better-supabase 0.13.0 → 0.14.0

package/dist/resource-Dk_JYsOt.js

@@ -0,0 +1,469 @@
+import { n as dbError, o as isDbError } from "./errors-03ysrOt4.js";
+import { a as ok, r as err, s as toDbError } from "./result-B3m7xtRY.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { n as validate } from "./standard-DtkpFGkS.js";
+import { a as methodNotAllowed } from "./problem-BWElIgIb.js";
+import { a as respond, i as isResult } from "./respond-z_yfyitp.js";
+import { n as checkPermission, t as checkEach } from "./authorizer-DPTeL-7h.js";
+import { n as planResource, t as matchAction } from "./resource-BRRU-A7j.js";
+//#region src/server/resource-execute.ts
+async function settled(value) {
+	return await value;
+}
+function failure(cause, message) {
+	if (isDbError(cause)) return err(cause);
+	const error = toDbError(cause);
+	return err(error.kind === "unexpected" ? dbError("unexpected", message) : error);
+}
+/**
+* Runs a hook: its `Result` passes through, anything else is an `unexpected`
+* error.
+*/
+async function runHook(name, call) {
+	try {
+		const value = await call();
+		if (!isResult(value)) return err(dbError("unexpected", `The ${name} hook must return a Result`));
+		return value.ok ? ok(value.data) : failure(value.error, `The ${name} hook failed`);
+	} catch (cause) {
+		return failure(cause, `The ${name} hook failed`);
+	}
+}
+/** Runs an action handler: a `Result` unwraps, a plain value is the data. */
+async function runHandler(name, call) {
+	try {
+		const value = await call();
+		if (!isResult(value)) return ok(value);
+		return value.ok ? ok(value.data) : failure(value.error, `The ${name} action failed`);
+	} catch (cause) {
+		return failure(cause, `The ${name} action failed`);
+	}
+}
+/**
+* Defines an action and types its handler's `data` and `query` from the
+* schemas.
+*/
+function defineAction(action) {
+	return action;
+}
+//#endregion
+//#region src/server/resource-http.ts
+const INTEGER = /* @__PURE__ */ new Set([
+	"int2",
+	"int4",
+	"int8"
+]);
+function keyValue(table, raw) {
+	const invalid = err(dbError("invalid_input", `${JSON.stringify(raw)} is not a valid ${table.key} key`));
+	const column = table.columns[table.primaryKey[0]];
+	if (column && INTEGER.has(column.type)) {
+		const value = typeof raw === "string" ? Number(raw) : raw;
+		return typeof value === "number" && Number.isSafeInteger(value) ? ok(value) : invalid;
+	}
+	return typeof raw === "string" && raw !== "" ? ok(raw) : invalid;
+}
+/**
+* A cross-site browser request that needed no CORS preflight: a form post
+* riding on the session cookie. Bearer requests and JSON bodies (which need a
+* preflight) pass, as do requests without an `Origin` (not a browser).
+*/
+function crossSiteSimpleRequest(request) {
+	if (request.method === "GET" || request.method === "HEAD") return false;
+	if (request.headers.has("authorization")) return false;
+	const origin = request.headers.get("origin");
+	if (!origin || origin === new URL(request.url).origin) return false;
+	if (request.headers.get("sec-fetch-site") === "same-origin") return false;
+	const type = request.headers.get("content-type") ?? "";
+	return !/^application\/(?:[\w.+-]+\+)?json\b/iu.test(type);
+}
+async function readBody(request) {
+	try {
+		const body = await request.json();
+		if (typeof body === "object" && body !== null && !Array.isArray(body)) return ok(body);
+	} catch {}
+	return err(dbError("invalid_input", "The request body must be a JSON object"));
+}
+/** Any JSON body; an empty body is `undefined`. */
+async function readJson(request) {
+	const text = await request.text();
+	if (text.trim() === "") return ok(void 0);
+	try {
+		return ok(JSON.parse(text));
+	} catch {
+		return err(dbError("invalid_input", "The request body must be JSON"));
+	}
+}
+/** URL parameters as an object; a repeated name becomes an array. */
+function queryObject(query) {
+	if (!(query instanceof URLSearchParams)) return query ?? {};
+	const values = {};
+	for (const [name, value] of query) {
+		const seen = values[name];
+		values[name] = seen === void 0 ? value : [...Array.isArray(seen) ? seen : [seen], value];
+	}
+	return values;
+}
+function pageArgs(query, max, pagination) {
+	const raw = (name) => {
+		const value = query instanceof URLSearchParams ? query.get(name) : query?.[name];
+		return value === null || value === "" ? void 0 : value;
+	};
+	const read = (name, fallback) => {
+		const value = raw(name);
+		if (value === void 0) return fallback;
+		const number = Number(value);
+		return Number.isSafeInteger(number) && number >= 1 ? number : void 0;
+	};
+	const issues = [];
+	const size = read("size", 50);
+	if (size === void 0 || size > max) issues.push({
+		message: `Must be between 1 and ${max}`,
+		path: ["size"]
+	});
+	const [used, unused] = pagination === "cursor" ? ["after", "page"] : ["page", "after"];
+	if (raw(unused) !== void 0) issues.push({
+		message: `This list pages with \`${used}\``,
+		path: [unused]
+	});
+	const page = read("page", 1);
+	if (pagination === "offset" && page === void 0) issues.push({
+		message: "Must be a positive integer",
+		path: ["page"]
+	});
+	const after = raw("after");
+	if (pagination === "cursor" && after !== void 0 && typeof after !== "string") issues.push({
+		message: "Must be text",
+		path: ["after"]
+	});
+	if (issues.length > 0 || size === void 0) return err(dbError("validation", "Invalid page parameters", { issues }));
+	return pagination === "cursor" ? ok({
+		after: typeof after === "string" ? after : null,
+		size
+	}) : ok({
+		page: page ?? 1,
+		size
+	});
+}
+function asObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? ok(value) : err(dbError("invalid_input", "Expected an object of column values"));
+}
+function splitPath(subpath) {
+	if (typeof subpath !== "string") return ok(subpath);
+	try {
+		return ok(subpath.split("/").filter((segment) => segment !== "").map((segment) => decodeURIComponent(segment)));
+	} catch {
+		return err(dbError("invalid_input", `Malformed path ${subpath}`));
+	}
+}
+function contextOf(db) {
+	const value = "$context" in db ? db.$context : void 0;
+	return isRecord(value) ? value : {};
+}
+/** Whether an action's path fits these segments, whatever the method. */
+function actionFits(action, segments) {
+	return action.segments.length === segments.length && action.segments.every((segment, index) => segment.startsWith("{") ? segments[index] !== "" : segment === segments[index]);
+}
+//#endregion
+//#region src/server/resource.ts
+/**
+* Operations over one table, matching the paths and responses of the API model:
+* `GET/POST /<table>`, `GET/PATCH/DELETE /<table>/{id}` and each action's path.
+* Shared by the HTTP adapters and the MCP table tools.
+*
+* With permissions, the authorizer decides before the repository runs: `get`,
+* `update` and `delete` fetch the row first (under RLS) and pass it as the
+* resource's properties, and `list` keeps only the rows it grants.
+*/
+function defineResource(betterSupabase, table, options = {}, authorizer) {
+	if (options.list && options.list.table !== table) throw new TypeError(`The list query is for "${options.list.table}", not "${table}"`);
+	const plan = planResource(betterSupabase.meta, table, options, authorizer);
+	const { meta, operations, keyParam, pagination, maxPageSize } = plan;
+	const has = (operation) => operations.includes(operation);
+	const extra = options.select === void 0 ? {} : { select: options.select };
+	const list = options.list;
+	const hooks = options.hooks ?? {};
+	const resourceOf = (id, row) => ({
+		type: table,
+		...id === void 0 ? {} : { id: String(id) },
+		...isRecord(row) ? { properties: row } : {}
+	});
+	const permit = (name, db, resource) => {
+		const permission = plan.permissions[name];
+		if (permission === void 0) return ok(void 0);
+		return checkPermission({
+			authorizer,
+			permission,
+			resource,
+			context: contextOf(db)
+		});
+	};
+	const ctxOf = (db, input) => ({
+		db,
+		table,
+		request: input.request,
+		context: contextOf(db)
+	});
+	const after = async (name, ctx, result) => {
+		const run = hooks[name];
+		if (!run || !result.ok) return result;
+		return runHook(name, () => run.call(hooks, ctx, result.data));
+	};
+	const authorize = async (ctx, operation, target) => hooks.authorize ? runHook("authorize", () => hooks.authorize(ctx, operation, target)) : ok(void 0);
+	const repositoryOf = (db) => {
+		const repository = db[table];
+		if (!repository) throw new TypeError(`The db has no "${table}" repository`);
+		return repository;
+	};
+	const key = (raw) => keyParam ? keyValue(meta, raw) : err(dbError("invalid_request", `${table} has no single-column key`));
+	/** Fetches the row a permission decision reads, under the caller's RLS. */
+	const rowFor = async (name, db, id) => {
+		if (plan.permissions[name] === void 0) return ok(void 0);
+		return settled(repositoryOf(db).findById(id));
+	};
+	const filterRows = async (db, result) => {
+		const permission = plan.permissions["list"];
+		if (permission === void 0 || !result.ok) return result;
+		if (!authorizer) {
+			const denied = await checkPermission({
+				authorizer,
+				permission,
+				resource: { type: table },
+				context: contextOf(db)
+			});
+			if (!denied.ok) return denied;
+		}
+		const page = result.data;
+		if (!isRecord(page) || !Array.isArray(page["items"])) return result;
+		const items = page["items"];
+		const granted = await checkEach(authorizer, permission, items.map((row) => resourceOf(keyParam && isRecord(row) ? row[keyParam] : void 0, row)), contextOf(db));
+		return ok({
+			...page,
+			items: items.filter((_, index) => granted[index])
+		});
+	};
+	const execute = async (db, operation, input = {}) => {
+		const repository = repositoryOf(db);
+		if (!has(operation)) return err(dbError("forbidden", `${operation} is not enabled for ${table}`));
+		const ctx = ctxOf(db, input);
+		switch (operation) {
+			case "list": {
+				let run;
+				let query = input.query;
+				if (list) {
+					const parsed = list.parse(input.query ?? {});
+					if (!parsed.ok) return err(dbError("validation", "Invalid list query", { issues: parsed.issues }));
+					query = parsed.value;
+					run = () => settled(list.run(db, parsed.value, extra));
+				} else {
+					const page = pageArgs(input.query, maxPageSize, pagination);
+					if (!page.ok) return page;
+					query = page.data;
+					run = () => settled(repository.paginate({
+						...extra,
+						...page.data,
+						..."page" in page.data ? { count: "exact" } : {}
+					}));
+				}
+				const allowed = await authorize(ctx, "list", { query });
+				if (!allowed.ok) return allowed;
+				return after("afterList", ctx, await filterRows(db, await run()));
+			}
+			case "get": {
+				const id = key(input.id);
+				if (!id.ok) return id;
+				const row = await settled(repository.findById(id.data, extra));
+				if (!row.ok) return row;
+				const permitted = await permit("get", db, resourceOf(id.data, row.data));
+				if (!permitted.ok) return permitted;
+				const allowed = await authorize(ctx, "get", {
+					id: id.data,
+					row: row.data
+				});
+				if (!allowed.ok) return allowed;
+				return after("afterGet", ctx, row);
+			}
+			case "create": {
+				const body = asObject(input.data);
+				if (!body.ok) return body;
+				const data = options.input?.create ? await validate(options.input.create, body.data, "data") : body;
+				if (!data.ok) return data;
+				const permitted = await permit("create", db, resourceOf(void 0, data.data));
+				if (!permitted.ok) return permitted;
+				const allowed = await authorize(ctx, "create", { data: data.data });
+				if (!allowed.ok) return allowed;
+				const values = hooks.beforeCreate ? await runHook("beforeCreate", () => hooks.beforeCreate(ctx, data.data)) : data;
+				if (!values.ok) return values;
+				const created = await settled(repository.create(values.data, extra));
+				return after("afterCreate", ctx, created);
+			}
+			case "update": {
+				const id = key(input.id);
+				if (!id.ok) return id;
+				const body = asObject(input.data);
+				if (!body.ok) return body;
+				const data = options.input?.update ? await validate(options.input.update, body.data, "data") : body;
+				if (!data.ok) return data;
+				const row = await rowFor("update", db, id.data);
+				if (!row.ok) return row;
+				const permitted = await permit("update", db, resourceOf(id.data, row.data));
+				if (!permitted.ok) return permitted;
+				const target = {
+					id: id.data,
+					data: data.data,
+					...row.data === void 0 ? {} : { row: row.data }
+				};
+				const allowed = await authorize(ctx, "update", target);
+				if (!allowed.ok) return allowed;
+				const values = hooks.beforeUpdate ? await runHook("beforeUpdate", () => hooks.beforeUpdate(ctx, data.data, target)) : data;
+				if (!values.ok) return values;
+				const updated = await settled(repository.update(id.data, values.data, extra));
+				return after("afterUpdate", ctx, updated);
+			}
+			case "delete": {
+				const id = key(input.id);
+				if (!id.ok) return id;
+				const row = await rowFor("delete", db, id.data);
+				if (!row.ok) return row;
+				const permitted = await permit("delete", db, resourceOf(id.data, row.data));
+				if (!permitted.ok) return permitted;
+				const target = {
+					id: id.data,
+					...row.data === void 0 ? {} : { row: row.data }
+				};
+				const allowed = await authorize(ctx, "delete", target);
+				if (!allowed.ok) return allowed;
+				if (hooks.beforeDelete) {
+					const before = await runHook("beforeDelete", () => hooks.beforeDelete(ctx, target));
+					if (!before.ok) return before;
+				}
+				return settled(repository.delete(id.data));
+			}
+			default: throw new TypeError(`Unknown operation ${String(operation)}`);
+		}
+	};
+	const action = async (db, name, input = {}) => {
+		const planned = plan.actions.find((candidate) => candidate.name === name);
+		const definition = options.actions?.[name];
+		if (!planned || !definition) return err(dbError("not_found", `${table} has no action ${name}`));
+		let id;
+		if (planned.params.length > 0) {
+			const parsed = key(input.id);
+			if (!parsed.ok) return parsed;
+			id = parsed.data;
+		}
+		let data = input.data;
+		if (planned.input) {
+			const parsed = await validate(planned.input, data, "data");
+			if (!parsed.ok) return parsed;
+			data = parsed.data;
+		}
+		let query = queryObject(input.query);
+		if (planned.query) {
+			const parsed = await validate(planned.query, query, "query");
+			if (!parsed.ok) return parsed;
+			query = parsed.data;
+		}
+		const row = id === void 0 ? ok(void 0) : await rowFor(name, db, id);
+		if (!row.ok) return row;
+		const permitted = await permit(name, db, resourceOf(id, row.data ?? data));
+		if (!permitted.ok) return permitted;
+		const ctx = ctxOf(db, input);
+		const allowed = await authorize(ctx, name, {
+			id,
+			data,
+			query,
+			...row.data === void 0 ? {} : { row: row.data }
+		});
+		if (!allowed.ok) return allowed;
+		return runHandler(name, () => definition.handler(ctx, {
+			id,
+			data,
+			query
+		}));
+	};
+	const collectionMethods = [...has("list") ? ["GET"] : [], ...has("create") ? ["POST"] : []];
+	const itemMethods = [
+		...has("get") ? ["GET"] : [],
+		...has("update") ? ["PATCH"] : [],
+		...has("delete") ? ["DELETE"] : []
+	];
+	const route = async (request, db, segments, actions) => {
+		if (crossSiteSimpleRequest(request)) return [err(dbError("forbidden", "Cross-site requests need Content-Type: application/json or a bearer token", { code: "CROSS_SITE_REQUEST" }))];
+		if (actions && segments.length > 0) {
+			const method = request.method === "HEAD" ? "GET" : request.method;
+			const found = matchAction(plan, method, segments);
+			if (found === "method") return [methodNotAllowed(plan.actions.filter((candidate) => actionFits(candidate, segments)).map((candidate) => candidate.method))];
+			if (found) {
+				const body = method === "GET" ? ok(void 0) : await readJson(request);
+				if (!body.ok) return [body];
+				const id = keyParam ? found.params[keyParam] : void 0;
+				return [await action(db, found.action.name, {
+					id,
+					data: body.data,
+					query: new URL(request.url).searchParams,
+					request
+				}), found.action.status ?? 200];
+			}
+		}
+		if (segments.length === 0) {
+			if (request.method === "GET" && has("list")) return [await execute(db, "list", {
+				query: new URL(request.url).searchParams,
+				request
+			})];
+			if (request.method === "POST" && has("create")) {
+				const body = await readBody(request);
+				return [body.ok ? await execute(db, "create", {
+					data: body.data,
+					request
+				}) : body, 201];
+			}
+			return [methodNotAllowed(collectionMethods)];
+		}
+		if (segments.length > 1 || !keyParam) return [new Response(null, { status: 404 })];
+		const id = segments[0];
+		if (request.method === "GET" && has("get")) return [await execute(db, "get", {
+			id,
+			request
+		})];
+		if (request.method === "PATCH" && has("update")) {
+			const body = await readBody(request);
+			return [body.ok ? await execute(db, "update", {
+				id,
+				data: body.data,
+				request
+			}) : body];
+		}
+		if (request.method === "DELETE" && has("delete")) return [await execute(db, "delete", {
+			id,
+			request
+		})];
+		return [methodNotAllowed(itemMethods)];
+	};
+	const reply = async (routed, respondOptions) => {
+		const [value, status] = await routed();
+		return respond(() => value, status === void 0 ? respondOptions : {
+			...respondOptions,
+			status
+		});
+	};
+	return {
+		table,
+		meta,
+		operations,
+		keyParam,
+		list,
+		pagination,
+		maxPageSize,
+		plan,
+		execute,
+		action,
+		handle(request, db, id, respondOptions = {}) {
+			return reply(() => route(request, db, id === void 0 ? [] : [id], false), respondOptions);
+		},
+		serve(request, db, subpath, respondOptions = {}) {
+			const segments = splitPath(subpath);
+			return reply(async () => segments.ok ? route(request, db, segments.data, true) : [segments], respondOptions);
+		}
+	};
+}
+//#endregion
+export { actionFits as n, defineAction as r, defineResource as t };

package/dist/resource-execute-bT9ltHVT.d.ts

@@ -0,0 +1,15 @@
+import { n as ResourceActionSpec } from "./resource-DYDEnww-.js";
+import { i as ResourceContext, n as Parsed, r as ResourceAction, t as ActionArgs } from "./resource-types-Bzt_bpR5.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/server/resource-execute.d.ts
+/**
+ * Defines an action and types its handler's `data` and `query` from the
+ * schemas.
+ */
+declare function defineAction<DbT = unknown, Ref = string, I extends StandardSchemaV1 | undefined = undefined, Q extends StandardSchemaV1 | undefined = undefined>(action: Omit<ResourceActionSpec<Ref>, "input" | "query"> & {
+  readonly input?: I;
+  readonly query?: Q;
+  handler(ctx: ResourceContext<DbT>, args: ActionArgs<Parsed<I>, Parsed<Q>>): unknown;
+}): ResourceAction<Ref, DbT>;
+//#endregion
+export { defineAction as t };

package/dist/resource-types-Bzt_bpR5.d.ts

@@ -0,0 +1,153 @@
+import { D as ValidationIssue, f as Result } from "./result-C6jDfedy.js";
+import { N as AnyModels, X as Insert, ht as TableMeta, mt as TableKey, st as Row, yt as Update } from "./executor-CPyrQdjh.js";
+import { m as RequestContext } from "./plugin-Ar5546xh.js";
+import { D as ResourceOperation } from "./model-Btl8X9cs.js";
+import { a as ResourcePlan, i as ResourcePagination, n as ResourceActionSpec, r as ResourceDescription } from "./resource-DYDEnww-.js";
+import { Et as SelectArg } from "./define-Dw7pRO4h.js";
+import { a as RespondOptions } from "./respond-CZYibxUx.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/server/resource-types.d.ts
+/** What a resource needs from `defineListQuery`. */
+interface ResourceList {
+  readonly table: string;
+  readonly pagination?: ResourcePagination;
+  readonly openapi: readonly unknown[];
+  readonly jsonSchema: Readonly<Record<string, unknown>>;
+  parse(input: never): {
+    readonly ok: true;
+    readonly value: unknown;
+  } | {
+    readonly ok: false;
+    readonly issues: readonly ValidationIssue[];
+  };
+  run(db: never, query: never, extra?: never): PromiseLike<unknown>;
+}
+/** What hooks and action handlers receive. */
+interface ResourceContext<DbT = unknown> {
+  /** The repositories, bound to the caller (RLS applies). */
+  readonly db: DbT;
+  readonly table: string;
+  /** The HTTP request, when the call came from one. */
+  readonly request: Request | undefined;
+  /** The verified request context: actor, tenant and claims. */
+  readonly context: RequestContext;
+}
+type HookResult<T> = Result<T> | PromiseLike<Result<T>>;
+/**
+ * The target of an item operation or action. `row` is set when a permission
+ * check fetched it.
+ */
+interface ResourceTarget<R> {
+  readonly id?: unknown;
+  readonly data?: unknown;
+  readonly query?: unknown;
+  readonly row?: R;
+}
+/** A list response: the page's rows plus its paging fields. */
+interface ResourcePage<R> {
+  readonly items: readonly R[];
+  readonly [field: string]: unknown;
+}
+/**
+ * Business logic around the repository. Every hook returns a `Result`; an error
+ * `Result` ends the request with that error, and a throw becomes an
+ * `unexpected` error. Hooks run after the authorizer.
+ */
+interface ResourceHooks<M extends AnyModels, T extends TableKey<M>, DbT = unknown> {
+  /** Runs before every operation and action; an error denies it. */
+  authorize?(ctx: ResourceContext<DbT>, operation: ResourceOperation | (string & {}), target: ResourceTarget<Row<M, T>>): HookResult<unknown>;
+  /** Returns the values to insert. */
+  beforeCreate?(ctx: ResourceContext<DbT>, data: Insert<M, T>): HookResult<Insert<M, T>>;
+  /** Returns the values to update. */
+  beforeUpdate?(ctx: ResourceContext<DbT>, data: Update<M, T>, target: ResourceTarget<Row<M, T>>): HookResult<Update<M, T>>;
+  beforeDelete?(ctx: ResourceContext<DbT>, target: ResourceTarget<Row<M, T>>): HookResult<unknown>;
+  /** Returns the response; describe a changed shape in `output.list`. */
+  afterList?(ctx: ResourceContext<DbT>, page: ResourcePage<Row<M, T>>): HookResult<unknown>;
+  afterGet?(ctx: ResourceContext<DbT>, row: Row<M, T>): HookResult<unknown>;
+  afterCreate?(ctx: ResourceContext<DbT>, row: Row<M, T>): HookResult<unknown>;
+  afterUpdate?(ctx: ResourceContext<DbT>, row: Row<M, T>): HookResult<unknown>;
+}
+/**
+ * What an action handler receives besides the context: values already
+ * validated.
+ */
+interface ActionArgs<I = unknown, Q = unknown> {
+  /** The parsed key, for item actions (`/{id}/send`). */
+  readonly id: unknown;
+  readonly data: I;
+  readonly query: Q;
+}
+/**
+ * A custom operation (`POST /<table>/{id}/send`). The handler returns a
+ * `Result`, a plain value or a `Response`; a throw becomes an `unexpected`
+ * error.
+ */
+interface ResourceAction<Ref = string, DbT = unknown> extends ResourceActionSpec<Ref> {
+  handler(ctx: ResourceContext<DbT>, args: ActionArgs): unknown;
+}
+type Parsed<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferOutput<S> : undefined;
+interface ResourceRouteOptions<M extends AnyModels, T extends TableKey<M>, Ref = string, DbT = unknown> extends Omit<ResourceDescription<Ref>, "list" | "input" | "actions" | "operations" | "pagination" | "maxPageSize"> {
+  /** Defaults to every operation for tables, `list` and `get` for views. */
+  readonly operations?: readonly ResourceOperation[];
+  /** Filters, search and sorts for `list`, from `defineListQuery`. */
+  readonly list?: ResourceList;
+  /** Columns returned by every operation. */
+  readonly select?: SelectArg<M, T>;
+  /** Validates request bodies before they reach the repository. */
+  readonly input?: {
+    readonly create?: StandardSchemaV1<unknown, Insert<M, T>>;
+    readonly update?: StandardSchemaV1<unknown, Update<M, T>>;
+  };
+  /**
+   * Paging of the default list: `offset` (`page` and `size`) or `cursor`
+   * (`after` and `size`, keyset). A `list` query brings its own. Defaults to
+   * `cursor`, or `offset` for a table or view without a primary key.
+   */
+  readonly pagination?: ResourcePagination;
+  /** Largest page for the default list. Defaults to 200. */
+  readonly maxPageSize?: number;
+  readonly hooks?: ResourceHooks<M, T, DbT>;
+  readonly actions?: Readonly<Record<string, ResourceAction<Ref, DbT>>>;
+}
+interface ResourceInput {
+  /** Primary key value; strings are converted for integer keys. */
+  readonly id?: unknown;
+  /** Body of `create`, `update` and actions. */
+  readonly data?: unknown;
+  /** `list` and action parameters: URL params or typed values. */
+  readonly query?: URLSearchParams | Readonly<Record<string, unknown>>;
+  /** The HTTP request, passed on to hooks and actions. */
+  readonly request?: Request;
+}
+interface ResourceHandler<Ref = string> {
+  readonly table: string;
+  readonly meta: TableMeta;
+  readonly operations: readonly ResourceOperation[];
+  /**
+   * Name of the key parameter, or `undefined` for tables without a
+   * single-column key.
+   */
+  readonly keyParam: string | undefined;
+  readonly list: ResourceList | undefined;
+  readonly pagination: ResourcePagination;
+  readonly maxPageSize: number;
+  /** What the resource serves; `defineApi` documents the same plan. */
+  readonly plan: ResourcePlan<Ref>;
+  /** Runs one operation as whoever `db` is bound to. Resolves to a `Result`. */
+  execute(db: object, operation: ResourceOperation, input?: ResourceInput): Promise<Result<unknown>>;
+  /** Runs one action by name. Resolves to a `Result`. */
+  action(db: object, name: string, input?: ResourceInput): Promise<Result<unknown>>;
+  /**
+   * Serves a collection request (`id` undefined) or an item request. Actions
+   * are not routed.
+   */
+  handle(request: Request, db: object, id: string | undefined, options?: RespondOptions): Promise<Response>;
+  /**
+   * Serves the collection (`[]`), an item (`[id]`) or an action path (`[id,
+   * "send"]`), below the resource's own path. A string is split on `/` and
+   * decoded.
+   */
+  serve(request: Request, db: object, subpath: string | readonly string[], options?: RespondOptions): Promise<Response>;
+}
+//#endregion
+export { ResourceHandler as a, ResourceList as c, ResourceContext as i, ResourceRouteOptions as l, Parsed as n, ResourceHooks as o, ResourceAction as r, ResourceInput as s, ActionArgs as t };