better-supabase 0.2.0 → 0.4.0

package/dist/{define-e3zI4_4g.d.ts → define-CRS2MRV3.d.ts}

@@ -1,10 +1,11 @@
-import { A as SchemaMeta, C as PrimaryKeyValue, D as Relations, E as RelationShape, I as UniqueKeyName, L as UniqueWhere, N as TableKey, O as Row, P as TableMeta, R as Update, _ as Insert, j as Simplify, k as Schema, n as AnyModels, t as AnyFunctions } from "./types-C83v5SQz.js";
-import { g as Operation, l as CountMode, r as Executor } from "./executor-CGdNQ27g.js";
-import { p as DbError, s as ThrowMapper, t as AsyncResult, v as ErrorMapper } from "./result-CTkCZ6JA.js";
-import { a as EventHub, f as Logger, i as EventHandler, o as EventName, s as MutationNotice, u as RpcNotice } from "./events-DOt3nSO-.js";
-import { a as ExtensionOf, g as WithExtension, h as RequestContext, n as AnyPlugin, r as ApplyExtension } from "./plugin-C4TR9J0Z.js";
-import { t as StandardSchemaV1 } from "./standard-CyhRzctb.js";
-import { i as PostgrestPlan } from "./postgrest-cAEQ_IQN.js";
+/// <reference lib="esnext.temporal" />
+import { A as SchemaMeta, C as PrimaryKeyValue, D as Relations, E as RelationTypes, I as UniqueKeyName, L as UniqueWhere, N as TableKey, O as Row, P as TableMeta, R as Update, g as Insert, j as Simplify, k as Schema, n as AnyModels, t as AnyFunctions } from "./types-DONv9SHN.js";
+import { g as Operation, l as CountMode, r as Executor } from "./executor-B5IoUxLE.js";
+import { p as DbError, s as ThrowMapper, t as AsyncResult, v as ErrorMapper } from "./result-CqEsbgYs.js";
+import { a as EventHub, f as Logger, i as EventHandler, o as EventName, s as MutationNotice, u as RpcNotice } from "./events-B21UOhvP.js";
+import { a as ExtensionOf, g as WithExtension, h as RequestContext, n as AnyPlugin, r as ApplyExtension } from "./plugin-bNhvJwRh.js";
+import { t as StandardSchemaV1 } from "./standard-BsaCYQJc.js";
+import { i as PostgrestPlan } from "./postgrest-Bc-0Xw62.js";
 //#region src/ir/args.d.ts
 interface BaseOps<V> {
   readonly eq?: V;
@@ -147,7 +148,7 @@ interface AggregateArgs<M extends AnyModels, T extends keyof M> {
 type SelectPart<M extends AnyModels, T extends keyof M, A> = A extends {
   readonly select: readonly (infer K)[];
 } ? Pick<Row<M, T>, Extract<K, keyof Row<M, T>>> : Row<M, T>;
-type RelationPayload<M extends AnyModels, R, V> = R extends RelationShape ? R["kind"] extends "many" ? Payload<M, Extract<R["table"], keyof M>, V extends true ? unknown : V>[] : R["nullable"] extends true ? Payload<M, Extract<R["table"], keyof M>, V extends true ? unknown : V> | null : Payload<M, Extract<R["table"], keyof M>, V extends true ? unknown : V> : never;
+type RelationPayload<M extends AnyModels, R, V> = R extends RelationTypes ? R["kind"] extends "many" ? Payload<M, Extract<R["table"], keyof M>, V extends true ? unknown : V>[] : R["nullable"] extends true ? Payload<M, Extract<R["table"], keyof M>, V extends true ? unknown : V> | null : Payload<M, Extract<R["table"], keyof M>, V extends true ? unknown : V> : never;
 type IncludePart<M extends AnyModels, T extends keyof M, A> = A extends {
   readonly include: infer I;
 } ? { -readonly [R in keyof I & keyof Relations<M, T>]: RelationPayload<M, Relations<M, T>[R], I[R]>; } & CountPart<I> & ([keyof I & MeasureKey] extends [never] ? unknown : RelationMeasures<M, T, I>) : unknown;
@@ -177,13 +178,17 @@ type AggregateResult<M extends AnyModels, T extends keyof M, A> = A extends {
   readonly groupBy: readonly unknown[];
 } ? AggregateRow<M, T, A>[] : AggregateRow<M, T, A>;
 /** The row type returned for read arguments `A` on table `T`. */
-type Payload<M extends AnyModels, T extends keyof M, A> = Simplify<SelectPart<M, T, A> & IncludePart<M, T, A>>;
+type Payload<M extends AnyModels, T extends keyof M, A> = A extends {
+  readonly include: unknown;
+} ? Simplify<SelectPart<M, T, A> & IncludePart<M, T, A>> : A extends {
+  readonly select: readonly unknown[];
+} ? Simplify<SelectPart<M, T, A>> : Row<M, T>;
 //#endregion
 //#region src/core/spec.d.ts
 type ReadMethod = "findMany" | "findFirst" | "findUnique" | "findById" | "count" | "aggregate" | "exists" | "paginate";
 declare const resultType: unique symbol;
 /**
- * A read, described as plain JSON: build it with `sb.spec`, run it with
+ * A read, described as plain JSON: build it with `betterSupabase.spec`, run it with
  * `db.$run(spec)`, send it from a Server Component to the client, or hand it
  * to `/query` and `/next`. Args never carry a `signal`.
  */
@@ -268,7 +273,7 @@ interface ReadSetOptions<P extends ReadSetParamTypes> {
  *
  * ```ts
  * export const appChrome = defineReadSet(
- *   sb,
+ *   betterSupabase,
  *   'app_chrome',
  *   { params: { userId: 'uuid' } },
  *   (s, p) => ({
@@ -281,7 +286,7 @@ interface ReadSetOptions<P extends ReadSetParamTypes> {
  * `p` holds placeholders, not values: pass them straight into `where` (or
  * `in`), where the function reads them from its `p jsonb` argument.
  */
-declare function defineReadSet<M extends AnyModels, D, F extends AnyFunctions, E, const N extends string, const P extends ReadSetParamTypes, const S extends Readonly<Record<string, QuerySpec>>>(sb: BetterSupabase<M, D, F, E>, name: N, options: ReadSetOptions<P>, build: (specs: Specs<M, E>, params: ReadSetParams<P>) => S): ReadSet<N, P, S>;
+declare function defineReadSet<M extends AnyModels, D, F extends AnyFunctions, E, const N extends string, const P extends ReadSetParamTypes, const S extends Readonly<Record<string, QuerySpec>>>(betterSupabase: BetterSupabase<M, D, F, E>, name: N, options: ReadSetOptions<P>, build: (specs: Specs<M, E>, params: ReadSetParams<P>) => S): ReadSet<N, P, S>;
 declare function isReadSet(value: unknown): value is ReadSet;
 /** App keys of every table the set reads. */
 declare function readSetTables(set: ReadSet, meta?: SchemaMeta): string[];
@@ -384,7 +389,7 @@ type PageOf<M extends AnyModels, T extends keyof M, A> = A extends {
   readonly after: unknown;
 } ? CursorPage<Payload<M, T, A>> : OffsetPage<Payload<M, T, A>>;
 interface Repository<M extends AnyModels, T extends TableKey<M>, E = unknown> {
-  readonly $table: T;
+  readonly $tableName: T;
   readonly $meta: TableMeta;
   findMany<const A extends FindManyArgs<M, T> & FindExt<E, M, T>>(args?: A): AsyncResult<Payload<M, T, A>[]>;
   findFirst<const A extends FindFirstArgs<M, T> & FindExt<E, M, T>>(args?: A): AsyncResult<Payload<M, T, A> | null>;
@@ -470,7 +475,7 @@ interface DbHelpers<M extends AnyModels, F extends AnyFunctions, E, C> {
   $table<T extends TableKey<M>>(name: T): RepositoryOf<M, T, E>;
   /** Calls, waves, tables and time for everything run through this `db`. */
   $stats(): DbStats;
-  /** Runs a `QuerySpec` built with `sb.spec`. */
+  /** Runs a `QuerySpec` built with `betterSupabase.spec`. */
   $run<S extends QuerySpec<TableKey<M>>>(spec: S, options?: {
     readonly signal?: AbortSignal;
   }): AsyncResult<InferResult<S>>;
@@ -515,7 +520,7 @@ interface CacheTarget {
 /**
  * Invalidates cached reads after a mutation. First-party adapters:
  * `nextCache()` (Next.js cache tags) and `queryCache(client)` (TanStack
- * Query). Attach one with `sb.cache(adapter)`; prove custom ones with
+ * Query). Attach one with `betterSupabase.cache(adapter)`; prove custom ones with
  * `testCacheAdapter`.
  */
 interface CacheAdapter {
@@ -549,20 +554,20 @@ declare function postgrestExecutor(client: PostgrestClientLike): Executor;
 declare function explainPostgrest(op: Operation): PostgrestPlan;
 //#endregion
 //#region src/core/define.d.ts
-interface DefineSupabaseOptions {
+interface SupabaseOptions {
   /** Clock used by plugins (timestamps, soft delete). */
-  readonly now?: () => Date;
+  readonly now?: () => Temporal.Instant;
   /** Extra error mappers, run before plugin mappers. */
   readonly errors?: readonly ErrorMapper[];
   /** Receives errors from event handlers, hooks and cache adapters. Defaults to `console`. */
   readonly logger?: Logger;
-  /** RPCs that change tables, keyed by function name. Prefer `sb.defineRpc()`. */
+  /** RPCs that change tables, keyed by function name. Prefer `betterSupabase.defineRpc()`. */
   readonly rpc?: Readonly<Record<string, RpcDefinition>>;
-  /** Builds the error `.orThrow()` throws. Prefer `sb.mapError()`. */
+  /** Builds the error `.orThrow()` throws. Prefer `betterSupabase.mapError()`. */
   readonly throwAs?: ThrowMapper;
-  /** Validates verified JWT claims on the server. Prefer `sb.claims()`, which also types them. */
+  /** Validates verified JWT claims on the server. Prefer `betterSupabase.claims()`, which also types them. */
   readonly claims?: StandardSchemaV1;
-  /** Parses `user_metadata` into `session.profile`. Prefer `sb.userMetadata()`, which also types it. */
+  /** Parses `user_metadata` into `session.profile`. Prefer `betterSupabase.userMetadata()`, which also types it. */
   readonly userMetadata?: StandardSchemaV1;
   /**
    * PostgREST's `db-max-rows`: the most rows one read returns. An unbounded
@@ -593,8 +598,8 @@ declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F ext
   readonly schema: Schema<M, D, F>;
   readonly plugins: readonly AnyPlugin[];
   readonly events: EventHub;
-  readonly options: DefineSupabaseOptions;
-  constructor(schema: Schema<M, D, F>, plugins?: readonly AnyPlugin[], options?: DefineSupabaseOptions, events?: EventHub);
+  readonly options: SupabaseOptions;
+  constructor(schema: Schema<M, D, F>, plugins?: readonly AnyPlugin[], options?: SupabaseOptions, events?: EventHub);
   get meta(): SchemaMeta;
   /** The schema set by `claims()`; its output types `session.claims`. */
   get claimsSchema(): StandardSchemaV1<unknown, C> | undefined;
@@ -606,7 +611,7 @@ declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F ext
    * A token that fails it resolves to `{ kind: 'invalid', reason: 'claims' }`.
    *
    * ```ts
-   * const sb = defineSupabase(schema).claims(z.object({ tenant_id: z.uuid() }));
+   * const betterSupabase = defineSupabase(schema).claims(z.object({ tenant_id: z.uuid() }));
    * ```
    */
   claims<S extends StandardSchemaV1>(schema: S): BetterSupabase<M, D, F, E, StandardSchemaV1.InferOutput<S>, P>;
@@ -619,7 +624,7 @@ declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F ext
    * the verified claims, never from `profile`.
    *
    * ```ts
-   * const sb = defineSupabase(schema).userMetadata(z.object({ display_name: z.string() }));
+   * const betterSupabase = defineSupabase(schema).userMetadata(z.object({ display_name: z.string() }));
    * ```
    */
   userMetadata<S extends StandardSchemaV1>(schema: S): BetterSupabase<M, D, F, E, C, StandardSchemaV1.InferOutput<S>>;
@@ -629,13 +634,13 @@ declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F ext
    * Results themselves keep their `DbError`.
    *
    * ```ts
-   * const sb = defineSupabase(schema).mapError((error) => new AppError(error));
+   * const betterSupabase = defineSupabase(schema).mapError((error) => new AppError(error));
    * ```
    */
   mapError(mapper: (error: DbError) => unknown): BetterSupabase<M, D, F, E, C, P>;
   /**
    * Builds serializable `QuerySpec`s with the same arguments and result types
-   * as the repository: `sb.spec.customers.findMany({ select: ['id'] })`.
+   * as the repository: `betterSupabase.spec.customers.findMany({ select: ['id'] })`.
    */
   get spec(): Specs<M, E>;
   /** App keys of every table a spec reads; mutations of any of them make it stale. */
@@ -647,7 +652,7 @@ declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F ext
    * invalidate them after it succeeds.
    *
    * ```ts
-   * sb.defineRpc('archive_customer', { invalidates: ['customers', 'notes'] });
+   * betterSupabase.defineRpc('archive_customer', { invalidates: ['customers', 'notes'] });
    * ```
    */
   defineRpc(name: Extract<keyof F, string>, options: {
@@ -671,9 +676,9 @@ declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F ext
  * Creates the data-layer definition from the generated `schema`.
  *
  * ```ts
- * export const sb = defineSupabase(schema).use(timestamps()).use(softDelete());
+ * export const betterSupabase = defineSupabase(schema).use(timestamps()).use(softDelete());
  * ```
  */
-declare function defineSupabase<M extends AnyModels, D, F extends AnyFunctions>(schema: Schema<M, D, F>, options?: DefineSupabaseOptions): BetterSupabase<M, D, F>;
+declare function defineSupabase<M extends AnyModels, D, F extends AnyFunctions>(schema: Schema<M, D, F>, options?: SupabaseOptions): BetterSupabase<M, D, F>;
 //#endregion
-export { Specs as $, RpcOptions as A, ReadSet as B, FindExt as C, WhereInput as Ct, Repository as D, PageOf as E, EMPTY_STATS as F, ReadSetParams as G, ReadSetParamType as H, StatsRecorder as I, isReadSet as J, ReadSetResult as K, recordStats as L, UpsertArgs as M, WriteArgs as N, RepositoryOf as O, DbStats as P, ReadMethod as Q, SearchArgs as R, DeleteExt as S, SortDirection as St, OffsetPageArgs as T, ReadSetParamTypes as U, ReadSetOptions as V, ReadSetParamValue as W, InferResult as X, readSetTables as Y, QuerySpec as Z, CursorPage as _, OrderByInput as _t, defineSupabase as a, AggregateRow as at, DbHelpers as b, RelationMeasureArg as bt, postgrestExecutor as c, FieldFilter as ct, MemoryCache as d, IncludeArg as dt, TableSpecs as et, cacheTargetOf as f, IncludeArgs as ft, ConflictTarget as g, OrderByArg as gt, rpcCacheTargets as h, NumericMeasureArg as ht, RpcDefinition as i, AggregateResult as it, UpdateArgs as j, Returned as k, CacheAdapter as l, FindFirstArgs as lt, rowKey as m, MeasureKey as mt, ConnectOptions as n, specTables as nt, PostgrestClientLike as o, CountArg as ot, memoryCache as p, MeasureArg as pt, defineReadSet as q, DefineSupabaseOptions as r, AggregateArgs as rt, explainPostgrest as s, CountArgs as st, BetterSupabase as t, isQuerySpec as tt, CacheTarget as u, FindManyArgs as ut, CursorPageArgs as v, Payload as vt, OffsetPage as w, DeleteArgs as x, SelectArg as xt, Db as y, ReadArgs as yt, InferReadSetParams as z };
+export { Specs as $, RpcOptions as A, ReadSet as B, FindExt as C, WhereInput as Ct, Repository as D, PageOf as E, EMPTY_STATS as F, ReadSetParams as G, ReadSetParamType as H, StatsRecorder as I, isReadSet as J, ReadSetResult as K, recordStats as L, UpsertArgs as M, WriteArgs as N, RepositoryOf as O, DbStats as P, ReadMethod as Q, SearchArgs as R, DeleteExt as S, SortDirection as St, OffsetPageArgs as T, ReadSetParamTypes as U, ReadSetOptions as V, ReadSetParamValue as W, InferResult as X, readSetTables as Y, QuerySpec as Z, CursorPage as _, OrderByInput as _t, defineSupabase as a, AggregateRow as at, DbHelpers as b, RelationMeasureArg as bt, postgrestExecutor as c, FieldFilter as ct, MemoryCache as d, IncludeArg as dt, TableSpecs as et, cacheTargetOf as f, IncludeArgs as ft, ConflictTarget as g, OrderByArg as gt, rpcCacheTargets as h, NumericMeasureArg as ht, SupabaseOptions as i, AggregateResult as it, UpdateArgs as j, Returned as k, CacheAdapter as l, FindFirstArgs as lt, rowKey as m, MeasureKey as mt, ConnectOptions as n, specTables as nt, PostgrestClientLike as o, CountArg as ot, memoryCache as p, MeasureArg as pt, defineReadSet as q, RpcDefinition as r, AggregateArgs as rt, explainPostgrest as s, CountArgs as st, BetterSupabase as t, isQuerySpec as tt, CacheTarget as u, FindManyArgs as ut, CursorPageArgs as v, Payload as vt, OffsetPage as w, DeleteArgs as x, SelectArg as xt, Db as y, ReadArgs as yt, InferReadSetParams as z };

package/dist/edge/index.d.ts

@@ -1,7 +1,7 @@
-import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
-import { t as BetterSupabase } from "../define-e3zI4_4g.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-Dne1ARSa.js";
-import { i as ResourceRouteOptions } from "../resource-CgZa3YG_.js";
+import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { t as BetterSupabase } from "../define-CRS2MRV3.js";
+import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-DgIbdrt8.js";
+import { a as ResourceRouteOptions } from "../resource-BJcaIfxi.js";
 //#region src/edge/index.d.ts
 export interface CorsOptions {
   /** Allowed origins, or `*`. Defaults to `*`. */
@@ -17,27 +17,23 @@ export interface EdgeOptions extends ServerOptions {
   /** Include error details in problem responses. Defaults to `NODE_ENV === 'development'`. */
   readonly exposeErrors?: boolean;
 }
-export interface HandlerOptions extends GuardOptions {
-  /** Refresh an expired cookie session and send the new cookies. */
-  readonly refresh?: boolean;
-}
 export type EdgeHandler = (request: Request) => Promise<Response>;
 export type ResourceMap<M extends AnyModels> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T> | true; };
-export interface ResourcesOptions extends HandlerOptions {
+export interface ResourcesOptions extends MiddlewareOptions {
   /** Path before the resources, e.g. `/api` (Supabase: `/<function-name>`). */
   readonly basePath?: string;
 }
-export interface BetterEdge<M extends AnyModels, F extends AnyFunctions, E> extends BetterServer<M, F, E> {
+export interface BetterEdge<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
   /**
    * A fetch handler (`Deno.serve`, Workers `fetch`) running as the caller.
    * `Result`s become JSON or Problem Details; `undefined` becomes 204.
    */
-  handler(fn: (request: Request, ctx: ServerContext<M, F, E>) => unknown, options?: HandlerOptions): EdgeHandler;
+  handler(fn: (request: Request, ctx: ServerContext<M, F, E, C, P>) => unknown, options?: MiddlewareOptions): EdgeHandler;
   /** REST resources matching `createOpenApi`, e.g. `Deno.serve(bs.resources({ customers: true }))`. */
   resources(map: ResourceMap<M>, options?: ResourcesOptions): EdgeHandler;
 }
 export declare const SUPABASE_CORS_HEADERS: readonly string[];
 /** Fetch-handler integration for Supabase Edge Functions, Deno, Bun and Workers. */
-export declare function createEdge<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>, options?: EdgeOptions): BetterEdge<M, F, E>;
+export declare function createEdge<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: EdgeOptions): BetterEdge<M, F, E, C, P>;
 //#endregion
-export type { GuardOptions, ResourceRouteOptions };
+export type { GuardOptions, MiddlewareOptions, ResourceRouteOptions };

package/dist/edge/index.js

@@ -1,7 +1,7 @@
-import { n as dbError } from "../errors-Bl3rkOzo.js";
-import { a as problemResponse } from "../problem-BTkTtRV9.js";
-import { i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-DMcbQwfN.js";
-import { t as defineResource } from "../resource-BHEWmQJK.js";
+import { n as dbError } from "../errors-L0xK41y_.js";
+import { a as problemResponse } from "../problem-BihjPR0t.js";
+import { a as guard, i as defaultExpose, n as extendServer, s as respond, t as createServer } from "../server-BA75B0mT.js";
+import { t as defineResource } from "../resource-My_y-Syh.js";
 //#region src/edge/index.ts
 const SUPABASE_CORS_HEADERS = [
 	"authorization",
@@ -9,15 +9,11 @@ const SUPABASE_CORS_HEADERS = [
 	"apikey",
 	"content-type"
 ];
-function corsHeaders(request, cors) {
-	const origin = request.headers.get("origin");
+/** The CORS headers for a request's origin; the fixed ones are joined once. */
+function corsFor(cors) {
 	const allowed = cors.origin ?? "*";
-	let value;
-	if (allowed === "*") value = "*";
-	else if (origin && (typeof allowed === "string" ? [allowed] : allowed).includes(origin)) value = origin;
-	if (!value) return void 0;
-	return {
-		"access-control-allow-origin": value,
+	const origins = new Set(typeof allowed === "string" ? [allowed] : allowed);
+	const fixed = {
 		"access-control-allow-headers": (cors.headers ?? SUPABASE_CORS_HEADERS).join(", "),
 		"access-control-allow-methods": (cors.methods ?? [
 			"GET",
@@ -26,8 +22,21 @@ function corsHeaders(request, cors) {
 			"DELETE",
 			"OPTIONS"
 		]).join(", "),
-		...cors.maxAge === void 0 ? {} : { "access-control-max-age": String(cors.maxAge) },
-		...value === "*" ? {} : { vary: "origin" }
+		...cors.maxAge === void 0 ? {} : { "access-control-max-age": String(cors.maxAge) }
+	};
+	const any = {
+		"access-control-allow-origin": "*",
+		...fixed
+	};
+	return (request) => {
+		if (allowed === "*") return any;
+		const origin = request.headers.get("origin");
+		if (!origin || !origins.has(origin)) return;
+		return {
+			"access-control-allow-origin": origin,
+			...fixed,
+			vary: "origin"
+		};
 	};
 }
 function withHeaders(response, headers) {
@@ -41,20 +50,23 @@ function withHeaders(response, headers) {
 	return target;
 }
 /** Fetch-handler integration for Supabase Edge Functions, Deno, Bun and Workers. */
-function createEdge(sb, options = {}) {
-	const server = createServer(sb, options);
+function createEdge(betterSupabase, options = {}) {
+	const server = createServer(betterSupabase, options);
 	const expose = options.exposeErrors ?? defaultExpose();
 	const cors = options.cors === true ? {} : options.cors === false ? void 0 : options.cors;
-	const serve = (run, handlerOptions) => {
+	const corsHeaders = cors ? corsFor(cors) : void 0;
+	const serve = (run, handlerOptions, early) => {
 		return async (request) => {
-			const extra = cors ? corsHeaders(request, cors) : void 0;
+			const extra = corsHeaders?.(request);
 			if (cors && request.method === "OPTIONS") return new Response(null, {
 				status: 204,
 				headers: extra ?? {}
 			});
+			const answered = early?.(request);
+			if (answered) return extra ? withHeaders(answered, extra) : answered;
 			const ctx = await server.context(request, { refresh: handlerOptions.refresh ?? false });
 			const instance = new URL(request.url).pathname;
-			const denied = guard(ctx.auth, handlerOptions.allow, handlerOptions.aal);
+			const denied = guard(ctx.auth, handlerOptions.allow, handlerOptions.aal, handlerOptions.scopes);
 			let response;
 			try {
 				response = denied ? problemResponse(denied, {
@@ -83,19 +95,33 @@ function createEdge(sb, options = {}) {
 			const handlers = /* @__PURE__ */ new Map();
 			for (const [table, resource] of Object.entries(map)) {
 				if (!resource) continue;
-				handlers.set(table, defineResource(sb, table, resource === true ? {} : resource));
+				handlers.set(table, defineResource(betterSupabase, table, resource === true ? {} : resource));
 			}
-			return serve(async (request, ctx) => {
+			const routes = /* @__PURE__ */ new WeakMap();
+			const notFound = (request) => {
 				const { pathname } = new URL(request.url);
-				const instance = pathname;
 				const [table, id, extra] = (pathname.startsWith(`${base}/`) ? pathname.slice(base.length + 1) : void 0)?.split("/") ?? [];
 				const handler = table ? handlers.get(table) : void 0;
-				if (!handler || extra !== void 0 || id !== void 0 && !handler.keyParam) return problemResponse(dbError("not_found", `No route for ${pathname}`), { instance });
-				return handler.handle(request, ctx.db, id === void 0 || id === "" ? void 0 : decodeURIComponent(id), {
+				if (!handler || extra !== void 0 || id !== void 0 && !handler.keyParam) return problemResponse(dbError("not_found", `No route for ${pathname}`), { instance: pathname });
+				let key;
+				try {
+					key = id === void 0 || id === "" ? void 0 : decodeURIComponent(id);
+				} catch {
+					return problemResponse(dbError("invalid_request", `Malformed id in ${pathname}`), { instance: pathname });
+				}
+				routes.set(request, {
+					handler,
+					id: key,
+					instance: pathname
+				});
+			};
+			return serve((request, ctx) => {
+				const { handler, id, instance } = routes.get(request);
+				return handler.handle(request, ctx.db, id, {
 					instance,
 					expose
 				});
-			}, resourcesOptions);
+			}, resourcesOptions, notFound);
 		}
 	});
 }

package/dist/{entitlements-Dng-ctuT.d.ts → entitlements-Dm-FHpNH.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSession } from "./view-D1s0wa0T.js";
+import { t as AuthSession } from "./view-B64o81wp.js";
 //#region src/auth/entitlements.d.ts
 /**
  * One entry of the `memberships` claim, in PermDock's shape. PermDock strips
@@ -25,7 +25,7 @@ interface MembershipClaim {
 }
 /**
  * Entitlement keys of the `features` claim: the literal union when
- * `sb.claims(schema)` declares one (`z.enum([...])`), otherwise `string`.
+ * `betterSupabase.claims(schema)` declares one (`z.enum([...])`), otherwise `string`.
  */
 type EntitlementKey<C> = C extends {
   readonly features?: infer F;

package/dist/env/index.js

@@ -1,2 +1,204 @@
-import { a as parseEnv, i as loadEnv, n as EnvValidationError, o as publicEnv, r as envSchema, s as toServerEnv, t as ENV_VARIABLES } from "../env-BEToab0I.js";
+//#region src/env/index.ts
+const PREFIXES = [
+	"",
+	"NEXT_PUBLIC_",
+	"VITE_",
+	"PUBLIC_",
+	"EXPO_PUBLIC_",
+	"NUXT_PUBLIC_"
+];
+const ENV_VARIABLES = {
+	url: PREFIXES.map((prefix) => `${prefix}SUPABASE_URL`),
+	publishableKey: PREFIXES.flatMap((prefix) => [`${prefix}SUPABASE_PUBLISHABLE_KEY`, `${prefix}SUPABASE_PUBLISHABLE_DEFAULT_KEY`]),
+	secretKey: ["SUPABASE_SECRET_KEY"],
+	dbUrl: ["SUPABASE_DB_URL", "DATABASE_URL"],
+	jwksUrl: ["SUPABASE_JWKS_URL"],
+	readUrl: ["SUPABASE_READ_URL"]
+};
+const LOOPBACK = /^(localhost|127(?:\.\d{1,3}){3}|\[::1\])$/;
+const HOSTED = /^([a-z0-9]{20})\.supabase\.co$/;
+var EnvValidationError = class extends Error {
+	name = "EnvValidationError";
+	issues;
+	constructor(issues) {
+		super(`Invalid Supabase environment:\n${issues.map((issue) => `  - ${issue.variables[0] ?? "env"}: ${issue.message}`).join("\n")}`);
+		this.issues = issues;
+	}
+};
+function first(source, names) {
+	for (const name of names) {
+		const value = source[name]?.trim();
+		if (value) return value;
+	}
+}
+/** `SUPABASE_*_KEYS` JSON objects, as `@supabase/server` reads them. */
+function keySet(source, name, kind, issues) {
+	const raw = source[name];
+	if (!raw) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		parsed = void 0;
+	}
+	const entries = typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? Object.entries(parsed) : [];
+	if (entries.length === 0 || entries.some(([, value]) => typeof value !== "string")) {
+		issues.push({
+			variables: [name],
+			message: "must be a JSON object of key names to keys"
+		});
+		return;
+	}
+	const keys = {};
+	for (const [key, value] of entries) if (checkKey(value, kind, [name], issues)) keys[key] = value;
+	return keys;
+}
+function preferred(keys) {
+	if (!keys) return void 0;
+	return keys["default"] ?? Object.values(keys)[0];
+}
+function checkUrl(value, variables, issues) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		issues.push({
+			variables,
+			message: "is not a valid URL"
+		});
+		return;
+	}
+	if (url.protocol === "https:") return url;
+	if (url.protocol === "http:" && LOOPBACK.test(url.hostname)) return url;
+	issues.push({
+		variables,
+		message: "must use https (http is only allowed for localhost / 127.0.0.1 / [::1])"
+	});
+}
+function checkKey(value, kind, variables, issues) {
+	if (value.startsWith(`sb_${kind}_`)) return true;
+	if (value.startsWith("eyJ")) issues.push({
+		variables,
+		message: `is a legacy JWT key; use the new sb_${kind}_ key (Project Settings > API Keys)`
+	});
+	else if (value.startsWith(kind === "publishable" ? "sb_secret_" : "sb_publishable_")) issues.push({
+		variables,
+		message: kind === "publishable" ? "holds a secret key; never expose sb_secret_ keys as publishable" : "holds a publishable key, not a secret key"
+	});
+	else issues.push({
+		variables,
+		message: `must start with sb_${kind}_`
+	});
+	return false;
+}
+/**
+* Reads and validates Supabase settings. Accepts the `SUPABASE_`,
+* `NEXT_PUBLIC_`, `VITE_`, `PUBLIC_`, `EXPO_PUBLIC_` and `NUXT_PUBLIC_`
+* spellings. Issues name variables, never values.
+*/
+function parseEnv(source, options = {}) {
+	const issues = [];
+	const required = new Set(options.require ?? []);
+	const rawUrl = first(source, ENV_VARIABLES.url);
+	const url = rawUrl ? checkUrl(rawUrl, ENV_VARIABLES.url, issues) : void 0;
+	if (!rawUrl) issues.push({
+		variables: ENV_VARIABLES.url,
+		message: "is not set"
+	});
+	const publishableKeys = keySet(source, "SUPABASE_PUBLISHABLE_KEYS", "publishable", issues);
+	const singlePublishable = first(source, ENV_VARIABLES.publishableKey);
+	const publishableKey = singlePublishable ?? preferred(publishableKeys);
+	if (!publishableKey) issues.push({
+		variables: ENV_VARIABLES.publishableKey,
+		message: "is not set"
+	});
+	else if (singlePublishable) checkKey(publishableKey, "publishable", ENV_VARIABLES.publishableKey, issues);
+	const namedSecrets = keySet(source, "SUPABASE_SECRET_KEYS", "secret", issues);
+	const singleSecret = first(source, ENV_VARIABLES.secretKey);
+	const secretKey = singleSecret ?? preferred(namedSecrets);
+	if (singleSecret) checkKey(singleSecret, "secret", ENV_VARIABLES.secretKey, issues);
+	else if (!secretKey && required.has("secretKey")) issues.push({
+		variables: ENV_VARIABLES.secretKey,
+		message: "is not set"
+	});
+	const dbUrl = first(source, ENV_VARIABLES.dbUrl);
+	if (dbUrl && !/^postgres(ql)?:\/\//.test(dbUrl)) issues.push({
+		variables: ENV_VARIABLES.dbUrl,
+		message: "must be a postgres:// connection string"
+	});
+	else if (!dbUrl && required.has("dbUrl")) issues.push({
+		variables: ENV_VARIABLES.dbUrl,
+		message: "is not set"
+	});
+	const rawJwks = first(source, ENV_VARIABLES.jwksUrl);
+	const jwksOverride = rawJwks ? checkUrl(rawJwks, ENV_VARIABLES.jwksUrl, issues) : void 0;
+	const rawRead = first(source, ENV_VARIABLES.readUrl);
+	const readUrl = rawRead ? checkUrl(rawRead, ENV_VARIABLES.readUrl, issues) : void 0;
+	if (issues.length > 0 || !url || !publishableKey) return {
+		ok: false,
+		issues
+	};
+	const base = url.href.replace(/\/+$/, "");
+	const projectRef = HOSTED.exec(url.hostname)?.[1];
+	return {
+		ok: true,
+		env: {
+			url: base,
+			publishableKey,
+			jwksUrl: jwksOverride ?? new URL(`${base}/auth/v1/.well-known/jwks.json`),
+			...secretKey ? {
+				secretKey,
+				secretKeys: {
+					...namedSecrets,
+					default: secretKey
+				}
+			} : {},
+			...dbUrl ? { dbUrl } : {},
+			...projectRef ? { projectRef } : {},
+			...readUrl ? { readUrl: readUrl.href.replace(/\/+$/, "") } : {}
+		}
+	};
+}
+function processEnv() {
+	return globalThis.process?.env ?? {};
+}
+/** Like `parseEnv`, but throws `EnvValidationError`. Reads `process.env` by default. */
+function loadEnv(source = processEnv(), options = {}) {
+	const result = parseEnv(source, options);
+	if (!result.ok) throw new EnvValidationError(result.issues);
+	return result.env;
+}
+/** The env validator as a Standard Schema, for t3-env, framework config or any validator slot. */
+function envSchema(options = {}) {
+	return { "~standard": {
+		version: 1,
+		vendor: "better-supabase",
+		validate(value) {
+			if (typeof value !== "object" || value === null) return { issues: [{ message: "Expected an environment object" }] };
+			const result = parseEnv(value, options);
+			if (result.ok) return { value: result.env };
+			return { issues: result.issues.map((issue) => ({
+				message: `${issue.variables[0] ?? "env"} ${issue.message}`,
+				path: issue.variables.slice(0, 1)
+			})) };
+		}
+	} };
+}
+/** The parts that are safe in client bundles. */
+function publicEnv(env) {
+	return {
+		url: env.url,
+		publishableKey: env.publishableKey
+	};
+}
+/** Converts to `@supabase/server`'s `SupabaseEnv` (the `env` option of `withSupabase`). */
+function toServerEnv(env) {
+	return {
+		url: env.url,
+		publishableKeys: { default: env.publishableKey },
+		secretKeys: env.secretKeys ?? (env.secretKey ? { default: env.secretKey } : {}),
+		jwks: env.jwksUrl
+	};
+}
+//#endregion
 export { ENV_VARIABLES, EnvValidationError, envSchema, loadEnv, parseEnv, publicEnv, toServerEnv };

package/dist/{errors-Bl3rkOzo.js → errors-L0xK41y_.js}

@@ -41,7 +41,7 @@ function isDbError(value) {
 }
 /**
 * The `DbError` in a `DbError`, a `DbException`, or an error whose `cause`
-* is a `DbError` (what `sb.mapError()` mappers should set).
+* is a `DbError` (what `betterSupabase.mapError()` mappers should set).
 */
 function dbErrorOf(value) {
 	if (value instanceof DbException) return value.error;

package/dist/events/index.d.ts

@@ -1,2 +1,2 @@
-import { a as HttpMode, c as RowEventData, d as httpSink, f as isCloudEvent, i as ForwardOptions, l as forwardMutations, m as toHttp, n as CloudEventOptions, o as HttpSinkOptions, p as toCloudEvents, r as EventSink, s as ROW_EVENT_TYPES, t as CloudEvent, u as fromHttp } from "../index-Ciu5Xlml.js";
+import { a as HttpMode, c as RowEventData, d as httpSink, f as isCloudEvent, i as ForwardOptions, l as forwardMutations, m as toHttp, n as CloudEventOptions, o as HttpSinkOptions, p as toCloudEvents, r as EventSink, s as ROW_EVENT_TYPES, t as CloudEvent, u as fromHttp } from "../index-D5IfUIDh.js";
 export { CloudEvent, CloudEventOptions, EventSink, ForwardOptions, HttpMode, HttpSinkOptions, ROW_EVENT_TYPES, RowEventData, forwardMutations, fromHttp, httpSink, isCloudEvent, toCloudEvents, toHttp };