better-supabase 0.0.0 → 0.1.0

package/dist/result-CTkCZ6JA.d.ts

@@ -0,0 +1,198 @@
+//#region src/core/errors.d.ts
+/**
+ * Extra fields carried by each error kind. Plugins can add kinds through the
+ * `errors` extension point; apps that want the new kinds in the union can add
+ * them to this interface.
+ */
+interface DbErrorKinds {
+  not_found: Record<never, never>;
+  unauthorized: Record<never, never>;
+  /** `required`: the assurance level the route needs, when a second factor is missing. */
+  forbidden: {
+    required?: "aal1" | "aal2";
+  };
+  conflict: {
+    constraint?: string;
+    columns?: readonly string[];
+  };
+  foreign_key: {
+    constraint?: string;
+    columns?: readonly string[];
+  };
+  check: {
+    constraint?: string;
+  };
+  not_null: {
+    column?: string;
+  };
+  exclusion: {
+    constraint?: string;
+  };
+  invalid_input: Record<never, never>;
+  raised: Record<never, never>;
+  timeout: Record<never, never>;
+  serialization: Record<never, never>;
+  network: Record<never, never>;
+  aborted: Record<never, never>;
+  invalid_request: Record<never, never>;
+  validation: {
+    issues: readonly ValidationIssue[];
+  };
+  multiple_rows: Record<never, never>;
+  stale: Record<never, never>;
+  /** `retryAfter`: seconds until the window resets (the `Retry-After` header). */
+  rate_limited: {
+    retryAfter?: number;
+  };
+  unexpected: Record<never, never>;
+}
+type DbErrorKind = keyof DbErrorKinds;
+interface ValidationIssue {
+  readonly message: string;
+  readonly path?: readonly PropertyKey[];
+}
+interface DbErrorBase<K extends DbErrorKind> {
+  readonly kind: K;
+  readonly message: string;
+  /** SQLSTATE or PostgREST code (`23505`, `PGRST116`), when known. */
+  readonly code?: string;
+  /** Suggested HTTP status, used by the RFC 9457 mapping. */
+  readonly status: number;
+  readonly details?: string;
+  /** Postgres `HINT`. `raised` errors use it as an app-level error code. */
+  readonly hint?: string;
+  /** App-cased table key the operation ran against. */
+  readonly table?: string;
+}
+/**
+ * A database error as plain, serializable data. Safe to send across server
+ * action and RPC boundaries.
+ */
+type DbError = { [K in DbErrorKind]: DbErrorBase<K> & DbErrorKinds[K]; }[DbErrorKind];
+type DbErrorOf<K extends DbErrorKind> = Extract<DbError, {
+  kind: K;
+}>;
+declare function statusOf(kind: DbErrorKind): number;
+type ExtraOf<K extends DbErrorKind> = Record<never, never> extends DbErrorKinds[K] ? [extra?: DbErrorKinds[K] & Partial<Omit<DbErrorBase<K>, "kind">>] : [extra: DbErrorKinds[K] & Partial<Omit<DbErrorBase<K>, "kind">>];
+/** Creates a `DbError` with the default status for its kind. */
+declare function dbError<K extends DbErrorKind>(kind: K, message: string, ...[extra]: ExtraOf<K>): DbErrorOf<K>;
+declare function isDbError(value: unknown): value is DbError;
+/**
+ * A unique violation, optionally for one constraint. Accepts a `DbError` or a
+ * `DbException`. Pass the generated `UniqueConstraint` type to check names:
+ * `isConflict<UniqueConstraint>(error, 'customers_organization_id_kvk_key')`.
+ */
+declare const isConflict: <C extends string = string>(error: unknown, constraint?: NoInfer<C>) => error is DbErrorOf<"conflict"> & {
+  readonly constraint: C;
+};
+/** A CHECK violation, optionally for one constraint (`CheckConstraint`). */
+declare const isCheck: <C extends string = string>(error: unknown, constraint?: NoInfer<C>) => error is DbErrorOf<"check"> & {
+  readonly constraint: C;
+};
+/** A foreign key violation, optionally for one constraint (`ForeignKeyConstraint`). */
+declare const isForeignKey: <C extends string = string>(error: unknown, constraint?: NoInfer<C>) => error is DbErrorOf<"foreign_key"> & {
+  readonly constraint: C;
+};
+/** Thrown by `.orThrow()`. Carries the plain `DbError` as `error`. */
+declare class DbException extends Error {
+  override readonly name = "DbException";
+  readonly error: DbError;
+  constructor(error: DbError);
+  get kind(): DbErrorKind;
+}
+/** Raw error shape shared by PostgREST responses and `pg` errors. */
+interface RawDbError {
+  readonly message?: string;
+  readonly code?: string;
+  readonly details?: string | null;
+  readonly hint?: string | null;
+  readonly constraint?: string;
+  readonly column?: string;
+  readonly table?: string;
+  readonly name?: string;
+}
+type ErrorMapper = (raw: RawDbError, fallback: DbError) => DbError | undefined;
+/**
+ * Maps a PostgREST or Postgres error to a `DbError`. Custom mappers run
+ * first; the first one that returns an error wins.
+ */
+declare function mapDbError(raw: RawDbError, mappers?: readonly ErrorMapper[]): DbError;
+//#endregion
+//#region src/core/result.d.ts
+/** Turns a `DbError` into the error `.orThrow()` throws; set with `sb.mapError()`. */
+type ThrowMapper = (error: DbError) => unknown;
+type Ok<T> = {
+  readonly ok: true;
+  readonly data: T;
+  readonly error: null;
+};
+type Err<E = DbError> = {
+  readonly ok: false;
+  readonly data: null;
+  readonly error: E;
+};
+type Result<T, E = DbError> = Ok<T> | Err<E>;
+declare function ok<T>(data: T): Ok<T>;
+declare function err<E = DbError>(error: E): Err<E>;
+/**
+ * A lazy-free `PromiseLike<Result<T>>` with helpers. `await` gives the
+ * `Result`; `.orThrow()` gives the data or throws a `DbException`.
+ */
+declare class AsyncResult<T> implements PromiseLike<Result<T>> {
+  #private;
+  constructor(promise: Promise<Result<T>>);
+  static from<T>(run: () => Promise<Result<T>>): AsyncResult<T>;
+  static ok<T>(data: T): AsyncResult<T>;
+  static err<T = never>(error: DbError): AsyncResult<T>;
+  then<R1 = Result<T>, R2 = never>(onfulfilled?: ((value: Result<T>) => R1 | PromiseLike<R1>) | null, onrejected?: ((reason: unknown) => R2 | PromiseLike<R2>) | null): Promise<R1 | R2>;
+  /**
+   * Resolves with the data, or rejects with a `DbException`. Pass `factory`
+   * to throw your own error instead, e.g. an HTTP error for your framework;
+   * without it, the mapper from `sb.mapError()` applies when one is set.
+   */
+  orThrow(factory?: (error: DbError) => unknown): Promise<T>;
+  /** Resolves with the data, or `fallback` when the result is an error. */
+  unwrapOr<F>(fallback: F): Promise<T | F>;
+  map<U>(fn: (data: T) => U): AsyncResult<U>;
+  mapError(fn: (error: DbError) => DbError): AsyncResult<T>;
+  andThen<U>(fn: (data: T) => PromiseLike<Result<U>>): AsyncResult<U>;
+}
+/** What `toBetterResult` returns: the `status`/`value`/`error` fields every better-result value has. */
+type BetterResultShape<T, E> = {
+  readonly status: "ok";
+  readonly value: T;
+} | {
+  readonly status: "error";
+  readonly error: E;
+};
+/** The part of better-result's `Result` namespace `toBetterResult` calls. */
+interface BetterResultApi<T, E> {
+  ok(value: NoInfer<T>): unknown;
+  err(error: NoInfer<E>): unknown;
+}
+/**
+ * Builds a better-result value with the `Result` namespace you pass, so
+ * better-result stays your dependency. Errors go through `mapError`, or, for a
+ * result from a `db` of `sb.mapError(fn)`, through `fn` (typed `unknown`).
+ * The value is a real `Ok`/`Err`: cast it (`as Result<T, E>`) for its
+ * methods in types; the cast itself is not checked against `T`.
+ *
+ * ```ts
+ * import { Result } from 'better-result';
+ * const customer = toBetterResult(await db.customers.findById(id), Result, toAppError);
+ * ```
+ */
+declare function toBetterResult<T, E>(result: Result<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): BetterResultShape<T, E>;
+declare function toBetterResult<T>(result: Result<T>, api: BetterResultApi<T, DbError>): BetterResultShape<T, DbError>;
+declare function toBetterResult<T, E>(result: AsyncResult<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): Promise<BetterResultShape<T, E>>;
+declare function toBetterResult<T>(result: AsyncResult<T>, api: BetterResultApi<T, unknown>): Promise<BetterResultShape<T, unknown>>;
+/**
+ * Converts a better-result value back into a `Result`, by its `status`
+ * field, so it works across better-result versions. A `DbError`, or an
+ * error whose `cause` is one, is kept; others go through `mapError`
+ * (default `toDbError`).
+ */
+declare function fromBetterResult<T>(result: BetterResultShape<T, unknown>, mapError?: (error: unknown) => DbError): Result<T>;
+declare function toDbError(cause: unknown): DbError;
+//#endregion
+export { isConflict as C, statusOf as D, mapDbError as E, isCheck as S, isForeignKey as T, DbException as _, Ok as a, ValidationIssue as b, err as c, toBetterResult as d, toDbError as f, DbErrorOf as g, DbErrorKinds as h, Err as i, fromBetterResult as l, DbErrorKind as m, BetterResultApi as n, Result as o, DbError as p, BetterResultShape as r, ThrowMapper as s, AsyncResult as t, ok as u, ErrorMapper as v, isDbError as w, dbError as x, RawDbError as y };

package/dist/result-DWXatkd6.js

@@ -0,0 +1,103 @@
+import { n as dbError, r as dbErrorOf, t as DbException } from "./errors-Bl3rkOzo.js";
+//#region src/core/result.ts
+const throwMappers = /* @__PURE__ */ new WeakMap();
+function inherit(from, next) {
+	const mapper = throwMappers.get(from);
+	if (mapper) throwMappers.set(next, mapper);
+	return next;
+}
+/** Marks `result` so its `.orThrow()` throws `mapper(error)`; returns it. */
+function withErrorMapper(result, mapper) {
+	throwMappers.set(result, mapper);
+	return result;
+}
+function ok(data) {
+	return {
+		ok: true,
+		data,
+		error: null
+	};
+}
+function err(error) {
+	return {
+		ok: false,
+		data: null,
+		error
+	};
+}
+/**
+* A lazy-free `PromiseLike<Result<T>>` with helpers. `await` gives the
+* `Result`; `.orThrow()` gives the data or throws a `DbException`.
+*/
+var AsyncResult = class AsyncResult {
+	#promise;
+	constructor(promise) {
+		this.#promise = promise.catch((cause) => err(toDbError(cause)));
+	}
+	static from(run) {
+		return new AsyncResult(Promise.resolve().then(run));
+	}
+	static ok(data) {
+		return new AsyncResult(Promise.resolve(ok(data)));
+	}
+	static err(error) {
+		return new AsyncResult(Promise.resolve(err(error)));
+	}
+	then(onfulfilled, onrejected) {
+		return this.#promise.then(onfulfilled, onrejected);
+	}
+	/**
+	* Resolves with the data, or rejects with a `DbException`. Pass `factory`
+	* to throw your own error instead, e.g. an HTTP error for your framework;
+	* without it, the mapper from `sb.mapError()` applies when one is set.
+	*/
+	async orThrow(factory) {
+		const result = await this.#promise;
+		if (result.ok) return result.data;
+		const mapper = factory ?? throwMappers.get(this);
+		throw mapper ? mapper(result.error) : new DbException(result.error);
+	}
+	/** Resolves with the data, or `fallback` when the result is an error. */
+	async unwrapOr(fallback) {
+		const result = await this.#promise;
+		return result.ok ? result.data : fallback;
+	}
+	map(fn) {
+		return inherit(this, new AsyncResult(this.#promise.then((result) => result.ok ? ok(fn(result.data)) : result)));
+	}
+	mapError(fn) {
+		return inherit(this, new AsyncResult(this.#promise.then((result) => result.ok ? result : err(fn(result.error)))));
+	}
+	andThen(fn) {
+		return inherit(this, new AsyncResult(this.#promise.then((result) => result.ok ? fn(result.data) : result)));
+	}
+};
+function toBetterResult(result, api, mapError) {
+	const build = (settled, mapper) => settled.ok ? api.ok(settled.data) : api.err(mapper ? mapper(settled.error) : settled.error);
+	if (result instanceof AsyncResult) {
+		const mapper = mapError ?? throwMappers.get(result);
+		return result.then((settled) => build(settled, mapper));
+	}
+	return build(result, mapError);
+}
+/**
+* Converts a better-result value back into a `Result`, by its `status`
+* field, so it works across better-result versions. A `DbError`, or an
+* error whose `cause` is one, is kept; others go through `mapError`
+* (default `toDbError`).
+*/
+function fromBetterResult(result, mapError = toDbError) {
+	switch (result.status) {
+		case "ok": return ok(result.value);
+		case "error": return err(dbErrorOf(result.error) ?? mapError(result.error));
+		default: throw new TypeError(`better-supabase: fromBetterResult() expects a better-result value, got ${String(result)}`);
+	}
+}
+function toDbError(cause) {
+	if (cause instanceof DbException) return cause.error;
+	if (cause instanceof Error && cause.name === "AbortError") return dbError("aborted", cause.message || "The operation was aborted");
+	const message = cause instanceof Error ? cause.message : String(cause);
+	return dbError("unexpected", message);
+}
+//#endregion
+export { toBetterResult as a, ok as i, err as n, toDbError as o, fromBetterResult as r, withErrorMapper as s, AsyncResult as t };

package/dist/scope-CDHcS7dE.js

@@ -0,0 +1,90 @@
+import { r as not, t as and } from "./types-6cYK9pbJ.js";
+//#region src/ir/scope.ts
+/**
+* Applies `scopeFor` to every relation filter in a condition. `every(W)`
+* becomes `none(S and not W)` so out-of-scope rows (soft-deleted, other
+* tenants) neither satisfy nor fail it.
+*/
+function scopeCondition(condition, scopeFor) {
+	if (!condition) return void 0;
+	switch (condition.kind) {
+		case "and":
+		case "or": return {
+			kind: condition.kind,
+			items: condition.items.map((item) => scopeCondition(item, scopeFor) ?? item)
+		};
+		case "not": return {
+			kind: "not",
+			item: scopeCondition(condition.item, scopeFor) ?? condition.item
+		};
+		case "column": return condition;
+		case "relation": {
+			const inner = scopeCondition(condition.where, scopeFor);
+			const scope = scopeFor(condition.target);
+			if (!scope) return {
+				...condition,
+				where: inner
+			};
+			switch (condition.quantifier) {
+				case "some":
+				case "none": return {
+					...condition,
+					where: and(inner, scope)
+				};
+				case "every": return inner ? {
+					...condition,
+					quantifier: "none",
+					where: and(scope, not(inner))
+				} : {
+					...condition,
+					where: void 0
+				};
+				default: return condition.quantifier;
+			}
+		}
+		default: return condition;
+	}
+}
+function scopeInclude(include, scopeFor) {
+	return {
+		...include,
+		selection: scopeSelection(include.selection, scopeFor),
+		where: and(scopeCondition(include.where, scopeFor), scopeFor(include.target))
+	};
+}
+/** Applies `scopeFor` to every include and to filters inside includes. */
+function scopeSelection(selection, scopeFor) {
+	if (selection.includes.length === 0) return selection;
+	return {
+		...selection,
+		includes: selection.includes.map((include) => scopeInclude(include, scopeFor))
+	};
+}
+/**
+* Scopes a whole operation: the root table's rows (reads, updates, deletes),
+* relation filters, includes and returned embeds. Inserts only get their
+* returning selection scoped.
+*/
+function scopeOperation(op, scopeFor, root = true) {
+	const own = root ? scopeFor(op.table) : void 0;
+	switch (op.kind) {
+		case "select": return {
+			...op,
+			selection: scopeSelection(op.selection, scopeFor),
+			where: and(scopeCondition(op.where, scopeFor), own)
+		};
+		case "update":
+		case "delete": return {
+			...op,
+			where: and(scopeCondition(op.where, scopeFor), own),
+			returning: op.returning ? scopeSelection(op.returning, scopeFor) : void 0
+		};
+		case "insert": return {
+			...op,
+			returning: op.returning ? scopeSelection(op.returning, scopeFor) : void 0
+		};
+		default: return op;
+	}
+}
+//#endregion
+export { scopeOperation as n, scopeSelection as r, scopeCondition as t };

package/dist/seed-CzecODcJ.js

@@ -0,0 +1,101 @@
+//#region src/testing/seed.ts
+const SEED = Symbol.for("better-supabase.seed");
+function isSeed(value) {
+	return typeof value === "object" && value !== null && SEED in value;
+}
+const quote = (text) => `'${text.replaceAll("'", "''")}'`;
+function arrayLiteral(values) {
+	return `{${values.map((value) => {
+		if (value === null) return "NULL";
+		if (Array.isArray(value)) return arrayLiteral(value);
+		return `"${(value instanceof Date ? value.toISOString() : String(value)).replace(/[\\"]/g, "\\$&")}"`;
+	}).join(",")}}`;
+}
+function literal(value, column, where) {
+	if (value === null) return "null";
+	if (column.json) return quote(JSON.stringify(value));
+	if (Array.isArray(value)) return quote(arrayLiteral(value));
+	if (value instanceof Date) return quote(value.toISOString());
+	const kind = typeof value;
+	switch (kind) {
+		case "string": return quote(value);
+		case "boolean":
+		case "bigint": return String(value);
+		case "number":
+			if (!Number.isFinite(value)) throw new TypeError(`${where}: ${String(value)} is not a finite number`);
+			return String(value);
+		case "object":
+		case "function":
+		case "symbol":
+		case "undefined": throw new TypeError(`${where}: unsupported value of type ${kind}`);
+		default: throw new TypeError(`${where}: unsupported value of type ${String(kind)}`);
+	}
+}
+const ident = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+/** Parents first (by forward relations), otherwise in the order given. */
+function order(meta, keys) {
+	const sorted = [];
+	const visiting = /* @__PURE__ */ new Set();
+	const visit = (key) => {
+		if (sorted.includes(key) || visiting.has(key)) return;
+		visiting.add(key);
+		for (const relation of Object.values(meta.tables[key]?.relations ?? {})) if (relation.direction === "forward" && relation.table !== key && keys.includes(relation.table)) visit(relation.table);
+		visiting.delete(key);
+		sorted.push(key);
+	};
+	for (const key of keys) visit(key);
+	return sorted;
+}
+function statement(table, rows) {
+	const entries = Object.entries(rows);
+	if (entries.length === 0) return void 0;
+	const columns = [];
+	for (const [, row] of entries) for (const [key, value] of Object.entries(row)) {
+		if (value === void 0 || columns.includes(key)) continue;
+		const column = table.columns[key];
+		if (!column) throw new TypeError(`seed ${table.key}: unknown column "${key}"`);
+		if (column.generated) throw new TypeError(`seed ${table.key}: "${key}" is a generated column`);
+		columns.push(key);
+	}
+	const values = entries.map(([name, row]) => {
+		return `  (${columns.map((key) => row[key] === void 0 ? "default" : literal(row[key], table.columns[key], `seed ${table.key}.${name}.${key}`)).join(", ")})`;
+	});
+	return `insert into ${`${ident(table.schema)}.${ident(table.name)}`} (${columns.map((key) => ident(table.columns[key].db)).join(", ")}) values\n${values.join(",\n")}\non conflict do nothing;`;
+}
+/**
+* Typed fixtures shared by `supabase/seeds` and your tests. Rows use app
+* casing and Insert types; `better-supabase seed` renders them to SQL.
+*
+* ```ts
+* export const seed = defineSeed(sb, {
+*   organizations: { acme: { id: ACME, name: 'Acme' } },
+*   customers: { first: { organizationId: ACME, name: 'First customer' } },
+* });
+* ```
+*/
+function defineSeed(sb, fixtures) {
+	const meta = sb.meta;
+	const statements = () => {
+		const keys = Object.keys(fixtures).filter((key) => fixtures[key] !== void 0);
+		for (const key of keys) {
+			const table = meta.tables[key];
+			if (!table) throw new TypeError(`seed: unknown table "${key}"`);
+			if (table.kind === "view") throw new TypeError(`seed: "${key}" is a view`);
+		}
+		return order(meta, keys).flatMap((key) => {
+			const sql = statement(meta.tables[key], fixtures[key]);
+			return sql ? [sql] : [];
+		});
+	};
+	return {
+		[SEED]: true,
+		rows: fixtures,
+		statements,
+		sql: () => statements().join("\n\n"),
+		async insert(sql) {
+			for (const text of statements()) await sql.queryRaw(text);
+		}
+	};
+}
+//#endregion
+export { isSeed as n, defineSeed as t };

package/dist/server/index.d.ts

@@ -0,0 +1,42 @@
+import { n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
+import { t as BetterSupabase, y as Db } from "../define-CTfWw-SS.js";
+import { h as RequestContext } from "../plugin-HvGqCurB.js";
+import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-TVia554c.js";
+import { _ as readSession, a as ResolveAuthOptions, b as writeSession, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as StoredSession, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, y as sessionCookieName } from "../resolve-DW8h9NPm.js";
+import { _ as DeleteAccountResult, a as guard, c as settle, d as ServerContext, f as ServerOptions, g as DeleteAccountOptions, h as ReplicaState, i as Settled, l as BetterServer, m as PRIMARY_COOKIE, n as GuardOptions, o as isResult, p as createServer, r as RespondOptions, s as respond, t as AuthKind, u as ContextOptions } from "../respond-PoTpy5DT.js";
+import { a as defineResource, i as ResourceRouteOptions, n as ResourceInput, r as ResourceList, t as ResourceHandler } from "../resource-SkPTRJDD.js";
+import { a as ProblemResponseOptions, c as problemResponse, i as ProblemOptions, l as toProblem, n as PROBLEM_TYPE_BASE, o as fromProblem, r as ProblemDetails, s as isProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-DlgB0lYl.js";
+import { n as RefreshOutcome, r as refreshSession } from "../index-cEeweTeM.js";
+import { SupabaseClient } from "@supabase/supabase-js";
+import { Middleware } from "@supabase/middleware";
+import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
+import { PostgresApi } from "@supabase/server/middleware/postgres";
+//#region src/server/middleware.d.ts
+/** The `withSupabase` context keys `withBetterSupabase` reads. */
+interface SupabaseAuthContext {
+  readonly jwtClaims: JWTClaims | null;
+  readonly userClaims: UserClaims | null;
+  readonly authMode: AuthMode;
+}
+/** Repository context from a `@supabase/server` context. */
+export declare function contextFromSupabase(ctx: SupabaseAuthContext): RequestContext;
+/**
+ * `@supabase/middleware` entry contributing `ctx.db`: repositories bound to
+ * `ctx.supabase` (the caller-scoped client from `withSupabase`).
+ *
+ * ```ts
+ * pipeline([withSupabase({ auth: 'user' }), withBetterSupabase(sb)()], (req, ctx) => ...)
+ * ```
+ */
+export declare function withBetterSupabase<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>): Middleware<"db", void, SupabaseAuthContext & {
+  readonly supabase: SupabaseClient;
+}, Db<M, F, E, SupabaseClient>>;
+/**
+ * Entry contributing `ctx.sql`: repositories over `ctx.postgres` from
+ * `withPostgresClient`, which runs each query as the caller with RLS.
+ */
+export declare function withBetterPostgres<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>): Middleware<"sql", void, SupabaseAuthContext & {
+  readonly postgres: PostgresApi;
+}, Db<M, F, E, undefined>>;
+//#endregion
+export { AUTH_CACHE_HEADERS, type Aal, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthState, type BetterServer, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type GuardOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type ReplicaState, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourceRouteOptions, type RespondOptions, type ServerContext, type ServerOptions, type Settled, type StoredSession, type SupabaseAuthContext, aalOf, amrOf, authContext, checkAal, clientIp, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, writeSession };

package/dist/server/index.js

@@ -0,0 +1,68 @@
+import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-DPu6Fh-t.js";
+import { a as settle, i as respond, n as guard, o as createServer, r as isResult, u as PRIMARY_COOKIE } from "../respond-4-dhoV7x.js";
+import { a as clientIp, f as sessionCookieName, g as impersonatorOf, i as authContext, m as refreshSession, n as amrOf, o as resolveAuth, p as writeSession, r as checkAal, s as AUTH_CACHE_HEADERS, t as aalOf, u as readSession } from "../mfa-CpogP66z.js";
+import { n as postgresExecutor } from "../executor-Ceq60hPM.js";
+import { t as defineResource } from "../resource-CYiu6Ygi.js";
+import { defineMiddleware } from "@supabase/middleware";
+//#region src/server/middleware.ts
+/** Repository context from a `@supabase/server` context. */
+function contextFromSupabase(ctx) {
+	switch (ctx.authMode) {
+		case "user":
+			if (!ctx.userClaims) break;
+			return {
+				actor: {
+					id: ctx.userClaims.id,
+					kind: "user",
+					...ctx.userClaims.role !== void 0 ? { role: ctx.userClaims.role } : {},
+					...ctx.userClaims.email !== void 0 ? { email: ctx.userClaims.email } : {}
+				},
+				claims: ctx.jwtClaims ?? {}
+			};
+		case "secret": return {
+			actor: {
+				id: "service",
+				kind: "service",
+				role: "service_role"
+			},
+			claims: { role: "service_role" }
+		};
+		case "publishable":
+		case "none": break;
+		default: return ctx.authMode;
+	}
+	return {
+		actor: {
+			id: "anon",
+			kind: "anon",
+			role: "anon"
+		},
+		claims: { role: "anon" }
+	};
+}
+/**
+* `@supabase/middleware` entry contributing `ctx.db`: repositories bound to
+* `ctx.supabase` (the caller-scoped client from `withSupabase`).
+*
+* ```ts
+* pipeline([withSupabase({ auth: 'user' }), withBetterSupabase(sb)()], (req, ctx) => ...)
+* ```
+*/
+function withBetterSupabase(sb) {
+	return defineMiddleware({
+		key: "db",
+		run: (_config) => (_req, ctx) => Promise.resolve({ db: sb.connect(ctx.supabase, contextFromSupabase(ctx)) })
+	});
+}
+/**
+* Entry contributing `ctx.sql`: repositories over `ctx.postgres` from
+* `withPostgresClient`, which runs each query as the caller with RLS.
+*/
+function withBetterPostgres(sb) {
+	return defineMiddleware({
+		key: "sql",
+		run: (_config) => (_req, ctx) => Promise.resolve({ sql: sb.connect(postgresExecutor(ctx.postgres), contextFromSupabase(ctx)) })
+	});
+}
+//#endregion
+export { AUTH_CACHE_HEADERS, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, aalOf, amrOf, authContext, checkAal, clientIp, contextFromSupabase, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, withBetterPostgres, withBetterSupabase, writeSession };

package/dist/session-C3osL21k.d.ts

@@ -0,0 +1,21 @@
+import { t as AuthSession } from "./view-B0ltUmTi.js";
+import { ReactNode } from "react";
+//#region src/react/session.d.ts
+interface SessionProviderProps {
+  /**
+   * An unresolved `next.session()` promise, created inside a `<Suspense>`
+   * boundary so the layout itself never waits for auth.
+   */
+  readonly sessionPromise: Promise<AuthSession>;
+  readonly children?: ReactNode;
+}
+/** Shares the server-verified session with Client Components. */
+declare function SessionProvider(props: SessionProviderProps): ReactNode;
+/**
+ * The session from the nearest `<SessionProvider>`. Suspends until the
+ * promise resolves, so render it inside `<Suspense>`. `C` types the claims
+ * (the output of `sb.claims(schema)`); `createHooks().useSession` infers it.
+ */
+declare function useSession<C = unknown>(): AuthSession<C>;
+//#endregion
+export { SessionProviderProps as n, useSession as r, SessionProvider as t };

package/dist/session-CD-3orO_.js

@@ -0,0 +1,19 @@
+import { createContext, createElement, use, useContext } from "react";
+//#region src/react/session.ts
+const SessionContext = createContext(null);
+/** Shares the server-verified session with Client Components. */
+function SessionProvider(props) {
+	return createElement(SessionContext.Provider, { value: props.sessionPromise }, props.children);
+}
+/**
+* The session from the nearest `<SessionProvider>`. Suspends until the
+* promise resolves, so render it inside `<Suspense>`. `C` types the claims
+* (the output of `sb.claims(schema)`); `createHooks().useSession` infers it.
+*/
+function useSession() {
+	const promise = useContext(SessionContext);
+	if (!promise) throw new Error("better-supabase: useSession() needs <SessionProvider sessionPromise={...}>");
+	return use(promise);
+}
+//#endregion
+export { useSession as n, SessionProvider as t };