better-supabase 0.0.0 → 0.1.0

package/dist/edge/index.d.ts

@@ -0,0 +1,43 @@
+import { k as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
+import { t as BetterSupabase } from "../define-CTfWw-SS.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-PoTpy5DT.js";
+import { i as ResourceRouteOptions } from "../resource-SkPTRJDD.js";
+//#region src/edge/index.d.ts
+export interface CorsOptions {
+  /** Allowed origins, or `*`. Defaults to `*`. */
+  readonly origin?: string | readonly string[];
+  /** Defaults to the headers supabase-js sends. */
+  readonly headers?: readonly string[];
+  readonly methods?: readonly string[];
+  readonly maxAge?: number;
+}
+export interface EdgeOptions extends ServerOptions {
+  /** Answer preflights and add CORS headers. `true` uses Supabase's defaults. */
+  readonly cors?: boolean | CorsOptions;
+  /** Include error details in problem responses. Defaults to `NODE_ENV === 'development'`. */
+  readonly exposeErrors?: boolean;
+}
+export interface HandlerOptions extends GuardOptions {
+  /** Refresh an expired cookie session and send the new cookies. */
+  readonly refresh?: boolean;
+}
+export type EdgeHandler = (request: Request) => Promise<Response>;
+export type ResourceMap<M extends AnyModels> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T> | true; };
+export interface ResourcesOptions extends HandlerOptions {
+  /** Path before the resources, e.g. `/api` (Supabase: `/<function-name>`). */
+  readonly basePath?: string;
+}
+export interface BetterEdge<M extends AnyModels, F extends AnyFunctions, E> extends BetterServer<M, F, E> {
+  /**
+   * A fetch handler (`Deno.serve`, Workers `fetch`) running as the caller.
+   * `Result`s become JSON or Problem Details; `undefined` becomes 204.
+   */
+  handler(fn: (request: Request, ctx: ServerContext<M, F, E>) => unknown, options?: HandlerOptions): EdgeHandler;
+  /** REST resources matching `createOpenApi`, e.g. `Deno.serve(bs.resources({ customers: true }))`. */
+  resources(map: ResourceMap<M>, options?: ResourcesOptions): EdgeHandler;
+}
+export declare const SUPABASE_CORS_HEADERS: readonly string[];
+/** Fetch-handler integration for Supabase Edge Functions, Deno, Bun and Workers. */
+export declare function createEdge<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>, options?: EdgeOptions): BetterEdge<M, F, E>;
+//#endregion
+export type { GuardOptions, ResourceRouteOptions };

package/dist/edge/index.js

@@ -0,0 +1,103 @@
+import { n as dbError } from "../errors-Bl3rkOzo.js";
+import { a as problemResponse } from "../problem-DPu6Fh-t.js";
+import { i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-4-dhoV7x.js";
+import { t as defineResource } from "../resource-CYiu6Ygi.js";
+//#region src/edge/index.ts
+const SUPABASE_CORS_HEADERS = [
+	"authorization",
+	"x-client-info",
+	"apikey",
+	"content-type"
+];
+function corsHeaders(request, cors) {
+	const origin = request.headers.get("origin");
+	const allowed = cors.origin ?? "*";
+	let value;
+	if (allowed === "*") value = "*";
+	else if (origin && (typeof allowed === "string" ? [allowed] : allowed).includes(origin)) value = origin;
+	if (!value) return void 0;
+	return {
+		"access-control-allow-origin": value,
+		"access-control-allow-headers": (cors.headers ?? SUPABASE_CORS_HEADERS).join(", "),
+		"access-control-allow-methods": (cors.methods ?? [
+			"GET",
+			"POST",
+			"PATCH",
+			"DELETE",
+			"OPTIONS"
+		]).join(", "),
+		...cors.maxAge === void 0 ? {} : { "access-control-max-age": String(cors.maxAge) },
+		...value === "*" ? {} : { vary: "origin" }
+	};
+}
+function withHeaders(response, headers) {
+	let target = response;
+	try {
+		for (const [name, value] of Object.entries(headers)) target.headers.set(name, value);
+	} catch {
+		target = new Response(response.body, response);
+		for (const [name, value] of Object.entries(headers)) target.headers.set(name, value);
+	}
+	return target;
+}
+/** Fetch-handler integration for Supabase Edge Functions, Deno, Bun and Workers. */
+function createEdge(sb, options = {}) {
+	const server = createServer(sb, options);
+	const expose = options.exposeErrors ?? defaultExpose();
+	const cors = options.cors === true ? {} : options.cors === false ? void 0 : options.cors;
+	const serve = (run, handlerOptions) => {
+		return async (request) => {
+			const extra = cors ? corsHeaders(request, cors) : void 0;
+			if (cors && request.method === "OPTIONS") return new Response(null, {
+				status: 204,
+				headers: extra ?? {}
+			});
+			const ctx = await server.context(request, { refresh: handlerOptions.refresh ?? false });
+			const instance = new URL(request.url).pathname;
+			const denied = guard(ctx.auth, handlerOptions.allow, handlerOptions.aal);
+			let response;
+			try {
+				response = denied ? problemResponse(denied, {
+					instance,
+					expose
+				}) : await run(request, ctx);
+			} catch (cause) {
+				response = problemResponse(dbError("unexpected", expose && cause instanceof Error ? cause.message : "Internal server error"), {
+					instance,
+					expose
+				});
+			}
+			response = ctx.resolution.apply(response);
+			return extra ? withHeaders(response, extra) : response;
+		};
+	};
+	return extendServer(server, {
+		handler(fn, handlerOptions = {}) {
+			return serve((request, ctx) => respond(() => fn(request, ctx), {
+				instance: new URL(request.url).pathname,
+				expose
+			}), handlerOptions);
+		},
+		resources(map, resourcesOptions = {}) {
+			const base = (resourcesOptions.basePath ?? "").replace(/\/$/, "");
+			const handlers = /* @__PURE__ */ new Map();
+			for (const [table, resource] of Object.entries(map)) {
+				if (!resource) continue;
+				handlers.set(table, defineResource(sb, table, resource === true ? {} : resource));
+			}
+			return serve(async (request, ctx) => {
+				const { pathname } = new URL(request.url);
+				const instance = pathname;
+				const [table, id, extra] = (pathname.startsWith(`${base}/`) ? pathname.slice(base.length + 1) : void 0)?.split("/") ?? [];
+				const handler = table ? handlers.get(table) : void 0;
+				if (!handler || extra !== void 0 || id !== void 0 && !handler.keyParam) return problemResponse(dbError("not_found", `No route for ${pathname}`), { instance });
+				return handler.handle(request, ctx.db, id === void 0 || id === "" ? void 0 : decodeURIComponent(id), {
+					instance,
+					expose
+				});
+			}, resourcesOptions);
+		}
+	});
+}
+//#endregion
+export { SUPABASE_CORS_HEADERS, createEdge };

package/dist/entitlements-BBg61DQZ.d.ts

@@ -0,0 +1,20 @@
+import { t as AuthSession } from "./view-B0ltUmTi.js";
+//#region src/auth/entitlements.d.ts
+/**
+ * Entitlement keys of the `memberships[].entitlements` claim: the literal
+ * union when `sb.claims(schema)` declares one (`z.enum([...])`), otherwise
+ * `string`.
+ */
+type EntitlementKey<C> = C extends {
+  readonly memberships?: readonly (infer M)[] | undefined;
+} ? M extends {
+  readonly entitlements?: readonly (infer K)[] | undefined;
+} ? K extends string ? K : string : string : string;
+/**
+ * Whether the session's `memberships` claim grants `key` in `tenantId`. The
+ * claim is as fresh as the token: enforce it in RLS with
+ * `better_supabase.has_entitlement()`, and refresh the session after checkout.
+ */
+declare function hasEntitlement<C>(session: AuthSession<C>, tenantId: string, key: EntitlementKey<C>): boolean;
+//#endregion
+export { hasEntitlement as n, EntitlementKey as t };

package/dist/entitlements-BC_khwRy.js

@@ -0,0 +1,17 @@
+//#region src/auth/entitlements.ts
+/**
+* Whether the session's `memberships` claim grants `key` in `tenantId`. The
+* claim is as fresh as the token: enforce it in RLS with
+* `better_supabase.has_entitlement()`, and refresh the session after checkout.
+*/
+function hasEntitlement(session, tenantId, key) {
+	if (session.kind !== "user") return false;
+	const memberships = session.claims.memberships;
+	if (!Array.isArray(memberships)) return false;
+	return memberships.some((entry) => {
+		if (entry?.tenant_id !== tenantId) return false;
+		return Array.isArray(entry.entitlements) && entry.entitlements.includes(key);
+	});
+}
+//#endregion
+export { hasEntitlement as t };

package/dist/env/index.d.ts

@@ -0,0 +1,2 @@
+import { a as EnvResult, c as PublicEnv, d as parseEnv, f as publicEnv, i as EnvOptions, l as envSchema, n as ENV_VARIABLES, o as EnvSource, p as toServerEnv, r as EnvIssue, s as EnvValidationError, t as BetterSupabaseEnv, u as loadEnv } from "../index-Dy6kuF0P.js";
+export { BetterSupabaseEnv, ENV_VARIABLES, EnvIssue, EnvOptions, EnvResult, EnvSource, EnvValidationError, PublicEnv, envSchema, loadEnv, parseEnv, publicEnv, toServerEnv };

package/dist/env/index.js

@@ -0,0 +1,2 @@
+import { a as parseEnv, i as loadEnv, n as EnvValidationError, o as publicEnv, r as envSchema, s as toServerEnv, t as ENV_VARIABLES } from "../env-BEToab0I.js";
+export { ENV_VARIABLES, EnvValidationError, envSchema, loadEnv, parseEnv, publicEnv, toServerEnv };

package/dist/env-BEToab0I.js

@@ -0,0 +1,204 @@
+//#region src/env/index.ts
+const PREFIXES = [
+	"",
+	"NEXT_PUBLIC_",
+	"VITE_",
+	"PUBLIC_",
+	"EXPO_PUBLIC_",
+	"NUXT_PUBLIC_"
+];
+const ENV_VARIABLES = {
+	url: PREFIXES.map((prefix) => `${prefix}SUPABASE_URL`),
+	publishableKey: PREFIXES.flatMap((prefix) => [`${prefix}SUPABASE_PUBLISHABLE_KEY`, `${prefix}SUPABASE_PUBLISHABLE_DEFAULT_KEY`]),
+	secretKey: ["SUPABASE_SECRET_KEY"],
+	dbUrl: ["SUPABASE_DB_URL", "DATABASE_URL"],
+	jwksUrl: ["SUPABASE_JWKS_URL"],
+	readUrl: ["SUPABASE_READ_URL"]
+};
+const LOOPBACK = /^(localhost|127(?:\.\d{1,3}){3}|\[::1\])$/;
+const HOSTED = /^([a-z0-9]{20})\.supabase\.co$/;
+var EnvValidationError = class extends Error {
+	name = "EnvValidationError";
+	issues;
+	constructor(issues) {
+		super(`Invalid Supabase environment:\n${issues.map((issue) => `  - ${issue.variables[0] ?? "env"}: ${issue.message}`).join("\n")}`);
+		this.issues = issues;
+	}
+};
+function first(source, names) {
+	for (const name of names) {
+		const value = source[name]?.trim();
+		if (value) return value;
+	}
+}
+/** `SUPABASE_*_KEYS` JSON objects, as `@supabase/server` reads them. */
+function keySet(source, name, kind, issues) {
+	const raw = source[name];
+	if (!raw) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		parsed = void 0;
+	}
+	const entries = typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? Object.entries(parsed) : [];
+	if (entries.length === 0 || entries.some(([, value]) => typeof value !== "string")) {
+		issues.push({
+			variables: [name],
+			message: "must be a JSON object of key names to keys"
+		});
+		return;
+	}
+	const keys = {};
+	for (const [key, value] of entries) if (checkKey(value, kind, [name], issues)) keys[key] = value;
+	return keys;
+}
+function preferred(keys) {
+	if (!keys) return void 0;
+	return keys["default"] ?? Object.values(keys)[0];
+}
+function checkUrl(value, variables, issues) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		issues.push({
+			variables,
+			message: "is not a valid URL"
+		});
+		return;
+	}
+	if (url.protocol === "https:") return url;
+	if (url.protocol === "http:" && LOOPBACK.test(url.hostname)) return url;
+	issues.push({
+		variables,
+		message: "must use https (http is only allowed for localhost / 127.0.0.1 / [::1])"
+	});
+}
+function checkKey(value, kind, variables, issues) {
+	if (value.startsWith(`sb_${kind}_`)) return true;
+	if (value.startsWith("eyJ")) issues.push({
+		variables,
+		message: `is a legacy JWT key; use the new sb_${kind}_ key (Project Settings > API Keys)`
+	});
+	else if (value.startsWith(kind === "publishable" ? "sb_secret_" : "sb_publishable_")) issues.push({
+		variables,
+		message: kind === "publishable" ? "holds a secret key; never expose sb_secret_ keys as publishable" : "holds a publishable key, not a secret key"
+	});
+	else issues.push({
+		variables,
+		message: `must start with sb_${kind}_`
+	});
+	return false;
+}
+/**
+* Reads and validates Supabase settings. Accepts the `SUPABASE_`,
+* `NEXT_PUBLIC_`, `VITE_`, `PUBLIC_`, `EXPO_PUBLIC_` and `NUXT_PUBLIC_`
+* spellings. Issues name variables, never values.
+*/
+function parseEnv(source, options = {}) {
+	const issues = [];
+	const required = new Set(options.require ?? []);
+	const rawUrl = first(source, ENV_VARIABLES.url);
+	const url = rawUrl ? checkUrl(rawUrl, ENV_VARIABLES.url, issues) : void 0;
+	if (!rawUrl) issues.push({
+		variables: ENV_VARIABLES.url,
+		message: "is not set"
+	});
+	const publishableKeys = keySet(source, "SUPABASE_PUBLISHABLE_KEYS", "publishable", issues);
+	const singlePublishable = first(source, ENV_VARIABLES.publishableKey);
+	const publishableKey = singlePublishable ?? preferred(publishableKeys);
+	if (!publishableKey) issues.push({
+		variables: ENV_VARIABLES.publishableKey,
+		message: "is not set"
+	});
+	else if (singlePublishable) checkKey(publishableKey, "publishable", ENV_VARIABLES.publishableKey, issues);
+	const namedSecrets = keySet(source, "SUPABASE_SECRET_KEYS", "secret", issues);
+	const singleSecret = first(source, ENV_VARIABLES.secretKey);
+	const secretKey = singleSecret ?? preferred(namedSecrets);
+	if (singleSecret) checkKey(singleSecret, "secret", ENV_VARIABLES.secretKey, issues);
+	else if (!secretKey && required.has("secretKey")) issues.push({
+		variables: ENV_VARIABLES.secretKey,
+		message: "is not set"
+	});
+	const dbUrl = first(source, ENV_VARIABLES.dbUrl);
+	if (dbUrl && !/^postgres(ql)?:\/\//.test(dbUrl)) issues.push({
+		variables: ENV_VARIABLES.dbUrl,
+		message: "must be a postgres:// connection string"
+	});
+	else if (!dbUrl && required.has("dbUrl")) issues.push({
+		variables: ENV_VARIABLES.dbUrl,
+		message: "is not set"
+	});
+	const rawJwks = first(source, ENV_VARIABLES.jwksUrl);
+	const jwksOverride = rawJwks ? checkUrl(rawJwks, ENV_VARIABLES.jwksUrl, issues) : void 0;
+	const rawRead = first(source, ENV_VARIABLES.readUrl);
+	const readUrl = rawRead ? checkUrl(rawRead, ENV_VARIABLES.readUrl, issues) : void 0;
+	if (issues.length > 0 || !url || !publishableKey) return {
+		ok: false,
+		issues
+	};
+	const base = url.href.replace(/\/+$/, "");
+	const projectRef = HOSTED.exec(url.hostname)?.[1];
+	return {
+		ok: true,
+		env: {
+			url: base,
+			publishableKey,
+			jwksUrl: jwksOverride ?? new URL(`${base}/auth/v1/.well-known/jwks.json`),
+			...secretKey ? {
+				secretKey,
+				secretKeys: {
+					...namedSecrets,
+					default: secretKey
+				}
+			} : {},
+			...dbUrl ? { dbUrl } : {},
+			...projectRef ? { projectRef } : {},
+			...readUrl ? { readUrl: readUrl.href.replace(/\/+$/, "") } : {}
+		}
+	};
+}
+function processEnv() {
+	return globalThis.process?.env ?? {};
+}
+/** Like `parseEnv`, but throws `EnvValidationError`. Reads `process.env` by default. */
+function loadEnv(source = processEnv(), options = {}) {
+	const result = parseEnv(source, options);
+	if (!result.ok) throw new EnvValidationError(result.issues);
+	return result.env;
+}
+/** The env validator as a Standard Schema, for t3-env, framework config or any validator slot. */
+function envSchema(options = {}) {
+	return { "~standard": {
+		version: 1,
+		vendor: "better-supabase",
+		validate(value) {
+			if (typeof value !== "object" || value === null) return { issues: [{ message: "Expected an environment object" }] };
+			const result = parseEnv(value, options);
+			if (result.ok) return { value: result.env };
+			return { issues: result.issues.map((issue) => ({
+				message: `${issue.variables[0] ?? "env"} ${issue.message}`,
+				path: issue.variables.slice(0, 1)
+			})) };
+		}
+	} };
+}
+/** The parts that are safe in client bundles. */
+function publicEnv(env) {
+	return {
+		url: env.url,
+		publishableKey: env.publishableKey
+	};
+}
+/** Converts to `@supabase/server`'s `SupabaseEnv` (the `env` option of `withSupabase`). */
+function toServerEnv(env) {
+	return {
+		url: env.url,
+		publishableKeys: { default: env.publishableKey },
+		secretKeys: env.secretKeys ?? (env.secretKey ? { default: env.secretKey } : {}),
+		jwks: env.jwksUrl
+	};
+}
+//#endregion
+export { parseEnv as a, loadEnv as i, EnvValidationError as n, publicEnv as o, envSchema as r, toServerEnv as s, ENV_VARIABLES as t };

package/dist/errors-Bl3rkOzo.js

@@ -0,0 +1,196 @@
+//#region src/core/errors.ts
+const STATUS = {
+	not_found: 404,
+	unauthorized: 401,
+	forbidden: 403,
+	conflict: 409,
+	foreign_key: 409,
+	check: 422,
+	not_null: 422,
+	exclusion: 409,
+	invalid_input: 400,
+	raised: 400,
+	timeout: 504,
+	serialization: 409,
+	network: 503,
+	aborted: 499,
+	invalid_request: 400,
+	validation: 422,
+	multiple_rows: 409,
+	stale: 412,
+	rate_limited: 429,
+	unexpected: 500
+};
+function statusOf(kind) {
+	return STATUS[kind];
+}
+/** Creates a `DbError` with the default status for its kind. */
+function dbError(kind, message, ...[extra]) {
+	const error = {
+		kind,
+		message,
+		status: STATUS[kind]
+	};
+	if (extra) {
+		for (const [key, value] of Object.entries(extra)) if (value !== void 0) error[key] = value;
+	}
+	return error;
+}
+function isDbError(value) {
+	return typeof value === "object" && value !== null && typeof value.kind === "string" && typeof value.message === "string" && typeof value.status === "number";
+}
+/**
+* The `DbError` in a `DbError`, a `DbException`, or an error whose `cause`
+* is a `DbError` (what `sb.mapError()` mappers should set).
+*/
+function dbErrorOf(value) {
+	if (value instanceof DbException) return value.error;
+	if (value instanceof Error && isDbError(value.cause)) return value.cause;
+	return isDbError(value) ? value : void 0;
+}
+function constraintGuard(kind) {
+	return (error, constraint) => {
+		const found = dbErrorOf(error);
+		if (found?.kind !== kind) return false;
+		return constraint === void 0 || found.constraint === constraint;
+	};
+}
+/**
+* A unique violation, optionally for one constraint. Accepts a `DbError` or a
+* `DbException`. Pass the generated `UniqueConstraint` type to check names:
+* `isConflict<UniqueConstraint>(error, 'customers_organization_id_kvk_key')`.
+*/
+const isConflict = constraintGuard("conflict");
+/** A CHECK violation, optionally for one constraint (`CheckConstraint`). */
+const isCheck = constraintGuard("check");
+/** A foreign key violation, optionally for one constraint (`ForeignKeyConstraint`). */
+const isForeignKey = constraintGuard("foreign_key");
+/** Thrown by `.orThrow()`. Carries the plain `DbError` as `error`. */
+var DbException = class extends Error {
+	name = "DbException";
+	error;
+	constructor(error) {
+		super(error.message);
+		this.error = error;
+	}
+	get kind() {
+		return this.error.kind;
+	}
+};
+const CONSTRAINT_IN_MESSAGE = /constraint "([^"]+)"/;
+const KEY_COLUMNS_IN_DETAILS = /^Key \(([^)]+)\)=/;
+const COLUMN_IN_MESSAGE = /column "([^"]+)"/;
+const RETRY_AFTER = /retry after (\d+)/i;
+const PERMISSION_DENIED = /^permission denied for (table|view|sequence|function|schema) (\S+)/;
+function constraintOf(raw) {
+	return raw.constraint ?? CONSTRAINT_IN_MESSAGE.exec(raw.message ?? "")?.[1];
+}
+function columnsOf(raw) {
+	return KEY_COLUMNS_IN_DETAILS.exec(raw.details ?? "")?.[1]?.split(",").map((column) => column.trim());
+}
+function optional(raw) {
+	const out = {};
+	if (raw.code) out.code = raw.code;
+	if (raw.details) out.details = raw.details;
+	if (raw.hint) out.hint = raw.hint;
+	return out;
+}
+/**
+* Maps a PostgREST or Postgres error to a `DbError`. Custom mappers run
+* first; the first one that returns an error wins.
+*/
+function mapDbError(raw, mappers = []) {
+	const fallback = mapBuiltin(raw);
+	for (const mapper of mappers) {
+		const mapped = mapper(raw, fallback);
+		if (mapped) return mapped;
+	}
+	return fallback;
+}
+function mapBuiltin(raw) {
+	const message = raw.message ?? "Unknown database error";
+	const base = optional(raw);
+	const code = raw.code ?? "";
+	if (raw.name === "AbortError" || code === "20" || message.startsWith("AbortError:")) return dbError("aborted", message, base);
+	switch (code) {
+		case "23505": {
+			const extra = {};
+			const constraint = constraintOf(raw);
+			const columns = columnsOf(raw);
+			if (constraint) extra.constraint = constraint;
+			if (columns) extra.columns = columns;
+			return dbError("conflict", message, {
+				...base,
+				...extra
+			});
+		}
+		case "23503": {
+			const extra = {};
+			const constraint = constraintOf(raw);
+			const columns = columnsOf(raw);
+			if (constraint) extra.constraint = constraint;
+			if (columns) extra.columns = columns;
+			return dbError("foreign_key", message, {
+				...base,
+				...extra
+			});
+		}
+		case "23514": {
+			const constraint = constraintOf(raw);
+			return dbError("check", message, {
+				...base,
+				...constraint ? { constraint } : {}
+			});
+		}
+		case "23502": {
+			const column = raw.column ?? COLUMN_IN_MESSAGE.exec(message)?.[1];
+			return dbError("not_null", message, {
+				...base,
+				...column ? { column } : {}
+			});
+		}
+		case "23P01": {
+			const constraint = constraintOf(raw);
+			return dbError("exclusion", message, {
+				...base,
+				...constraint ? { constraint } : {}
+			});
+		}
+		case "42501": {
+			const object = PERMISSION_DENIED.exec(message);
+			const postgrestHint = base.hint?.startsWith("Grant the required");
+			if (!object || base.hint && !postgrestHint) return dbError("forbidden", message, base);
+			const advice = object[1] === "table" || object[1] === "view" ? `Supabase no longer grants new tables to the Data API roles: add ${object[2]} to \`expose\` and run \`better-supabase sql add grants\`. \`better-supabase doctor\` (BS106) lists every missing grant.` : `Supabase no longer grants new objects to the Data API roles automatically; grant ${object[1] === "function" ? "execute" : "usage"} on ${object[1]} ${object[2]} to the role that needs it.`;
+			return dbError("forbidden", message, {
+				...base,
+				hint: postgrestHint ? `${base.hint} ${advice}` : advice
+			});
+		}
+		case "P0001": return dbError("raised", message, base);
+		case "57014": return dbError("timeout", message, base);
+		case "40001":
+		case "40P01": return dbError("serialization", message, base);
+		case "PGRST116": return /multiple|more than one/i.test(raw.details ?? message) ? dbError("multiple_rows", message, base) : dbError("not_found", message, base);
+		case "PGRST301":
+		case "PGRST302":
+		case "PGRST303": return dbError("unauthorized", message, base);
+		case "PGRST123": return dbError("invalid_request", message, {
+			...base,
+			hint: base.hint ?? "PostgREST aggregates are off. Run `alter role authenticator set pgrst.db_aggregates_enabled = 'true'; notify pgrst, 'reload config';` (see BS210), or use better-supabase/postgres."
+		});
+		case "BS429":
+		case "PT429": {
+			const seconds = RETRY_AFTER.exec(raw.details ?? "")?.[1];
+			return dbError("rate_limited", message, {
+				...base,
+				...seconds ? { retryAfter: Number(seconds) } : {}
+			});
+		}
+	}
+	if (code.startsWith("22")) return dbError("invalid_input", message, base);
+	if (code.startsWith("PGRST1") || code.startsWith("PGRST2")) return dbError("invalid_request", message, base);
+	if (code.startsWith("08") || /fetch failed|network/i.test(message)) return dbError("network", message, base);
+	return dbError("unexpected", message, base);
+}
+//#endregion
+export { isConflict as a, mapDbError as c, isCheck as i, statusOf as l, dbError as n, isDbError as o, dbErrorOf as r, isForeignKey as s, DbException as t };

package/dist/events/index.d.ts

@@ -0,0 +1,2 @@
+import { a as HttpMode, c as RowEventData, d as httpSink, f as isCloudEvent, i as ForwardOptions, l as forwardMutations, m as toHttp, n as CloudEventOptions, o as HttpSinkOptions, p as toCloudEvents, r as EventSink, s as ROW_EVENT_TYPES, t as CloudEvent, u as fromHttp } from "../index-DQVvHzjW.js";
+export { CloudEvent, CloudEventOptions, EventSink, ForwardOptions, HttpMode, HttpSinkOptions, ROW_EVENT_TYPES, RowEventData, forwardMutations, fromHttp, httpSink, isCloudEvent, toCloudEvents, toHttp };

package/dist/events/index.js

@@ -0,0 +1,2 @@
+import { a as isCloudEvent, i as httpSink, n as forwardMutations, o as toCloudEvents, r as fromHttp, s as toHttp, t as ROW_EVENT_TYPES } from "../events-BuzTgn2D.js";
+export { ROW_EVENT_TYPES, forwardMutations, fromHttp, httpSink, isCloudEvent, toCloudEvents, toHttp };