better-supabase 0.13.0 → 0.15.0

package/dist/comments-Ceqo9bwE.js

@@ -1,230 +0,0 @@
-import { n as dbError } from "./errors-D7u24ZJH.js";
-import { t as AsyncResult } from "./result-DIT_qp4G.js";
-import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { a as stripTypePrefix } from "./cloud-event-XsM53POL.js";
-import { C as optionalText, D as recordOf, F as stringsOf, I as textOf, R as toInstant, S as optionalInstant, k as recordsOf, m as instantArg, n as applyTemporal, o as blockCall, w as pageOf } from "./block-helpers-DwE32_gT.js";
-import { r as withBlockHooks } from "./block-hooks-C1r-R2r0.js";
-import { n as blockFields } from "./block-fields-Cwd4c8m-.js";
-import { n as defineListQuery } from "./list-query-CuS1w2Af.js";
-//#region src/blocks/comments/comments.ts
-const ACTIVITY_SOURCES = [
-	"event",
-	"audit",
-	"delivery",
-	"run"
-];
-function sourceOf(value) {
-	return ACTIVITY_SOURCES.find((source) => source === value) ?? "event";
-}
-const MENTION = /@\[[^\]\n]{1,100}\]\(([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\)/gi;
-/**
-* The user ids mentioned in a body written as `@[Ada](<user id>)`, the markup
-* mention inputs produce, in order and without repeats.
-*/
-function mentionsIn(body) {
-	return [...new Set([...body.matchAll(MENTION)].flatMap((match) => match[1] ? [match[1].toLowerCase()] : []))];
-}
-function commentOf(value) {
-	const row = recordOf(value, "comments");
-	return {
-		id: textOf(row["id"]),
-		organizationId: textOf(row["organization_id"]),
-		subjectType: textOf(row["subject_type"]),
-		subjectId: textOf(row["subject_id"]),
-		authorId: optionalText(row["author_id"]),
-		body: textOf(row["body"] ?? ""),
-		document: row["document"] ?? null,
-		mentions: stringsOf(row["mentions"]),
-		parentId: optionalText(row["parent_id"]),
-		createdAt: toInstant(textOf(row["created_at"])),
-		editedAt: optionalInstant(row["edited_at"]),
-		deletedAt: optionalInstant(row["deleted_at"]),
-		fields: isRecord(row["fields"]) ? row["fields"] : {}
-	};
-}
-function activityOf(value) {
-	const row = recordOf(value, "activity_entries");
-	return {
-		id: textOf(row["id"]),
-		source: sourceOf(row["source"]),
-		organizationId: textOf(row["organization_id"]),
-		type: textOf(row["type"]),
-		actorId: optionalText(row["actor_id"]),
-		subjectType: optionalText(row["subject_type"]),
-		subjectId: optionalText(row["subject_id"]),
-		summary: optionalText(row["summary"]),
-		data: isRecord(row["data"]) ? row["data"] : {},
-		occurredAt: toInstant(textOf(row["occurred_at"]))
-	};
-}
-/** Comments over the `comments` module's functions, as the caller. */
-function createComments(options) {
-	applyTemporal(options);
-	const call = blockCall(options.transport, options.schema, options.mappers);
-	const fields = blockFields(options.fields, "comment fields");
-	const mentionsOf = (body, rich) => options.mentionsOf ? options.mentionsOf({
-		body,
-		document: rich
-	}) : mentionsIn(body);
-	return withBlockHooks({
-		create: (comment) => fields.args(comment.fields).andThen((checked) => call("create_comment", {
-			tenant: comment.organizationId,
-			subject_type: comment.subjectType,
-			subject_id: comment.subjectId,
-			body: comment.body,
-			mentions: comment.mentions ?? mentionsOf(comment.body, comment.document),
-			parent: comment.parentId,
-			document: comment.document,
-			fields: checked
-		}, commentOf).andThen(fields.row)),
-		edit: (id, edit) => fields.args(edit.fields).andThen((checked) => call("edit_comment", {
-			id,
-			body: edit.body,
-			mentions: edit.mentions ?? mentionsOf(edit.body, edit.document),
-			document: edit.document ?? void 0,
-			...edit.document === null ? { clear_document: true } : {},
-			fields: checked
-		}, (value) => value).andThen((value) => value === null || value === void 0 ? AsyncResult.err(dbError("not_found", "No comment you can edit has this id", { hint: "COMMENT_NOT_FOUND" })) : fields.row(commentOf(value)))),
-		remove: (id) => call("delete_comment", { id }, (value) => value === true),
-		list: (organizationId, subjectType, subjectId, list = {}) => call("list_comments", {
-			tenant: organizationId,
-			subject_type: subjectType,
-			subject_id: subjectId,
-			after: instantArg(pageOf(list).cursor),
-			max_rows: list.limit,
-			skip: list.offset,
-			after_id: list.cursorId
-		}, (value) => recordsOf(value, "list_comments").map(commentOf)).andThen(fields.rows),
-		counts: (organizationId, subjectType, subjectIds) => call("comment_counts", {
-			tenant: organizationId,
-			subject_type: subjectType,
-			subject_ids: [...subjectIds]
-		}, (value) => {
-			const found = isRecord(value) ? value : {};
-			return Object.fromEntries(subjectIds.map((id) => [id, Number(found[id] ?? 0)]));
-		}),
-		copy: (organizationId, from, to) => call("copy_comments", {
-			tenant: organizationId,
-			from_type: from.type,
-			from_id: from.id,
-			to_type: to.type,
-			to_id: to.id
-		}, (value) => Number(value ?? 0)),
-		history: (organizationId, subject, history = {}) => call("list_activity", {
-			tenant: organizationId,
-			subject_type: subject?.type,
-			subject_id: subject?.id,
-			before: instantArg(pageOf(history).cursor),
-			max_rows: history.limit,
-			sources: history.sources ? [...history.sources] : void 0
-		}, (value) => recordsOf(value, "list_activity").map(activityOf))
-	}, options.hooks, {
-		block: "comments",
-		...options.logger ? { logger: options.logger } : {}
-	});
-}
-const matches = (patterns, type) => patterns.some((pattern) => pattern.endsWith(".*") ? type.startsWith(pattern.slice(0, -1)) : pattern === type);
-const firstText = (data, keys) => {
-	for (const key of keys) {
-		const value = optionalText(data[key]);
-		if (value !== void 0) return value;
-	}
-};
-/** `comments/<id>` as `{ type: "comment", id }`, the shape block subjects use. */
-function subjectOf(subject) {
-	const slash = subject?.indexOf("/") ?? -1;
-	if (subject === void 0 || slash < 1) return;
-	const plural = subject.slice(0, slash);
-	return {
-		type: plural.endsWith("s") ? plural.slice(0, -1) : plural,
-		id: subject.slice(slash + 1)
-	};
-}
-/**
-* An outbox sink that writes events into the activity feed:
-* `outbox.relay('activity', activitySink({ transport }))`. Events without a
-* tenant (`partitionkey`) are skipped, and a replayed event writes nothing.
-*/
-function activitySink(options) {
-	const call = blockCall(options.transport, options.schema);
-	return { async send(events) {
-		const entries = [];
-		for (const event of events) {
-			const tenant = optionalText(event["partitionkey"]);
-			if (tenant === void 0) continue;
-			const type = stripTypePrefix(event.type, options.typePrefix);
-			if (options.types && !matches(options.types, type)) continue;
-			const described = options.describe ? options.describe(event, type) : {};
-			if (described === null) continue;
-			const data = isRecord(event.data) ? event.data : {};
-			const subject = subjectOf(event.subject);
-			entries.push({
-				event_id: event.id,
-				organization_id: tenant,
-				type,
-				actor_id: described?.actorId ?? firstText(data, [
-					"actorId",
-					"authorId",
-					"userId"
-				]),
-				subject_type: described?.subjectType ?? optionalText(data["subjectType"]) ?? subject?.type,
-				subject_id: described?.subjectId ?? optionalText(data["subjectId"]) ?? subject?.id,
-				summary: described?.summary,
-				data: described?.data ?? data,
-				occurred_at: event.time
-			});
-		}
-		if (entries.length > 0) await call("record_activity", { batch: { entries } }, () => void 0).orThrow();
-	} };
-}
-const FACETS = [
-	[
-		"type",
-		"type",
-		"type"
-	],
-	[
-		"actor",
-		"actor_id",
-		"actorId"
-	],
-	[
-		"subjectType",
-		"subject_type",
-		"subjectType"
-	],
-	[
-		"subjectId",
-		"subject_id",
-		"subjectId"
-	]
-];
-/**
-* A cursor-paged list over `activity_entries` (generate types for the
-* `better_supabase` schema to get it in your models), newest first, filtered by
-* type, actor and subject. Members with `activity.read` see their tenants'
-* entries, less those on a registered subject that `can_subject` doesn't let
-* them read (with the `subjects` module). It reads the table, so it lists no
-* audit entries; `history()` does.
-*/
-function activityListQuery(betterSupabase, table, options = {}) {
-	const meta = betterSupabase.meta.tables[table];
-	if (!meta) throw new TypeError(`activityListQuery: unknown table "${table}"`);
-	const camel = meta.columns["occurredAt"] !== void 0;
-	const facets = Object.fromEntries(FACETS.map(([key, snake, camelName]) => [key, camel ? camelName : snake]).filter(([, column]) => meta.columns[column] !== void 0));
-	const occurredAt = camel ? "occurredAt" : "occurred_at";
-	const config = {
-		facets,
-		sorts: {
-			newest: [{ [occurredAt]: "desc" }, { id: "desc" }],
-			oldest: [{ [occurredAt]: "asc" }, { id: "asc" }]
-		},
-		defaultSort: "newest",
-		pagination: "cursor",
-		...options.pageSize === void 0 ? {} : { pageSize: options.pageSize },
-		...options.maxPageSize === void 0 ? {} : { maxPageSize: options.maxPageSize }
-	};
-	return defineListQuery(betterSupabase, table, config);
-}
-//#endregion
-export { mentionsIn as i, activitySink as n, createComments as r, activityListQuery as t };

package/dist/compiler-DCotQWcs.d.ts

@@ -1,14 +0,0 @@
-import { v as Operation } from "./executor-C29668fO.js";
-import { a as PostgrestPlan } from "./postgrest-DGjrW4sK.js";
-//#region src/core/compiler.d.ts
-/**
- * Turns an IR operation into something a backend runs. An `Executor` for a new
- * backend usually pairs with a `Compiler` for it.
- */
-interface Compiler<TTarget> {
-  readonly target: string;
-  compile(op: Operation): TTarget;
-}
-declare const postgrestCompiler: Compiler<PostgrestPlan>;
-//#endregion
-export { postgrestCompiler as n, Compiler as t };

package/dist/compose-VBQL7zIO.js

@@ -1,53 +0,0 @@
-import { n as dbError } from "./errors-D7u24ZJH.js";
-import { t as AsyncResult } from "./result-DIT_qp4G.js";
-import { n as credentialRefInTenant, t as credentialProviderOf } from "./provider-BhIkKBOh.js";
-//#region src/credentials/compose.ts
-const NO_CAPABILITIES = {
-	userSubjects: false,
-	authorization: false,
-	revoke: false,
-	inbound: false
-};
-const unsupported = (provider, what) => dbError("unsupported", `The credential provider "${provider}" ${what}`, { hint: "CREDENTIAL_UNSUPPORTED" });
-/**
-* One provider over several: each call goes to the provider whose `name` is the
-* ref's `provider`. A ref no provider handles fails with `invalid_input`
-* (`CREDENTIAL_PROVIDER_UNKNOWN`), and an optional method the chosen provider
-* lacks with `unsupported`.
-*/
-function credentialRouter(providers, options = {}) {
-	const byName = /* @__PURE__ */ new Map();
-	for (const provider of providers) {
-		if (byName.has(provider.name)) throw new TypeError(`credentialRouter got two providers named "${provider.name}"`);
-		byName.set(provider.name, credentialProviderOf(provider));
-	}
-	const unknown = (ref) => dbError("invalid_input", `No credential provider named "${ref.provider}" is configured`, { hint: "CREDENTIAL_PROVIDER_UNKNOWN" });
-	const route = (ref, then) => {
-		const provider = byName.get(ref.provider);
-		return provider === void 0 ? AsyncResult.err(unknown(ref)) : then(provider);
-	};
-	return {
-		apiVersion: 1,
-		name: options.name ?? "router",
-		getToken: (ref, tokenOptions) => route(ref, (provider) => provider.getToken(ref, tokenOptions)),
-		capabilities: (ref) => byName.get(ref.provider)?.capabilities(ref) ?? NO_CAPABILITIES,
-		startAuthorization: (ref, startOptions) => route(ref, (provider) => provider.startAuthorization === void 0 ? AsyncResult.err(unsupported(provider.name, "doesn't authorize accounts")) : provider.startAuthorization(ref, startOptions)),
-		completeAuthorization: (ref, completeOptions) => route(ref, (provider) => provider.completeAuthorization === void 0 ? AsyncResult.err(unsupported(provider.name, "doesn't authorize accounts")) : provider.completeAuthorization(ref, completeOptions)),
-		revoke: (ref, revokeOptions) => route(ref, (provider) => provider.revoke(ref, revokeOptions)),
-		verifyInbound: (request, ref) => route(ref, (provider) => provider.verifyInbound === void 0 ? AsyncResult.err(unsupported(provider.name, "doesn't verify inbound requests")) : provider.verifyInbound(request, ref)),
-		set: (ref, value, setOptions) => route(ref, (provider) => provider.set === void 0 ? AsyncResult.err(unsupported(provider.name, "can't store secrets")) : provider.set(ref, value, setOptions))
-	};
-}
-/**
-* Revokes the credential a ref names when a provider is configured and can
-* revoke it. Resolves `false` without a provider, for a provider without
-* revocation, or for a ref outside `options.tenant`.
-*/
-function revokeIfConfigured(provider, ref, options) {
-	if (provider === void 0) return AsyncResult.ok(false);
-	if ("tenant" in options && !credentialRefInTenant(ref, options.tenant)) return AsyncResult.ok(false);
-	if (!provider.capabilities(ref).revoke) return AsyncResult.ok(false);
-	return provider.revoke(ref, { subject: options.subject });
-}
-//#endregion
-export { revokeIfConfigured as n, credentialRouter as t };

package/dist/composite-BgBzdYP-.d.ts

@@ -1,82 +0,0 @@
-import { a as AnyModels, i as AnyFunctions } from "./types-DmshMaXz.js";
-import { r as AuthState } from "./resolve-D57oDWNr.js";
-import { o as Db, t as BetterSupabase } from "./define-D0LSXmUP.js";
-import { K as ReplicaState, a as ServerContext, c as ServerOptions, n as BetterServer, v as ActiveSupport } from "./server-types-D_cQ6OxZ.js";
-import { n as SessionEntryConfig } from "./session-DNRYXIOU.js";
-import { r as GuardOptions } from "./respond-QW-f1yio.js";
-import { SupabaseClient } from "@supabase/supabase-js";
-import { Entry, SingleKeyEntry } from "@supabase/middleware";
-import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
-//#region src/server/entries/guard.d.ts
-interface GuardEntryConfig extends GuardOptions {
-  /**
-   * Include error messages in problem responses. Defaults to `NODE_ENV ===
-   * 'development'`.
-   */
-  readonly expose?: boolean;
-}
-/**
- * Entry that answers callers `allow`, `aal` or `scopes` refuse with a 401 or
- * 403 Problem Details response, before the handler runs. It contributes
- * `ctx.guard`, the options the caller passed.
- */
-declare function withGuard<C, P>(config?: GuardEntryConfig): SingleKeyEntry<"guard", {
-  readonly auth: AuthState<C, P>;
-}, GuardOptions>;
-//#endregion
-//#region src/server/composite.d.ts
-/** What `withBetterSupabase` takes besides the definition or server. */
-interface BetterSupabaseConfig extends SessionEntryConfig, GuardEntryConfig {}
-/** The keys `withBetterSupabase` puts on `ctx`. */
-interface BetterSupabaseContributions<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> {
-  /**
-   * The full request context: `auth`, `supabase`, `stats()`, `apply()` and the
-   * rest.
-   */
-  bs: ServerContext<M, F, E, C, P, B>;
-  /** The verified token's payload, or `null`; the key `withSupabase` uses. */
-  jwtClaims: (JWTClaims & C) | null;
-  userClaims: UserClaims | null;
-  authMode: AuthMode;
-  /** Repositories over PostgREST as the caller. */
-  db: Db<M, F, E, SupabaseClient, B>;
-  /**
-   * Repositories over direct Postgres as the caller, when Postgres is
-   * configured or upstream.
-   */
-  sql: Db<M, F, E, undefined, B> | undefined;
-  tenant: string | undefined;
-  support: ActiveSupport | undefined;
-  replica: ReplicaState | undefined;
-}
-/**
- * The entry `withBetterSupabase` returns, for `pipeline` and the framework
- * bridges.
- */
-type BetterSupabaseEntry<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> = Entry<BetterSupabaseContributions<M, F, E, C, P, B>>;
-/**
- * The whole better-supabase server as one `@supabase/middleware` entry: it
- * verifies the caller (bearer token or session cookie), refuses callers the
- * guard rejects with Problem Details, and contributes `ctx.db`, `ctx.sql`,
- * `ctx.bs` and the `withSupabase` keys (`jwtClaims`, `userClaims`, `authMode`),
- * so `withPostgresClient` and `withOpenFeature` compose after it. Refreshed
- * cookies and `bs-primary-until` go out on the response.
- *
- * ```ts
- * export default {
- *   fetch: pipeline(
- *     [withBetterSupabase(betterSupabase)],
- *     async (req, ctx) =>
- *       Response.json(await ctx.db.notes.findMany().orThrow()),
- *   ),
- * };
- * ```
- *
- * Pass a server from `createServer` to share its clients and JWKS cache with
- * the rest of the app; pass the definition to build one with `config`'s server
- * options.
- */
-declare function withBetterSupabase<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P, B>, config?: BetterSupabaseConfig & ServerOptions): BetterSupabaseEntry<M, F, E, C, P, B>;
-declare function withBetterSupabase<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown>(server: BetterServer<M, F, E, C, P, B>, config?: BetterSupabaseConfig): BetterSupabaseEntry<M, F, E, C, P, B>;
-//#endregion
-export { GuardEntryConfig as a, withBetterSupabase as i, BetterSupabaseContributions as n, withGuard as o, BetterSupabaseEntry as r, BetterSupabaseConfig as t };

package/dist/composite-BgSdL5tk.js

@@ -1,130 +0,0 @@
-import { o as problemResponse } from "./problem-D0KDiYPk.js";
-import { T as serverCore, _ as withSupport, g as withTenant, s as createServer, w as withServerContext, y as withSession } from "./adapter-D8dW6p2A.js";
-import { s as withPrimaryPin } from "./replicas-BvIL4_jL.js";
-import { r as guard, t as defaultExpose } from "./respond-DjEmE_DN.js";
-import { a as withAuthMode, i as withAuth, o as withJwtClaims, s as withUserClaims } from "./claims-T8TWZ53E.js";
-import { defineComposite, defineMiddleware } from "@supabase/middleware";
-//#region src/server/entries/db.ts
-/**
-* Entry contributing `ctx.db`: repositories over PostgREST as the caller (RLS
-* applies), from `ctx.bs`. Reads go to the read replica when one is
-* configured.
-*/
-function withDb() {
-	return defineMiddleware({
-		key: "db",
-		run: () => (_request, ctx) => Promise.resolve({ db: ctx.bs.db })
-	})();
-}
-//#endregion
-//#region src/server/entries/guard.ts
-/**
-* Entry that answers callers `allow`, `aal` or `scopes` refuse with a 401 or
-* 403 Problem Details response, before the handler runs. It contributes
-* `ctx.guard`, the options the caller passed.
-*/
-function withGuard(config = {}) {
-	const { expose = defaultExpose(), ...options } = config;
-	return defineMiddleware({
-		key: "guard",
-		run: () => (request, ctx) => {
-			const denied = guard(ctx.auth, options.allow, options.aal, options.scopes);
-			return Promise.resolve(denied ? problemResponse(denied, {
-				instance: new URL(request.url).pathname,
-				expose
-			}) : { guard: options });
-		}
-	})();
-}
-//#endregion
-//#region src/server/entries/replica.ts
-/**
-* Entry contributing `ctx.replica`, where `ctx.db` reads go when a read URL is
-* configured (`undefined` without one). On the way out it sets the
-* `bs-primary-until` cookie after a write, so the caller's next reads see it.
-*/
-function withReplica(core) {
-	return defineMiddleware({
-		key: "replica",
-		run: () => async function* run(_request, ctx) {
-			const { replica } = ctx.bs;
-			const response = yield { replica };
-			return withPrimaryPin(response, ctx.bs.replica, core.pinMs);
-		}
-	})();
-}
-//#endregion
-//#region src/server/entries/sql.ts
-/**
-* Entry contributing `ctx.sql`: repositories over direct Postgres as the
-* caller, with RLS, from `createServer`'s `postgres`, else `undefined`.
-* `withPostgresClient` reads `jwtClaims`, so it runs after this entry and can't
-* back `ctx.sql`; importing the SQL compiler here would also ship it to every
-* app without Postgres.
-*/
-function withSql() {
-	return defineMiddleware({
-		key: "sql",
-		run: () => (_request, ctx) => Promise.resolve({ sql: ctx.bs.sql })
-	})();
-}
-//#endregion
-//#region src/server/composite.ts
-/**
-* The single-key entries `withBetterSupabase` bundles, outermost first. The
-* framework factories run these directly, so their terminal sees `auth`.
-*/
-function betterSupabaseParts(core, config = {}) {
-	const { refresh, cookies, waitUntil, encode, cookieScopes, checkSession, ...guardConfig } = config;
-	return [
-		withSession(core, {
-			...refresh === void 0 ? {} : { refresh },
-			...cookies === void 0 ? {} : { cookies },
-			...waitUntil === void 0 ? {} : { waitUntil },
-			...encode === void 0 ? {} : { encode },
-			...cookieScopes === void 0 ? {} : { cookieScopes },
-			...checkSession === void 0 ? {} : { checkSession }
-		}),
-		withTenant(core),
-		withSupport(core),
-		withServerContext(core),
-		withAuth(),
-		withGuard(guardConfig),
-		withJwtClaims(),
-		withUserClaims(),
-		withAuthMode(),
-		withDb(),
-		withSql(),
-		withReplica(core)
-	];
-}
-function isDefinition(source) {
-	return "connect" in source && typeof source.connect === "function";
-}
-function withBetterSupabase(source, config = {}) {
-	const server = isDefinition(source) ? createServer(source, config) : source;
-	const core = serverCore(server);
-	const { refresh, cookies, waitUntil, encode, cookieScopes, checkSession, allow, aal, scopes, expose } = config;
-	const parts = betterSupabaseParts(core, {
-		...refresh === void 0 ? {} : { refresh },
-		...cookies === void 0 ? {} : { cookies },
-		...waitUntil === void 0 ? {} : { waitUntil },
-		...encode === void 0 ? {} : { encode },
-		...cookieScopes === void 0 ? {} : { cookieScopes },
-		...checkSession === void 0 ? {} : { checkSession },
-		...allow === void 0 ? {} : { allow },
-		...aal === void 0 ? {} : { aal },
-		...scopes === void 0 ? {} : { scopes },
-		...expose === void 0 ? {} : { expose }
-	});
-	return defineComposite({
-		build: () => parts,
-		internal: [
-			"session",
-			"auth",
-			"guard"
-		]
-	})();
-}
-//#endregion
-export { withGuard as n, withBetterSupabase as t };