better-supabase 0.0.0 → 0.1.0

package/dist/types-6cYK9pbJ.js

@@ -0,0 +1,29 @@
+//#region src/ir/types.ts
+const and = (...items) => {
+	const present = items.filter((item) => item !== void 0);
+	if (present.length === 0) return void 0;
+	if (present.length === 1) return present[0];
+	return {
+		kind: "and",
+		items: present
+	};
+};
+const or = (...items) => {
+	if (items.length === 1 && items[0]) return items[0];
+	return {
+		kind: "or",
+		items
+	};
+};
+const not = (item) => ({
+	kind: "not",
+	item
+});
+const column = (name, op, value) => ({
+	kind: "column",
+	column: name,
+	op,
+	value
+});
+//#endregion
+export { or as i, column as n, not as r, and as t };

package/dist/types-C2fslP1z.d.ts

@@ -0,0 +1,195 @@
+//#region src/schema/types.d.ts
+type Casing = "snake" | "camel";
+/** Runtime metadata for one column. Keyed by the app (cased) column name. */
+interface ColumnMeta {
+  /** Database column name. */
+  readonly db: string;
+  /** Postgres type name (`uuid`, `text`, `timestamptz`, `note_kind`). */
+  readonly type: string;
+  readonly nullable: boolean;
+  readonly hasDefault: boolean;
+  readonly generated?: boolean;
+  /** Identity column; `'always'` columns can't be written. */
+  readonly identity?: "always" | "by default";
+  /** `false` when inserts can't set this column (generated, identity always, view). */
+  readonly insertable?: false;
+  /** `false` when updates can't set this column. */
+  readonly updatable?: false;
+  readonly array?: boolean;
+  readonly json?: boolean;
+  /** Allowed values for enum columns and CHECK-constraint unions. */
+  readonly enum?: readonly string[];
+  /** How values are decoded from the wire (see the `codecs` config). */
+  readonly codec?: Codec;
+  /** Listed in `config.sensitive`; the `noSensitiveSelect` rule guards reads of it. */
+  readonly sensitive?: true;
+  /** Bucket id of the objects this text column points to (`config.storagePaths`). */
+  readonly storage?: string;
+}
+/**
+ * Runtime representation for a column: `date` decodes timestamps to `Date`,
+ * `bigint` and `string` read the exact text of `int8`/`numeric` values.
+ */
+type Codec = "date" | "bigint" | "string";
+interface RelationMeta {
+  /** App key of the target table. */
+  readonly table: string;
+  readonly kind: "one" | "many";
+  readonly nullable: boolean;
+  /** Foreign key constraint name, used as the PostgREST embed hint. */
+  readonly foreignKey: string;
+  /** App column names on the source table. */
+  readonly columns: readonly string[];
+  /** App column names on the target table. */
+  readonly references: readonly string[];
+  /** `forward`: this table holds the FK. `reverse`: the target holds it. */
+  readonly direction: "forward" | "reverse";
+  /** What deleting the referenced row does to the referencing rows, when it changes them. */
+  readonly onDelete?: "cascade" | "set null" | "set default";
+}
+interface TableFlags {
+  /** App column holding the soft-delete timestamp. */
+  readonly softDelete?: string;
+  readonly timestamps?: {
+    readonly createdAt?: string;
+    readonly updatedAt?: string;
+  };
+  /** App column holding the tenant id. */
+  readonly tenant?: string;
+  readonly actor?: {
+    readonly createdBy?: string;
+    readonly updatedBy?: string;
+  };
+  /** App column used for optimistic concurrency, usually `updatedAt`. */
+  readonly version?: string;
+}
+interface TableMeta {
+  /** App key of the table (`customerTags` in camel casing). */
+  readonly key: string;
+  /** Database table name. */
+  readonly name: string;
+  readonly schema: string;
+  readonly kind: "table" | "view";
+  readonly columns: Readonly<Record<string, ColumnMeta>>;
+  /** App column names. */
+  readonly primaryKey: readonly string[];
+  /** Constraint name to app column names. */
+  readonly uniqueKeys: Readonly<Record<string, readonly string[]>>;
+  readonly relations: Readonly<Record<string, RelationMeta>>;
+  readonly flags: TableFlags;
+}
+interface FunctionMeta {
+  readonly name: string;
+  readonly schema: string;
+  readonly args: readonly {
+    readonly name: string;
+    readonly type: string;
+  }[];
+  readonly returns: string;
+  readonly returnsSet: boolean;
+  readonly volatility: "immutable" | "stable" | "volatile";
+}
+interface SchemaMeta {
+  readonly version: 1;
+  readonly casing: Casing;
+  readonly tables: Readonly<Record<string, TableMeta>>;
+  readonly enums: Readonly<Record<string, readonly string[]>>;
+  readonly functions: Readonly<Record<string, FunctionMeta>>;
+  readonly buckets?: Readonly<Record<string, BucketMeta>>;
+  readonly topics?: Readonly<Record<string, string>>;
+  /** Tables that broadcast change signals (`config.realtime.tables`), keyed by app key. */
+  readonly realtime?: Readonly<Record<string, RealtimeTableMeta>>;
+}
+interface RealtimeTableMeta {
+  /** App column whose value scopes the broadcast topic. */
+  readonly tenant?: string;
+}
+interface BucketMeta {
+  readonly id: string;
+  readonly public: boolean;
+  readonly path: string;
+  readonly policy?: "tenant" | "owner" | "public" | "none";
+  readonly fileSizeLimit?: string;
+  readonly allowedMimeTypes?: readonly string[];
+}
+interface RelationShape {
+  readonly table: string;
+  readonly kind: "one" | "many";
+  readonly nullable: boolean;
+}
+interface FlagsShape {
+  readonly softDelete?: string;
+  readonly timestamps?: true;
+  readonly tenant?: string;
+  readonly actor?: true;
+  readonly version?: string;
+}
+interface ModelShape {
+  readonly Row: object;
+  readonly Insert: object;
+  readonly Update: object;
+  readonly Relations: object;
+  readonly PrimaryKey: PropertyKey;
+  readonly UniqueKeys: object;
+  /** CHECK constraint names. */
+  readonly Checks?: string;
+  /** Foreign key constraint names on this table. */
+  readonly ForeignKeys?: string;
+  readonly Flags: FlagsShape;
+}
+type AnyModels = {
+  readonly [table: string]: ModelShape;
+};
+type FunctionShape = {
+  readonly Args: object;
+  readonly Returns: unknown;
+};
+type AnyFunctions = {
+  readonly [name: string]: FunctionShape;
+};
+/**
+ * Carries the model types next to the runtime metadata. Created by
+ * `defineSchema` in the generated module.
+ */
+interface Schema<M extends AnyModels = AnyModels, D = unknown, F extends AnyFunctions = AnyFunctions> {
+  readonly meta: SchemaMeta;
+  /** Phantom. Never present at runtime. */
+  readonly "~types"?: {
+    readonly models: M;
+    readonly database: D;
+    readonly functions: F;
+  };
+}
+type ModelsOf<S> = S extends Schema<infer M> ? M : never;
+type DatabaseOf<S> = S extends Schema<AnyModels, infer D> ? D : never;
+type FunctionsOf<S> = S extends Schema<AnyModels, unknown, infer F> ? F : never;
+type TableKey<M extends AnyModels> = Extract<keyof M, string>;
+type Row<M extends AnyModels, T extends keyof M> = M[T]["Row"];
+type Insert<M extends AnyModels, T extends keyof M> = M[T]["Insert"];
+type Update<M extends AnyModels, T extends keyof M> = M[T]["Update"];
+type Relations<M extends AnyModels, T extends keyof M> = M[T]["Relations"];
+type Flags<M extends AnyModels, T extends keyof M> = M[T]["Flags"];
+type PrimaryKeyColumn<M extends AnyModels, T extends keyof M> = Extract<M[T]["PrimaryKey"], keyof Row<M, T>>;
+type UniqueKeyName<M extends AnyModels, T extends keyof M> = Extract<keyof M[T]["UniqueKeys"], string>;
+type UniqueKeyColumns<M extends AnyModels, T extends keyof M, K extends keyof M[T]["UniqueKeys"]> = Extract<M[T]["UniqueKeys"][K] extends readonly (infer C)[] ? C : never, keyof Row<M, T>>;
+/**
+ * Values for exactly one unique key: the primary key columns, or the columns
+ * of one named unique constraint or unique index.
+ */
+type UniqueWhere<M extends AnyModels, T extends keyof M> = { readonly [C in PrimaryKeyColumn<M, T>]: Row<M, T>[C]; } | { [K in keyof M[T]["UniqueKeys"]]: { readonly [C in UniqueKeyColumns<M, T, K>]: Row<M, T>[C]; }; }[keyof M[T]["UniqueKeys"]];
+/** Every unique constraint name in the schema, for `isConflict`. */
+type UniqueConstraint<M extends AnyModels> = { [T in keyof M]: Extract<keyof M[T]["UniqueKeys"], string>; }[keyof M];
+/** Every CHECK constraint name in the schema, for `isCheck`. */
+type CheckConstraint<M extends AnyModels> = { [T in keyof M]: M[T] extends {
+  readonly Checks: infer C extends string;
+} ? C : never; }[keyof M];
+/** Every foreign key constraint name in the schema, for `isForeignKey`. */
+type ForeignKeyConstraint<M extends AnyModels> = { [T in keyof M]: M[T] extends {
+  readonly ForeignKeys: infer C extends string;
+} ? C : never; }[keyof M];
+type IsUnion<T, U = T> = T extends unknown ? [U] extends [T] ? false : true : never;
+/** A single value for single-column keys, an object for composite keys. */
+type PrimaryKeyValue<M extends AnyModels, T extends keyof M> = true extends IsUnion<PrimaryKeyColumn<M, T>> ? { readonly [K in PrimaryKeyColumn<M, T>]: Row<M, T>[K]; } : Row<M, T>[PrimaryKeyColumn<M, T>];
+type Simplify<T> = { [K in keyof T]: T[K]; } & {};
+//#endregion
+export { TableMeta as A, Relations as C, Simplify as D, SchemaMeta as E, UniqueKeyName as M, UniqueWhere as N, TableFlags as O, Update as P, RelationShape as S, Schema as T, ModelsOf as _, CheckConstraint as a, RealtimeTableMeta as b, DatabaseOf as c, ForeignKeyConstraint as d, FunctionMeta as f, ModelShape as g, Insert as h, Casing as i, UniqueConstraint as j, TableKey as k, Flags as l, FunctionsOf as m, AnyModels as n, Codec as o, FunctionShape as p, BucketMeta as r, ColumnMeta as s, AnyFunctions as t, FlagsShape as u, PrimaryKeyColumn as v, Row as w, RelationMeta as x, PrimaryKeyValue as y };

package/dist/version-Cqq1m3UY.js

@@ -0,0 +1,4 @@
+//#region src/cli/version.ts
+const VERSION = "0.0.0";
+//#endregion
+export { VERSION as t };

package/dist/view-B0ltUmTi.d.ts

@@ -0,0 +1,43 @@
+import { p as DbError } from "./result-CTkCZ6JA.js";
+import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-TVia554c.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-DW8h9NPm.js";
+import { JWTClaims, UserClaims } from "@supabase/server";
+//#region src/auth/view.d.ts
+/**
+ * The verified caller as plain data: no token, no clients. Safe to return
+ * from a `'use cache: private'` function and to pass to Client Components.
+ */
+type AuthSession<C = unknown> = {
+  readonly kind: "user";
+  readonly user: UserClaims;
+  /**
+   * The verified JWT payload, including custom access token hook claims,
+   * typed and validated by `sb.claims(schema)`.
+   */
+  readonly claims: JWTClaims & C;
+  /** Seconds since epoch, from the token's `exp`. */
+  readonly expiresAt: number | null;
+  /** `aal2` once the user verified a second factor in this session. */
+  readonly aal: Aal;
+  /** How the user signed in (`password`, `totp`, `sso/saml`, ...). */
+  readonly amr: readonly AmrEntry[];
+  /** Set when an admin acts as this user (the `act` claim), for a banner. */
+  readonly impersonator?: Impersonator;
+} | {
+  readonly kind: "service";
+  readonly keyName: string;
+} | {
+  readonly kind: "anon";
+  readonly reason: AnonReason;
+} | {
+  readonly kind: "invalid";
+  readonly reason: InvalidReason;
+  readonly error: DbError;
+};
+type AnonReason = Extract<AuthState, {
+  kind: "anon";
+}>["reason"];
+/** Drops the token from an `AuthState`, leaving only serializable fields. */
+declare function toSession<C>(auth: AuthState<C>): AuthSession<C>;
+//#endregion
+export { toSession as n, AuthSession as t };

package/dist/view-B6F9QbG-.js

@@ -0,0 +1,35 @@
+import { g as impersonatorOf, n as amrOf, t as aalOf } from "./mfa-CpogP66z.js";
+//#region src/auth/view.ts
+/** Drops the token from an `AuthState`, leaving only serializable fields. */
+function toSession(auth) {
+	switch (auth.kind) {
+		case "user": {
+			const impersonator = impersonatorOf(auth.claims);
+			return {
+				kind: "user",
+				user: auth.user,
+				claims: auth.claims,
+				expiresAt: auth.expiresAt,
+				aal: aalOf(auth.claims),
+				amr: amrOf(auth.claims),
+				...impersonator ? { impersonator } : {}
+			};
+		}
+		case "service": return {
+			kind: "service",
+			keyName: auth.keyName
+		};
+		case "anon": return {
+			kind: "anon",
+			reason: auth.reason
+		};
+		case "invalid": return {
+			kind: "invalid",
+			reason: auth.reason,
+			error: auth.error
+		};
+		default: return auth;
+	}
+}
+//#endregion
+export { toSession as t };

package/dist/webhooks/index.d.ts

@@ -0,0 +1,152 @@
+import { k as TableKey, n as AnyModels, t as AnyFunctions, w as Row } from "../types-C2fslP1z.js";
+import { o as Result } from "../result-CTkCZ6JA.js";
+import { t as BetterSupabase } from "../define-CTfWw-SS.js";
+//#region src/webhooks/index.d.ts
+export interface VerifiedWebhook<T = unknown> {
+  readonly id: string;
+  readonly timestamp: Date;
+  readonly payload: T;
+  readonly body: string;
+}
+export interface VerifyOptions {
+  /** Allowed clock skew in seconds. Defaults to 300. */
+  readonly tolerance?: number;
+  readonly now?: () => number;
+}
+export type WebhookInput = Request | {
+  readonly headers: Headers | Readonly<Record<string, string>>;
+  readonly body: string;
+};
+/** Constant-time string comparison. */
+export declare function timingSafeEqual(a: string, b: string): boolean;
+/** Headers for a signed Standard Webhooks request. */
+export declare function signWebhook(secret: string, message: {
+  readonly id: string;
+  readonly body: string;
+  readonly timestamp?: Date;
+}): Promise<Record<string, string>>;
+/**
+ * Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
+ * `webhook-signature`) and parses the JSON body. Pass several secrets while
+ * rotating.
+ */
+export declare function verifyWebhook<T = unknown>(input: WebhookInput, secrets: string | readonly string[], options?: VerifyOptions): Promise<Result<VerifiedWebhook<T>>>;
+/** Checks a shared-secret header (database webhooks), in constant time. */
+export declare function verifySharedSecret(request: Request, secret: string, headerName?: string): boolean;
+interface HookUser {
+  readonly id: string;
+  readonly email?: string;
+  readonly phone?: string;
+  readonly app_metadata?: Readonly<Record<string, unknown>>;
+  readonly user_metadata?: Readonly<Record<string, unknown>>;
+  readonly [key: string]: unknown;
+}
+export interface AuthHookError {
+  readonly error: {
+    readonly http_code: number;
+    readonly message: string;
+  };
+}
+export interface AuthHooks {
+  custom_access_token: {
+    input: {
+      readonly user_id: string;
+      readonly claims: Readonly<Record<string, unknown>> & {
+        readonly sub: string;
+        readonly role: string;
+      };
+      readonly authentication_method: string;
+    };
+    output: {
+      readonly claims: Readonly<Record<string, unknown>>;
+    };
+  };
+  send_email: {
+    input: {
+      readonly user: HookUser;
+      readonly email_data: {
+        readonly token: string;
+        readonly token_hash: string;
+        readonly redirect_to: string;
+        readonly email_action_type: string;
+        readonly site_url: string;
+        readonly token_new: string;
+        readonly token_hash_new: string;
+      };
+    };
+    output: Record<never, never>;
+  };
+  send_sms: {
+    input: {
+      readonly user: HookUser;
+      readonly sms: {
+        readonly otp: string;
+      };
+    };
+    output: Record<never, never>;
+  };
+  mfa_verification_attempt: {
+    input: {
+      readonly factor_id: string;
+      readonly factor_type: string;
+      readonly user_id: string;
+      readonly valid: boolean;
+    };
+    output: {
+      readonly decision: "continue" | "reject";
+      readonly message?: string;
+    };
+  };
+  password_verification_attempt: {
+    input: {
+      readonly user_id: string;
+      readonly valid: boolean;
+    };
+    output: {
+      readonly decision: "continue" | "reject";
+      readonly message?: string;
+      readonly should_logout_user?: boolean;
+    };
+  };
+  before_user_created: {
+    input: {
+      readonly metadata: Readonly<Record<string, unknown>>;
+      readonly user: HookUser;
+    };
+    output: Record<never, never>;
+  };
+}
+export type AuthHookKind = keyof AuthHooks;
+/** Rejects a hook with a status and message Supabase Auth passes to the client. */
+export declare function hookError(status: number, message: string): AuthHookError;
+/**
+ * A `(request) => Response` handler for a Supabase Auth hook: verifies the
+ * Standard Webhooks signature, types the payload and serializes the answer.
+ *
+ * ```ts
+ * export const POST = authHook('custom_access_token', env.AUTH_HOOK_SECRET, async ({ claims, user_id }) => ({
+ *   claims: { ...claims, org_id: await orgFor(user_id) },
+ * }));
+ * ```
+ */
+export declare function authHook<K extends AuthHookKind>(_kind: K, secret: string | readonly string[], handler: (payload: AuthHooks[K]["input"], webhook: VerifiedWebhook<AuthHooks[K]["input"]>) => AuthHooks[K]["output"] | AuthHookError | Promise<AuthHooks[K]["output"] | AuthHookError>, options?: VerifyOptions): (request: Request) => Promise<Response>;
+export interface DatabaseWebhookPayload {
+  readonly type: "INSERT" | "UPDATE" | "DELETE";
+  readonly table: string;
+  readonly schema: string;
+  readonly record: Readonly<Record<string, unknown>> | null;
+  readonly old_record: Readonly<Record<string, unknown>> | null;
+}
+export interface DatabaseChange<R> {
+  readonly type: "INSERT" | "UPDATE" | "DELETE";
+  readonly table: string;
+  readonly record: R | null;
+  readonly oldRecord: Partial<R> | null;
+}
+export declare function isDatabaseWebhook(value: unknown): value is DatabaseWebhookPayload;
+/**
+ * Reads a database webhook payload for `table` as an app-cased change.
+ * Returns `null` for other tables or payloads that aren't database webhooks.
+ */
+export declare function databaseChange<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(sb: BetterSupabase<M, D, F, E>, table: T, payload: unknown): DatabaseChange<Row<M, T>> | null;
+//#endregion

package/dist/webhooks/index.js

@@ -0,0 +1,2 @@
+import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../webhooks-DbMTJJX2.js";
+export { authHook, databaseChange, hookError, isDatabaseWebhook, signWebhook, timingSafeEqual, verifySharedSecret, verifyWebhook };

package/dist/webhooks-DbMTJJX2.js

@@ -0,0 +1,139 @@
+import { n as dbError } from "./errors-Bl3rkOzo.js";
+import { i as ok, n as err } from "./result-DWXatkd6.js";
+import { s as toApp } from "./shared-_6-uPL7E.js";
+//#region src/webhooks/index.ts
+const encoder = new TextEncoder();
+/** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */
+function secretBytes(secret) {
+	const raw = secret.replace(/^v1,/, "").replace(/^whsec_/, "");
+	try {
+		return Uint8Array.from(atob(raw), (char) => char.charCodeAt(0));
+	} catch {
+		throw new TypeError("Webhook secret is not valid base64");
+	}
+}
+async function signature(secret, content) {
+	const key = await crypto.subtle.importKey("raw", secretBytes(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(content)));
+	let binary = "";
+	for (const byte of mac) binary += String.fromCharCode(byte);
+	return btoa(binary);
+}
+/** Constant-time string comparison. */
+function timingSafeEqual(a, b) {
+	const left = encoder.encode(a);
+	const right = encoder.encode(b);
+	let diff = left.length ^ right.length;
+	for (let index = 0; index < Math.max(left.length, right.length); index++) diff |= (left[index] ?? 0) ^ (right[index] ?? 0);
+	return diff === 0;
+}
+function header(headers, name) {
+	if (headers instanceof Headers) return headers.get(name);
+	return Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1] ?? null;
+}
+const unauthorized = (code, message) => dbError("unauthorized", message, { code });
+/** Headers for a signed Standard Webhooks request. */
+async function signWebhook(secret, message) {
+	const timestamp = String(Math.floor((message.timestamp ?? /* @__PURE__ */ new Date()).getTime() / 1e3));
+	return {
+		"webhook-id": message.id,
+		"webhook-timestamp": timestamp,
+		"webhook-signature": `v1,${await signature(secret, `${message.id}.${timestamp}.${message.body}`)}`
+	};
+}
+/**
+* Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
+* `webhook-signature`) and parses the JSON body. Pass several secrets while
+* rotating.
+*/
+async function verifyWebhook(input, secrets, options = {}) {
+	const headers = input.headers;
+	const body = input instanceof Request ? await input.text() : input.body;
+	const id = header(headers, "webhook-id");
+	const timestamp = header(headers, "webhook-timestamp");
+	const signatures = header(headers, "webhook-signature");
+	if (!id || !timestamp || !signatures) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing webhook signature headers"));
+	const seconds = Number(timestamp);
+	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
+	const now = (options.now?.() ?? Date.now()) / 1e3;
+	const tolerance = options.tolerance ?? 300;
+	if (seconds < now - tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_OLD", "Webhook timestamp is too old"));
+	if (seconds > now + tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_NEW", "Webhook timestamp is in the future"));
+	const content = `${id}.${timestamp}.${body}`;
+	const offered = signatures.split(" ").map((entry) => entry.split(",")).filter(([version, value]) => version === "v1" && value).map(([, value]) => value);
+	let valid = false;
+	for (const secret of typeof secrets === "string" ? [secrets] : secrets) {
+		const expected = await signature(secret, content);
+		for (const candidate of offered) if (timingSafeEqual(candidate, expected)) valid = true;
+	}
+	if (!valid) return err(unauthorized("WEBHOOK_INVALID_SIGNATURE", "Invalid webhook signature"));
+	try {
+		return ok({
+			id,
+			timestamp: /* @__PURE__ */ new Date(seconds * 1e3),
+			payload: JSON.parse(body),
+			body
+		});
+	} catch {
+		return err(dbError("invalid_request", "Webhook body is not JSON"));
+	}
+}
+/** Checks a shared-secret header (database webhooks), in constant time. */
+function verifySharedSecret(request, secret, headerName = "authorization") {
+	return timingSafeEqual((request.headers.get(headerName) ?? "").replace(/^Bearer\s+/i, ""), secret);
+}
+/** Rejects a hook with a status and message Supabase Auth passes to the client. */
+function hookError(status, message) {
+	return { error: {
+		http_code: status,
+		message
+	} };
+}
+/**
+* A `(request) => Response` handler for a Supabase Auth hook: verifies the
+* Standard Webhooks signature, types the payload and serializes the answer.
+*
+* ```ts
+* export const POST = authHook('custom_access_token', env.AUTH_HOOK_SECRET, async ({ claims, user_id }) => ({
+*   claims: { ...claims, org_id: await orgFor(user_id) },
+* }));
+* ```
+*/
+function authHook(_kind, secret, handler, options) {
+	return async (request) => {
+		const verified = await verifyWebhook(request, secret, options);
+		if (!verified.ok) return Response.json(hookError(verified.error.status, verified.error.message), { status: verified.error.status });
+		try {
+			const answer = await handler(verified.data.payload, verified.data);
+			const status = "error" in answer ? answer.error.http_code : 200;
+			return Response.json(answer, { status });
+		} catch (cause) {
+			console.error("better-supabase: auth hook failed", cause);
+			return Response.json(hookError(500, "Hook failed"), { status: 500 });
+		}
+	};
+}
+function isDatabaseWebhook(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const payload = value;
+	return (payload["type"] === "INSERT" || payload["type"] === "UPDATE" || payload["type"] === "DELETE") && typeof payload["table"] === "string" && typeof payload["schema"] === "string";
+}
+/**
+* Reads a database webhook payload for `table` as an app-cased change.
+* Returns `null` for other tables or payloads that aren't database webhooks.
+*/
+function databaseChange(sb, table, payload) {
+	const meta = sb.meta.tables[table];
+	if (!meta || !isDatabaseWebhook(payload) || payload.table !== meta.name || payload.schema !== meta.schema) return null;
+	return {
+		type: payload.type,
+		table,
+		record: payload.record ? toApp(meta, payload.record) : null,
+		oldRecord: payload.old_record ? toApp(meta, payload.old_record) : null
+	};
+}
+//#endregion
+export { signWebhook as a, verifyWebhook as c, isDatabaseWebhook as i, databaseChange as n, timingSafeEqual as o, hookError as r, verifySharedSecret as s, authHook as t };