better-supabase 0.2.0 → 0.3.0

package/dist/env/index.js

@@ -1,2 +1,204 @@
-import { a as parseEnv, i as loadEnv, n as EnvValidationError, o as publicEnv, r as envSchema, s as toServerEnv, t as ENV_VARIABLES } from "../env-BEToab0I.js";
+//#region src/env/index.ts
+const PREFIXES = [
+	"",
+	"NEXT_PUBLIC_",
+	"VITE_",
+	"PUBLIC_",
+	"EXPO_PUBLIC_",
+	"NUXT_PUBLIC_"
+];
+const ENV_VARIABLES = {
+	url: PREFIXES.map((prefix) => `${prefix}SUPABASE_URL`),
+	publishableKey: PREFIXES.flatMap((prefix) => [`${prefix}SUPABASE_PUBLISHABLE_KEY`, `${prefix}SUPABASE_PUBLISHABLE_DEFAULT_KEY`]),
+	secretKey: ["SUPABASE_SECRET_KEY"],
+	dbUrl: ["SUPABASE_DB_URL", "DATABASE_URL"],
+	jwksUrl: ["SUPABASE_JWKS_URL"],
+	readUrl: ["SUPABASE_READ_URL"]
+};
+const LOOPBACK = /^(localhost|127(?:\.\d{1,3}){3}|\[::1\])$/;
+const HOSTED = /^([a-z0-9]{20})\.supabase\.co$/;
+var EnvValidationError = class extends Error {
+	name = "EnvValidationError";
+	issues;
+	constructor(issues) {
+		super(`Invalid Supabase environment:\n${issues.map((issue) => `  - ${issue.variables[0] ?? "env"}: ${issue.message}`).join("\n")}`);
+		this.issues = issues;
+	}
+};
+function first(source, names) {
+	for (const name of names) {
+		const value = source[name]?.trim();
+		if (value) return value;
+	}
+}
+/** `SUPABASE_*_KEYS` JSON objects, as `@supabase/server` reads them. */
+function keySet(source, name, kind, issues) {
+	const raw = source[name];
+	if (!raw) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		parsed = void 0;
+	}
+	const entries = typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? Object.entries(parsed) : [];
+	if (entries.length === 0 || entries.some(([, value]) => typeof value !== "string")) {
+		issues.push({
+			variables: [name],
+			message: "must be a JSON object of key names to keys"
+		});
+		return;
+	}
+	const keys = {};
+	for (const [key, value] of entries) if (checkKey(value, kind, [name], issues)) keys[key] = value;
+	return keys;
+}
+function preferred(keys) {
+	if (!keys) return void 0;
+	return keys["default"] ?? Object.values(keys)[0];
+}
+function checkUrl(value, variables, issues) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		issues.push({
+			variables,
+			message: "is not a valid URL"
+		});
+		return;
+	}
+	if (url.protocol === "https:") return url;
+	if (url.protocol === "http:" && LOOPBACK.test(url.hostname)) return url;
+	issues.push({
+		variables,
+		message: "must use https (http is only allowed for localhost / 127.0.0.1 / [::1])"
+	});
+}
+function checkKey(value, kind, variables, issues) {
+	if (value.startsWith(`sb_${kind}_`)) return true;
+	if (value.startsWith("eyJ")) issues.push({
+		variables,
+		message: `is a legacy JWT key; use the new sb_${kind}_ key (Project Settings > API Keys)`
+	});
+	else if (value.startsWith(kind === "publishable" ? "sb_secret_" : "sb_publishable_")) issues.push({
+		variables,
+		message: kind === "publishable" ? "holds a secret key; never expose sb_secret_ keys as publishable" : "holds a publishable key, not a secret key"
+	});
+	else issues.push({
+		variables,
+		message: `must start with sb_${kind}_`
+	});
+	return false;
+}
+/**
+* Reads and validates Supabase settings. Accepts the `SUPABASE_`,
+* `NEXT_PUBLIC_`, `VITE_`, `PUBLIC_`, `EXPO_PUBLIC_` and `NUXT_PUBLIC_`
+* spellings. Issues name variables, never values.
+*/
+function parseEnv(source, options = {}) {
+	const issues = [];
+	const required = new Set(options.require ?? []);
+	const rawUrl = first(source, ENV_VARIABLES.url);
+	const url = rawUrl ? checkUrl(rawUrl, ENV_VARIABLES.url, issues) : void 0;
+	if (!rawUrl) issues.push({
+		variables: ENV_VARIABLES.url,
+		message: "is not set"
+	});
+	const publishableKeys = keySet(source, "SUPABASE_PUBLISHABLE_KEYS", "publishable", issues);
+	const singlePublishable = first(source, ENV_VARIABLES.publishableKey);
+	const publishableKey = singlePublishable ?? preferred(publishableKeys);
+	if (!publishableKey) issues.push({
+		variables: ENV_VARIABLES.publishableKey,
+		message: "is not set"
+	});
+	else if (singlePublishable) checkKey(publishableKey, "publishable", ENV_VARIABLES.publishableKey, issues);
+	const namedSecrets = keySet(source, "SUPABASE_SECRET_KEYS", "secret", issues);
+	const singleSecret = first(source, ENV_VARIABLES.secretKey);
+	const secretKey = singleSecret ?? preferred(namedSecrets);
+	if (singleSecret) checkKey(singleSecret, "secret", ENV_VARIABLES.secretKey, issues);
+	else if (!secretKey && required.has("secretKey")) issues.push({
+		variables: ENV_VARIABLES.secretKey,
+		message: "is not set"
+	});
+	const dbUrl = first(source, ENV_VARIABLES.dbUrl);
+	if (dbUrl && !/^postgres(ql)?:\/\//.test(dbUrl)) issues.push({
+		variables: ENV_VARIABLES.dbUrl,
+		message: "must be a postgres:// connection string"
+	});
+	else if (!dbUrl && required.has("dbUrl")) issues.push({
+		variables: ENV_VARIABLES.dbUrl,
+		message: "is not set"
+	});
+	const rawJwks = first(source, ENV_VARIABLES.jwksUrl);
+	const jwksOverride = rawJwks ? checkUrl(rawJwks, ENV_VARIABLES.jwksUrl, issues) : void 0;
+	const rawRead = first(source, ENV_VARIABLES.readUrl);
+	const readUrl = rawRead ? checkUrl(rawRead, ENV_VARIABLES.readUrl, issues) : void 0;
+	if (issues.length > 0 || !url || !publishableKey) return {
+		ok: false,
+		issues
+	};
+	const base = url.href.replace(/\/+$/, "");
+	const projectRef = HOSTED.exec(url.hostname)?.[1];
+	return {
+		ok: true,
+		env: {
+			url: base,
+			publishableKey,
+			jwksUrl: jwksOverride ?? new URL(`${base}/auth/v1/.well-known/jwks.json`),
+			...secretKey ? {
+				secretKey,
+				secretKeys: {
+					...namedSecrets,
+					default: secretKey
+				}
+			} : {},
+			...dbUrl ? { dbUrl } : {},
+			...projectRef ? { projectRef } : {},
+			...readUrl ? { readUrl: readUrl.href.replace(/\/+$/, "") } : {}
+		}
+	};
+}
+function processEnv() {
+	return globalThis.process?.env ?? {};
+}
+/** Like `parseEnv`, but throws `EnvValidationError`. Reads `process.env` by default. */
+function loadEnv(source = processEnv(), options = {}) {
+	const result = parseEnv(source, options);
+	if (!result.ok) throw new EnvValidationError(result.issues);
+	return result.env;
+}
+/** The env validator as a Standard Schema, for t3-env, framework config or any validator slot. */
+function envSchema(options = {}) {
+	return { "~standard": {
+		version: 1,
+		vendor: "better-supabase",
+		validate(value) {
+			if (typeof value !== "object" || value === null) return { issues: [{ message: "Expected an environment object" }] };
+			const result = parseEnv(value, options);
+			if (result.ok) return { value: result.env };
+			return { issues: result.issues.map((issue) => ({
+				message: `${issue.variables[0] ?? "env"} ${issue.message}`,
+				path: issue.variables.slice(0, 1)
+			})) };
+		}
+	} };
+}
+/** The parts that are safe in client bundles. */
+function publicEnv(env) {
+	return {
+		url: env.url,
+		publishableKey: env.publishableKey
+	};
+}
+/** Converts to `@supabase/server`'s `SupabaseEnv` (the `env` option of `withSupabase`). */
+function toServerEnv(env) {
+	return {
+		url: env.url,
+		publishableKeys: { default: env.publishableKey },
+		secretKeys: env.secretKeys ?? (env.secretKey ? { default: env.secretKey } : {}),
+		jwks: env.jwksUrl
+	};
+}
+//#endregion
 export { ENV_VARIABLES, EnvValidationError, envSchema, loadEnv, parseEnv, publicEnv, toServerEnv };

package/dist/events/index.d.ts

@@ -1,2 +1,2 @@
-import { a as HttpMode, c as RowEventData, d as httpSink, f as isCloudEvent, i as ForwardOptions, l as forwardMutations, m as toHttp, n as CloudEventOptions, o as HttpSinkOptions, p as toCloudEvents, r as EventSink, s as ROW_EVENT_TYPES, t as CloudEvent, u as fromHttp } from "../index-Ciu5Xlml.js";
+import { a as HttpMode, c as RowEventData, d as httpSink, f as isCloudEvent, i as ForwardOptions, l as forwardMutations, m as toHttp, n as CloudEventOptions, o as HttpSinkOptions, p as toCloudEvents, r as EventSink, s as ROW_EVENT_TYPES, t as CloudEvent, u as fromHttp } from "../index-GV77NpRP.js";
 export { CloudEvent, CloudEventOptions, EventSink, ForwardOptions, HttpMode, HttpSinkOptions, ROW_EVENT_TYPES, RowEventData, forwardMutations, fromHttp, httpSink, isCloudEvent, toCloudEvents, toHttp };

package/dist/events/index.js

@@ -1,2 +1,140 @@
-import { a as isCloudEvent, i as httpSink, n as forwardMutations, o as toCloudEvents, r as fromHttp, s as toHttp, t as ROW_EVENT_TYPES } from "../events-BuzTgn2D.js";
+import { n as nowInstant } from "../temporal-BwshQk0W.js";
+//#region src/events/index.ts
+const ROW_EVENT_TYPES = {
+	insert: "dev.better-supabase.row.created",
+	upsert: "dev.better-supabase.row.upserted",
+	update: "dev.better-supabase.row.updated",
+	delete: "dev.better-supabase.row.deleted"
+};
+function subjectOf(meta, table, row) {
+	const key = meta?.tables[table]?.primaryKey;
+	if (!key || key.length === 0) return void 0;
+	const values = key.map((column) => row[column]);
+	if (values.some((value) => value === void 0 || value === null)) return void 0;
+	return `${table}/${values.map((value) => encodeURIComponent(String(value))).join(",")}`;
+}
+/**
+* One CloudEvent per mutated row: `dev.better-supabase.row.created` with the
+* app-cased row as `data`, the primary key as `subject`, the tenant as
+* `partitionkey` and the actor as `actorid`.
+*/
+function toCloudEvents(notice, options) {
+	const type = options.typePrefix ? `${options.typePrefix}.row.${ROW_EVENT_TYPES[notice.kind].split(".").at(-1)}` : ROW_EVENT_TYPES[notice.kind];
+	const time = (options.now ?? nowInstant)().toString();
+	return notice.rows.map((row) => {
+		const subject = subjectOf(options.meta, notice.table, row);
+		return {
+			specversion: "1.0",
+			id: options.id?.() ?? crypto.randomUUID(),
+			source: options.source,
+			type,
+			...subject ? { subject } : {},
+			time,
+			datacontenttype: "application/json",
+			data: {
+				table: notice.table,
+				row
+			},
+			...notice.context.tenant ? { partitionkey: notice.context.tenant } : {},
+			...notice.context.actor?.id ? { actorid: notice.context.actor.id } : {}
+		};
+	});
+}
+/**
+* Sends a CloudEvent for every mutation to `sink`. Returns a function that
+* stops forwarding. Use an outbox (SQL kit) when events must not be lost.
+*/
+function forwardMutations(sb, sink, options) {
+	return sb.events.on("mutation", (notice) => {
+		if (options.filter && !options.filter(notice)) return;
+		const events = toCloudEvents(notice, {
+			...options,
+			meta: sb.meta
+		});
+		if (events.length === 0) return;
+		const report = (error) => {
+			(options.onError ?? ((cause) => {
+				sb.events.logger.error("event sink failed", { cause });
+			}))(error, events);
+		};
+		try {
+			Promise.resolve(sink.send(events)).catch(report);
+		} catch (error) {
+			report(error);
+		}
+	});
+}
+const STRUCTURED = "application/cloudevents+json";
+const BATCH = "application/cloudevents-batch+json";
+/** The HTTP protocol binding: headers and body for one event (or a batch). */
+function toHttp(events, mode = "structured") {
+	const list = Array.isArray(events) ? events : [events];
+	switch (mode) {
+		case "batch": return [{
+			headers: { "content-type": BATCH },
+			body: JSON.stringify(list)
+		}];
+		case "structured": return list.map((event) => ({
+			headers: { "content-type": STRUCTURED },
+			body: JSON.stringify(event)
+		}));
+		case "binary": return list.map((event) => {
+			const headers = {};
+			for (const [key, value] of Object.entries(event)) {
+				if (key === "data" || key === "datacontenttype" || value === void 0) continue;
+				headers[`ce-${key}`] = encodeURIComponent(String(value)).replaceAll("%20", " ");
+			}
+			headers["content-type"] = event.datacontenttype ?? "application/json";
+			return {
+				headers,
+				body: event.data === void 0 ? "" : JSON.stringify(event.data)
+			};
+		});
+		default: throw new TypeError(`Unknown CloudEvents mode ${String(mode)}`);
+	}
+}
+function isCloudEvent(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const event = value;
+	return event["specversion"] === "1.0" && typeof event["id"] === "string" && typeof event["source"] === "string" && typeof event["type"] === "string";
+}
+/** Reads CloudEvents from a request in any of the three HTTP modes. */
+async function fromHttp(request) {
+	const contentType = request.headers.get("content-type") ?? "";
+	const text = await request.text();
+	if (contentType.startsWith(BATCH)) {
+		const parsed = JSON.parse(text);
+		if (!Array.isArray(parsed) || !parsed.every(isCloudEvent)) throw new TypeError("Invalid CloudEvents batch");
+		return parsed;
+	}
+	if (contentType.startsWith(STRUCTURED)) {
+		const parsed = JSON.parse(text);
+		if (!isCloudEvent(parsed)) throw new TypeError("Invalid CloudEvent");
+		return [parsed];
+	}
+	const event = {};
+	for (const [key, value] of request.headers) if (key.startsWith("ce-")) event[key.slice(3)] = decodeURIComponent(value);
+	if (contentType) event["datacontenttype"] = contentType;
+	if (text) event["data"] = contentType.includes("json") ? JSON.parse(text) : text;
+	if (!isCloudEvent(event)) throw new TypeError("Request is not a CloudEvent");
+	return [event];
+}
+/** POSTs events to `url`. Non-2xx responses reject. */
+function httpSink(url, options = {}) {
+	const send = options.fetch ?? fetch;
+	return { async send(events) {
+		for (const message of toHttp(events, options.mode ?? "batch")) {
+			const response = await send(url, {
+				method: "POST",
+				headers: {
+					...options.headers,
+					...message.headers
+				},
+				body: message.body
+			});
+			if (!response.ok) throw new Error(`Event sink responded ${String(response.status)}`);
+		}
+	} };
+}
+//#endregion
 export { ROW_EVENT_TYPES, forwardMutations, fromHttp, httpSink, isCloudEvent, toCloudEvents, toHttp };

package/dist/{events-DOt3nSO-.d.ts → events-Do8jXh4D.d.ts}

@@ -1,6 +1,6 @@
-import { g as Operation } from "./executor-CGdNQ27g.js";
-import { p as DbError } from "./result-CTkCZ6JA.js";
-import { h as RequestContext, l as MutationKind } from "./plugin-C4TR9J0Z.js";
+import { g as Operation } from "./executor-DynmIWhq.js";
+import { p as DbError } from "./result-c2OYgCV2.js";
+import { h as RequestContext, l as MutationKind } from "./plugin-DVRB8qNE.js";
 //#region src/core/logger.d.ts
 type LogFields = Readonly<Record<string, unknown>>;
 /**

package/dist/{executor-BYXQ9AGn.d.ts → executor-B26lgbHD.d.ts}

@@ -1,5 +1,5 @@
-import { r as Executor } from "./executor-CGdNQ27g.js";
-import { y as RawDbError } from "./result-CTkCZ6JA.js";
+import { r as Executor } from "./executor-DynmIWhq.js";
+import { y as RawDbError } from "./result-c2OYgCV2.js";
 //#region src/postgres/executor.d.ts
 /**
  * Anything that runs parameterized SQL: `ctx.postgres` from

package/dist/{executor-DeppvirK.js → executor-C57jx2pn.js}

@@ -1,6 +1,6 @@
 import { c as mapDbError, n as dbError } from "./errors-Bl3rkOzo.js";
 import { i as ok, n as err, o as toDbError } from "./result-DWXatkd6.js";
-import { t as compileSql } from "./sql-DTjA1LPj.js";
+import { t as compileSql } from "./sql-BIgk12ew.js";
 //#region src/postgres/executor.ts
 function isPgError(value) {
 	return typeof value === "object" && value !== null && typeof value.code === "string";
@@ -25,6 +25,11 @@ async function run(client, plan, op) {
 		const [first] = await client.queryRaw(plan.count.text, [...plan.count.params]);
 		count = first?.count ?? 0;
 	} else if (op.kind !== "select") count = rows.length;
+	for (const next of plan.chunks ?? []) {
+		const more = await run(client, next, op);
+		rows.push(...more.rows);
+		count = (count ?? 0) + (more.count ?? 0);
+	}
 	return {
 		rows,
 		count
@@ -74,7 +79,7 @@ async function executeOn(client, op, context) {
 	if (context.signal?.aborted) return err(dbError("aborted", "The request was aborted"));
 	let result;
 	try {
-		result = await run(client, plan, op);
+		result = plan.chunks && client.transaction ? await client.transaction((scoped) => run(scoped, plan, op)) : await run(client, plan, op);
 	} catch (cause) {
 		const raw = fromPgError(cause);
 		return err(raw ? mapDbError(raw, context.errorMappers) : toDbError(cause));

package/dist/{executor-CGdNQ27g.d.ts → executor-DynmIWhq.d.ts}

@@ -1,5 +1,5 @@
-import { P as TableMeta, T as RelationMeta, c as Codec } from "./types-C83v5SQz.js";
-import { o as Result, v as ErrorMapper } from "./result-CTkCZ6JA.js";
+import { P as TableMeta, T as RelationMeta, c as Codec } from "./types-DONv9SHN.js";
+import { o as Result, v as ErrorMapper } from "./result-c2OYgCV2.js";
 //#region src/ir/types.d.ts
 /**
  * The query IR. Every repository call becomes one of these operations; the

package/dist/hono/index.d.ts

@@ -1,8 +1,8 @@
-import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
-import { t as BetterSupabase } from "../define-e3zI4_4g.js";
-import { r as AuthState } from "../resolve-CjHILk2w.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-Dne1ARSa.js";
-import { i as ResourceRouteOptions } from "../resource-CgZa3YG_.js";
+import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { t as BetterSupabase } from "../define-DUbydmJa.js";
+import { r as AuthState } from "../resolve-BRciX2jK.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-DAkPIdTH.js";
+import { a as ResourceRouteOptions } from "../resource-CwVgiI5q.js";
 import { Context, ErrorHandler, Hono, MiddlewareHandler } from "hono";
 //#region src/hono/index.d.ts
 /** Hono `Env` with the request's better-supabase context in `c.var`. */

package/dist/hono/index.js

@@ -1,7 +1,7 @@
 import { n as dbError, r as dbErrorOf } from "../errors-Bl3rkOzo.js";
-import { a as problemResponse } from "../problem-BTkTtRV9.js";
-import { i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-DMcbQwfN.js";
-import { t as defineResource } from "../resource-BHEWmQJK.js";
+import { a as problemResponse } from "../problem-CGt1ADix.js";
+import { i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-C44EZAJo.js";
+import { t as defineResource } from "../resource-D30rp0GN.js";
 import { Hono } from "hono";
 //#region src/hono/index.ts
 function contextOf(c) {
@@ -31,7 +31,7 @@ function createHono(sb, options = {}) {
 		middleware(middlewareOptions = {}) {
 			return async (c, next) => {
 				const ctx = await server.context(c.req.raw, { refresh: middlewareOptions.refresh ?? false });
-				const denied = guard(ctx.auth, middlewareOptions.allow, middlewareOptions.aal);
+				const denied = guard(ctx.auth, middlewareOptions.allow, middlewareOptions.aal, middlewareOptions.scopes);
 				if (denied) return ctx.resolution.apply(problemResponse(denied, {
 					instance: new URL(c.req.url).pathname,
 					expose

package/dist/{index-CBDufH1M.d.ts → index-BNsABq7P.d.ts}

@@ -1,16 +1,16 @@
-import { p as DbError } from "./result-CTkCZ6JA.js";
-import { Z as QuerySpec } from "./define-e3zI4_4g.js";
-import { i as BrowserAuth, t as AuthSnapshot } from "./index-D4v7sncu.js";
+import { p as DbError } from "./result-c2OYgCV2.js";
+import { Z as QuerySpec } from "./define-DUbydmJa.js";
+import { i as BrowserAuth, t as AuthSnapshot } from "./index-UJ-LUxtI.js";
 import { n as TemplateValues } from "./template-mbvlysOo.js";
-import { t as AuthSession } from "./view-D1s0wa0T.js";
-import { a as LiveSource, g as Topic, h as SubscriptionStatus, p as SubscribeOptions, r as LiveCountSeed, u as EventSchemas, v as TopicHandlers, y as TopicMessage } from "./live-DJyZMD6w.js";
-import "./entitlements-Dng-ctuT.js";
-import "./session-C3LxnQ0e.js";
+import { t as AuthSession } from "./view-3Po_PVlr.js";
+import { a as LiveSource, g as Topic, h as SubscriptionStatus, p as SubscribeOptions, r as LiveCountSeed, u as EventSchemas, v as TopicHandlers, y as TopicMessage } from "./live-QE3UPbGm.js";
+import "./entitlements-DvJXoI02.js";
+import "./react/session.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { ReactNode } from "react";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 import { QueryClient } from "@tanstack/query-core";
-//#region src/react/index.d.ts
+//#region src/react/hooks.d.ts
 /** The parts of `createBrowser()` the provider needs. */
 interface BrowserLike {
   readonly sb: LiveSource;

package/dist/{index-Bw1bwtC0.d.ts → index-CADlNHK-.d.ts}

@@ -1,14 +1,16 @@
-import { N as TableKey, O as Row, n as AnyModels, t as AnyFunctions } from "./types-C83v5SQz.js";
-import { l as CountMode } from "./executor-CGdNQ27g.js";
-import { b as ValidationIssue, t as AsyncResult } from "./result-CTkCZ6JA.js";
-import { C as FindExt, Ct as WhereInput, O as RepositoryOf, T as OffsetPageArgs, dt as IncludeArg, gt as OrderByArg, t as BetterSupabase, vt as Payload, w as OffsetPage, xt as SelectArg } from "./define-e3zI4_4g.js";
+import { N as TableKey, O as Row, n as AnyModels, t as AnyFunctions } from "./types-DONv9SHN.js";
+import { l as CountMode } from "./executor-DynmIWhq.js";
+import { b as ValidationIssue, t as AsyncResult } from "./result-c2OYgCV2.js";
+import { C as FindExt, Ct as WhereInput, O as RepositoryOf, T as OffsetPageArgs, _ as CursorPage, dt as IncludeArg, gt as OrderByArg, t as BetterSupabase, v as CursorPageArgs, vt as Payload, w as OffsetPage, xt as SelectArg } from "./define-DUbydmJa.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
-//#region src/list/index.d.ts
+//#region src/list/list-query.d.ts
 /** Facet value meaning "not set": filters with `is null`. */
 declare const UNSET = "__unset__";
 type Column<M extends AnyModels, T extends keyof M> = Extract<keyof Row<M, T>, string>;
 type TextColumn<M extends AnyModels, T extends keyof M> = { [K in Column<M, T>]: [NonNullable<Row<M, T>[K]>] extends [string] ? K : never; }[Column<M, T>];
-interface ListQueryConfig<M extends AnyModels, T extends keyof M, S extends string, F extends string, C extends boolean = boolean> {
+/** `offset` pages by number; `cursor` continues after the last row (keyset). */
+type ListPagination = "offset" | "cursor";
+interface ListQueryConfig<M extends AnyModels, T extends keyof M, S extends string, F extends string, C extends boolean = boolean, P extends ListPagination = ListPagination> {
   /**
    * Also count rows per facet value, with one grouped aggregate that runs
    * next to the page: 2 calls, 1 wave. Needs PostgREST aggregates.
@@ -26,6 +28,12 @@ interface ListQueryConfig<M extends AnyModels, T extends keyof M, S extends stri
   /** Named orderings. Add a unique column last for stable pages. */
   readonly sorts: { readonly [K in S]: OrderByArg<M, T>; };
   readonly defaultSort: NoInfer<S>;
+  /**
+   * `cursor` takes an `after` cursor instead of `page` and returns
+   * `nextCursor`: the cost of a page stays the same however deep it is, and
+   * rows inserted meanwhile don't shift it. Defaults to `offset`.
+   */
+  readonly pagination?: P;
   /** Defaults to 50. */
   readonly pageSize?: number;
   /** Defaults to 200. */
@@ -36,8 +44,10 @@ interface ListQueryConfig<M extends AnyModels, T extends keyof M, S extends stri
 interface ListQuery<S extends string, F extends string> {
   readonly q?: string;
   readonly sort: S;
-  /** 1-based. */
+  /** 1-based. Always 1 with cursor pagination. */
   readonly page: number;
+  /** Cursor pagination: the `nextCursor` of the previous page. */
+  readonly after?: string;
   readonly size: number;
   readonly facets: { readonly [K in F]?: readonly string[]; };
 }
@@ -46,6 +56,7 @@ interface ListQueryInput<S extends string, F extends string> {
   readonly q?: string;
   readonly sort?: S;
   readonly page?: number;
+  readonly after?: string;
   readonly size?: number;
   readonly facets?: { readonly [K in F]?: readonly string[]; };
 }
@@ -83,13 +94,14 @@ interface FacetInfo {
 /** Rows per facet value, keyed by facet and then by value (`UNSET` for empty). */
 type FacetCounts<F extends string> = { readonly [K in F]: Readonly<Record<string, number>>; };
 /** A page of a list; with `facetCounts: true`, also the counts per facet value. */
-type ListPage<R, F extends string, C extends boolean> = OffsetPage<R> & ([C] extends [true] ? {
+type ListPage<R, F extends string, C extends boolean, P extends ListPagination = "offset"> = ([P] extends ["cursor"] ? CursorPage<R> : OffsetPage<R>) & ([C] extends [true] ? {
   readonly facetCounts: FacetCounts<F>;
 } : [C] extends [false] ? unknown : {
   readonly facetCounts?: FacetCounts<F>;
 });
-interface ListDefinition<M extends AnyModels, T extends TableKey<M>, E, S extends string, F extends string, C extends boolean = false> {
+interface ListDefinition<M extends AnyModels, T extends TableKey<M>, E, S extends string, F extends string, C extends boolean = false, P extends ListPagination = "offset"> {
   readonly table: T;
+  readonly pagination: P;
   readonly defaults: ListQuery<S, F>;
   readonly facets: readonly FacetInfo[];
   /** Validates typed input or URL params. Also a Standard Schema (`schema`). */
@@ -100,13 +112,13 @@ interface ListDefinition<M extends AnyModels, T extends TableKey<M>, E, S extend
   /** `{ parse, serialize }` per URL key, for routers and nuqs (`list.nuqs(createParser)`). */
   readonly parsers: ListParsers<S, F>;
   nuqs<P>(createParser: (spec: ParserSpec<unknown>) => P): { readonly [K in keyof ListParsers<S, F>]: P; };
-  /** Repository arguments: `where`, `orderBy`, `page`, `size`, `count`. */
-  args(query: ListQuery<S, F>): OffsetPageArgs<M, T>;
+  /** Repository arguments: `where`, `orderBy`, `size`, and `page` and `count` or `after`. */
+  args(query: ListQuery<S, F>): [P] extends ["cursor"] ? CursorPageArgs<M, T> : OffsetPageArgs<M, T>;
   /**
    * Runs the list against a table, merging your `select`, `include`, `where`
    * and `count`. One request, plus one for `facetCounts`, always one wave.
    */
-  run<const A extends ListExtra<M, T> & FindExt<E, M, T>>(db: { readonly [K in T]: RepositoryOf<M, K, E>; }, query: ListQuery<S, F>, extra?: A): AsyncResult<ListPage<Payload<M, T, A>, F, C>>;
+  run<const A extends ListExtra<M, T> & FindExt<E, M, T>>(db: { readonly [K in T]: RepositoryOf<M, K, E>; }, query: ListQuery<S, F>, extra?: A): AsyncResult<ListPage<Payload<M, T, A>, F, C, P>>;
   /** OpenAPI 3.1 query parameters. */
   readonly openapi: readonly OpenApiParameter[];
   /** JSON Schema of the typed input, e.g. for MCP tool arguments. */
@@ -123,6 +135,7 @@ type ListParsers<S extends string, F extends string> = {
   readonly q: ParserSpec<string>;
   readonly sort: ParserSpec<S>;
   readonly page: ParserSpec<number>;
+  readonly after: ParserSpec<string>;
   readonly size: ParserSpec<number>;
 } & { readonly [K in F]: ParserSpec<readonly string[]>; };
 /**
@@ -139,6 +152,6 @@ type ListParsers<S extends string, F extends string> = {
  * });
  * ```
  */
-declare function defineListQuery<M extends AnyModels, D, Fn extends AnyFunctions, E, T extends TableKey<M>, const S extends string, const F extends string = never, const C extends boolean = false>(sb: BetterSupabase<M, D, Fn, E>, table: T, config: ListQueryConfig<M, T, S, F, C>): ListDefinition<M, T, E, S, F, C>;
+declare function defineListQuery<M extends AnyModels, D, Fn extends AnyFunctions, E, T extends TableKey<M>, const S extends string, const F extends string = never, const C extends boolean = false, const P extends ListPagination = "offset">(sb: BetterSupabase<M, D, Fn, E>, table: T, config: ListQueryConfig<M, T, S, F, C, P>): ListDefinition<M, T, E, S, F, C, P>;
 //#endregion
-export { ListPage as a, ListQuery as c, ListSearchParams as d, OpenApiParameter as f, defineListQuery as h, ListExtra as i, ListQueryConfig as l, UNSET as m, FacetInfo as n, ListParseResult as o, ParserSpec as p, ListDefinition as r, ListParsers as s, FacetCounts as t, ListQueryInput as u };
+export { ListPage as a, ListParsers as c, ListQueryInput as d, ListSearchParams as f, defineListQuery as g, UNSET as h, ListExtra as i, ListQuery as l, ParserSpec as m, FacetInfo as n, ListPagination as o, OpenApiParameter as p, ListDefinition as r, ListParseResult as s, FacetCounts as t, ListQueryConfig as u };

package/dist/{index-DuP14VHo.d.ts → index-CTTMS6_1.d.ts}

@@ -1,9 +1,11 @@
-import { b as PermdockBucketPolicy, i as BucketPolicyName } from "./types-C83v5SQz.js";
-import { p as DbError, t as AsyncResult } from "./result-CTkCZ6JA.js";
+/// <reference lib="esnext.temporal" />
+import { b as PermdockBucketPolicy, i as BucketPolicyName } from "./types-DONv9SHN.js";
+import { p as DbError, t as AsyncResult } from "./result-c2OYgCV2.js";
 import { n as StoragePath, t as PathIn } from "./path-Cv__-OTj.js";
+import { t as PermdockCatalog } from "./permdock-sql-DImJULY-.js";
 import { n as TemplateValues, t as TemplateParams } from "./template-mbvlysOo.js";
 import { SupabaseClient } from "@supabase/supabase-js";
-//#region src/storage/index.d.ts
+//#region src/storage/bucket.d.ts
 type BucketPolicy = BucketPolicyName | PermdockBucketPolicy;
 interface BucketConfig<P extends string = string, Id extends string = string> {
   /** Bucket id, e.g. `customer-logos`. */
@@ -20,10 +22,16 @@ interface BucketConfig<P extends string = string, Id extends string = string> {
    * The helpers check role and scope only. Use `permdock` just for
    * permissions whose grants have no row conditions beyond the scope: for a
    * permission with row conditions (e.g. `ownerId = principal.id`) the bucket
-   * grants every object in the scope. Leave those to the policies
-   * `permdock rls generate` writes.
+   * would grant every object in the scope. Pass `catalog` to refuse those
+   * keys here; `better-supabase doctor` (BS214) refuses them from the
+   * catalog file.
    */
   readonly policy?: BucketPolicy;
+  /**
+   * PermDock's `permissions.catalog.json`. With it, a `permdock` policy
+   * naming a permission with `rowConditions: true` throws.
+   */
+  readonly catalog?: PermdockCatalog;
   /** `'5MiB'`, `'500KB'` or bytes. */
   readonly fileSizeLimit?: string | number;
   /** `['image/png', 'image/*']`. */
@@ -105,14 +113,17 @@ interface ReplaceResult<Id extends string = string> {
 interface SweepOptions<P extends string> {
   /** Only look under the path prefix these values fill. */
   readonly within?: Partial<TemplateValues<P>>;
-  /** Minimum age in milliseconds, or a cutoff date. */
-  readonly olderThan: number | Date;
+  /**
+   * A cutoff instant, or a minimum age. A duration counts a day as 24 hours
+   * and cannot use months or years.
+   */
+  readonly olderThan: Temporal.Instant | Temporal.Duration;
   /** Returns which of `paths` are still referenced. */
   readonly referenced: (paths: readonly string[]) => PromiseLike<Iterable<string>> | Iterable<string>;
   readonly dryRun?: boolean;
   readonly batchSize?: number;
   readonly signal?: AbortSignal;
-  readonly now?: () => number;
+  readonly now?: () => Temporal.Instant;
 }
 interface SweepResult {
   readonly scanned: number;