better-supabase 0.11.0 → 0.13.0

package/dist/streams/index.d.ts

@@ -1,25 +1,31 @@
-import { T as ErrorMapper, t as AsyncResult } from "../result-BREt7qOh.js";
-import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-DezJPPA0.js";
-import { a as StreamStatus, i as StreamReadOptions, n as StreamOpenOptions, o as StreamStore, r as StreamPurgeOptions, t as StreamAppendResult } from "../store-B18bIvKc.js";
+import { T as ErrorMapper, t as AsyncResult } from "../result-mijqfoJN.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-DBPhgF3W.js";
+import { a as StreamStatus, i as StreamReadOptions, n as StreamOpenOptions, o as StreamStore, r as StreamPurgeOptions, t as StreamAppendResult } from "../store-DKqbuNvw.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 //#region src/streams/postgres.d.ts
 interface PostgresStreamStoreOptions {
-  /** `sqlTransport(postgres.asService())` for the writer; the owner's transport for reads. */
+  /**
+   * `sqlTransport(postgres.asService())` for the writer; the owner's transport
+   * for reads.
+   */
   readonly transport: BlockTransport;
   /** The schema of the `streams` module. Defaults to `better_supabase`. */
   readonly schema?: string;
   readonly mappers?: readonly ErrorMapper[];
   /**
-   * `realtime` (the default) pings the stream's private topic after each
-   * batch; `poll` skips the ping for apps near the Realtime message quota,
-   * and readers poll instead.
+   * `realtime` (the default) pings the stream's private topic after each batch;
+   * `poll` skips the ping for apps near the Realtime message quota, and readers
+   * poll instead.
    */
   readonly wake?: "realtime" | "poll";
   /** A Supabase client a reader joins the topic with, to wake up on the ping. */
   readonly realtime?: Pick<SupabaseClient, "channel" | "removeChannel">;
   /** `blocks.streams.options.topic`. Defaults to `stream`. */
   readonly topic?: string;
-  /** Milliseconds between reads of an idle stream: 250 by default, 2000 with `realtime`. */
+  /**
+   * Milliseconds between reads of an idle stream: 250 by default, 2000 with
+   * `realtime`.
+   */
   readonly pollMs?: number;
   /** Chunks per read. Defaults to 1000. */
   readonly batch?: number;
@@ -44,21 +50,21 @@ interface TeedStream {
   readonly stream: ReadableStream<string>;
   /**
    * Settles once every chunk is stored and the stream is closed, with the
-   * number of chunks. It keeps going after the live client disconnects, so
-   * hand it to `waitUntil` or `after`.
+   * number of chunks. It keeps going after the live client disconnects, so hand
+   * it to `waitUntil` or `after`.
    */
   readonly persisted: AsyncResult<number>;
 }
 /**
- * Copies `source` into `store` under `id` while passing it through. Chunks
- * are written in batches, each at its own index, so a reader that counted
- * `n` chunks of the live stream resumes with `read(id, n)`.
+ * Copies `source` into `store` under `id` while passing it through. Chunks are
+ * written in batches, each at its own index, so a reader that counted `n`
+ * chunks of the live stream resumes with `read(id, n)`.
  */
 export declare function teeToStore(store: StreamStore, id: string, source: ReadableStream<string>, options?: TeeToStoreOptions): TeedStream;
 /**
  * Stores `source` under `id` without a live copy, for a stream the caller
- * already sends elsewhere (the second branch of its own `tee()`). Settles
- * like `teeToStore`'s `persisted`.
+ * already sends elsewhere (the second branch of its own `tee()`). Settles like
+ * `teeToStore`'s `persisted`.
  */
 export declare function writeToStore(store: StreamStore, id: string, source: ReadableStream<string>, options?: TeeToStoreOptions): AsyncResult<number>;
 interface ResumeFromStoreOptions {
@@ -67,9 +73,9 @@ interface ResumeFromStoreOptions {
   readonly signal?: AbortSignal;
 }
 /**
- * The rest of stream `id` from `fromIdx`, or `undefined` when there is
- * nothing to resume: no such stream, or a closed one the client has read to
- * the end. A route answers `undefined` with 204.
+ * The rest of stream `id` from `fromIdx`, or `undefined` when there is nothing
+ * to resume: no such stream, or a closed one the client has read to the end. A
+ * route answers `undefined` with 204.
  */
 export declare function resumeFromStore(store: StreamStore, id: string, options?: ResumeFromStoreOptions): AsyncResult<ReadableStream<string> | undefined>;
 //#endregion

package/dist/streams/index.js

@@ -1,8 +1,8 @@
 import { n as isRecord } from "../guards-6F2bCtQR.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-J7ZepTq2.js";
-import { D as recordOf, F as stringsOf, M as seconds, o as blockCall } from "../block-helpers-DkVZNDrj.js";
-import { n as teeToStore, r as writeToStore, t as resumeFromStore } from "../tee-Cw-iJAWL.js";
-import { t as pollingRead } from "../store-BdH5ruDx.js";
+import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-Ds0C2mUf.js";
+import { D as recordOf, F as stringsOf, M as seconds, o as blockCall } from "../block-helpers-DwE32_gT.js";
+import { n as teeToStore, r as writeToStore, t as resumeFromStore } from "../tee-1fsH3bEz.js";
+import { t as pollingRead } from "../store-McN-2esd.js";
 //#region src/streams/postgres.ts
 function statusOf(value) {
 	if (!isRecord(value)) return;

package/dist/streams/redis/index.d.ts

@@ -1,8 +1,8 @@
-import { o as StreamStore } from "../../store-B18bIvKc.js";
+import { o as StreamStore } from "../../store-DKqbuNvw.js";
 //#region src/streams/redis/redis.d.ts
 /**
- * The commands the store sends, as node-redis 5 and 6 (`createClient()`)
- * name them. Any client with these methods works.
+ * The commands the store sends, as node-redis 5 and 6 (`createClient()`) name
+ * them. Any client with these methods works.
  */
 interface RedisStreamClient {
   hSetNX(key: string, field: string, value: string): Promise<unknown>;
@@ -24,7 +24,10 @@ interface RedisStreamSharedOptions {
   readonly keyPrefix?: string;
   /** How long a stream opened without a `ttl` lives. Defaults to `'1 day'`. */
   readonly ttl?: number | string;
-  /** Milliseconds between reads of an idle stream: 250 by default, 2000 with `subscriber`. */
+  /**
+   * Milliseconds between reads of an idle stream: 250 by default, 2000 with
+   * `subscriber`.
+   */
   readonly pollMs?: number;
   /** Chunks per read. Defaults to 1000. */
   readonly batch?: number;
@@ -43,9 +46,9 @@ type RedisStreamStoreOptions = RedisStreamSharedOptions & ({
 /**
  * A `StreamStore` on Redis, for apps that keep live output out of Postgres.
  * Chunks live in a list and the state in a hash, both expiring after the
- * stream's `ttl`, so `purge` has nothing to do and resolves with 0. Redis
- * has no row-level security: check that the caller owns the stream before
- * `read` or `cancel`.
+ * stream's `ttl`, so `purge` has nothing to do and resolves with 0. Redis has
+ * no row-level security: check that the caller owns the stream before `read` or
+ * `cancel`.
  */
 export declare function redisStreamStore(options: RedisStreamStoreOptions, load?: () => Promise<unknown>): StreamStore;
 //#endregion

package/dist/streams/redis/index.js

@@ -1,13 +1,13 @@
-import { n as dbError } from "../../errors-BV1SKTVs.js";
-import { a as ok, r as err, t as AsyncResult } from "../../result-DIeYscA3.js";
+import { n as dbError } from "../../errors-D7u24ZJH.js";
+import { a as ok, r as err, t as AsyncResult } from "../../result-DIT_qp4G.js";
 import { n as isRecord } from "../../guards-6F2bCtQR.js";
-import { t as importOptionalPeer } from "../../optional-peer-Dx8TaYXw.js";
-import { t as pollingRead } from "../../store-BdH5ruDx.js";
+import { t as importOptionalPeer } from "../../optional-peer-C1NbBRJm.js";
+import { t as pollingRead } from "../../store-McN-2esd.js";
 //#region src/streams/redis/redis.ts
 const isNodeRedis = (value) => isRecord(value) && typeof value["createClient"] === "function";
 /**
-* Loads `redis` on first use. The specifier is a variable so bundlers leave
-* the optional peer out of apps that pass their own client.
+* Loads `redis` on first use. The specifier is a variable so bundlers leave the
+* optional peer out of apps that pass their own client.
 */
 const loadRedis = () => importOptionalPeer("redis");
 async function connectUrl(url, load) {
@@ -39,9 +39,9 @@ const text = (value) => typeof value === "string" ? value : void 0;
 /**
 * A `StreamStore` on Redis, for apps that keep live output out of Postgres.
 * Chunks live in a list and the state in a hash, both expiring after the
-* stream's `ttl`, so `purge` has nothing to do and resolves with 0. Redis
-* has no row-level security: check that the caller owns the stream before
-* `read` or `cancel`.
+* stream's `ttl`, so `purge` has nothing to do and resolves with 0. Redis has
+* no row-level security: check that the caller owns the stream before `read` or
+* `cancel`.
 */
 function redisStreamStore(options, load = loadRedis) {
 	let connected = "client" in options ? Promise.resolve({

package/dist/stripe/index.d.ts

@@ -1,6 +1,9 @@
-import { t as StripeClient } from "../stripe-NVcNOhHy.js";
+import { t as StripeClient } from "../stripe-BSEwKCni.js";
 //#region src/stripe/stripe.d.ts
-/** The secret key and, optionally, the API version of the Stripe client to create. */
+/**
+ * The secret key and, optionally, the API version of the Stripe client to
+ * create.
+ */
 interface StripeFromKeyOptions {
   readonly secretKey: string;
   readonly apiVersion?: string;

package/dist/stripe/index.js

@@ -1,5 +1,5 @@
-import { n as memoized } from "../optional-peer-Dx8TaYXw.js";
-import { n as stripeClient } from "../stripe-XZrSmDTf.js";
+import { n as memoized } from "../optional-peer-C1NbBRJm.js";
+import { n as stripeClient } from "../stripe-BJUfp5jM.js";
 //#region src/stripe/stripe.ts
 /**
 * A `stripe` source for the billing, usage and commerce Stripe adapters that

package/dist/stripe-BJUfp5jM.js

@@ -0,0 +1,32 @@
+import { t as importOptionalPeer } from "./optional-peer-C1NbBRJm.js";
+//#region src/blocks/stripe.ts
+const isModule = (value) => typeof value === "object" && value !== null && "default" in value && typeof value.default === "function" && "createFetchHttpClient" in value.default;
+/**
+* Loads `stripe` on first use. The specifier is a variable so bundlers leave
+* the optional peer out of apps that pass their own client; a missing install
+* returns `undefined` and the caller explains how to add it.
+*/
+const loadStripeModule = () => importOptionalPeer("stripe");
+/**
+* The client `source` names: itself, or one created with Stripe's fetch HTTP
+* client so it runs on every WinterTC runtime.
+*/
+async function stripeClient(source, load = loadStripeModule) {
+	if (typeof source === "function") return source();
+	if (!("secretKey" in source)) return source;
+	const loaded = await load();
+	if (!isModule(loaded)) throw new TypeError("Stripe calls need the stripe package in a runtime that can resolve it: pnpm add stripe, and in a bundled app pass `stripe: stripeFromKey({ secretKey })` from better-supabase/stripe, or a Stripe client");
+	const Stripe = loaded.default;
+	return new Stripe(source.secretKey, {
+		httpClient: Stripe.createFetchHttpClient(),
+		...source.apiVersion === void 0 ? {} : { apiVersion: source.apiVersion }
+	});
+}
+/** Resolves the client once, on first use; a function source runs on every use. */
+function lazyStripe(source) {
+	if (typeof source === "function") return async () => source();
+	let client;
+	return () => client ??= stripeClient(source);
+}
+//#endregion
+export { stripeClient as n, lazyStripe as t };

package/dist/stripe-BSEwKCni.d.ts

@@ -0,0 +1,140 @@
+//#region src/blocks/stripe.d.ts
+/**
+ * The part of the Stripe SDK (`stripe`, an optional peer) the billing and usage
+ * blocks call, typed structurally so the blocks never import it.
+ */
+interface StripeClient {
+  readonly customers: {
+    create(params: {
+      readonly email?: string;
+      readonly name?: string;
+      readonly metadata?: Readonly<Record<string, string>>;
+    }, options?: {
+      readonly idempotencyKey?: string;
+    }): Promise<{
+      readonly id: string;
+    }>;
+    /** Used by `billing.updateCustomer`. */
+    update?(id: string, params: Readonly<Record<string, unknown>>): Promise<{
+      readonly id: string;
+    }>;
+    /** Used by `billing.taxIds`. */
+    listTaxIds?(id: string, params?: {
+      readonly limit?: number;
+    }): Promise<{
+      readonly data: readonly StripeTaxId[];
+    }>;
+    /** Used by `billing.addTaxId`. */
+    createTaxId?(id: string, params: {
+      readonly type: string;
+      readonly value: string;
+    }): Promise<StripeTaxId>;
+    /** Used by `billing.removeTaxId`. */
+    deleteTaxId?(id: string, taxId: string): Promise<{
+      readonly id: string;
+      readonly deleted?: boolean;
+    }>;
+  };
+  readonly checkout: {
+    readonly sessions: {
+      create(params: Readonly<Record<string, unknown>>, options?: {
+        readonly idempotencyKey?: string;
+      }): Promise<{
+        readonly id: string;
+        readonly url: string | null;
+      }>;
+    };
+  };
+  readonly billingPortal: {
+    readonly sessions: {
+      create(params: {
+        readonly customer: string;
+        readonly return_url?: string;
+      }): Promise<{
+        readonly id: string;
+        readonly url: string;
+      }>;
+    };
+  };
+  readonly subscriptionItems: {
+    update(id: string, params: {
+      readonly quantity: number;
+      readonly proration_behavior?: string;
+    }, options?: {
+      readonly idempotencyKey?: string;
+    }): Promise<{
+      readonly id: string;
+      readonly quantity?: number | null;
+    }>;
+  };
+  readonly subscriptions: {
+    cancel(id: string): Promise<{
+      readonly id: string;
+    }>;
+    /** Used by `billing.changePlan` and `billing.cancelAtPeriodEnd`. */
+    update?(id: string, params: Readonly<Record<string, unknown>>, options?: {
+      readonly idempotencyKey?: string;
+    }): Promise<{
+      readonly id: string;
+    }>;
+  };
+  /** Used by `billing.voidInvoice` and `billing.markInvoiceUncollectible`. */
+  readonly invoices?: {
+    voidInvoice(id: string): Promise<{
+      readonly id: string;
+      readonly status?: string | null;
+    }>;
+    markUncollectible(id: string): Promise<{
+      readonly id: string;
+      readonly status?: string | null;
+    }>;
+  };
+  readonly billing: {
+    readonly meterEvents: {
+      create(params: {
+        readonly event_name: string;
+        readonly payload: Readonly<Record<string, string>>;
+        readonly identifier?: string;
+        readonly timestamp?: number;
+      }, options?: {
+        readonly idempotencyKey?: string;
+      }): Promise<unknown>;
+    };
+  };
+  readonly webhooks: {
+    constructEventAsync(payload: string, header: string, secret: string): Promise<{
+      readonly id: string;
+      readonly type: string;
+      readonly data: {
+        readonly object: unknown;
+      };
+    }>;
+  };
+}
+/** A customer tax id as Stripe returns it (`eu_vat`, `DE123456789`). */
+interface StripeTaxId {
+  readonly id: string;
+  readonly type: string;
+  readonly value: string;
+  readonly country?: string | null;
+  readonly verification?: {
+    readonly status?: string | null;
+  } | null;
+  readonly created?: number | null;
+}
+/**
+ * A Stripe client, a function that returns a client (`stripeFromKey()` from
+ * `better-supabase/stripe` in a bundled app), or the secret key to create one
+ * from the `stripe` package: the plain Node shortcut, which needs a runtime
+ * that resolves `stripe` when the call runs. The function runs on every Stripe
+ * call, so it can create the client lazily, pick a per-request or per-tenant
+ * client (Stripe Connect), or read a rotated key; cache inside it when needed.
+ * `C` is the part of the SDK the caller uses (`StripeClient` for billing and
+ * usage).
+ */
+type StripeSource<C extends object = StripeClient> = C | {
+  readonly secretKey: string;
+  readonly apiVersion?: string;
+} | (() => C | Promise<C>);
+//#endregion
+export { StripeSource as n, StripeTaxId as r, StripeClient as t };

package/dist/subject-readers-BJzh7WF7.js

@@ -0,0 +1,49 @@
+import "./block-helpers-DwE32_gT.js";
+//#region src/core/subject-readers.ts
+/**
+* A registered subject's type and id, from `subjects/<type>/<id>` or
+* `<type>/<id>`.
+*/
+function parseSubject(subject, types) {
+	const rest = subject.startsWith("subjects/") ? subject.slice(9) : subject;
+	const slash = rest.indexOf("/");
+	if (slash <= 0 || slash === rest.length - 1) return;
+	const type = rest.slice(0, slash);
+	return types.has(type) ? {
+		type,
+		id: rest.slice(slash + 1)
+	} : void 0;
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+* The default subscriber policy under an authorization provider: a subscriber
+* gets an event about a subject in `config.subjects` only when
+* `can_subject_for` says it may `read` the subject (the key in
+* `config.subjects.<type>.permissions`, never a share-link grant). Events
+* without a subject, or about a type the registry doesn't list, keep every
+* subscriber, so the block's own tenant check decides them. `transport` must
+* run as the service role.
+*/
+function subjectReaders(transport, options = {}) {
+	const schema = options.schema ?? "better_supabase";
+	const action = options.action ?? "read";
+	let types;
+	const registered = () => types ??= transport.call(schema, "subject_types", {}).then((value) => new Set(Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [])).catch((cause) => {
+		types = void 0;
+		throw cause;
+	});
+	return async (event, subscribers) => {
+		if (typeof event.subject !== "string" || subscribers.length === 0) return subscribers;
+		const subject = parseSubject(event.subject, await registered());
+		if (subject === void 0) return subscribers;
+		const allowed = await Promise.all(subscribers.map(async (subscriber) => UUID.test(subscriber.principal) ? await transport.call(schema, "can_subject_for", {
+			member: subscriber.principal,
+			subject_type: subject.type,
+			subject_id: subject.id,
+			action
+		}) === true : false));
+		return subscribers.filter((_, index) => allowed[index]);
+	};
+}
+//#endregion
+export { subjectReaders as t };

package/dist/subject-readers-Bbq1i0Ol.d.ts

@@ -0,0 +1,21 @@
+import { t as BlockTransport } from "./block-transport-DBPhgF3W.js";
+import { g as SubscriberPolicy } from "./authorization-hooks-HXVZXxUk.js";
+//#region src/core/subject-readers.d.ts
+interface SubjectReadersOptions {
+  /** The schema of the `subjects` module. Default `better_supabase`. */
+  readonly schema?: string;
+  /** The `config.subjects` action to check. Default `read`. */
+  readonly action?: string;
+}
+/**
+ * The default subscriber policy under an authorization provider: a subscriber
+ * gets an event about a subject in `config.subjects` only when
+ * `can_subject_for` says it may `read` the subject (the key in
+ * `config.subjects.<type>.permissions`, never a share-link grant). Events
+ * without a subject, or about a type the registry doesn't list, keep every
+ * subscriber, so the block's own tenant check decides them. `transport` must
+ * run as the service role.
+ */
+declare function subjectReaders(transport: BlockTransport, options?: SubjectReadersOptions): SubscriberPolicy;
+//#endregion
+export { subjectReaders as n, SubjectReadersOptions as t };

package/dist/subjects-DQ2SU4cA.d.ts

@@ -0,0 +1,77 @@
+//#region src/config/types/subjects.d.ts
+/**
+ * One entity the app's blocks attach to (`subjects.<type>`): a task, a
+ * customer, a document. Every subject-bound SQL module reads these entries
+ * unless its own `options.subjects` says otherwise. ADR 0020.
+ */
+interface SubjectConfig {
+  /** `schema.table`, or a table in `public`. */
+  readonly table: string;
+  /** The id column. Defaults to `id`. */
+  readonly id?: string;
+  /**
+   * The id column's type, such as `uuid` or `bigint`, so lookups compare on the
+   * primary key's own type. Without it the column is compared as text.
+   */
+  readonly idType?: string;
+  /**
+   * The tenant column. Defaults to `organization_id`, or
+   * `<sql.naming.tenant>_id` when the tenant is renamed. `false` for a subject
+   * without a tenant, which modules that keep a tenant on every row skip.
+   */
+  readonly tenant?: string | false;
+  /** The column `subject_title` returns. */
+  readonly title?: string;
+  /**
+   * The path `subject_url` returns, with `{column}` placeholders:
+   * `/tasks/{id}`.
+   */
+  readonly url?: string;
+  /**
+   * A permission key per action (`read`, `write`, or an app action) that
+   * `can_subject` checks in the subject's tenant, on top of the row being
+   * visible to the caller. `read` is also the permission modules check before
+   * they attach rows to the subject.
+   */
+  readonly permissions?: Readonly<Record<string, string>>;
+  /**
+   * A scope the authorization provider declares whose ids are this subject's
+   * ids, so a grant on the record counts as well as one on the tenant.
+   */
+  readonly scope?: string;
+  /** Delete module rows for a subject when its row is deleted. */
+  readonly cascade?: boolean;
+  /**
+   * The column holding the soft-delete time. Blocks hide rows where it is set,
+   * metrics skip them, and `gen` makes it the table's `softDelete()` column.
+   */
+  readonly deletedAt?: string;
+  /** The columns a search index reads. */
+  readonly search?: {
+    readonly title?: string;
+    readonly body?: readonly string[];
+  };
+  /**
+   * The text column holding the subject's rank key, and the column it is
+   * grouped by (a board stage), for `move()`. ADR 0021.
+   */
+  readonly rank?: {
+    readonly column: string;
+    readonly group?: string;
+  };
+  /**
+   * The columns the versions block snapshots and restores, and whether it
+   * snapshots on each change. An app table's `subject.versions` sets it.
+   */
+  readonly versions?: {
+    readonly columns: readonly string[];
+    readonly auto: boolean;
+  };
+}
+/**
+ * The app's subject types, keyed by type name (lowercase, digits and
+ * underscores).
+ */
+type SubjectsConfig = Readonly<Record<string, SubjectConfig>>;
+//#endregion
+export { SubjectsConfig as n, SubjectConfig as t };

package/dist/subscribers-BvZxcd63.js

@@ -0,0 +1,33 @@
+//#region src/realtime/subscribers.ts
+/**
+* Runs `policy` and keeps the subscribers passed in whose `kind` and
+* `principal` it returned, so a policy can narrow a fan-out but never widen it.
+* Without a policy every subscriber stays. A throw or rejection allows no one.
+*/
+async function allowedSubscribers(policy, event, subscribers) {
+	if (policy === void 0 || subscribers.length === 0) return {
+		ok: true,
+		allowed: subscribers
+	};
+	let kept;
+	try {
+		const returned = await policy(event, subscribers);
+		if (!Array.isArray(returned)) throw new TypeError("The subscriber policy did not return an array");
+		kept = new Set(returned.flatMap((entry) => typeof entry === "object" && entry !== null && "principal" in entry && typeof entry.principal === "string" ? [keyOf({
+			principal: entry.principal,
+			..."kind" in entry && (entry.kind === "user" || entry.kind === "service") ? { kind: entry.kind } : {}
+		})] : []));
+	} catch (cause) {
+		return {
+			ok: false,
+			cause
+		};
+	}
+	return {
+		ok: true,
+		allowed: subscribers.filter((subscriber) => kept.has(keyOf(subscriber)))
+	};
+}
+const keyOf = (subscriber) => `${subscriber.kind ?? "user"}:${subscriber.principal}`;
+//#endregion
+export { allowedSubscribers as t };

package/dist/supabase-mcp-Dz9DgrKP.js

@@ -0,0 +1,28 @@
+import { t as importOptionalPeer } from "./optional-peer-C1NbBRJm.js";
+//#region src/core/supabase-mcp.ts
+const INSTALL = "Supabase's MCP server needs @supabase/mcp-server-supabase: pnpm add @supabase/mcp-server-supabase";
+const isRecord = (value) => typeof value === "object" && value !== null;
+function isServerModule(value) {
+	return isRecord(value) && "createToolSchemas" in value && "createSupabaseMcpHandler" in value && typeof value["createToolSchemas"] === "function" && typeof value["createSupabaseMcpHandler"] === "function";
+}
+function isPlatformModule(value) {
+	return isRecord(value) && "createSupabaseApiPlatform" in value && typeof value["createSupabaseApiPlatform"] === "function";
+}
+/**
+* Loads `@supabase/mcp-server-supabase` on first use. The specifiers are
+* variables so bundlers leave the optional peer out of apps that don't call
+* Supabase's MCP server; a missing install throws how to add it.
+*/
+async function loadSupabaseMcp() {
+	const loaded = await importOptionalPeer("@supabase/mcp-server-supabase");
+	if (!isServerModule(loaded)) throw new TypeError(INSTALL);
+	return loaded;
+}
+/** Loads the Management API platform of `@supabase/mcp-server-supabase`. */
+async function loadSupabaseMcpPlatform() {
+	const loaded = await importOptionalPeer("@supabase/mcp-server-supabase/platform/api");
+	if (!isPlatformModule(loaded)) throw new TypeError(INSTALL);
+	return loaded;
+}
+//#endregion
+export { loadSupabaseMcp as n, loadSupabaseMcpPlatform as r, isRecord as t };

package/dist/supabase-mcp-Z4vtsuoO.d.ts

@@ -0,0 +1,46 @@
+//#region src/core/supabase-mcp.d.ts
+/** The feature groups Supabase's MCP server turns on with `features`. */
+type SupabaseMcpFeature = "account" | "branching" | "database" | "debugging" | "development" | "docs" | "functions" | "storage";
+/** Which project and tools a Supabase MCP server exposes. */
+interface SupabaseMcpScope {
+  /**
+   * Scopes the server to one project. Without it the tools reach every project
+   * the Management API token can.
+   */
+  readonly projectRef?: string;
+  /** Runs SQL read-only and leaves out the tools that write. Defaults to true. */
+  readonly readOnly?: boolean;
+  /** The feature groups to turn on; the server's defaults when unset. */
+  readonly features?: readonly SupabaseMcpFeature[];
+}
+/** The parts of `@supabase/mcp-server-supabase` better-supabase calls. */
+interface SupabaseMcpModule {
+  createToolSchemas(options: {
+    features?: readonly SupabaseMcpFeature[];
+    projectScoped?: boolean;
+    readOnly?: boolean;
+  }): Record<string, unknown>;
+  createSupabaseMcpHandler(options: {
+    platform: unknown;
+    projectId?: string;
+    readOnly?: boolean;
+    features?: string[];
+  }): {
+    fetch(request: Request, options?: {
+      readonly authInfo?: unknown;
+    }): Promise<Response>;
+    close(): Promise<void>;
+  };
+}
+/**
+ * The part of `@supabase/mcp-server-supabase/platform/api` better-supabase
+ * calls.
+ */
+interface SupabaseMcpPlatformModule {
+  createSupabaseApiPlatform(options: {
+    accessToken: string;
+    apiUrl?: string;
+  }): unknown;
+}
+//#endregion
+export { SupabaseMcpScope as i, SupabaseMcpModule as n, SupabaseMcpPlatformModule as r, SupabaseMcpFeature as t };