better-supabase 0.11.0 → 0.13.0

package/dist/next/index.d.ts

@@ -1,22 +1,22 @@
-import { a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
-import { r as AuthState } from "../resolve-Bqb8TMTt.js";
-import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
-import { Wt as DbStats, at as QuerySpec, q as ReadSet, s as CacheAdapter, t as BetterSupabase } from "../define-M_r1d2AT.js";
-import { n as Impersonator } from "../impersonation-D5chOkrO.js";
-import { C as SupportSessions, S as SupportPolicy, T as supportSessions, a as ServerContext, c as ServerOptions, l as SharedServer, n as BetterServer, r as ContextOptions, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions } from "../server-types-BKN_R4Ws.js";
-import { n as AmrEntry, t as Aal } from "../mfa-YzkRjNad.js";
-import { t as tenantOf } from "../tenant-BNp3kBAG.js";
-import { n as toSession, t as AuthSession } from "../view-Bf7e07rQ.js";
-import { t as AuthOutageHook } from "../session-CwpfitmI.js";
-import { n as AuthKind, r as GuardOptions } from "../respond-CEBC6KUX.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-BeZX2pR_.js";
-import { r as LiveCountSeed, t as CountRunner } from "../index-qCG78-Rf.js";
-import { r as MembershipClaim } from "../entitlements-DgkeStXd.js";
-import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-CGr0BbL-.js";
-import { t as ResourceMap } from "../resources-BiQpsM6O.js";
-import { t as defineAction } from "../resource-execute-ruP2L1op.js";
-import { i as tagFor, t as TagOptions } from "../tags-AUpl4Ob9.js";
-import { n as supportOf, t as SupportView } from "../support-view-IRnDLuGN.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-DmshMaXz.js";
+import { r as AuthState } from "../resolve-D57oDWNr.js";
+import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-DFP3gHv8.js";
+import { I as ReadSet, J as QuerySpec, Lt as DbStats, Ut as CacheAdapter, t as BetterSupabase } from "../define-D0LSXmUP.js";
+import { n as Impersonator } from "../impersonation-YTa9dZUv.js";
+import { n as AmrEntry, t as Aal } from "../mfa-Dt8AdWht.js";
+import { t as tenantOf } from "../tenant-l3H2ouv7.js";
+import { n as toSession, t as AuthSession } from "../view-CKzCp8FW.js";
+import { C as SupportSessions, S as SupportPolicy, T as supportSessions, a as ServerContext, c as ServerOptions, l as SharedServer, n as BetterServer, r as ContextOptions, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions } from "../server-types-D_cQ6OxZ.js";
+import { t as AuthOutageHook } from "../session-DNRYXIOU.js";
+import { n as AuthKind, r as GuardOptions } from "../respond-QW-f1yio.js";
+import { a as AuthorizedContext, c as ResourceLoaderContext, i as AuthorizeOptions, l as Unwrapped, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-LeQGMzLH.js";
+import { r as LiveCountSeed, t as CountRunner } from "../index-C7-2ZS9f.js";
+import { r as MembershipClaim } from "../entitlements-CMGsO4gL.js";
+import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-NXau9LJE.js";
+import { t as ResourceMap } from "../resources-CZ60Vqwq.js";
+import { t as defineAction } from "../resource-execute-BbjuiXwD.js";
+import { i as tagFor, t as TagOptions } from "../tags-tbiuHHMV.js";
+import { n as supportOf, t as SupportView } from "../support-view-BOJJSZKv.js";
 import { NextRequest } from "next/server.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/collector.d.ts
@@ -32,16 +32,16 @@ interface NextResourcesOptions extends GuardOptions {
   /** The catch-all route's path, e.g. `/api` for `app/api/[...path]/route.ts`. */
   readonly basePath?: string;
   /**
-   * Refresh an expired session cookie and send the new cookies. Off by
-   * default because the proxy refreshes everything it matches.
+   * Refresh an expired session cookie and send the new cookies. Off by default
+   * because the proxy refreshes everything it matches.
    */
   readonly refresh?: boolean;
 }
 /** A route handler of the resources' catch-all route. */
 type NextResourceHandler = (request: Request) => Promise<Response>;
 /**
- * The exports of `app/api/[...path]/route.ts`:
- * `export const { GET, POST, PATCH, PUT, DELETE } = bs.resources({ ... })`.
+ * The exports of `app/api/[...path]/route.ts`: `export const { GET, POST,
+ * PATCH, PUT, DELETE } = bs.resources({ ... })`.
  */
 interface NextResourceRoutes {
   readonly GET: NextResourceHandler;
@@ -60,7 +60,10 @@ interface NextOptions extends ServerOptions {
   readonly server?: SharedServer;
   /** Invalidate `tagFor(table)` cache tags after mutations. Defaults to true. */
   readonly cacheTags?: boolean;
-  /** Include internal error messages in Problem Details. Defaults to development only. */
+  /**
+   * Include internal error messages in Problem Details. Defaults to development
+   * only.
+   */
   readonly exposeErrors?: boolean;
   /** Per-request database call counts. See the Budget docs. */
   readonly debug?: NextDebugOptions;
@@ -68,7 +71,10 @@ interface NextOptions extends ServerOptions {
 interface NextDebugOptions {
   /** Collect outside development too, e.g. for e2e runs against `next start`. */
   readonly enabled?: boolean;
-  /** Header with `calls;waves;ms` on route handler responses. Defaults to `x-bs-db-calls`. */
+  /**
+   * Header with `calls;waves;ms` on route handler responses. Defaults to
+   * `x-bs-db-calls`.
+   */
   readonly header?: string;
   /** Warns in development when one render goes over it. */
   readonly budget?: DbBudget;
@@ -78,25 +84,28 @@ interface NextDebugOptions {
 interface ProxyOptions<C = unknown, P = unknown> {
   /**
    * Another middleware to compose with, such as next-intl's. It runs on the
-   * original request, alongside auth; its rewrite, redirect or request
-   * headers are kept, and refreshed cookies are merged into its response.
+   * original request, alongside auth; its rewrite, redirect or request headers
+   * are kept, and refreshed cookies are merged into its response.
    */
   readonly before?: (request: NextRequest) => Response | undefined | Promise<Response | undefined>;
-  /** Answer before rendering, e.g. redirect signed-out users. Refreshed cookies are kept. */
+  /**
+   * Answer before rendering, e.g. redirect signed-out users. Refreshed cookies
+   * are kept.
+   */
   readonly protect?: (auth: AuthState<C, P>, request: NextRequest) => Response | undefined | Promise<Response | undefined>;
   /**
    * A prefetch never refreshes, so a session cookie whose token expired
-   * resolves to `{ kind: 'anon', reason: 'expired' }` there. `'protect'`
-   * (the default) passes that to `protect` like any other caller.
-   * `'render'` skips `protect` for it, so the prefetch renders signed out
-   * instead of caching a redirect to sign-in; `sessionStale` keeps that view
-   * out of the App Shell, and the navigation itself refreshes the session.
+   * resolves to `{ kind: 'anon', reason: 'expired' }` there. `'protect'` (the
+   * default) passes that to `protect` like any other caller. `'render'` skips
+   * `protect` for it, so the prefetch renders signed out instead of caching a
+   * redirect to sign-in; `sessionStale` keeps that view out of the App Shell,
+   * and the navigation itself refreshes the session.
    */
   readonly expiredPrefetch?: "protect" | "render";
   /**
    * Methods that run `protect`. Defaults to `GET` and `HEAD`, so a Server
-   * Action POST is not redirected before the action runs. Set `true` to
-   * include mutations, or pass the methods yourself.
+   * Action POST is not redirected before the action runs. Set `true` to include
+   * mutations, or pass the methods yourself.
    */
   readonly protectMethods?: true | readonly string[];
   /** Post-processes the final response; return a new one to replace it. */
@@ -108,35 +117,37 @@ interface ProxyOptions<C = unknown, P = unknown> {
   readonly serverTiming?: boolean;
   readonly endedSession?: true | EndedSessionOptions;
   /**
-   * Called when a refresh failed because the Auth server was unreachable,
-   * timed out or answered 5xx or 429. When the access token couldn't be
-   * kept (`event.kept` is false), a returned `Response` replaces the
-   * proxy's response, such as a 503 with `Retry-After`. A throw is logged
-   * and ignored.
+   * Called when a refresh failed because the Auth server was unreachable, timed
+   * out or answered 5xx or 429. When the access token couldn't be kept
+   * (`event.kept` is false), a returned `Response` replaces the proxy's
+   * response, such as a 503 with `Retry-After`. A throw is logged and ignored.
    */
   readonly onAuthOutage?: AuthOutageHook;
 }
 interface EndedSessionOptions {
   readonly paths?: readonly string[];
   readonly redirect?: string;
-  /** The `reason` query value on the redirect. Defaults to `session_ended` and `account_banned`. */
+  /**
+   * The `reason` query value on the redirect. Defaults to `session_ended` and
+   * `account_banned`.
+   */
   readonly reasons?: {
     readonly ended?: string;
     readonly banned?: string;
   };
 }
-interface ActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R, Ref> {
+interface ActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown, X = ResourceLoaderContext<C, P>> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R, Ref, X> {
   /** Validates the input (plain object or `FormData`) with any Standard Schema. */
   readonly input?: S;
   /**
    * The active tenant for the action's context, from the validated input,
-   * instead of `NextOptions.tenant`. It is checked the same way: the
-   * `tenant()` plugin and `current_tenant_id()` only honor a tenant the
-   * caller belongs to.
+   * instead of `NextOptions.tenant`. It is checked the same way: the `tenant()`
+   * plugin and `current_tenant_id()` only honor a tenant the caller belongs
+   * to.
    */
   readonly tenant?: (input: ActionParsed<S>) => string | undefined;
 }
-interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<NextRequest, C, P, R, Ref> {
+interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown, X = ResourceLoaderContext<C, P>> extends GuardOptions, AuthorizeOptions<NextRequest, C, P, R, Ref, X> {
   /**
    * Refresh an expired session cookie in the route and send the new cookies
    * with its response. For routes the proxy's matcher skips; off by default
@@ -144,16 +155,16 @@ interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean, Re
    */
   readonly refresh?: boolean;
 }
-interface RequireOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<undefined, C, P, R, Ref> {
+interface RequireOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown, X = ResourceLoaderContext<C, P>> extends GuardOptions, AuthorizeOptions<undefined, C, P, R, Ref, X> {
   /** The active tenant, as for `bs.context({ tenant })`. */
   readonly tenant?: string;
 }
 interface ScopeOptions {
   /**
    * The active tenant, e.g. from route params, instead of `NextOptions.tenant`
-   * (whose request has the incoming headers but no URL here). It goes where
-   * the resolver's result goes, so it gets the same checks: the `tenant()`
-   * plugin and `current_tenant_id()` only honor a tenant the caller belongs to.
+   * (whose request has the incoming headers but no URL here). It goes where the
+   * resolver's result goes, so it gets the same checks: the `tenant()` plugin
+   * and `current_tenant_id()` only honor a tenant the caller belongs to.
    */
   readonly tenant?: string;
 }
@@ -177,9 +188,9 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    */
   session(): Promise<AuthSession<C, P>>;
   /**
-   * The context for a session and its token, without reading the request.
-   * The token is verified again (memoized, no network call); a token for
-   * another user than `session` gives an `invalid` context.
+   * The context for a session and its token, without reading the request. The
+   * token is verified again (memoized, no network call); a token for another
+   * user than `session` gives an `invalid` context.
    */
   contextForSession(session: AuthSession<C, P>, options: {
     readonly token: string | null;
@@ -192,7 +203,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    *
    * ```ts
    * async function getCustomers() {
-   *   'use cache: private';
+   *   "use cache: private";
    *   const { db } = await bs.cached();
    *   return db.customers.findMany().orThrow();
    * }
@@ -200,12 +211,12 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    */
   cached(options?: CachedOptions<Extract<keyof M, string>>): Promise<CachedContext<M, F, E, C, P, B>>;
   /**
-   * Drops every `bs.cached()` entry of a user, e.g. after a role change,
-   * and the entries tagged with `tags` (such as a permission snapshot's tag).
-   * In a Server Action it also re-renders the caller's page, so no
-   * `refresh()` is needed. It reaches server caches and the caller's router
-   * only: another user's browser keeps its `'use cache: private'` entries
-   * until they go stale or that user's token changes.
+   * Drops every `bs.cached()` entry of a user, e.g. after a role change, and
+   * the entries tagged with `tags` (such as a permission snapshot's tag). In a
+   * Server Action it also re-renders the caller's page, so no `refresh()` is
+   * needed. It reaches server caches and the caller's router only: another
+   * user's browser keeps its `'use cache: private'` entries until they go stale
+   * or that user's token changes.
    */
   invalidateSession(userId: string, options?: {
     readonly tags?: readonly string[];
@@ -213,15 +224,15 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
   /**
    * Counts on the server and returns a serializable seed for
    * `useLiveCount(seed)`, so the badge renders with a number and the client
-   * only refetches on changes. Pass `db` inside `'use cache: private'`
-   * (from `bs.cached()`); otherwise it uses `bs.context()`. A failed
-   * count gives `count: null` instead of throwing.
+   * only refetches on changes. Pass `db` inside `'use cache: private'` (from
+   * `bs.cached()`); otherwise it uses `bs.context()`. A failed count gives
+   * `count: null` instead of throwing.
    */
   liveCount<T extends Extract<keyof M, string>>(spec: QuerySpec<T, "count", number>, db?: CountRunner): Promise<LiveCountSeed<T>>;
   /** Route handler with auth, Result unwrapping and Problem Details errors. */
   route<Params = Record<string, string | string[]>, R extends boolean = false>(handler: (request: NextRequest, ctx: ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R> & {
     readonly params: Params;
-  }) => unknown, options?: RouteOptions<C, P, R, Ref>): (request: NextRequest, segment: {
+  }) => unknown, options?: RouteOptions<C, P, R, Ref, NextResource<M, F, E, C, P, B>>): (request: NextRequest, segment: {
     readonly params: Promise<Params>;
   }) => Promise<Response>;
   /**
@@ -229,30 +240,34 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    *
    * ```ts
    * export const invite = bs.action(
-   *   { input: Invite, requireTenant: true, roles: ['admin'] },
-   *   async (input, { db, tenant }) => db.invitations.create({ ...input, organizationId: tenant }),
+   *   { input: Invite, requireTenant: true, roles: ["admin"] },
+   *   async (input, { db, tenant }) =>
+   *     db.invitations.create({ ...input, organizationId: tenant }),
    * );
    * ```
    */
-  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: ActionOptions<S, C, P, R, Ref>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: ActionOptions<S, C, P, R, Ref, NextResource<M, F, E, C, P, B>>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
   /**
-   * For Server Components: the caller's context, or the Next.js interrupt
-   * for a refused caller. `unauthorized` calls `unauthorized()`, `forbidden`
-   * calls `forbidden()` (both need `experimental.authInterrupts`, else
-   * `notFound()`), and `not_found` calls `notFound()`.
+   * For Server Components: the caller's context, or the Next.js interrupt for a
+   * refused caller. `unauthorized` calls `unauthorized()`, `forbidden` calls
+   * `forbidden()` (both need `experimental.authInterrupts`, else `notFound()`),
+   * and `not_found` calls `notFound()`.
    *
    * ```ts
-   * const { db, tenant } = await bs.require({ requireTenant: true, roles: ['admin'] });
+   * const { db, tenant } = await bs.require({
+   *   requireTenant: true,
+   *   roles: ["admin"],
+   * });
    * ```
    */
-  require<R extends boolean = false>(options?: RequireOptions<C, P, R, Ref>): Promise<ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>;
+  require<R extends boolean = false>(options?: RequireOptions<C, P, R, Ref, NextResource<M, F, E, C, P, B>>): Promise<ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>;
   /**
-   * REST resources for a catch-all route, matching the API model:
-   * collections, items and actions, as the caller (RLS), behind the guard in
-   * `options`, with Problem Details errors. An unknown path answers 404
-   * before auth resolves.
+   * REST resources for a catch-all route, matching the API model: collections,
+   * items and actions, as the caller (RLS), behind the guard in `options`, with
+   * Problem Details errors. An unknown path answers 404 before auth resolves.
    *
-   * ```ts title="app/api/[...path]/route.ts"
+   * ```ts
+   * // app/api/[...path]/route.ts
    * export const { GET, POST, PATCH, PUT, DELETE } = bs.resources(
    *   { customers: true },
    *   { basePath: "/api" },
@@ -266,9 +281,9 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    */
   cacheTag(table: Extract<keyof M, string>, id?: string | number, options?: TagOptions): void;
   /**
-   * Tags the current `"use cache"` scope with every table the specs (or a
-   * read set) read, plus the row of each `findById`, so any mutation that
-   * changes one revalidates it.
+   * Tags the current `"use cache"` scope with every table the specs (or a read
+   * set) read, plus the row of each `findById`, so any mutation that changes
+   * one revalidates it.
    */
   cacheTags(target: QuerySpec<Extract<keyof M, string>> | readonly QuerySpec<Extract<keyof M, string>>[] | ReadSet, options?: TagOptions): void;
   /**
@@ -277,12 +292,15 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    */
   debugRoute(): (request: Request) => Promise<Response>;
   /**
-   * Starts a support session for the signed-in admin and sets its cookie,
-   * so the admin's next requests render as the target. Call it from a
-   * server action.
+   * Starts a support session for the signed-in admin and sets its cookie, so
+   * the admin's next requests render as the target. Call it from a server
+   * action.
    */
   startSupport(request: SupportStartRequest): Promise<ActionResult<SupportStarted>>;
-  /** Ends the admin's support session and clears its cookie. Call it from a server action. */
+  /**
+   * Ends the admin's support session and clears its cookie. Call it from a
+   * server action.
+   */
   stopSupport(): Promise<ActionResult<{
     readonly ended: boolean;
   }>>;
@@ -298,9 +316,9 @@ interface SupportStarted {
 interface SessionStaleOptions {
   /**
    * With fewer seconds left on the token, the view is not reused at all (0):
-   * Next.js would not prefetch it anyway. Defaults to 30, and values below
-   * 30 count as 30: the client router keeps any entry for at least 30
-   * seconds, so a shorter stale time would outlive the token.
+   * Next.js would not prefetch it anyway. Defaults to 30, and values below 30
+   * count as 30: the client router keeps any entry for at least 30 seconds, so
+   * a shorter stale time would outlive the token.
    */
   readonly min?: number;
   /** 300 (5 minutes) joins the route's App Shell. Defaults to 300. */
@@ -315,15 +333,18 @@ interface CachedOptions<T extends string = string> extends ScopeOptions {
   readonly tenant?: string;
   /**
    * `cacheLife` for the entry. `stale` is `sessionStale`, and never more than
-   * `stale` when it is set: pass a permission snapshot's lifetime so the
-   * entry goes stale with the snapshot too.
+   * `stale` when it is set: pass a permission snapshot's lifetime so the entry
+   * goes stale with the snapshot too.
    */
   readonly life?: SessionStaleOptions & {
     readonly stale?: number;
     readonly revalidate?: number;
     readonly expire?: number;
   };
-  /** More `cacheTag`s for the entry, e.g. `snapshotTag(sub)` or `organization:<id>`. */
+  /**
+   * More `cacheTag`s for the entry, e.g. `snapshotTag(sub)` or
+   * `organization:<id>`.
+   */
   readonly tags?: readonly string[];
   /**
    * Tables the entry reads, so the `updateTag` after a mutation drops it:
@@ -339,10 +360,10 @@ type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown,
 };
 interface NextCacheOptions {
   /**
-   * How a mutation outside a Server Action (a route handler, a webhook)
-   * expires its tags with `revalidateTag`. Defaults to `{ expire: 0 }`, so
-   * the next read waits for fresh data; `'max'` serves the stale entry
-   * while it revalidates.
+   * How a mutation outside a Server Action (a route handler, a webhook) expires
+   * its tags with `revalidateTag`. Defaults to `{ expire: 0 }`, so the next
+   * read waits for fresh data; `'max'` serves the stale entry while it
+   * revalidates.
    */
   readonly revalidate?: string | {
     readonly expire?: number;
@@ -350,19 +371,24 @@ interface NextCacheOptions {
 }
 interface RequireAalOptions {
   /**
-   * Page that enrolls or challenges a second factor. Signed-in users below
-   * the level are redirected there with `?next=<path>`; without it they get
-   * a 403 Problem Details response.
+   * Page that enrolls or challenges a second factor. Signed-in users below the
+   * level are redirected there with `?next=<path>`; without it they get a 403
+   * Problem Details response.
    */
   readonly redirect?: string;
   /** Paths that need the level. Defaults to every path but `redirect`. */
   readonly match?: (pathname: string) => boolean;
 }
+/**
+ * What a `resource` loader gets in Next.js: the caller's context, with the
+ * checked tenant.
+ */
+type NextResource<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> = ServerContext<M, F, E, C, P, B> & ResourceLoaderContext<C, P>;
 //#endregion
 //#region src/next/create.d.ts
 /**
- * The Next.js adapter: proxy, Server Components, route handlers, server
- * actions and cache tags, on top of `createServer`.
+ * The Next.js adapter: proxy, Server Components, route handlers, server actions
+ * and cache tags, on top of `createServer`.
  *
  * ```ts
  * export const bs = createNext(betterSupabase);
@@ -378,17 +404,17 @@ export declare function supportTag(sessionId: string): string;
 /**
  * `cacheLife` `stale` seconds for a view of `session`: `max`, but never past
  * the token's expiry, and 0 once fewer than `min` seconds are left. A
- * signed-out view that a refresh would change (an `expired` or
- * `refresh_failed` cookie, or an `invalid` token) is 0 as well, so it never
- * joins the App Shell.
+ * signed-out view that a refresh would change (an `expired` or `refresh_failed`
+ * cookie, or an `invalid` token) is 0 as well, so it never joins the App
+ * Shell.
  */
 export declare function sessionStale(session: AuthSession, options?: SessionStaleOptions, now?: number): number;
 /** The tag `bs.cached()` puts on a user's entries. */
 export declare function sessionTag(userId: string): string;
 /**
  * Invalidates `bs:<table>` for every table in the target, the tenant's
- * `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has
- * no tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
+ * `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has no
+ * tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
  * tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
  */
 export declare function nextCache(options?: NextCacheOptions): CacheAdapter;
@@ -397,20 +423,26 @@ export declare function nextCache(options?: NextCacheOptions): CacheAdapter;
 /** Response header with the URL of the request's totals on `bs.debugRoute()`. */
 export declare const STATS_URL_HEADER = "x-bs-stats";
 export declare function shouldCheckSession(request: NextRequest, options?: EndedSessionOptions): boolean;
-/** Page loads, client navigations and server actions; never prefetches or assets. */
+/**
+ * Page loads, client navigations and server actions; never prefetches or
+ * assets.
+ */
 export declare function shouldRefresh(request: Request): boolean;
 /**
  * A `proxy` `protect` that keeps signed-in users below `level` out of the
  * matched paths. The JWT carries no factor list, so this also sends users
- * without a factor to `redirect` to enroll one. Anonymous callers pass;
- * combine it with your sign-in redirect.
+ * without a factor to `redirect` to enroll one. Anonymous callers pass; combine
+ * it with your sign-in redirect.
  *
  * ```ts
  * bs.proxy(request, {
- *   protect: requireAal('aal2', { redirect: '/mfa', match: (path) => path.startsWith('/settings') }),
+ *   protect: requireAal("aal2", {
+ *     redirect: "/mfa",
+ *     match: (path) => path.startsWith("/settings"),
+ *   }),
  * });
  * ```
  */
 export declare function requireAal(level: Aal, options?: RequireAalOptions): (auth: AuthState, request: NextRequest) => Response | undefined;
 //#endregion
-export { type Aal, type ActionArgs, type ActionOptions, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthSession, type AuthorizeOptions, type AuthorizedContext, type BetterNext, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EndedSessionOptions, type GuardOptions, type Impersonator, type LiveCountSeed, type MembershipClaim, type NextCacheOptions, type NextDebugOptions, type NextOptions, type NextResourceHandler, type NextResourceRoutes, type NextResourcesOptions, type ProxyOptions, type RequireAalOptions, type RequireOptions, type ResourceAction, type ResourceContext, type ResourceHooks, type ResourceMap, type ResourceRouteOptions, type RouteOptions, type ScopeOptions, type SessionStaleOptions, type SupportOptions, type SupportPolicy, type SupportSessions, type SupportStartRequest, type SupportStarted, type SupportView, type TagOptions, defineAction, supportOf, supportSessions, tagFor, tenantOf, toSession };
+export { type Aal, type ActionArgs, type ActionOptions, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthSession, type AuthorizeOptions, type AuthorizedContext, type BetterNext, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EndedSessionOptions, type GuardOptions, type Impersonator, type LiveCountSeed, type MembershipClaim, type NextCacheOptions, type NextDebugOptions, type NextOptions, type NextResourceHandler, type NextResourceRoutes, type NextResourcesOptions, type ProxyOptions, type RequireAalOptions, type RequireOptions, type ResourceAction, type ResourceContext, type ResourceHooks, type ResourceLoaderContext, type ResourceMap, type ResourceRouteOptions, type RouteOptions, type ScopeOptions, type SessionStaleOptions, type SupportOptions, type SupportPolicy, type SupportSessions, type SupportStartRequest, type SupportStarted, type SupportView, type TagOptions, defineAction, supportOf, supportSessions, tagFor, tenantOf, toSession };