better-supabase 0.12.0 → 0.14.0

package/dist/h3/index.js

@@ -1,15 +1,17 @@
-import { a as toResponse, i as nitroCloudflareEnv, n as bufferInPlace, t as around } from "../shared-BmMcMoW9.js";
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-CFpfmjcS.js";
+import { a as toResponse, i as nitroCloudflareEnv, n as bufferInPlace, t as around } from "../shared-Bf-I13Ht.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-DXydjgsS.js";
 //#region src/bridges/h3.ts
 /**
-* Runs an entry array as H3 2 middleware (`app.use(...)`, Nitro and Nuxt
-* server middleware). Every contributed key lands on `event.context`, and
-* the handler's value comes back as a `Response` (JSON for plain values)
-* so response-phase entries can add headers and cookies.
+* Runs an entry array as H3 2 middleware (`app.use(...)`, Nitro and Nuxt server
+* middleware). Every contributed key lands on `event.context`, and the
+* handler's value comes back as a `Response` (JSON for plain values) so
+* response-phase entries can add headers and cookies.
 *
 * ```ts
-* app.use(toH3([withBetterSupabase(server)]))
-* app.get('/notes', (event) => event.context.db.notes.findMany().orThrow())
+* app.use(toH3([withBetterSupabase(server)]));
+* app.get("/notes", (event) =>
+*   event.context.db.notes.findMany().orThrow(),
+* );
 * ```
 */
 function toH3(entries, options = {}) {
@@ -31,11 +33,13 @@ function toH3(entries, options = {}) {
 //#endregion
 //#region src/h3/guard.ts
 /**
-* Route middleware that refuses callers outside `options`: Problem Details,
-* or a redirect to `signIn` or `mfa`. Runs after `toH3(...)`.
+* Route middleware that refuses callers outside `options`: Problem Details, or
+* a redirect to `signIn` or `mfa`. Runs after `toH3(...)`.
 *
 * ```ts
-* app.get('/admin', handler, { middleware: [guard({ roles: ['admin'] })] })
+* app.get("/admin", handler, {
+*   middleware: [guard({ roles: ["admin"] })],
+* });
 * ```
 */
 function guard(options = {}) {

package/dist/h3/v1/index.d.ts

@@ -1,9 +1,12 @@
-import { n as RouteGuardOptions } from "../../refusal-C7geIBRl.js";
-import { t as Validated } from "../../shared-DDSjEGDR.js";
-import { n as NodeRequestHead, t as NodeHeaderTarget } from "../../node-headers-AO06VhqH.js";
+import { n as RouteGuardOptions } from "../../refusal-efy5bZMd.js";
+import { t as Validated } from "../../shared-CRRfQAKG.js";
+import { n as NodeRequestHead, t as NodeHeaderTarget } from "../../node-headers-BPtMP4_V.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 //#region src/h3/v1/index.d.ts
-/** The part of an H3 1 event (Nitro 2, Nuxt 3 and 4) the bridge reads and writes. */
+/**
+ * The part of an H3 1 event (Nitro 2, Nuxt 3 and 4) the bridge reads and
+ * writes.
+ */
 export interface H3V1Event<Context extends object = Record<string, unknown>> {
   readonly node: {
     readonly req: NodeRequestHead;
@@ -17,44 +20,51 @@ export interface H3V1Event<Context extends object = Record<string, unknown>> {
   };
 }
 export interface ToH3V1Options<Context extends object> {
-  /** The host's env object for `getEnv`; defaults to `event.context.cloudflare.env`. */
+  /**
+   * The host's env object for `getEnv`; defaults to
+   * `event.context.cloudflare.env`.
+   */
   readonly env?: (event: H3V1Event<Context>) => unknown;
   /** Read the protocol and host from `x-forwarded-*`. Defaults to false. */
   readonly trustProxy?: boolean;
 }
 /**
- * An H3 1 handler, typed structurally so the package does not import `h3`.
- * It returns a `Response` to end the request or `undefined` to continue.
+ * An H3 1 handler, typed structurally so the package does not import `h3`. It
+ * returns a `Response` to end the request or `undefined` to continue.
  */
 export type H3V1Handler<Context extends object> = (event: H3V1Event<Context>) => Promise<Response | undefined>;
 /**
- * Runs an entry array as Nitro 2 server middleware. A short circuit (a 401,
- * a CORS preflight) ends the request; otherwise the entries' cookies and
- * headers go on the response and every contribution lands on
- * `event.context`. Response-phase entries (`withDbStats`) see an empty
- * response under H3 1.
+ * Runs an entry array as Nitro 2 server middleware. A short circuit (a 401, a
+ * CORS preflight) ends the request; otherwise the entries' cookies and headers
+ * go on the response and every contribution lands on `event.context`.
+ * Response-phase entries (`withDbStats`) see an empty response under H3 1.
  *
- * ```ts title="server/middleware/supabase.ts"
- * export default defineEventHandler(toH3V1([withBetterSupabase(server)]))
+ * ```ts
+ * // server/middleware/supabase.ts
+ * export default defineEventHandler(toH3V1([withBetterSupabase(server)]));
  * ```
  */
 export declare function toH3V1<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, options?: ToH3V1Options<Partial<Contributions<Entries>>>): H3V1Handler<Partial<Contributions<Entries>>>;
 /**
- * Refuses callers outside `options`: Problem Details, or a redirect to
- * `signIn` or `mfa`. Returns `undefined` for callers it lets through, so a
- * route handler can return its result.
+ * Refuses callers outside `options`: Problem Details, or a redirect to `signIn`
+ * or `mfa`. Returns `undefined` for callers it lets through, so a route handler
+ * can return its result.
  *
- * ```ts title="server/api/admin.get.ts"
- * const admins = guard({ roles: ['admin'] })
- * export default defineEventHandler(async (event) =>
- *   (await admins(event)) ?? event.context.db.members.findMany().orThrow())
+ * ```ts
+ * // server/api/admin.get.ts
+ * const admins = guard({ roles: ["admin"] });
+ * export default defineEventHandler(
+ *   async (event) =>
+ *     (await admins(event)) ??
+ *     event.context.db.members.findMany().orThrow(),
+ * );
  * ```
  */
 export declare function guard(options?: RouteGuardOptions): (event: H3V1Event<object>) => Promise<Response | undefined>;
 /**
- * Answers thrown `DbException`s (from `.orThrow()`) with Problem Details
- * and returns `undefined` for every other error, for a Nitro `error` hook
- * or a handler's `catch`.
+ * Answers thrown `DbException`s (from `.orThrow()`) with Problem Details and
+ * returns `undefined` for every other error, for a Nitro `error` hook or a
+ * handler's `catch`.
  */
 export declare function problemOnError(options?: {
   readonly expose?: boolean;

package/dist/h3/v1/index.js

@@ -1,16 +1,16 @@
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../../refusal-CFpfmjcS.js";
-import { t as beforeRoute } from "../../before-route-B98js9m_.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../../refusal-DXydjgsS.js";
+import { t as beforeRoute } from "../../before-route-B23K2zYU.js";
 import { n as headRequest, t as applyWebHeaders } from "../../node-headers-C71zNQHe.js";
 //#region src/h3/v1/index.ts
 /**
-* Runs an entry array as Nitro 2 server middleware. A short circuit (a 401,
-* a CORS preflight) ends the request; otherwise the entries' cookies and
-* headers go on the response and every contribution lands on
-* `event.context`. Response-phase entries (`withDbStats`) see an empty
-* response under H3 1.
+* Runs an entry array as Nitro 2 server middleware. A short circuit (a 401, a
+* CORS preflight) ends the request; otherwise the entries' cookies and headers
+* go on the response and every contribution lands on `event.context`.
+* Response-phase entries (`withDbStats`) see an empty response under H3 1.
 *
-* ```ts title="server/middleware/supabase.ts"
-* export default defineEventHandler(toH3V1([withBetterSupabase(server)]))
+* ```ts
+* // server/middleware/supabase.ts
+* export default defineEventHandler(toH3V1([withBetterSupabase(server)]));
 * ```
 */
 function toH3V1(entries, options = {}) {
@@ -24,23 +24,27 @@ function toH3V1(entries, options = {}) {
 	};
 }
 /**
-* Refuses callers outside `options`: Problem Details, or a redirect to
-* `signIn` or `mfa`. Returns `undefined` for callers it lets through, so a
-* route handler can return its result.
+* Refuses callers outside `options`: Problem Details, or a redirect to `signIn`
+* or `mfa`. Returns `undefined` for callers it lets through, so a route handler
+* can return its result.
 *
-* ```ts title="server/api/admin.get.ts"
-* const admins = guard({ roles: ['admin'] })
-* export default defineEventHandler(async (event) =>
-*   (await admins(event)) ?? event.context.db.members.findMany().orThrow())
+* ```ts
+* // server/api/admin.get.ts
+* const admins = guard({ roles: ["admin"] });
+* export default defineEventHandler(
+*   async (event) =>
+*     (await admins(event)) ??
+*     event.context.db.members.findMany().orThrow(),
+* );
 * ```
 */
 function guard(options = {}) {
 	return (event) => routeRefusal(guardedLocals(event.context), headRequest(event.node.req), options);
 }
 /**
-* Answers thrown `DbException`s (from `.orThrow()`) with Problem Details
-* and returns `undefined` for every other error, for a Nitro `error` hook
-* or a handler's `catch`.
+* Answers thrown `DbException`s (from `.orThrow()`) with Problem Details and
+* returns `undefined` for every other error, for a Nitro `error` hook or a
+* handler's `catch`.
 */
 function problemOnError(options = {}) {
 	return (error, event) => errorResponse(error, headRequest(event.node.req), options);

package/dist/hmac-B3CTTlfv.js

@@ -0,0 +1,23 @@
+//#region src/core/hmac.ts
+let encoderInstance;
+const encoder = { encode: (text) => (encoderInstance ??= new TextEncoder()).encode(text) };
+/** Constant-time string comparison. */
+function timingSafeEqual(a, b) {
+	const left = encoder.encode(a);
+	const right = encoder.encode(b);
+	let diff = left.length ^ right.length;
+	for (let index = 0; index < Math.max(left.length, right.length); index += 1) diff |= (left[index] ?? 0) ^ (right[index] ?? 0);
+	return diff === 0;
+}
+/** Lowercase hex of a byte array. */
+const toHex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+/** The hex HMAC-SHA-256 of `message`, keyed with the UTF-8 bytes of `secret`. */
+async function hmacHex(secret, message) {
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return toHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(message))));
+}
+//#endregion
+export { hmacHex as n, timingSafeEqual as r, encoder as t };

package/dist/hono/index.d.ts

@@ -1,15 +1,15 @@
-import { B as TableKey, a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
-import { r as AuthState } from "../resolve-Ceft-18-.js";
-import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
-import { t as BetterSupabase } from "../define-DYZnvAbs.js";
-import { a as ServerContext, c as ServerOptions, l as SharedServer, n as BetterServer } from "../server-types-fLdep4gb.js";
-import { t as AuthSession } from "../view-KQhe6eNc.js";
-import { i as MiddlewareOptions, r as GuardOptions } from "../respond-BSL36dQp.js";
-import { s as BlockRequireOptions } from "../kit-De-EVRhw.js";
+import { M as AnyFunctions, N as AnyModels, mt as TableKey } from "../executor-CPyrQdjh.js";
+import { r as AuthState } from "../resolve-CzUKTIMq.js";
+import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-DFP3gHv8.js";
+import { t as BetterSupabase } from "../define-Dw7pRO4h.js";
+import { t as AuthSession } from "../view-2_I-2ukO.js";
+import { a as ServerContext, c as ServerOptions, l as SharedServer, n as BetterServer } from "../server-types-BOs-eFpo.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-CZYibxUx.js";
+import { c as ResourceLoaderContext, s as BlockRequireOptions } from "../kit-DKfbNTAA.js";
 import { t as CorsOptions } from "../cors-kLq6VM06.js";
-import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-LW1i5-h3.js";
-import { t as defineAction } from "../resource-execute-Bxvgmx-n.js";
-import { i as RouteRateLimitRule, n as RateLimitVerdict, r as RateLimiter, t as RateLimitRouteOptions } from "../rate-limit-c6c1mB6R.js";
+import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-Bzt_bpR5.js";
+import { t as defineAction } from "../resource-execute-bT9ltHVT.js";
+import { i as RouteRateLimitRule, n as RateLimitVerdict, r as RateLimiter, t as RateLimitRouteOptions } from "../rate-limit-CrOuXfjj.js";
 import { AnyEntry, Contributions, ValidateEntries } from "@supabase/middleware";
 import { Context, ErrorHandler, Hono, MiddlewareHandler } from "hono";
 //#region src/bridges/hono.d.ts
@@ -21,8 +21,8 @@ type HonoBridge<Entries extends readonly AnyEntry[]> = [ValidateEntries<Entries>
   Variables: Contributions<Entries>;
 }> : ValidateEntries<Entries>;
 /**
- * Runs an entry array in Hono's middleware slot. The pipeline folds once,
- * so entries keep their state across requests; each request publishes every
+ * Runs an entry array in Hono's middleware slot. The pipeline folds once, so
+ * entries keep their state across requests; each request publishes every
  * contributed key on `c.var`, runs the rest of the Hono chain, and returns
  * Hono's response back up through the entries, so response-phase entries
  * (refreshed cookies, `withCors`) see it.
@@ -31,8 +31,8 @@ type HonoBridge<Entries extends readonly AnyEntry[]> = [ValidateEntries<Entries>
  * const app = new Hono().use(toHono([withBetterSupabase(server)])).get('/notes', (c) => ...)
  * ```
  *
- * Chain `.use()` into the routes it gates: Hono carries the contributed
- * keys through the chained call's type.
+ * Chain `.use()` into the routes it gates: Hono carries the contributed keys
+ * through the chained call's type.
  */
 export declare function toHono<const Entries extends readonly AnyEntry[]>(entries: Entries): HonoBridge<Entries>;
 //#endregion
@@ -52,49 +52,67 @@ export interface HonoEnv<M extends AnyModels, F extends AnyFunctions, E, C = unk
 export interface HonoOptions extends ServerOptions {
   /**
    * An existing server, such as the one `createNext` returned, so both
-   * frameworks share one `createServer`: the same cookies, clients,
-   * credentials and event sinks. The server options are then ignored.
+   * frameworks share one `createServer`: the same cookies, clients, credentials
+   * and event sinks. The server options are then ignored.
    */
   readonly server?: SharedServer;
-  /** Answer preflights and add CORS headers to every route of `app()`. `true` uses Supabase's defaults. */
+  /**
+   * Answer preflights and add CORS headers to every route of `app()`. `true`
+   * uses Supabase's defaults.
+   */
   readonly cors?: boolean | CorsOptions;
-  /** Include error details in problem responses. Defaults to `NODE_ENV === 'development'`. */
+  /**
+   * Include error details in problem responses. Defaults to `NODE_ENV ===
+   * 'development'`.
+   */
   readonly exposeErrors?: boolean;
   /**
-   * Keeps the invocation alive for event sink sends a handler started.
-   * Defaults to `c.executionCtx.waitUntil` when the runtime passes one (Workers).
+   * Keeps the invocation alive for event sink sends a handler started. Defaults
+   * to `c.executionCtx.waitUntil` when the runtime passes one (Workers).
    */
   readonly waitUntil?: (promise: Promise<unknown>) => void;
 }
 export interface BetterHono<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Ref = string, B = unknown> extends BetterServer<M, F, E, C, P, B> {
   /**
-   * The app's Hono `Env`, for `new Hono<typeof bs.Env>()` and
-   * `Context<typeof bs.Env>`. Type only: `undefined` at runtime.
+   * The app's Hono `Env`, for `new Hono<typeof bs.Env>()` and `Context<typeof
+   * bs.Env>`. Type only: `undefined` at runtime.
    */
   readonly Env: HonoEnv<M, F, E, C, P, B>;
   /** `new Hono<typeof bs.Env>()` with `onError(bs.onError)` installed. */
   app(): Hono<HonoEnv<M, F, E, C, P, B>>;
-  /** Resolves the caller, enforces `allow` and sets `c.var.bs`, `c.var.db`, `c.var.auth`. */
+  /**
+   * Resolves the caller, enforces `allow` and sets `c.var.bs`, `c.var.db`,
+   * `c.var.auth`.
+   */
   middleware(options?: MiddlewareOptions): MiddlewareHandler<HonoEnv<M, F, E, C, P, B>>;
   /**
    * A route guard after `middleware()`: `allow`, `aal`, `scopes`,
    * `requireTenant` and `authorize`. A refused caller gets Problem Details.
    *
    * ```ts
-   * app.post('/invites', bs.require({ requireTenant: true, roles: ['admin'] }), handler)
+   * app.post(
+   *   "/invites",
+   *   bs.require({ requireTenant: true, roles: ["admin"] }),
+   *   handler,
+   * );
    * ```
    */
-  require: (options?: BlockRequireOptions<C, P, boolean, Ref>) => MiddlewareHandler<HonoEnv<M, F, E, C, P, B>>;
+  require: (options?: BlockRequireOptions<C, P, boolean, Ref, ServerContext<M, F, E, C, P, B> & ResourceLoaderContext<C, P>>) => MiddlewareHandler<HonoEnv<M, F, E, C, P, B>>;
   /**
    * Counts a hit per request with a rate limiter, such as `createRateLimit()`,
    * and adds the `RateLimit` (and with `rule`, `RateLimit-Policy`) fields. A
    * refused request gets a 429 with `Retry-After`.
    *
    * ```ts
-   * app.use('/api/*', bs.rateLimit({
-   *   limiter, scope: 'api', rule: { max: 100, period: '1 minute' },
-   *   key: (c) => c.req.header('x-api-key'),
-   * }))
+   * app.use(
+   *   "/api/*",
+   *   bs.rateLimit({
+   *     limiter,
+   *     scope: "api",
+   *     rule: { max: 100, period: "1 minute" },
+   *     key: (c) => c.req.header("x-api-key"),
+   *   }),
+   * );
    * ```
    */
   rateLimit(options: RateLimitRouteOptions<Context<HonoEnv<M, F, E, C, P, B>>>): MiddlewareHandler<HonoEnv<M, F, E, C, P, B>>;
@@ -106,15 +124,15 @@ export interface BetterHono<M extends AnyModels, F extends AnyFunctions, E, C =
     readonly status?: number;
   }): (c: Context<HonoEnv<M, F, E, C, P, B>>) => Promise<Response>;
   /**
-   * `app.onError(bs.onError)`: `DbException`s (and errors caused by a `DbError`)
-   * become Problem Details, Hono's `HTTPException`s keep their own response,
-   * and anything else is a 500.
+   * `app.onError(bs.onError)`: `DbException`s (and errors caused by a
+   * `DbError`) become Problem Details, Hono's `HTTPException`s keep their own
+   * response, and anything else is a 500.
    */
   readonly onError: ErrorHandler<HonoEnv<M, F, E, C, P, B>>;
   /**
-   * REST routes for a table matching the API model: the collection, the
-   * item and each action's path. Mount with
-   * `app.route('/customers', bs.resource('customers'))` behind `middleware()`.
+   * REST routes for a table matching the API model: the collection, the item
+   * and each action's path. Mount with `app.route('/customers',
+   * bs.resource('customers'))` behind `middleware()`.
    */
   resource<T extends TableKey<M>>(table: T, options?: ResourceRouteOptions<M, T, Ref, ServerContext<M, F, E, C, P, B>["db"]>): Hono<HonoEnv<M, F, E, C, P, B>>;
 }

package/dist/hono/index.js

@@ -1,15 +1,15 @@
-import { r as dbErrorOf } from "../errors-BV1SKTVs.js";
-import { o as problemResponse } from "../problem-JRCohp1j.js";
-import { a as unexpectedResponse, c as extendServer, n as flushEvents, s as createServer } from "../adapter-CRNH2aX_.js";
-import { n as toSession } from "../view-CYX1wsgp.js";
-import { a as respond, t as defaultExpose } from "../respond-Bhp3G__q.js";
-import { t as withBetterSupabase } from "../composite-1kPAxXto.js";
-import { r as defineAction, t as defineResource } from "../resource-Bdkqi8jo.js";
-import { i as requireCaller } from "../kit-LTbHrWWD.js";
-import { t as matchResource } from "../resources-Ck7itNeX.js";
-import { r as handoffOf } from "../shared-BmMcMoW9.js";
+import { r as dbErrorOf } from "../errors-03ysrOt4.js";
+import { o as problemResponse } from "../problem-BWElIgIb.js";
+import { a as unexpectedResponse, c as extendServer, n as flushEvents, s as createServer } from "../adapter-BCFAg58A.js";
+import { n as toSession } from "../view-BtgqxQLM.js";
+import { a as respond, t as defaultExpose } from "../respond-z_yfyitp.js";
+import { t as withBetterSupabase } from "../composite-Dv6o2BSw.js";
+import { r as defineAction, t as defineResource } from "../resource-Dk_JYsOt.js";
+import { i as requireCaller } from "../kit-Ct4Z6GIO.js";
+import { t as matchResource } from "../resources-BV6j5TTD.js";
+import { r as handoffOf } from "../shared-Bf-I13Ht.js";
 import { n as corsConfig } from "../cors-h_v7TPxl.js";
-import { t as rateLimitGate } from "../rate-limit-DVZ7qIzW.js";
+import { t as rateLimitGate } from "../rate-limit-B_U12PdL.js";
 import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { withCors } from "@supabase/middleware/cors";
 import { Hono } from "hono";
@@ -22,8 +22,8 @@ function publishAll(c, ctx) {
 	for (const [key, value] of Object.entries(ctx)) c.set(key, value);
 }
 /**
-* The Hono middleware for `entries`. `publish` decides what lands on
-* `c.var`; `createHono` adds `auth` from `ctx.bs`.
+* The Hono middleware for `entries`. `publish` decides what lands on `c.var`;
+* `createHono` adds `auth` from `ctx.bs`.
 */
 function honoMiddleware(entries, publish = publishAll) {
 	const run = pipeline(entries, async (_request, ctx) => {
@@ -49,8 +49,8 @@ function honoMiddleware(entries, publish = publishAll) {
 	};
 }
 /**
-* Runs an entry array in Hono's middleware slot. The pipeline folds once,
-* so entries keep their state across requests; each request publishes every
+* Runs an entry array in Hono's middleware slot. The pipeline folds once, so
+* entries keep their state across requests; each request publishes every
 * contributed key on `c.var`, runs the rest of the Hono chain, and returns
 * Hono's response back up through the entries, so response-phase entries
 * (refreshed cookies, `withCors`) see it.
@@ -59,8 +59,8 @@ function honoMiddleware(entries, publish = publishAll) {
 * const app = new Hono().use(toHono([withBetterSupabase(server)])).get('/notes', (c) => ...)
 * ```
 *
-* Chain `.use()` into the routes it gates: Hono carries the contributed
-* keys through the chained call's type.
+* Chain `.use()` into the routes it gates: Hono carries the contributed keys
+* through the chained call's type.
 */
 function toHono(entries) {
 	return honoMiddleware(entries);
@@ -136,7 +136,7 @@ function createHono(betterSupabase, options = {}) {
 		},
 		require: (requireOptions = {}) => async (c, next) => {
 			const ctx = contextOf(c);
-			const caller = await requireCaller(ctx.auth, requireOptions, c.get("tenant"), options.authorizer);
+			const caller = await requireCaller(ctx.auth, requireOptions, c.get("tenant"), options.authorizer, ctx);
 			if ("kind" in caller) return problemResponse(caller, {
 				instance: new URL(c.req.url).pathname,
 				expose

package/dist/http-51t9xppD.js

@@ -0,0 +1,28 @@
+import { n as dbError } from "./errors-03ysrOt4.js";
+import { o as problemResponse } from "./problem-BWElIgIb.js";
+import { UI_MESSAGE_STREAM_HEADERS } from "ai";
+//#region src/ai-sdk/http.ts
+/** A 400 problem response for a malformed chat request. */
+function badRequest(message) {
+	return problemResponse(dbError("invalid_request", message, { code: "AI_CHAT_BAD_REQUEST" }));
+}
+/** The JSON body of a request, or `undefined` when it is not JSON. */
+async function readJson(request) {
+	try {
+		return await request.json();
+	} catch {
+		return;
+	}
+}
+/**
+* A UI message stream as a response, with extra headers such as the workflow
+* run id.
+*/
+function sse(stream, headers = {}) {
+	return new Response(stream.pipeThrough(new TextEncoderStream()), { headers: {
+		...UI_MESSAGE_STREAM_HEADERS,
+		...headers
+	} });
+}
+//#endregion
+export { readJson as n, sse as r, badRequest as t };

package/dist/http-BjjojWg3.js

@@ -0,0 +1,40 @@
+import { i as toWebHeaders, r as nodeRequestUrl, t as applyWebHeaders } from "./node-headers-C71zNQHe.js";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+//#region src/node/http.ts
+/**
+* A Node `IncomingMessage` as a Web `Request`. Express, Fastify and Koa pass
+* theirs (`req`, `request.raw`, `ctx.req`). With `body: false` the stream stays
+* unread, for middleware that runs before a body parser.
+*/
+function toWebRequest(req, options = {}) {
+	const method = req.method ?? "GET";
+	const hasBody = (options.body ?? true) && method !== "GET" && method !== "HEAD";
+	const controller = new AbortController();
+	req.once("close", () => {
+		if (!req.complete) controller.abort();
+	});
+	return new Request(nodeRequestUrl(req, options.trustProxy ?? false), {
+		method,
+		headers: toWebHeaders(req.headers),
+		signal: controller.signal,
+		...hasBody ? {
+			body: Readable.toWeb(req),
+			duplex: "half"
+		} : {}
+	});
+}
+/** Writes a Web `Response` to a Node `ServerResponse`, streaming the body. */
+async function sendWebResponse(res, response) {
+	res.statusCode = response.status;
+	if (response.statusText) res.statusMessage = response.statusText;
+	applyWebHeaders(res, response.headers);
+	if (!response.body) {
+		res.end();
+		return;
+	}
+	const body = response.body;
+	await pipeline(Readable.fromWeb(body), res);
+}
+//#endregion
+export { toWebRequest as n, sendWebResponse as t };

package/dist/http-DzbloBR-.js

@@ -0,0 +1,141 @@
+import { getEnv } from "@supabase/middleware";
+import { fromSupabaseUrl } from "@supabase/server/oauth-protected-resource";
+//#region src/mcp/http.ts
+/**
+* The RFC 9728 well-known prefix. The Supabase Edge Functions gateway never
+* routes it to a function.
+*/
+const WELL_KNOWN = "/.well-known/oauth-protected-resource";
+/**
+* The path suffix `withOAuthProtectedResource` serves, reachable through
+* `/functions/v1/<slug>`.
+*/
+const SUFFIX = "/oauth-protected-resource";
+/**
+* The prefix the Edge Functions gateway strips before the function sees the
+* request.
+*/
+const EDGE_PREFIX = "/functions/v1";
+const ALLOW_HEADERS = "Authorization, Content-Type, Accept, Mcp-Protocol-Version, Mcp-Session-Id, Mcp-Method, Mcp-Name";
+const trim = (value) => value.replace(/\/+$/, "");
+/**
+* Whether the request runs on Supabase Edge Functions, detected as
+* `@supabase/server` 1.9 does, minus its plain-Deno fallback so a Deno Deploy
+* server keeps its own URLs.
+*/
+function onEdgeFunctions() {
+	return ["SUPABASE_FUNCTION_SLUG", "SB_EXECUTION_ID"].some((key) => Boolean(getEnv(key)));
+}
+/**
+* The public origin: `SUPABASE_PUBLIC_URL`, else the gateway's `X-Forwarded-*`
+* headers.
+*/
+function edgeOrigin(request) {
+	const publicUrl = getEnv("SUPABASE_PUBLIC_URL");
+	if (publicUrl) return trim(publicUrl);
+	const url = new URL(request.url);
+	const host = request.headers.get("x-forwarded-host") ?? url.hostname;
+	const proto = (request.headers.get("x-forwarded-proto") ?? url.protocol.slice(0, -1)).toLowerCase();
+	const port = host.includes(":") ? "" : request.headers.get("x-forwarded-port") ?? url.port;
+	return `${proto}://${host}${port && !(proto === "https" && port === "443" || proto === "http" && port === "80") ? `:${port}` : ""}`;
+}
+function stripMetadata(pathname) {
+	if (pathname.startsWith(WELL_KNOWN)) return pathname.slice(37);
+	if (pathname.endsWith(SUFFIX)) return pathname.slice(0, -25);
+	return pathname;
+}
+function edgePath(request) {
+	const slug = getEnv("SUPABASE_FUNCTION_SLUG");
+	if (slug) return `${EDGE_PREFIX}/${slug}`;
+	return trim(`${EDGE_PREFIX}${stripMetadata(new URL(request.url).pathname)}`);
+}
+/**
+* A request for the RFC 9728 metadata, at the well-known prefix or the
+* `{resource}/oauth-protected-resource` suffix.
+*/
+function isMetadataRequest(request) {
+	const { pathname } = new URL(request.url);
+	if (pathname === WELL_KNOWN || pathname.startsWith(`${WELL_KNOWN}/`)) return true;
+	return pathname.endsWith(SUFFIX) && request.method !== "POST";
+}
+/**
+* The public URLs of an MCP endpoint. On Supabase Edge Functions they come from
+* the gateway (the request URL is internal there, without `/functions/v1`), and
+* the metadata is advertised at the suffix route.
+*/
+function discovery(options, supabaseUrl) {
+	const resource = (request) => {
+		if (typeof options.resource === "function") return options.resource(request);
+		if (options.resource) return options.resource;
+		if (onEdgeFunctions()) return `${edgeOrigin(request)}${edgePath(request)}`;
+		const url = new URL(request.url);
+		return trim(`${url.origin}${stripMetadata(url.pathname)}`);
+	};
+	return {
+		resource,
+		metadataUrl: (request) => {
+			const target = new URL(resource(request));
+			const path = trim(target.pathname);
+			return onEdgeFunctions() ? `${target.origin}${path}${SUFFIX}` : `${target.origin}${WELL_KNOWN}${path}`;
+		},
+		authorizationServers: (request) => {
+			if (options.authorizationServers) return options.authorizationServers;
+			return onEdgeFunctions() ? [`${edgeOrigin(request)}/auth/v1`] : [fromSupabaseUrl(supabaseUrl())];
+		},
+		host: (request) => {
+			return (onEdgeFunctions() ? request.headers.get("x-forwarded-host") : null) ?? request.headers.get("host");
+		}
+	};
+}
+/** The `OPTIONS` answer for the metadata route. */
+function metadataPreflight() {
+	return new Response(null, {
+		status: 204,
+		headers: {
+			"access-control-allow-origin": "*",
+			"access-control-allow-methods": "GET, OPTIONS",
+			"access-control-allow-headers": "Content-Type, Mcp-Protocol-Version"
+		}
+	});
+}
+/** The `OPTIONS` answer for the MCP endpoint. */
+function endpointPreflight(request, allowedOrigins) {
+	return withCors(new Response(null, {
+		status: 204,
+		headers: {
+			"access-control-allow-methods": "POST, OPTIONS",
+			"access-control-allow-headers": ALLOW_HEADERS,
+			"access-control-max-age": "86400"
+		}
+	}), request, allowedOrigins);
+}
+/**
+* Adds CORS headers to an endpoint response, keeping any the handler set. With
+* `allowedOrigins` a listed origin is echoed; otherwise any origin may call,
+* which is safe because the token travels in a header, not a cookie.
+*/
+function withCors(response, request, allowedOrigins) {
+	const origin = request.headers.get("origin");
+	const allow = allowedOrigins ? origin && allowedOrigins.includes(origin) ? origin : null : "*";
+	const apply = (headers) => {
+		if (allow && !headers.has("access-control-allow-origin")) {
+			headers.set("access-control-allow-origin", allow);
+			if (allow !== "*") headers.append("vary", "Origin");
+		}
+		if (!headers.has("access-control-expose-headers")) headers.set("access-control-expose-headers", "WWW-Authenticate");
+	};
+	try {
+		apply(response.headers);
+		return response;
+	} catch {
+		const headers = new Headers(response.headers);
+		apply(headers);
+		return new Response(response.body, {
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+	}
+}
+//#endregion
+export { withCors as a, metadataPreflight as i, endpointPreflight as n, isMetadataRequest as r, discovery as t };