better-supabase 0.2.0 → 0.4.0

package/README.md

@@ -4,7 +4,7 @@
 
 [![npm](https://img.shields.io/npm/v/better-supabase)](https://www.npmjs.com/package/better-supabase)
 [![license](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/ScaleDockHQ/better-supabase/blob/main/LICENSE)
-![TypeScript](https://img.shields.io/badge/TypeScript-5.9%20%7C%206%20%7C%207-3178c6.svg)
+![TypeScript](https://img.shields.io/badge/TypeScript-6%20%7C%207-3178c6.svg)
 
 `better-supabase gen` extends `supabase gen types` with relation cardinality, unique keys, CHECK unions and typed jsonb. The generated `schema` gives every table a typed repository that compiles to one PostgREST request, returns a `Result` instead of throwing, and runs as the caller so RLS always applies.
 
@@ -15,31 +15,33 @@ pnpm add better-supabase @supabase/supabase-js
 pnpm add -D pg
 ```
 
-ESM only. Node 24 or later for the CLI; the runtime entries run on every WinterTC runtime (Node, Deno, Bun, Workers, Supabase Edge Functions). TypeScript 5.9, 6 and 7 are tested.
+ESM only. The package includes the `better-supabase` CLI, which needs Node 24 or later; the runtime entries run on every WinterTC runtime (Node, Deno, Bun, Workers, Supabase Edge Functions). TypeScript 6 and 7 are tested.
 
 ## Quick start
 
+Or start with `npx better-supabase init`, which detects your frameworks and prints the install command.
+
 ```bash
 supabase start
-pnpm better-supabase init   # config, src/lib/supabase.ts and framework glue
+pnpm better-supabase init   # config, src/lib/supabase/index.ts and framework glue
 pnpm better-supabase gen    # database.types.ts and generated.ts
 ```
 
 ```ts
-import { createClient } from '@supabase/supabase-js';
-import { defineSupabase } from 'better-supabase';
+import { createClient } from "@supabase/supabase-js";
+import { defineSupabase } from "better-supabase";
 
-import { schema } from './lib/supabase/generated.ts';
+import { schema } from "./lib/supabase/generated.ts";
 
-export const sb = defineSupabase(schema);
+export const betterSupabase = defineSupabase(schema);
 
-const db = sb.connect(createClient(url, publishableKey));
+const db = betterSupabase.connect(createClient(url, publishableKey));
 
 const result = await db.customers.findMany({
-  select: ['id', 'name'],
-  where: { status: 'active', notes: { some: { kind: 'call' } } },
-  include: { organization: { select: ['name'] } },
-  orderBy: { name: 'asc' },
+  select: ["id", "name"],
+  where: { status: "active", notes: { some: { kind: "call" } } },
+  include: { organization: { select: ["name"] } },
+  orderBy: { name: "asc" },
   limit: 20,
 });
 if (!result.ok) return result; // DbError: kind, message, status, code
@@ -47,27 +49,29 @@ if (!result.ok) return result; // DbError: kind, message, status, code
 
 ## Subpaths
 
-| Import | What it gives you |
-| --- | --- |
-| `better-supabase` | `defineSupabase`, repositories, `Result`, `DbError`, `SPEC_PINS` |
-| `better-supabase/config` | `defineConfig` and generators for `better-supabase.config.ts` |
-| `better-supabase/client` | Browser repositories that follow the session |
-| `better-supabase/react` | Provider, typed hooks and the server session |
-| `better-supabase/query` | TanStack Query options with table-based invalidation |
-| `better-supabase/server` | Repositories bound to the caller, admin and acting-as identities |
-| `better-supabase/postgres` | The same repositories over direct Postgres |
-| `better-supabase/ssr` | The `@supabase/ssr` cookie format for any framework |
-| `better-supabase/next`, `/next/image` | Proxy, Server Components, route handlers, server actions, Storage images |
-| `better-supabase/hono`, `/orpc`, `/edge` | Framework adapters |
-| `better-supabase/mcp` | MCP servers whose tools run as the signed-in user |
-| `better-supabase/jobs` | Supabase Queues jobs, idempotency keys and a webhook inbox |
-| `better-supabase/list` | Search, facets, sorting and pagination from one definition |
-| `better-supabase/storage`, `/realtime` | Typed bucket paths and broadcast topics |
-| `better-supabase/env` | Validated Supabase settings |
-| `better-supabase/events`, `/webhooks`, `/openapi`, `/otel` | CloudEvents, Standard Webhooks, OpenAPI 3.1 and OpenTelemetry |
-| `better-supabase/plugins/*` | Timestamps, soft delete, tenant, actor, validation and runtime rules |
-| `better-supabase/lint` | Editor rules for unbounded reads and unscoped deletes |
-| `better-supabase/testing` | `asUser`, `localAuth`, typed seeds and conformance kits |
+| Import                                                     | What it gives you                                                        |
+| ---------------------------------------------------------- | ------------------------------------------------------------------------ |
+| `better-supabase`                                          | `defineSupabase`, repositories, `Result`, `DbError`, `SPEC_PINS`         |
+| `better-supabase/config`                                   | `defineConfig` and generators for `better-supabase.config.ts`            |
+| `better-supabase/cli`                                      | `run`, `registerCommand` and codegen for scripts that drive the CLI      |
+| `better-supabase/client`                                   | Browser repositories that follow the session                             |
+| `better-supabase/react`                                    | Provider, typed hooks and the server session                             |
+| `better-supabase/query`                                    | TanStack Query options with table-based invalidation                     |
+| `better-supabase/server`                                   | Repositories bound to the caller, admin and acting-as identities         |
+| `better-supabase/postgres`                                 | The same repositories over direct Postgres                               |
+| `better-supabase/ssr`                                      | The `@supabase/ssr` cookie format for any framework                      |
+| `better-supabase/next`, `/next/image`                      | Proxy, Server Components, route handlers, server actions, Storage images |
+| `better-supabase/hono`, `/orpc`, `/edge`                   | Framework adapters                                                       |
+| `better-supabase/mcp`                                      | MCP servers whose tools run as the signed-in user                        |
+| `better-supabase/jobs`                                     | Supabase Queues jobs, idempotency keys and a webhook inbox               |
+| `better-supabase/list`                                     | Search, facets, sorting and pagination from one definition               |
+| `better-supabase/storage`, `/realtime`                     | Typed bucket paths and broadcast topics                                  |
+| `better-supabase/env`                                      | Validated Supabase settings                                              |
+| `better-supabase/events`, `/webhooks`, `/openapi`, `/otel` | CloudEvents, Standard Webhooks, OpenAPI 3.1 and OpenTelemetry            |
+| `better-supabase/plugins/*`                                | Timestamps, soft delete, tenant, actor, validation and runtime rules     |
+| `better-supabase/sql`                                      | The SQL kit modules and read-set compiler behind `better-supabase sql`   |
+| `better-supabase/lint`                                     | Editor rules for unbounded reads and unscoped deletes                    |
+| `better-supabase/testing`                                  | `asUser`, `localAuth`, typed seeds and conformance kits                  |
 
 ## For AI agents
 

package/dist/base64-D2gsioCY.js

@@ -0,0 +1,42 @@
+//#region src/core/base64.ts
+const encoder = /* @__PURE__ */ new TextEncoder();
+const decoder = /* @__PURE__ */ new TextDecoder();
+/** Standard base64 (RFC 4648 section 4) of `input`, with padding. */
+function toBase64(input) {
+	const bytes = typeof input === "string" ? encoder.encode(input) : input;
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary);
+}
+/** Bytes of standard or URL-safe base64, padded or not. Throws on invalid input. */
+function fromBase64(text) {
+	const base64 = text.replaceAll("-", "+").replaceAll("_", "/");
+	const binary = atob(base64 + "=".repeat((4 - base64.length % 4) % 4));
+	const bytes = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
+	return bytes;
+}
+/** URL-safe base64 (RFC 4648 section 5) of `input`, without padding. */
+function toBase64Url(input) {
+	return toBase64(input).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+/** UTF-8 text of base64 or base64url. Throws on invalid input. */
+function base64ToText(text) {
+	return decoder.decode(fromBase64(text));
+}
+/**
+* The payload of a JWT, decoded without verifying the signature. Only for
+* reading claims such as `exp` from a token that is verified elsewhere.
+*/
+function decodeJwtPayload(token) {
+	const part = token.split(".")[1];
+	if (!part) return void 0;
+	try {
+		const parsed = JSON.parse(base64ToText(part));
+		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { toBase64Url as a, toBase64 as i, decodeJwtPayload as n, fromBase64 as r, base64ToText as t };

package/dist/claims-BAf6c7is.js

@@ -0,0 +1,48 @@
+//#region src/core/claims.ts
+const DEFAULT_CLAIMS = {
+	tenant: "tenant_id",
+	scope: "tenant",
+	features: "features"
+};
+/** The configured claim names, with defaults for the ones codegen left out. */
+function claimsOf(meta) {
+	if (!meta?.claims) return DEFAULT_CLAIMS;
+	let claims = claimsByMeta.get(meta);
+	if (!claims) {
+		claims = {
+			...DEFAULT_CLAIMS,
+			...meta.claims
+		};
+		claimsByMeta.set(meta, claims);
+	}
+	return claims;
+}
+const claimsByMeta = /* @__PURE__ */ new WeakMap();
+/** Where the active tenant is read from: the top-level claim, then `app_metadata`. */
+function tenantClaimPaths(tenant = DEFAULT_CLAIMS.tenant) {
+	let paths = tenantPaths.get(tenant);
+	if (!paths) {
+		paths = [tenant, `app_metadata.${tenant}`];
+		tenantPaths.set(tenant, paths);
+	}
+	return paths;
+}
+const tenantPaths = /* @__PURE__ */ new Map();
+/** Claim paths come from configuration, so this stays small. */
+const segmentsByPath = /* @__PURE__ */ new Map();
+function segmentsOf(path) {
+	let segments = segmentsByPath.get(path);
+	if (!segments) {
+		segments = path.split(".");
+		if (segmentsByPath.size < 256) segmentsByPath.set(path, segments);
+	}
+	return segments;
+}
+/** The string at a dotted claim path, if any. */
+function claimAt(claims, path) {
+	let value = claims;
+	for (const segment of segmentsOf(path)) value = typeof value === "object" && value !== null ? value[segment] : void 0;
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+//#endregion
+export { tenantClaimPaths as i, claimAt as n, claimsOf as r, DEFAULT_CLAIMS as t };

package/dist/cli/_format-Cax5EsM9.js

@@ -0,0 +1,101 @@
+//#region ../../node_modules/.pnpm/confbox@0.3.1/node_modules/confbox/dist/_chunks/libs/detect-indent.mjs
+const e = /^(?:( )+|\t+)/;
+const t$1 = `space`;
+function n$1(e, n, r) {
+	return e && n === t$1 && r === 1;
+}
+function r$1(r, a) {
+	let o = /* @__PURE__ */ new Map(), s = 0, c, l;
+	for (let u of r.split(/\n/g)) {
+		if (!u) continue;
+		let r = u.match(e);
+		if (r === null) s = 0, c = ``;
+		else {
+			let e = r[0].length, u = r[1] ? t$1 : `tab`;
+			if (n$1(a, u, e)) continue;
+			u !== c && (s = 0), c = u;
+			let d = 1, f = 0, p = e - s;
+			if (s = e, p === 0) d = 0, f = 1;
+			else {
+				let e = Math.abs(p);
+				if (n$1(a, u, e)) continue;
+				l = i$1(u, e);
+			}
+			let m = o.get(l);
+			o.set(l, m === void 0 ? [1, 0] : [m[0] + d, m[1] + f]);
+		}
+	}
+	return o;
+}
+function i$1(e, n) {
+	return (e === t$1 ? `s` : `t`) + String(n);
+}
+function a$1(e) {
+	return {
+		type: e[0] === `s` ? t$1 : `tab`,
+		amount: Number(e.slice(1))
+	};
+}
+function o$1(e) {
+	let t, n = 0, r = 0;
+	for (let [i, [a, o]] of e) (a > n || a === n && o > r) && (n = a, r = o, t = i);
+	return t;
+}
+function s$1(e, n) {
+	return (e === t$1 ? ` ` : `	`).repeat(n);
+}
+function c(e) {
+	if (typeof e != `string`) throw TypeError(`Expected a string`);
+	let t = r$1(e, !0);
+	t.size === 0 && (t = r$1(e, !1));
+	let n = o$1(t), i, c = 0, l = ``;
+	return n !== void 0 && ({type: i, amount: c} = a$1(n), l = s$1(i, c)), {
+		amount: c,
+		type: i,
+		indent: l
+	};
+}
+//#endregion
+//#region ../../node_modules/.pnpm/confbox@0.3.1/node_modules/confbox/dist/_chunks/_format.mjs
+const t = Symbol.for(`__confbox_fmt__`);
+const n = /^(\s+)/;
+const r = /(\s+)$/;
+function i(e) {
+	return e.charCodeAt(0) === 65279 ? e.slice(1) : e;
+}
+function a(e, t = {}) {
+	return {
+		sample: t.indent === void 0 && t.preserveIndentation !== !1 && i(e).slice(0, t?.sampleSize || 1024),
+		whiteSpace: t.preserveWhitespace === !1 ? void 0 : {
+			start: n.exec(e)?.[0] || ``,
+			end: r.exec(e)?.[0] || ``
+		}
+	};
+}
+function o(e, n, r) {
+	!n || typeof n != `object` || Object.defineProperty(n, t, {
+		enumerable: !1,
+		configurable: !0,
+		writable: !0,
+		value: a(e, r)
+	});
+}
+function s(n, r) {
+	if (!n || typeof n != `object` || !(t in n)) return {
+		indent: r?.indent ?? 2,
+		whitespace: {
+			start: ``,
+			end: ``
+		}
+	};
+	let i = n[t];
+	return {
+		indent: r?.indent || c(i.sample || ``).indent,
+		whitespace: i.whiteSpace || {
+			start: ``,
+			end: ``
+		}
+	};
+}
+//#endregion
+export { o as n, s as r, i as t };

package/dist/cli/bin.js

@@ -1,15 +1,48 @@
 #!/usr/bin/env node
-import { i as run } from "../cli-DrSgDOQC.js";
+import { i as run } from "./run-CP20LKk_.js";
+import { t as colorEnabled } from "./style-C0NFdJRL.js";
+import { text } from "node:stream/consumers";
 //#region src/cli/bin.ts
+const clack = () => import("./prompts-BTYQGunc.js").then((module) => module.clackPrompter);
+const prompts = {
+	select: async (message, choices, initial) => (await clack()).select(message, choices, initial),
+	multiselect: async (message, choices, initial) => (await clack()).multiselect(message, choices, initial),
+	confirm: async (message) => (await clack()).confirm(message),
+	spinner: (message) => {
+		let stop;
+		let stopped = false;
+		clack().then((prompter) => {
+			if (!stopped) stop = prompter.spinner(message);
+		});
+		return () => {
+			stopped = true;
+			stop?.();
+		};
+	}
+};
 const controller = new AbortController();
-process.once("SIGINT", () => controller.abort());
-process.once("SIGTERM", () => controller.abort());
+process.once("SIGINT", () => {
+	controller.abort();
+});
+process.once("SIGTERM", () => {
+	controller.abort();
+});
 const result = await run(process.argv.slice(2), {
+	cwd: process.cwd(),
+	env: process.env,
 	signal: controller.signal,
 	io: {
-		stdout: (text) => process.stdout.write(text),
-		stderr: (text) => process.stderr.write(text)
+		stdout: (chunk) => {
+			process.stdout.write(chunk);
+		},
+		stderr: (chunk) => {
+			process.stderr.write(chunk);
+		},
+		stdin: () => text(process.stdin),
+		color: colorEnabled(),
+		...process.stdin.isTTY && process.stdout.isTTY ? { prompts } : {}
 	}
 });
-process.exitCode = result.code;
+process.exitCode = controller.signal.aborted ? 130 : result.code;
 //#endregion
+export {};