better-supabase 0.15.1 → 0.16.0

package/dist/relay-gKvKJ3xf.js

@@ -0,0 +1,208 @@
+import { t as topicPort } from "./watch-topic-CuaWfCuv.js";
+//#region src/realtime/relay.ts
+const CLOSED_STATE = 2;
+function parse(event) {
+	if (typeof event.data !== "string") return;
+	try {
+		return JSON.parse(event.data);
+	} catch {
+		return;
+	}
+}
+/** The runtime's `EventSource`, read without assuming DOM types. */
+function globalEventSource() {
+	const value = "EventSource" in globalThis ? globalThis.EventSource : void 0;
+	return typeof value === "function" ? value : void 0;
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* A Realtime client that joins topics through `realtimeRelay` on the server
+* instead of a browser connection with the user's token: for support sessions
+* ("view as user") and apps that keep sessions in httpOnly cookies. It has the
+* `RealtimeClient` surface, so `defineTopic(...).subscribe`, `send`,
+* `liveQuery`, `watchTopic` and the React hooks take it unchanged. Each topic
+* is one server-sent event stream that reconnects on its own and reports a
+* rejoin after a gap, so live queries refetch. Presence states arrive, but
+* `track` answers `error`: presence is not relayed upstream.
+*
+* ```ts
+* const realtime = relayRealtimeClient("/api/realtime");
+* using sub = notifications.subscribe(realtime, { userId }, handlers);
+* ```
+*/
+function relayRealtimeClient(url, options = {}) {
+	const channels = [];
+	const timeoutMs = options.timeoutMs ?? 15e3;
+	const maxBackoffMs = options.maxBackoffMs ?? 3e4;
+	const channelClose = /* @__PURE__ */ new WeakMap();
+	const post = async (topic, event, payload) => {
+		const doFetch = options.fetch ?? globalThis.fetch.bind(globalThis);
+		try {
+			const response = await doFetch(url, {
+				method: "POST",
+				credentials: "same-origin",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					topic,
+					event,
+					payload
+				})
+			});
+			if (response.ok) {
+				await response.body?.cancel();
+				return { success: true };
+			}
+			const problem = await response.json().catch(() => void 0);
+			const detail = isRecord(problem) && typeof problem["detail"] === "string" ? problem["detail"] : isRecord(problem) && typeof problem["title"] === "string" ? problem["title"] : response.statusText;
+			return {
+				success: false,
+				status: response.status,
+				error: detail
+			};
+		} catch (cause) {
+			return {
+				success: false,
+				status: 0,
+				error: cause instanceof Error ? cause.message : String(cause)
+			};
+		}
+	};
+	const create = (name) => {
+		const topic = `realtime:${name}`;
+		const listeners = [];
+		let presence = {};
+		let source;
+		let status;
+		let subscribed = false;
+		let ending = false;
+		let removed = false;
+		let backoff = 1e3;
+		let joinTimer;
+		let retryTimer;
+		const dispatch = (type, event, message) => {
+			for (const listener of listeners) if (listener.event === `${type}:*` || listener.event === `${type}:${event}`) listener.callback(message);
+		};
+		const open = () => {
+			if (removed) return;
+			const Source = options.EventSource ?? globalEventSource();
+			if (Source === void 0) {
+				status?.("CHANNEL_ERROR", /* @__PURE__ */ new Error("relayRealtimeClient needs EventSource"));
+				return;
+			}
+			const next = new Source(`${url}${url.includes("?") ? "&" : "?"}topic=${encodeURIComponent(name)}`, { withCredentials: true });
+			source = next;
+			clearTimeout(joinTimer);
+			joinTimer = setTimeout(() => {
+				if (!subscribed && source === next) status?.("TIMED_OUT");
+			}, timeoutMs);
+			next.addEventListener("status", (event) => {
+				const data = parse(event);
+				if (!isRecord(data) || source !== next) return;
+				if (data["status"] === "subscribed") {
+					clearTimeout(joinTimer);
+					subscribed = true;
+					ending = false;
+					backoff = 1e3;
+					status?.("SUBSCRIBED");
+				} else if (data["status"] === "error") status?.("CHANNEL_ERROR", /* @__PURE__ */ new Error(`Realtime error on ${name}`));
+			});
+			next.addEventListener("broadcast", (event) => {
+				const data = parse(event);
+				if (!isRecord(data) || typeof data["event"] !== "string") return;
+				dispatch("broadcast", data["event"], {
+					type: "broadcast",
+					event: data["event"],
+					payload: data["payload"]
+				});
+			});
+			next.addEventListener("presence", (event) => {
+				const data = parse(event);
+				if (!isRecord(data)) return;
+				presence = Object.fromEntries(Object.entries(data).filter((entry) => Array.isArray(entry[1])));
+				dispatch("presence", "sync", {});
+			});
+			next.addEventListener("end", () => {
+				ending = true;
+			});
+			next.addEventListener("error", () => {
+				if (removed || source !== next) return;
+				if (next.readyState !== CLOSED_STATE) {
+					if (subscribed && !ending) status?.("CHANNEL_ERROR", /* @__PURE__ */ new Error(`The relay connection for ${name} dropped`));
+					return;
+				}
+				next.close();
+				source = void 0;
+				if (!subscribed) {
+					clearTimeout(joinTimer);
+					status?.("CHANNEL_ERROR", /* @__PURE__ */ new Error(`The relay refused ${name}`));
+					return;
+				}
+				status?.("CHANNEL_ERROR", /* @__PURE__ */ new Error(`The relay closed ${name}; reconnecting`));
+				retryTimer = setTimeout(open, backoff);
+				backoff = Math.min(backoff * 2, maxBackoffMs);
+			});
+		};
+		const close = () => {
+			removed = true;
+			clearTimeout(joinTimer);
+			clearTimeout(retryTimer);
+			source?.close();
+			source = void 0;
+		};
+		const channel = {
+			topic,
+			on(type, filter, callback) {
+				listeners.push({
+					event: `${type}:${filter.event ?? "*"}`,
+					callback
+				});
+				return channel;
+			},
+			subscribe(callback) {
+				if (status !== void 0 || removed) throw new Error(`tried to subscribe multiple times to ${name} on the relay`);
+				status = callback ?? (() => void 0);
+				open();
+				return channel;
+			},
+			unsubscribe: () => {
+				close();
+				status?.("CLOSED");
+				return Promise.resolve("ok");
+			},
+			presenceState: () => presence,
+			track: () => Promise.resolve("error"),
+			untrack: () => Promise.resolve("error"),
+			send: async (message) => (await post(name, message.event, message.payload)).success ? "ok" : "error",
+			httpSend: (event, payload) => post(name, event, payload)
+		};
+		channelClose.set(channel, close);
+		return channel;
+	};
+	return {
+		channel: (name) => {
+			const topic = `realtime:${name}`;
+			const open = channels.find((each) => each.topic === topic);
+			if (open) return open;
+			const channel = create(name);
+			channels.push(channel);
+			return channel;
+		},
+		getChannels: () => [...channels],
+		removeChannel: (channel) => {
+			const index = channels.indexOf(channel);
+			if (index !== -1) channels.splice(index, 1);
+			channelClose.get(channel)?.();
+			return Promise.resolve("ok");
+		},
+		realtime: { setAuth: () => Promise.resolve() }
+	};
+}
+/**
+* The block controllers' realtime port over `realtimeRelay`:
+* `topicPort(relayRealtimeClient(url, options))`.
+*/
+function relayTopicPort(url, options = {}) {
+	return topicPort(relayRealtimeClient(url, options));
+}
+//#endregion
+export { relayTopicPort as n, relayRealtimeClient as t };

package/dist/{resource-execute-CzHuDsil.d.ts → resource-execute-Cpnob1Vj.d.ts}

@@ -1,5 +1,5 @@
 import { n as ResourceActionSpec } from "./resource-D8pzB5Qf.js";
-import { i as ResourceContext, n as Parsed, r as ResourceAction, t as ActionArgs } from "./resource-types-DnKiH4G2.js";
+import { i as ResourceContext, n as Parsed, r as ResourceAction, t as ActionArgs } from "./resource-types-pMeLs68X.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/server/resource-execute.d.ts
 /**

package/dist/{resource-types-DnKiH4G2.d.ts → resource-types-pMeLs68X.d.ts}

@@ -1,6 +1,6 @@
 import { D as ValidationIssue, f as Result } from "./result-DZeA5KS6.js";
 import { Ft as RequestContext, K as Insert, dt as TableMeta, ht as Update, it as Row, k as AnyModels, ut as TableKey } from "./types-DFdg_4yN.js";
-import { Wt as SelectArg } from "./define-DFBnQyYg.js";
+import { Wt as SelectArg } from "./define-C5AcEkEJ.js";
 import { a as RespondOptions } from "./respond-Dn1_YhC1.js";
 import { D as ResourceOperation, k as TableVerb } from "./model-hwpvole9.js";
 import { a as ResourcePlan, i as ResourcePagination, n as ResourceActionSpec, r as ResourceDescription } from "./resource-D8pzB5Qf.js";

package/dist/{resources-B9cQxhjw.d.ts → resources-7iq2-5_A.d.ts}

@@ -1,5 +1,5 @@
 import { k as AnyModels, ut as TableKey } from "./types-DFdg_4yN.js";
-import { l as ResourceRouteOptions } from "./resource-types-DnKiH4G2.js";
+import { l as ResourceRouteOptions } from "./resource-types-pMeLs68X.js";
 //#region src/server/resources.d.ts
 /** Resources by table name; `true` serves a table with the defaults. */
 type ResourceMap<M extends AnyModels, Ref = string, DbT = unknown> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T, Ref, DbT> | true; };

package/dist/server/index.d.ts

@@ -5,31 +5,35 @@ import { C as readSession, D as writeSession, T as sessionCookieName, _ as Store
 import { n as SqlClient } from "../executor-hGjrop3A.js";
 import { a as SessionActor, c as agentClaims, i as IDENTITY_SCOPES, l as delegationOf, n as ActorOutcome, o as SessionDelegation, r as AgentActOptions, s as actorOf, t as ActClaim } from "../actor-CoveJgya.js";
 import { n as PERMISSION_CAP_CLAIM } from "../delegation-C7eWP2r8.js";
-import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DNwN8iGz.js";
+import { a as ProblemFormat, c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DNwN8iGz.js";
 import { a as AuthorizationSubject, c as AuthzVersionCache, d as bindAuthorizer, f as defineAuthorizer, i as AuthorizationResource, l as PermissionRef, n as AuthorizationOutcome, o as Authorizer, p as requestMemo, r as AuthorizationRequest, s as AuthorizerRuntime, t as AnyAuthorizer, u as RequestMemo } from "../authorizer-B6X09otb.js";
-import { J as DbStats, t as BetterSupabase, v as Db } from "../define-DFBnQyYg.js";
-import { k as StorageApi } from "../bucket-CiNi8sIw.js";
-import { $ as SessionMemoStats, A as supportCookieValue, B as SupportSessionStore, C as SupportSessions, D as SupportCookieOptions, E as SUPPORT_COOKIE, F as SupportEndedBy, G as PRIMARY_COOKIE, H as sqlSupportStore, I as SupportListFilter, J as DeleteAccountOptions, K as ReplicaState, L as SupportRequest, M as SupportApprovalQuery, N as SupportApprover, O as clearSupportCookie, P as SupportCallerClaims, Q as SessionMemoOptions, R as SupportRequestInput, S as SupportPolicy, T as supportSessions, U as supportClaims, V as SupportStartInput, W as RequestIdOptions, X as deleteAccount, Y as DeleteAccountResult, Z as SessionMemo, _ as suspendAccount, a as ServerContext, at as sessionMemo, b as SupportExpireRouteOptions, c as ServerOptions, d as EndSessionsResult, et as SessionSnapshot, f as LastSignIn, g as lastSignIns, h as endSessions, i as ForContextOptions, it as sessionCacheKey, j as SqlSupportStoreOptions, k as supportCookie, m as SuspendAccountResult, n as BetterServer, nt as isSessionSnapshot, o as ServerDbOptions, ot as snapshotOf, p as SuspendAccountOptions, q as LiteDriver, r as ContextOptions, rt as issuedAtOf, s as ServerKeys, t as AdminDb, tt as authzVersionOf, u as TENANT_HEADER, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions, y as SupportApi, z as SupportSession } from "../server-types-7QPzW2bF.js";
+import { J as DbStats, t as BetterSupabase, v as Db } from "../define-C5AcEkEJ.js";
+import { j as StorageApi } from "../bucket-vc-QRrva.js";
+import { A as isSessionSnapshot, C as DeleteAccountResult, D as SessionMemoStats, E as SessionMemoOptions, M as sessionCacheKey, N as sessionMemo, O as SessionSnapshot, P as snapshotOf, S as DeleteAccountOptions, T as SessionMemo, _ as suspendAccount, a as ServerContext, b as ReplicaState, c as ServerOptions, d as EndSessionsResult, f as LastSignIn, g as lastSignIns, h as endSessions, i as ForContextOptions, j as issuedAtOf, k as authzVersionOf, m as SuspendAccountResult, n as BetterServer, o as ServerDbOptions, p as SuspendAccountOptions, r as ContextOptions, s as ServerKeys, t as AdminDb, u as TENANT_HEADER, v as RequestIdOptions, w as deleteAccount, x as LiteDriver, y as PRIMARY_COOKIE } from "../server-types-CK8mUIUT.js";
 import { n as Impersonator, r as impersonatorOf, t as ImpersonationOptions } from "../impersonation-YTa9dZUv.js";
 import { a as checkAal, i as amrOf, n as AmrEntry, r as aalOf, t as Aal } from "../mfa-oIOYTpvc.js";
 import { _ as SupportAuthorize, a as AutomationHooks, b as TicketSubject, c as ChatActionHook, d as IdentityRef, f as IdentityTarget, g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, l as DelegationPermissions, m as Subscriber, n as Approver, o as AutomationRef, p as PrincipalByIdentity, r as ApproverOf, s as ChatAction, t as ApprovalRequestRef, u as DelegationRef, v as SupportAuthorizeInput, x as defineAuthorizationHooks, y as SupportDecision } from "../authorization-hooks-D_pwXlBs.js";
+import { c as RealtimeClient } from "../topic-CZXHhZye.js";
 import { n as toSession, t as AuthSession } from "../view-DyFdMCqg.js";
-import { a as serverCore, i as ServerCore, n as SessionEntryConfig, r as withSession, t as AuthOutageHook } from "../session-CfBCJGgc.js";
+import { C as SupportSessionStore, E as supportClaims, S as SupportSession, T as sqlSupportStore, _ as SupportCallerClaims, a as SupportPolicy, b as SupportRequest, c as supportSessions, d as clearSupportCookie, f as supportCookie, g as SupportApprover, h as SupportApprovalQuery, i as SupportOptions, l as SUPPORT_COOKIE, m as SqlSupportStoreOptions, n as SupportApi, o as SupportSessions, p as supportCookieValue, r as SupportExpireRouteOptions, s as SupportStartRequest, t as ActiveSupport, u as SupportCookieOptions, v as SupportEndedBy, w as SupportStartInput, x as SupportRequestInput, y as SupportListFilter } from "../support-B4ZBVxt3.js";
+import { a as serverCore, i as ServerCore, n as SessionEntryConfig, r as withSession, t as AuthOutageHook } from "../session-DWmFv3vB.js";
 import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-Dn1_YhC1.js";
-import { a as GuardEntryConfig, i as withBetterSupabase, n as BetterSupabaseContributions, o as withGuard, r as BetterSupabaseEntry, t as BetterSupabaseConfig } from "../composite-BZYXlVBN.js";
+import { a as GuardEntryConfig, i as withBetterSupabase, n as BetterSupabaseContributions, o as withGuard, r as BetterSupabaseEntry, t as BetterSupabaseConfig } from "../composite-CfYyU3vs.js";
 import { a as AuthorizedContext, c as ResourceLoaderContext, d as rolesAt, i as AuthorizeOptions, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as hasRole } from "../kit-DOwKpSkA.js";
 import { n as subjectReaders, t as SubjectReadersOptions } from "../subject-readers-8GySC9Z8.js";
 import { i as toCsv, n as csvColumns, t as CsvOptions } from "../csv-DhHQS2x_.js";
 import { i as JwsAlgorithm, n as Jwks, r as JwksOfOptions } from "../jws-D0toeQlA.js";
 import { i as ResourcePagination } from "../resource-D8pzB5Qf.js";
-import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-DnKiH4G2.js";
-import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-BjHflcHF.js";
+import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-pMeLs68X.js";
+import { a as claimsFingerprint, i as SessionWatchStatus, n as SessionStatusRouteOptions, o as sessionStatusRoute, r as SessionStatusServer, t as SessionStatusBody } from "../session-status-qQLm7jzh.js";
+import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-qvVk79pp.js";
 import { n as RefreshOutcome, r as refreshSession } from "../refresh-DT_ICaK-.js";
 import { n as passwordGrant, r as safeRedirectPath, t as PasswordGrantOptions } from "../sign-in-BAjR49fq.js";
 import { n as supportOf, t as SupportView } from "../support-view-BYOgwXsJ.js";
 import { a as sessionStatus, i as clearSessionCookies, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-gUsMZVNg.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware, SingleKeyEntry } from "@supabase/middleware";
+import { StandardSchemaV1 } from "@standard-schema/spec";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
 import { PostgresApi } from "@supabase/server/middleware/postgres";
 //#region src/server/csv.d.ts
@@ -194,6 +198,140 @@ interface SupportStorageOptions {
  */
 export declare function supportStorage(options: SupportStorageOptions): StorageApi;
 //#endregion
+//#region src/server/realtime-relay.d.ts
+/**
+ * A topic the relay serves: a `defineTopic(...)` topic, or `liveRelayTopic` for
+ * the `realtime-tables` channels behind `liveQuery` and `useLiveQuery`.
+ */
+interface RelayTopic {
+  readonly private: boolean;
+  /** Join with presence, so members' states reach the client. */
+  readonly presence?: boolean;
+  /** Whether clients may broadcast on it (`defineTopic`'s `send` option). */
+  readonly clientSend?: boolean;
+  /** Payload schemas per event; a send through the relay is validated. */
+  readonly events?: Readonly<Record<string, StandardSchemaV1>>;
+  /** Anything but `null` when `topic` is one of this topic's names. */
+  match(topic: string): unknown;
+}
+/** The channels `liveQuery` joins: `bsb:t:<schema>.<table>[:...]`, private. */
+export declare const liveRelayTopic: RelayTopic;
+/** What `authorize` decides on. */
+interface RelayAccessInput {
+  readonly topic: string;
+  readonly action: "receive" | "send";
+  /** The caller: in a support session, the viewed user. */
+  readonly auth: AuthState;
+  readonly support: ActiveSupport | undefined;
+  /** The claims the check runs with: the target's in a support session. */
+  readonly claims: Readonly<Record<string, unknown>>;
+}
+/**
+ * Decides whether the caller may receive or send on a topic. A throw or
+ * rejection denies.
+ */
+type RelayAuthorize = (input: RelayAccessInput) => boolean | PromiseLike<boolean>;
+/**
+ * The part of a server the relay uses: `createServer`, `createNext` and the
+ * other adapters fit.
+ */
+interface RelayServer {
+  context(request: Request, options?: {
+    readonly refresh?: boolean;
+  }): Promise<{
+    readonly auth: AuthState;
+    readonly resolution: {
+      readonly auth: AuthState;
+    };
+    readonly support?: ActiveSupport;
+    apply(response: Response): Response;
+  }>;
+  admin(): {
+    readonly $client: RealtimeClient;
+  };
+}
+/** A pool that runs a function in one transaction: `createPostgres()`. */
+interface RelayPostgres {
+  transaction<T>(fn: (client: SqlClient) => Promise<T>): Promise<T>;
+}
+interface RealtimeRelayOptions {
+  /** The topics the relay serves; any other name answers 404. */
+  readonly topics: readonly RelayTopic[];
+  /**
+   * Checks each join and send against the `realtime.messages` policies, run as
+   * the caller (the viewed user in a support session) the way Realtime checks a
+   * browser's join. Needs a pool whose role may assume `authenticated`, such as
+   * `createPostgres()`.
+   */
+  readonly postgres?: RelayPostgres;
+  /** Decides access instead of the policies. */
+  readonly authorize?: RelayAuthorize;
+  /**
+   * The client that joins upstream. Defaults to the server's secret-key client
+   * (`server.admin().$client`); joins of a topic share one channel per
+   * process.
+   */
+  readonly upstream?: RealtimeClient;
+  /** Milliseconds between keep-alive comments. Defaults to 25000. */
+  readonly heartbeatMs?: number;
+  /**
+   * Milliseconds a stream stays open before it ends with `max_duration` and the
+   * client reconnects, which checks access again. Defaults to 240000, under
+   * common serverless limits.
+   */
+  readonly maxDurationMs?: number;
+  /**
+   * Events a slow client may fall behind by before its stream ends with
+   * `overflow`; the reconnect reports a rejoin, so the client refetches.
+   * Defaults to 256.
+   */
+  readonly maxQueued?: number;
+  /** Milliseconds the client waits before reconnecting. Defaults to 1000. */
+  readonly retryMs?: number;
+  /**
+   * Refresh an expiring session cookie and send the new cookies. Defaults to
+   * false: the proxy refreshes, and an expired session answers 401.
+   */
+  readonly refresh?: boolean;
+  readonly problem?: ProblemFormat;
+}
+/** Why the relay ended a stream, in its `end` event. */
+type RelayEndReason = "expired" | "max_duration" | "overflow" | "closed" | "upstream_error";
+/**
+ * Whether `claims` may receive or send on `topic`, by the `realtime.messages`
+ * policies, checked the way Realtime checks a join: a probe message is
+ * inserted, then read (receive) or written (send) as the caller, and the
+ * transaction rolls back.
+ */
+export declare function realtimeTopicAccess(postgres: RelayPostgres, input: {
+  readonly claims: Readonly<Record<string, unknown>>;
+  readonly topic: string;
+  readonly action: "receive" | "send";
+  readonly extension?: "broadcast" | "presence";
+}): Promise<boolean>;
+/**
+ * Realtime for callers without a browser token of their own: a support session
+ * ("view as user"), or an app that keeps sessions in httpOnly cookies. `GET
+ * ?topic=<name>` resolves the caller, checks the topic's access as that caller
+ * (the viewed user in a support session), joins upstream with the secret key
+ * and streams the topic's broadcasts and presence as server-sent events. `POST
+ * { topic, event, payload }` broadcasts for the caller after the same check on
+ * the send policy; read-only support sessions can't send.
+ * `relayRealtimeClient(url)` from `better-supabase/realtime` is the client.
+ *
+ * ```ts
+ * // app/api/realtime/route.ts
+ * export const { GET, POST } = realtimeRelay(bsb, {
+ *   topics: [notifications, liveRelayTopic],
+ *   postgres,
+ * });
+ * ```
+ */
+export declare function realtimeRelay(server: RelayServer, options: RealtimeRelayOptions): {
+  readonly GET: (request: Request) => Promise<Response>;
+  readonly POST: (request: Request) => Promise<Response>;
+};
+//#endregion
 //#region src/server/entries/upstream.d.ts
 /** The `withSupabase` context keys `withBetterDb` and `withBetterPostgres` read. */
 interface SupabaseAuthContext {
@@ -500,4 +638,4 @@ export declare function withDbStats(options?: {
   };
 }, () => DbStats>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AccessTokenResolverOptions, type AccessTokenRevocation, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type ActorOutcome, type AdminDb, type AgentActOptions, type AmrEntry, type AnyAuthorizer, type ApprovalRequestRef, type Approver, type ApproverOf, type AuthKind, type AuthOutageHook, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationHooks, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type AuthorizerRuntime, type AuthzVersionCache, type AuthzVersionChannel, type AuthzVersionClient, type AuthzVersionSubscription, type AutomationHooks, type AutomationRef, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ChatAction, type ChatActionHook, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DelegationPermissions, type DelegationRef, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, IDENTITY_SCOPES, type IdentityRef, type IdentityTarget, type ImpersonationEvents, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PERMISSION_CAP_CLAIM, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PasswordGrantOptions, type PermissionRef, type PrincipalByIdentity, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RateLimitPolicy, type RateLimitState, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type RequestMemo, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourceLoaderContext, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionMemo, type SessionMemoOptions, type SessionMemoStats, type SessionSnapshot, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SubjectReadersOptions, type SubscribeAuthzVersionsOptions, type Subscriber, type SubscriberEvent, type SubscriberPolicy, type SupabaseAuthContext, type SupportApi, type SupportApprovalQuery, type SupportApprover, type SupportAuthorize, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportDecision, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportRequest, type SupportRequestInput, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, type TicketSubject, aalOf, actorOf, agentClaims, amrOf, authContext, authzVersionOf, bindAuthorizer, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, csvColumns, defineAuthorizationHooks, defineAuthorizer, delegationOf, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, isSessionSnapshot, issuedAtOf, lastSignIns, passwordGrant, problemResponse, readSession, refreshFor, refreshSession, requestMemo, resolveAuth, respond, rolesAt, safeRedirectPath, serverCore, sessionCacheKey, sessionCookieName, sessionMemo, sessionStatus, settle, shouldCheckSession, shouldRefresh, snapshotOf, sqlSupportStore, subjectReaders, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, type Aal, type AccessTokenResolverOptions, type AccessTokenRevocation, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type ActorOutcome, type AdminDb, type AgentActOptions, type AmrEntry, type AnyAuthorizer, type ApprovalRequestRef, type Approver, type ApproverOf, type AuthKind, type AuthOutageHook, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationHooks, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type AuthorizerRuntime, type AuthzVersionCache, type AuthzVersionChannel, type AuthzVersionClient, type AuthzVersionSubscription, type AutomationHooks, type AutomationRef, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ChatAction, type ChatActionHook, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DelegationPermissions, type DelegationRef, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, IDENTITY_SCOPES, type IdentityRef, type IdentityTarget, type ImpersonationEvents, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PERMISSION_CAP_CLAIM, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PasswordGrantOptions, type PermissionRef, type PrincipalByIdentity, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RateLimitPolicy, type RateLimitState, type RealtimeRelayOptions, type RefreshOutcome, type RefreshPolicy, type RelayAccessInput, type RelayAuthorize, type RelayEndReason, type RelayPostgres, type RelayServer, type RelayTopic, type ReplicaState, type RequestIdOptions, type RequestMemo, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourceLoaderContext, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionMemo, type SessionMemoOptions, type SessionMemoStats, type SessionSnapshot, type SessionStatus, type SessionStatusBody, type SessionStatusOptions, type SessionStatusRouteOptions, type SessionStatusServer, type SessionWatchStatus, type Settled, type SqlSupportStoreOptions, type StoredSession, type SubjectReadersOptions, type SubscribeAuthzVersionsOptions, type Subscriber, type SubscriberEvent, type SubscriberPolicy, type SupabaseAuthContext, type SupportApi, type SupportApprovalQuery, type SupportApprover, type SupportAuthorize, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportDecision, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportRequest, type SupportRequestInput, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, type TicketSubject, aalOf, actorOf, agentClaims, amrOf, authContext, authzVersionOf, bindAuthorizer, cacheTagsOf, checkAal, claimsFingerprint, clearSessionCookies, clearSupportCookie, clientIp, csvColumns, defineAuthorizationHooks, defineAuthorizer, delegationOf, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, isSessionSnapshot, issuedAtOf, lastSignIns, passwordGrant, problemResponse, readSession, refreshFor, refreshSession, requestMemo, resolveAuth, respond, rolesAt, safeRedirectPath, serverCore, sessionCacheKey, sessionCookieName, sessionMemo, sessionStatus, sessionStatusRoute, settle, shouldCheckSession, shouldRefresh, snapshotOf, sqlSupportStore, subjectReaders, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };