better-supabase 0.0.0 → 0.2.0

package/dist/plugins/soft-delete/index.js

@@ -0,0 +1,69 @@
+import { t as and } from "../../types-6cYK9pbJ.js";
+import { i as ok, t as AsyncResult } from "../../result-DWXatkd6.js";
+import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
+import { n as scopeOperation } from "../../scope-CDHcS7dE.js";
+import { a as isNotNull, o as isNull, t as dbName } from "../../shared-_6-uPL7E.js";
+//#region src/plugins/soft-delete/index.ts
+function deletedColumn(table) {
+	return dbName(table, table.flags.softDelete);
+}
+function scopeFor(table) {
+	const column = deletedColumn(table);
+	return column ? isNull(column) : void 0;
+}
+/**
+* Soft delete for tables generated with `Flags.softDelete`:
+*
+* - reads, updates and deletes skip deleted rows, including inside includes
+*   and relation filters (`withDeleted` / `onlyDeleted` change the root table);
+* - `delete` sets the column instead (`{ hard: true }` really deletes);
+* - `restore(key)` clears it.
+*
+* Deletes become updates without `RETURNING`, so a SELECT policy that hides
+* deleted rows does not make them fail.
+*/
+function softDelete() {
+	return definePlugin({
+		name: "softDelete",
+		enforce: "pre",
+		transformQuery(op, { options }) {
+			const hardDelete = op.kind === "delete" && options["hard"] === true;
+			const withDeleted = options["withDeleted"] === true || hardDelete;
+			const onlyDeleted = options["onlyDeleted"] === true;
+			const scoped = scopeOperation(op, scopeFor, !withDeleted && !onlyDeleted);
+			const column = deletedColumn(op.table);
+			if (!onlyDeleted || !column || scoped.kind === "insert") return scoped;
+			return {
+				...scoped,
+				where: and(scoped.where, isNotNull(column))
+			};
+		},
+		beforeMutation(op, { table, options, now }) {
+			if (op.kind !== "delete" || options["hard"] === true) return op;
+			const column = deletedColumn(table);
+			if (!column) return op;
+			return {
+				kind: "update",
+				table,
+				set: { [column]: now().toISOString() },
+				where: op.where,
+				returning: void 0
+			};
+		},
+		repository({ table, base }) {
+			const flag = table.flags.softDelete;
+			if (!flag) return void 0;
+			const update = base["update"];
+			return { restore: (key, args) => AsyncResult.from(async () => {
+				const result = await update(key, { [flag]: null }, {
+					...args,
+					withDeleted: true,
+					returning: false
+				});
+				return result.ok ? ok(void 0) : result;
+			}) };
+		}
+	});
+}
+//#endregion
+export { softDelete };

package/dist/plugins/tenant/index.d.ts

@@ -0,0 +1,49 @@
+import { A as SchemaMeta } from "../../types-C83v5SQz.js";
+import { f as Plugin, h as RequestContext, m as RepositoryExtension, o as HasFlag } from "../../plugin-C4TR9J0Z.js";
+//#region src/plugins/tenant/index.d.ts
+/**
+ * Dotted paths to the string claims of `C` (up to three levels), e.g.
+ * `'tenant_id' | 'app_metadata.tenant_id'`. Any string without a claims type.
+ */
+export type ClaimPath<C> = unknown extends C ? string : StringPaths<C, [1, 2, 3]>;
+type StringPaths<T, Depth extends readonly unknown[]> = T extends object ? T extends readonly unknown[] ? never : { [K in keyof T & string]-?: (NonNullable<T[K]> extends string ? K : never) | (Depth extends readonly [unknown, ...infer Rest] ? `${K}.${StringPaths<NonNullable<T[K]>, Rest>}` : never); }[keyof T & string] : never;
+/** `C` is the claims type (`sb.claims(schema)`'s output); it types `claim`. */
+export interface TenantOptions<C = unknown> {
+  /**
+   * JWT claim path(s) holding the tenant id when `context.tenant` is not set.
+   * Dots walk into objects. Defaults to `config.claims.tenant` (`tenant_id`),
+   * then the same key in `app_metadata`. `user_metadata` is never a source:
+   * users can write it.
+   */
+  readonly claim?: ClaimPath<C> | readonly ClaimPath<C>[];
+  /** Custom resolution, e.g. from a header validated against memberships. */
+  readonly resolve?: (context: RequestContext) => string | undefined;
+  /**
+   * What happens on a tenant table without a tenant in the context:
+   * `error` (default) fails with `forbidden`; `skip` leaves it to RLS.
+   */
+  readonly onMissing?: "error" | "skip";
+}
+export interface TenantFindArgs {
+  /** Skip the tenant filter for this call (admin tooling, jobs). RLS still applies. */
+  readonly allTenants?: boolean;
+}
+export interface TenantExtension extends RepositoryExtension {
+  readonly findArgs: HasFlag<this["M"], this["T"], "tenant"> extends true ? TenantFindArgs : unknown;
+  readonly methods: unknown;
+  readonly deleteArgs: HasFlag<this["M"], this["T"], "tenant"> extends true ? TenantFindArgs : unknown;
+}
+/**
+ * The tenant for a request: `context.tenant`, then the configured claim.
+ * `schema` supplies the default claim (`config.claims.tenant`).
+ */
+export declare function resolveTenant<C = unknown>(context: RequestContext, options?: TenantOptions<C>, schema?: Pick<SchemaMeta, "claims">): string | undefined;
+/**
+ * Multi-tenancy for tables generated with `Flags.tenant`. Scopes reads,
+ * updates and deletes to the request's tenant (nested includes and relation
+ * filters too), fills the tenant column on insert and rejects writes that
+ * would move rows to another tenant. It complements RLS; it does not replace
+ * it.
+ */
+export declare function tenant<C = unknown>(options?: TenantOptions<C>): Plugin<"tenant", TenantExtension>;
+//#endregion

package/dist/plugins/tenant/index.js

@@ -0,0 +1,75 @@
+import { n as dbError, t as DbException } from "../../errors-Bl3rkOzo.js";
+import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
+import { n as scopeOperation } from "../../scope-CDHcS7dE.js";
+import { i as tenantClaimPaths, n as claimAt, r as claimsOf } from "../../claims-CoTobNC-.js";
+import { n as equals, r as forbidden, t as dbName } from "../../shared-_6-uPL7E.js";
+//#region src/plugins/tenant/index.ts
+/**
+* The tenant for a request: `context.tenant`, then the configured claim.
+* `schema` supplies the default claim (`config.claims.tenant`).
+*/
+function resolveTenant(context, options = {}, schema) {
+	if (options.resolve) return options.resolve(context);
+	if (typeof context.tenant === "string") return context.tenant;
+	const claim = options.claim;
+	const paths = typeof claim === "string" ? [claim] : claim ?? tenantClaimPaths(claimsOf(schema).tenant);
+	for (const path of paths) {
+		const value = claimAt(context.claims, path);
+		if (value !== void 0) return value;
+	}
+}
+function tenantColumn(table) {
+	return dbName(table, table.flags.tenant);
+}
+/**
+* Multi-tenancy for tables generated with `Flags.tenant`. Scopes reads,
+* updates and deletes to the request's tenant (nested includes and relation
+* filters too), fills the tenant column on insert and rejects writes that
+* would move rows to another tenant. It complements RLS; it does not replace
+* it.
+*/
+function tenant(options = {}) {
+	const onMissing = options.onMissing ?? "error";
+	const current = (table, context, schema) => {
+		const id = resolveTenant(context, options, schema);
+		if (id === void 0 && onMissing === "error" && tenantColumn(table)) throw new DbException(dbError("forbidden", `No tenant in the request context for "${table.key}"`));
+		return id;
+	};
+	return definePlugin({
+		name: "tenant",
+		transformQuery(op, { context, schema, options: call }) {
+			if (call["allTenants"] === true) return op;
+			const id = current(op.table, context, schema);
+			if (id === void 0) return op;
+			return scopeOperation(op, (table) => {
+				const column = tenantColumn(table);
+				return column ? equals(column, id) : void 0;
+			});
+		},
+		beforeMutation(op, { table, context, schema, options: call }) {
+			const column = tenantColumn(table);
+			if (!column || call["allTenants"] === true) return op;
+			const id = current(table, context, schema);
+			if (id === void 0) return op;
+			switch (op.kind) {
+				case "insert": return {
+					...op,
+					rows: op.rows.map((row) => {
+						if (column in row && row[column] !== id) forbidden(`Cannot write a ${table.key} row for another tenant`);
+						return {
+							...row,
+							[column]: id
+						};
+					})
+				};
+				case "update":
+					if (column in op.set && op.set[column] !== id) forbidden(`Cannot move a ${table.key} row to another tenant`);
+					return op;
+				case "delete": return op;
+				default: return op;
+			}
+		}
+	});
+}
+//#endregion
+export { resolveTenant, tenant };

package/dist/plugins/timestamps/index.d.ts

@@ -0,0 +1,9 @@
+import { f as Plugin } from "../../plugin-C4TR9J0Z.js";
+//#region src/plugins/timestamps/index.d.ts
+/**
+ * Stamps the columns generated as `Flags.timestamps`: `createdAt` on insert,
+ * `updatedAt` on insert and update. Values the caller passes win. Pair it with
+ * the `updated-at` SQL kit trigger to cover writes that bypass the app.
+ */
+export declare function timestamps(): Plugin<"timestamps">;
+//#endregion

package/dist/plugins/timestamps/index.js

@@ -0,0 +1,37 @@
+import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
+import { i as insertsOnly, l as withDefault, t as dbName } from "../../shared-_6-uPL7E.js";
+//#region src/plugins/timestamps/index.ts
+/**
+* Stamps the columns generated as `Flags.timestamps`: `createdAt` on insert,
+* `updatedAt` on insert and update. Values the caller passes win. Pair it with
+* the `updated-at` SQL kit trigger to cover writes that bypass the app.
+*/
+function timestamps() {
+	return definePlugin({
+		name: "timestamps",
+		beforeMutation(op, { table, now }) {
+			const flags = table.flags.timestamps;
+			if (!flags) return op;
+			const created = dbName(table, flags.createdAt);
+			const updated = dbName(table, flags.updatedAt);
+			const stamp = now().toISOString();
+			switch (op.kind) {
+				case "insert": {
+					const stampCreated = insertsOnly(op);
+					return {
+						...op,
+						rows: op.rows.map((row) => withDefault(stampCreated ? withDefault(row, created, stamp) : row, updated, stamp))
+					};
+				}
+				case "update": return {
+					...op,
+					set: withDefault(op.set, updated, stamp)
+				};
+				case "delete": return op;
+				default: return op;
+			}
+		}
+	});
+}
+//#endregion
+export { timestamps };

package/dist/plugins/validation/index.d.ts

@@ -0,0 +1,24 @@
+import { f as Plugin } from "../../plugin-C4TR9J0Z.js";
+import { t as StandardSchemaV1 } from "../../standard-CyhRzctb.js";
+//#region src/plugins/validation/index.d.ts
+export interface TableValidators {
+  /** Validates inserts and upserts, with app-cased keys. */
+  readonly insert?: StandardSchemaV1;
+  /** Validates update patches, with app-cased keys. */
+  readonly update?: StandardSchemaV1;
+}
+export interface ValidationOptions {
+  /**
+   * Validators per table key. The `validators` export of a generated
+   * `zod()` or `valibot()` module fits as is.
+   */
+  readonly schemas: Readonly<Record<string, TableValidators>>;
+}
+/**
+ * Validates writes with Standard Schema validators (zod, valibot, arktype,
+ * ...). Runs after other plugins (`enforce: 'post'`), so it sees the tenant,
+ * timestamp and actor columns they fill. Failures become `validation` errors
+ * (422) with issue paths; bulk writes prefix the row index.
+ */
+export declare function validation(options: ValidationOptions): Plugin<"validation">;
+//#endregion

package/dist/plugins/validation/index.js

@@ -0,0 +1,59 @@
+import { n as dbError, t as DbException } from "../../errors-Bl3rkOzo.js";
+import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
+import { t as validate } from "../../standard-FUi3Z3-7.js";
+import { c as toDb, s as toApp } from "../../shared-_6-uPL7E.js";
+//#region src/plugins/validation/index.ts
+async function check(schema, table, row, label, index) {
+	const result = await validate(schema, toApp(table, row), label);
+	if (result.ok) {
+		const output = result.data;
+		return typeof output === "object" && output !== null ? toDb(table, output) : { ...row };
+	}
+	const error = result.error;
+	if (index === void 0 || error.kind !== "validation") throw new DbException(error);
+	const issues = error.issues.map((issue) => ({
+		message: issue.message,
+		path: [index, ...issue.path ?? []]
+	}));
+	throw new DbException(dbError("validation", error.message, { issues }));
+}
+/**
+* Validates writes with Standard Schema validators (zod, valibot, arktype,
+* ...). Runs after other plugins (`enforce: 'post'`), so it sees the tenant,
+* timestamp and actor columns they fill. Failures become `validation` errors
+* (422) with issue paths; bulk writes prefix the row index.
+*/
+function validation(options) {
+	return definePlugin({
+		name: "validation",
+		enforce: "post",
+		async beforeMutation(op, { table }) {
+			const validators = options.schemas[table.key];
+			if (!validators) return op;
+			switch (op.kind) {
+				case "insert": {
+					const schema = validators.insert;
+					if (!schema) return op;
+					const many = op.rows.length > 1;
+					const rows = await Promise.all(op.rows.map((row, index) => check(schema, table, row, `${table.key} insert`, many ? index : void 0)));
+					return {
+						...op,
+						rows
+					};
+				}
+				case "update": {
+					const schema = validators.update;
+					if (!schema) return op;
+					return {
+						...op,
+						set: await check(schema, table, op.set, `${table.key} update`, void 0)
+					};
+				}
+				case "delete": return op;
+				default: return op;
+			}
+		}
+	});
+}
+//#endregion
+export { validation };

package/dist/pool-R2m_DkXi.d.ts

@@ -0,0 +1,37 @@
+import { t as SqlClient } from "./executor-BYXQ9AGn.js";
+//#region src/postgres/pool.d.ts
+interface PostgresOptions {
+  /** Defaults to `$SUPABASE_DB_URL`, then `$DATABASE_URL`. */
+  readonly connectionString?: string;
+  readonly max?: number;
+  /** Statement timeout in milliseconds, applied per transaction. */
+  readonly statementTimeout?: number;
+}
+/** JWT claims to run as. `role` must be `authenticated` or `anon`. */
+interface SqlClaims {
+  readonly sub?: string;
+  readonly role?: string;
+  readonly [claim: string]: unknown;
+}
+interface Postgres {
+  /** Connects as the connection-string role. On Supabase that bypasses RLS. */
+  readonly admin: SqlClient;
+  /** Runs every query as the given user, with RLS, like PostgREST does. */
+  asUser(claims: SqlClaims): SqlClient;
+  /** Runs every query as `anon`. */
+  readonly anon: SqlClient;
+  /** Runs `fn` in one transaction. Pass claims to run it as a user. */
+  transaction<T>(fn: (client: SqlClient) => Promise<T>, options?: {
+    readonly claims?: SqlClaims;
+  }): Promise<T>;
+  end(): Promise<void>;
+  [Symbol.asyncDispose](): Promise<void>;
+}
+/**
+ * A pooled Postgres connection for jobs, scripts and tests. Each query (or
+ * transaction) runs in its own transaction; claims and role are
+ * transaction-local, so nothing leaks back into the pool.
+ */
+declare function createPostgres(options?: PostgresOptions): Postgres;
+//#endregion
+export { createPostgres as i, PostgresOptions as n, SqlClaims as r, Postgres as t };

package/dist/postgres/index.d.ts

@@ -0,0 +1,28 @@
+import { g as Operation } from "../executor-CGdNQ27g.js";
+import { n as fromPgError, r as postgresExecutor, t as SqlClient } from "../executor-BYXQ9AGn.js";
+import { i as createPostgres, n as PostgresOptions, r as SqlClaims, t as Postgres } from "../pool-R2m_DkXi.js";
+import { t as Compiler } from "../compiler-CZ9nIuqy.js";
+//#region src/compile/sql.d.ts
+interface SqlQuery {
+  readonly text: string;
+  readonly params: readonly unknown[];
+}
+/**
+ * The SQL for one operation. `rows` returns a `row` json column per result
+ * row; `count` returns one `count` column. Either may be absent: a HEAD read
+ * only counts, a filter that can never match runs nothing.
+ */
+interface SqlPlan {
+  readonly rows: SqlQuery | undefined;
+  readonly count: SqlQuery | undefined;
+  /** No row can match; the executor returns an empty result without a query. */
+  readonly never: boolean;
+}
+export declare function quoteIdent(name: string): string;
+/** Compiles an operation to parameterized SQL. Rows come back as json. */
+export declare function compileSql(op: Operation): SqlPlan;
+//#endregion
+//#region src/postgres/compiler.d.ts
+export declare const sqlCompiler: Compiler<SqlPlan>;
+//#endregion
+export { type Postgres, type PostgresOptions, type SqlClaims, type SqlClient, type SqlPlan, type SqlQuery, createPostgres, fromPgError, postgresExecutor };

package/dist/postgres/index.js

@@ -0,0 +1,79 @@
+import { n as quoteIdent, t as compileSql } from "../sql-DTjA1LPj.js";
+import { n as postgresExecutor, t as fromPgError } from "../executor-DeppvirK.js";
+import { Pool } from "pg";
+//#region src/postgres/pool.ts
+const ROLES = /* @__PURE__ */ new Set(["authenticated", "anon"]);
+function roleOf(claims) {
+	const role = claims.role ?? (claims.sub ? "authenticated" : "anon");
+	if (!ROLES.has(role)) throw new TypeError(`Cannot run as role "${role}": only "authenticated" and "anon" are assumed. Use postgres.admin for service work.`);
+	return role;
+}
+/**
+* A pooled Postgres connection for jobs, scripts and tests. Each query (or
+* transaction) runs in its own transaction; claims and role are
+* transaction-local, so nothing leaks back into the pool.
+*/
+function createPostgres(options = {}) {
+	const connectionString = options.connectionString ?? process.env["SUPABASE_DB_URL"] ?? process.env["DATABASE_URL"];
+	if (!connectionString) throw new TypeError("createPostgres needs a connectionString, $SUPABASE_DB_URL or $DATABASE_URL");
+	const pool = new Pool({
+		connectionString,
+		max: options.max ?? 10
+	});
+	async function begin(client, session) {
+		await client.query("begin");
+		if (options.statementTimeout !== void 0) await client.query(`set local statement_timeout = ${Math.trunc(options.statementTimeout)}`);
+		if (session) {
+			await client.query("select set_config('request.jwt.claims', $1, true)", [JSON.stringify({
+				...session.claims,
+				role: session.role
+			})]);
+			await client.query(`set local role ${session.role}`);
+		}
+	}
+	async function transaction(session, fn) {
+		const client = await pool.connect();
+		try {
+			await begin(client, session);
+			const scoped = {
+				queryRaw: async (text, params) => (await client.query(text, params)).rows,
+				transaction: (inner) => inner(scoped)
+			};
+			const result = await fn(scoped);
+			await client.query("commit");
+			return result;
+		} catch (cause) {
+			await client.query("rollback").catch(() => void 0);
+			throw cause;
+		} finally {
+			client.release();
+		}
+	}
+	const clientFor = (session) => ({
+		queryRaw: (text, params) => transaction(session, (client) => client.queryRaw(text, params)),
+		transaction: (fn) => transaction(session, fn)
+	});
+	const sessionFor = (claims) => ({
+		claims,
+		role: roleOf(claims)
+	});
+	return {
+		admin: clientFor(void 0),
+		anon: clientFor({
+			claims: { role: "anon" },
+			role: "anon"
+		}),
+		asUser: (claims) => clientFor(sessionFor(claims)),
+		transaction: (fn, txOptions) => transaction(txOptions?.claims ? sessionFor(txOptions.claims) : void 0, fn),
+		end: () => pool.end(),
+		[Symbol.asyncDispose]: () => pool.end()
+	};
+}
+//#endregion
+//#region src/postgres/compiler.ts
+const sqlCompiler = {
+	target: "sql",
+	compile: compileSql
+};
+//#endregion
+export { compileSql, createPostgres, fromPgError, postgresExecutor, quoteIdent, sqlCompiler };

package/dist/postgrest-cAEQ_IQN.d.ts

@@ -0,0 +1,43 @@
+import { g as Operation } from "./executor-CGdNQ27g.js";
+//#region src/compile/postgrest.d.ts
+/**
+ * A compiled PostgREST request, expressed as calls on the public
+ * postgrest-js builder so it works with any supabase-js client.
+ */
+interface PostgrestPlan {
+  /** `select` parameter, or `undefined` for mutations without returning. */
+  readonly select: string | undefined;
+  readonly filters: readonly PlanFilter[];
+  readonly orders: readonly PlanOrder[];
+  readonly limits: readonly PlanLimit[];
+  readonly range: {
+    readonly from: number;
+    readonly to: number;
+  } | undefined;
+  /** The condition can never match; skip the request. */
+  readonly never: boolean;
+}
+type PlanFilter = {
+  readonly kind: "filter";
+  readonly path: string;
+  readonly operator: string;
+  readonly value: string;
+} | {
+  readonly kind: "or";
+  readonly expression: string;
+  readonly referencedTable: string | undefined;
+};
+interface PlanOrder {
+  readonly column: string;
+  readonly ascending: boolean;
+  readonly nullsFirst: boolean | undefined;
+  readonly referencedTable: string | undefined;
+}
+interface PlanLimit {
+  readonly count: number;
+  readonly referencedTable: string | undefined;
+}
+/** Compiles an operation into a PostgREST plan. */
+declare function compilePostgrest(op: Operation): PostgrestPlan;
+//#endregion
+export { compilePostgrest as a, PostgrestPlan as i, PlanLimit as n, PlanOrder as r, PlanFilter as t };

package/dist/problem-BTkTtRV9.js

@@ -0,0 +1,97 @@
+import { n as dbError } from "./errors-Bl3rkOzo.js";
+//#region src/core/problem.ts
+const PROBLEM_TYPE_BASE = "https://bettersupabase.com/problems/";
+const PROBLEM_CONTENT_TYPE = "application/problem+json";
+const TITLES = {
+	not_found: "Not found",
+	unauthorized: "Unauthorized",
+	forbidden: "Forbidden",
+	conflict: "Conflict",
+	foreign_key: "Referenced row missing or still referenced",
+	check: "Check constraint violated",
+	not_null: "Required value missing",
+	exclusion: "Exclusion constraint violated",
+	invalid_input: "Invalid input",
+	raised: "Request rejected",
+	timeout: "Timed out",
+	serialization: "Concurrent update, retry",
+	network: "Database unreachable",
+	aborted: "Aborted",
+	invalid_request: "Invalid request",
+	validation: "Validation failed",
+	multiple_rows: "More than one row matched",
+	stale: "Row changed since it was read",
+	rate_limited: "Too many requests",
+	unexpected: "Unexpected error"
+};
+/** Kinds whose message may contain internals (SQL, hostnames), hidden unless `expose` is set. */
+const INTERNAL = /* @__PURE__ */ new Set([
+	"unexpected",
+	"network",
+	"invalid_request"
+]);
+/** Converts a `DbError` to Problem Details. */
+function toProblem(error, options = {}) {
+	const problem = {
+		type: `${PROBLEM_TYPE_BASE}${error.kind.replace(/_/g, "-")}`,
+		title: TITLES[error.kind],
+		status: error.status,
+		kind: error.kind
+	};
+	if (!INTERNAL.has(error.kind) || options.expose) problem["detail"] = error.message;
+	if (options.instance) problem["instance"] = options.instance;
+	if (error.code) problem["code"] = error.code;
+	if (error.hint) problem["hint"] = error.hint;
+	if ("constraint" in error && error.constraint) problem["constraint"] = error.constraint;
+	if ("columns" in error) problem["columns"] = error.columns;
+	if ("column" in error && error.column) problem["column"] = error.column;
+	if ("issues" in error) problem["issues"] = error.issues;
+	if ("required" in error) problem["required"] = error.required;
+	if ("retryAfter" in error) problem["retryAfter"] = error.retryAfter;
+	return problem;
+}
+/**
+* An `application/problem+json` response. A 401 carries an RFC 6750
+* `WWW-Authenticate: Bearer` challenge.
+*/
+function problemResponse(error, options = {}) {
+	const headers = new Headers(options.headers);
+	headers.set("content-type", PROBLEM_CONTENT_TYPE);
+	if (error.status === 401 && !headers.has("www-authenticate")) {
+		const realm = (options.realm ?? "supabase").replace(/"/g, "");
+		const params = error.code === "MISSING_CREDENTIALS" ? "" : ", error=\"invalid_token\"";
+		headers.set("www-authenticate", `Bearer realm="${realm}"${params}`);
+	}
+	if ("retryAfter" in error && !headers.has("retry-after")) headers.set("retry-after", String(error.retryAfter));
+	return new Response(JSON.stringify(toProblem(error, options)), {
+		status: error.status,
+		headers
+	});
+}
+function isProblem(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const problem = value;
+	return typeof problem["type"] === "string" && typeof problem["status"] === "number" && typeof problem["title"] === "string";
+}
+function isKind(value) {
+	return typeof value === "string" && value in TITLES;
+}
+/** Turns a Problem Details body back into a `DbError` (client side). */
+function fromProblem(problem) {
+	const kind = isKind(problem.kind) ? problem.kind : "unexpected";
+	const extra = { status: problem.status };
+	for (const key of [
+		"code",
+		"hint",
+		"constraint",
+		"columns",
+		"column",
+		"required",
+		"retryAfter"
+	]) if (problem[key] !== void 0) extra[key] = problem[key];
+	extra["issues"] = problem.issues ?? [];
+	if (kind !== "validation") delete extra["issues"];
+	return dbError(kind, problem.detail ?? problem.title, extra);
+}
+//#endregion
+export { problemResponse as a, isProblem as i, PROBLEM_TYPE_BASE as n, toProblem as o, fromProblem as r, PROBLEM_CONTENT_TYPE as t };

package/dist/problem-DlgB0lYl.d.ts

@@ -0,0 +1,47 @@
+import { b as ValidationIssue, m as DbErrorKind, p as DbError } from "./result-CTkCZ6JA.js";
+//#region src/core/problem.d.ts
+/** RFC 9457 Problem Details, with the `DbError` fields as extension members. */
+interface ProblemDetails {
+  readonly type: string;
+  readonly title: string;
+  readonly status: number;
+  readonly detail?: string;
+  readonly instance?: string;
+  /** The `DbError` kind. */
+  readonly kind: DbErrorKind;
+  readonly code?: string;
+  readonly hint?: string;
+  readonly constraint?: string;
+  readonly columns?: readonly string[];
+  readonly column?: string;
+  readonly issues?: readonly ValidationIssue[];
+  /** The assurance level a `forbidden` answer needs (`aal2`). */
+  readonly required?: "aal1" | "aal2";
+  /** Seconds until a `rate_limited` caller may retry. */
+  readonly retryAfter?: number;
+}
+declare const PROBLEM_TYPE_BASE = "https://bettersupabase.com/problems/";
+declare const PROBLEM_CONTENT_TYPE = "application/problem+json";
+interface ProblemOptions {
+  /** URI reference for this occurrence, e.g. the request path. */
+  readonly instance?: string;
+  /** Include messages of internal errors. Defaults to false. */
+  readonly expose?: boolean;
+}
+interface ProblemResponseOptions extends ProblemOptions {
+  readonly headers?: HeadersInit;
+  /** `realm` of the RFC 6750 challenge on 401. */
+  readonly realm?: string;
+}
+/** Converts a `DbError` to Problem Details. */
+declare function toProblem(error: DbError, options?: ProblemOptions): ProblemDetails;
+/**
+ * An `application/problem+json` response. A 401 carries an RFC 6750
+ * `WWW-Authenticate: Bearer` challenge.
+ */
+declare function problemResponse(error: DbError, options?: ProblemResponseOptions): Response;
+declare function isProblem(value: unknown): value is ProblemDetails;
+/** Turns a Problem Details body back into a `DbError` (client side). */
+declare function fromProblem(problem: ProblemDetails): DbError;
+//#endregion
+export { ProblemResponseOptions as a, problemResponse as c, ProblemOptions as i, toProblem as l, PROBLEM_TYPE_BASE as n, fromProblem as o, ProblemDetails as r, isProblem as s, PROBLEM_CONTENT_TYPE as t };

package/dist/query/index.d.ts

@@ -0,0 +1,2 @@
+import { a as QueryHelpers, c as TableQueries, d as queryCache, f as BetterQueryMeta, i as Queries, l as createQueries, n as InfiniteOptionsOf, o as QueryKeyOf, p as invalidateTables, r as MutationOptionsOf, s as QueryOptionsOf, t as CreateQueriesOptions, u as invalidateOnMutation } from "../index-K-3WM2Hp.js";
+export { type BetterQueryMeta, CreateQueriesOptions, InfiniteOptionsOf, MutationOptionsOf, Queries, QueryHelpers, QueryKeyOf, QueryOptionsOf, TableQueries, createQueries, invalidateOnMutation, invalidateTables, queryCache };

package/dist/query/index.js

@@ -0,0 +1,3 @@
+import { t as invalidateTables } from "../invalidate-DbxuL2jL.js";
+import { n as invalidateOnMutation, r as queryCache, t as createQueries } from "../query-ChvDbsDE.js";
+export { createQueries, invalidateOnMutation, invalidateTables, queryCache };