* ```
+*/
+function createNext(sb, options = {}) {
+	const base = createServer(sb, options);
+	const pinMs = options.replicas?.pinMs ?? 5e3;
+	const expose = options.exposeErrors ?? defaultExpose();
+	if (options.cacheTags !== false) sb.cache(nextCache());
+	const debug = options.debug;
+	const statsHeader = debug?.header ?? "x-bs-db-calls";
+	const statsRoute = debug?.route ?? "/api/bs-stats";
+	const development = typeof process !== "undefined" && process.env["NODE_ENV"] === "development";
+	const collector = debug && (debug.enabled ?? development) ? sharedCollector({
+		logger: sb.events.logger,
+		warn: development,
+		...debug.budget ? { budget: debug.budget } : {}
+	}) : void 0;
+	const statsFor = (request) => {
+		const id = collector && request.headers.get("x-bs-request-id");
+		return id ? { stats: collector.recorderFor(id) } : {};
+	};
+	const incomingRequest = async () => new Request("http://next.local/", { headers: new Headers(await headers()) });
+	const server = cache(async () => {
+		const request = await incomingRequest();
+		return base.context(request, statsFor(request));
+	});
+	const session = cache(async () => {
+		const resolution = await base.resolve(await incomingRequest(), { refresh: false });
+		return toSession(resolution.auth);
+	});
+	const serverFor = async (view, { token }) => {
+		const request = new Request("http://next.local/", { headers: token ? { authorization: `Bearer ${token}` } : {} });
+		const ctx = await base.context(request);
+		if (ctx.auth.kind === "user" ? view.kind === "user" && view.user.id === ctx.auth.user.id : view.kind !== "user") return ctx;
+		return base.contextFor({
+			kind: "invalid",
+			reason: "token",
+			error: dbError("unauthorized", "The token does not belong to the session passed to serverFor()")
+		});
+	};
+	const withAccounts = withExtra(base, { deleteAccount: ((userId, deleteOptions) => base.deleteAccount(userId, deleteOptions).map((result) => {
+		invalidate(sessionTag(userId));
+		return result;
+	})) });
+	return extendServer(withAccounts, {
+		server,
+		session,
+		serverFor,
+		async cached(cachedOptions = {}) {
+			const [view, ctx] = await Promise.all([session(), server()]);
+			const life = cachedOptions.life;
+			cacheLife({
+				stale: sessionStale(view, life),
+				...life?.revalidate === void 0 ? {} : { revalidate: life.revalidate },
+				...life?.expire === void 0 ? {} : { expire: life.expire }
+			});
+			if (view.kind === "user") cacheTag(sessionTag(view.user.id));
+			return withExtra(ctx, { session: view });
+		},
+		invalidateSession(userId) {
+			invalidate(sessionTag(userId));
+		},
+		async liveCount(spec, db) {
+			const result = await (db ?? (await server()).db).$run(spec);
+			return {
+				spec,
+				count: result.ok && typeof result.data === "number" ? result.data : null
+			};
+		},
+		async proxy(request, proxyOptions = {}) {
+			const started = performance.now();
+			const id = collector ? crypto.randomUUID() : void 0;
+			let verifyMs = 0;
+			const [early, resolution] = await Promise.all([proxyOptions.before?.(request), base.resolve(request, { refresh: shouldRefresh(request) }).then((resolved) => {
+				verifyMs = performance.now() - started;
+				return resolved;
+			})]);
+			const custom = await proxyOptions.protect?.(resolution.auth, request);
+			const initial = custom ?? early;
+			if (!initial && resolution.cookies.length === 0 && !id && !proxyOptions.after && !proxyOptions.serverTiming) return NextResponse.next();
+			let response = resolution.apply(mutableResponse(initial ?? NextResponse.next()));
+			if (!custom && !isRedirect(response)) {
+				const forwarded = {};
+				if (resolution.cookies.length > 0) forwarded["cookie"] = resolution.requestCookies.map((cookie) => `${cookie.name}=${encodeURIComponent(cookie.value)}`).join("; ");
+				if (id) forwarded[REQUEST_ID_HEADER] = id;
+				if (Object.keys(forwarded).length > 0 || early) overrideRequestHeaders(response, request, forwarded);
+			}
+			if (id) {
+				response.headers.set(REQUEST_ID_HEADER, id);
+				response.headers.set(STATS_URL_HEADER, `${statsRoute}?id=${id}`);
+			}
+			if (proxyOptions.after) {
+				const replaced = await proxyOptions.after(response, resolution.auth);
+				if (replaced) response = mutableResponse(replaced);
+			}
+			if (proxyOptions.serverTiming) response.headers.append("server-timing", serverTimingValue({
+				"bs-proxy": performance.now() - started,
+				"bs-verify": verifyMs
+			}));
+			return response;
+		},
+		route(handler, guardOptions = {}) {
+			return async (request, segment) => {
+				const ctx = await base.context(request, statsFor(request));
+				const denied = guard(ctx.auth, guardOptions.allow, guardOptions.aal);
+				const instance = request.nextUrl.pathname;
+				if (denied) return problemResponse(denied, {
+					instance,
+					expose
+				});
+				const params = await segment.params;
+				const response = await respond(() => handler(request, withExtra(ctx, { params })), {
+					instance,
+					expose
+				});
+				if (ctx.replica?.wrote) try {
+					response.headers.append("set-cookie", primaryCookie(pinMs));
+				} catch {}
+				if (collector) try {
+					response.headers.set(statsHeader, formatStats(ctx.stats()));
+				} catch {}
+				return response;
+			};
+		},
+		debugRoute() {
+			return async (request) => {
+				const id = new URL(request.url).searchParams.get("id");
+				if (!collector || !id) return Response.json({ error: collector ? "missing ?id=" : "debug is off" }, {
+					status: 404,
+					headers: { "cache-control": "no-store" }
+				});
+				const stats = collector.get(id) ?? EMPTY_STATS;
+				return Response.json(stats, { headers: {
+					[statsHeader]: formatStats(stats),
+					"cache-control": "no-store"
+				} });
+			};
+		},
+		action(actionOptions, fn) {
+			return async (input) => {
+				const ctx = await server();
+				const denied = guard(ctx.auth, actionOptions.allow, actionOptions.aal);
+				if (denied) return {
+					ok: false,
+					data: null,
+					error: denied
+				};
+				let parsed = input instanceof FormData ? formDataObject(input) : input;
+				if (actionOptions.input) {
+					const checked = await validate(actionOptions.input, parsed, "input");
+					if (!checked.ok) return {
+						ok: false,
+						data: null,
+						error: checked.error
+					};
+					parsed = checked.data;
+				}
+				const settled = await settle(() => fn(parsed, ctx));
+				if (ctx.replica?.wrote) (await cookies()).set(PRIMARY_COOKIE, String(Date.now() + pinMs), {
+					path: "/",
+					maxAge: Math.max(1, Math.ceil(pinMs / 1e3)),
+					httpOnly: true,
+					sameSite: "lax"
+				});
+				return settled.ok ? {
+					ok: true,
+					data: settled.data,
+					error: null
+				} : {
+					ok: false,
+					data: null,
+					error: settled.error
+				};
+			};
+		},
+		cacheTag(table, id) {
+			cacheTag(tagFor(table), ...id === void 0 ? [] : [tagFor(table, id)]);
+		},
+		cacheTags(target) {
+			const specs = isReadSet(target) ? Object.values(target.specs) : Array.isArray(target) ? target : [target];
+			const tags = /* @__PURE__ */ new Set();
+			for (const spec of specs) {
+				for (const table of sb.tablesOf(spec)) tags.add(tagFor(table));
+				const [id] = spec.args;
+				if (spec.method === "findById" && (typeof id === "string" || typeof id === "number")) tags.add(tagFor(spec.table, id));
+			}
+			cacheTag(...tags);
+		}
+	});
+}
+//#endregion
+export { REQUEST_ID_HEADER, STATS_URL_HEADER, createNext, hasEntitlement, nextCache, requireAal, sessionStale, sessionTag, shouldRefresh, tagFor, toSession };

package/dist/openapi/index.d.ts

@@ -0,0 +1,2 @@
+import { a as ResourceOptions, i as ResourceOperation, n as OpenApiOptions, o as createOpenApi, r as PROBLEM_SCHEMA, t as OpenApiDocument } from "../index-DRid0qIv.js";
+export { OpenApiDocument, OpenApiOptions, PROBLEM_SCHEMA, ResourceOperation, ResourceOptions, createOpenApi };