better-supabase 0.2.0 → 0.4.0

package/dist/{live-D8rV1Ldw.js → live-CdJBOc4f.js}

@@ -64,6 +64,10 @@ function join(client, topic, listener) {
 			left = true;
 			current.listeners.delete(listener);
 			if (current.listeners.size > 0) return;
+			await new Promise((resolve) => {
+				setTimeout(resolve, 0);
+			});
+			if (current.listeners.size > 0 || byTopic.get(topic) !== current) return;
 			byTopic.delete(topic);
 			await client.removeChannel(current.channel);
 		}
@@ -76,13 +80,13 @@ function join(client, topic, listener) {
 * table, so any number of them can run at once.
 *
 * ```ts
-* using live = liveQuery(sb, supabase, spec, { onChange: () => refetch() });
+* using live = liveQuery(betterSupabase, supabase, spec, { onChange: () => refetch() });
 * ```
 */
-function liveQuery(sb, client, spec, options) {
-	const touched = Array.isArray(spec) ? spec : sb.tablesOf(spec);
-	const tables = touched.filter((table) => sb.meta.realtime?.[table]);
-	const unwatched = touched.filter((table) => !sb.meta.realtime?.[table]);
+function liveQuery(betterSupabase, client, spec, options) {
+	const touched = Array.isArray(spec) ? spec : betterSupabase.tablesOf(spec);
+	const tables = touched.filter((table) => betterSupabase.meta.realtime?.[table]);
+	const unwatched = touched.filter((table) => !betterSupabase.meta.realtime?.[table]);
 	const debounceMs = options.debounceMs ?? 100;
 	const changed = /* @__PURE__ */ new Set();
 	let timer;
@@ -94,7 +98,7 @@ function liveQuery(sb, client, spec, options) {
 		changed.clear();
 		options.onChange(batch);
 	};
-	const memberships = tables.map((table) => join(client, liveTopic(sb.meta, table, options.tenant), () => {
+	const memberships = tables.map((table) => join(client, liveTopic(betterSupabase.meta, table, options.tenant), () => {
 		changed.add(table);
 		if (timer !== void 0) clearTimeout(timer);
 		timer = setTimeout(flush, debounceMs);
@@ -130,12 +134,12 @@ function liveQuery(sb, client, spec, options) {
 * Responses that arrive out of order are dropped.
 *
 * ```ts
-* using live = liveCount(sb, supabase, db, sb.spec.notes.count(), {
+* using live = liveCount(betterSupabase, supabase, db, betterSupabase.spec.notes.count(), {
 *   onCount: (count) => render(count),
 * });
 * ```
 */
-function liveCount(sb, client, db, spec, options) {
+function liveCount(betterSupabase, client, db, spec, options) {
 	let latest = 0;
 	let closed = false;
 	const refetch = () => {
@@ -146,7 +150,7 @@ function liveCount(sb, client, db, spec, options) {
 			else options.onError?.(result.error);
 		});
 	};
-	const live = liveQuery(sb, client, spec, {
+	const live = liveQuery(betterSupabase, client, spec, {
 		onChange: refetch,
 		...options.tenant === void 0 ? {} : { tenant: options.tenant },
 		...options.debounceMs === void 0 ? {} : { debounceMs: options.debounceMs },

package/dist/lookup-BaP5bI27.js

@@ -0,0 +1,18 @@
+//#region src/schema/lookup.ts
+const lookups = /* @__PURE__ */ new WeakMap();
+/** The cached lookup for a table; metadata is immutable after `defineSchema`. */
+function lookupOf(table) {
+	let lookup = lookups.get(table);
+	if (!lookup) {
+		const entries = Object.entries(table.columns);
+		lookup = {
+			entries,
+			byDb: new Map(entries.map((entry) => [entry[1].db, entry])),
+			keys: [table.primaryKey, ...Object.values(table.uniqueKeys)]
+		};
+		lookups.set(table, lookup);
+	}
+	return lookup;
+}
+//#endregion
+export { lookupOf as t };

package/dist/mcp/index.d.ts

@@ -1,13 +1,13 @@
-import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
-import { t as BetterSupabase } from "../define-e3zI4_4g.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-Dne1ARSa.js";
-import { i as ResourceRouteOptions } from "../resource-CgZa3YG_.js";
+import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { t as BetterSupabase } from "../define-CRS2MRV3.js";
+import { f as ServerContext, n as GuardOptions, p as ServerOptions, u as BetterServer } from "../respond-DgIbdrt8.js";
+import { a as ResourceRouteOptions } from "../resource-BJcaIfxi.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
-//#region src/mcp/index.d.ts
+//#region src/mcp/mcp.d.ts
 export declare const MCP_PROTOCOL_VERSION: string;
 type Json = Readonly<Record<string, unknown>>;
 /** MCP tool annotations (hints for clients, not guarantees). */
-export interface ToolAnnotations {
+interface ToolAnnotations {
   readonly title?: string;
   readonly readOnlyHint?: boolean;
   readonly destructiveHint?: boolean;
@@ -15,7 +15,7 @@ export interface ToolAnnotations {
   readonly openWorldHint?: boolean;
 }
 /** A tool as listed by `tools/list`. */
-export interface ToolInfo {
+interface ToolInfo {
   readonly name: string;
   readonly title?: string;
   readonly description?: string;
@@ -23,26 +23,26 @@ export interface ToolInfo {
   readonly outputSchema?: Json;
   readonly annotations?: ToolAnnotations;
 }
-export interface ToolContext<M extends AnyModels, F extends AnyFunctions, E> extends ServerContext<M, F, E> {
+interface ToolContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends ServerContext<M, F, E, C, P> {
   readonly request: Request;
   readonly signal: AbortSignal;
 }
-export interface McpTool<M extends AnyModels, F extends AnyFunctions, E> {
+interface McpTool<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
   readonly info: ToolInfo;
   /** Validates arguments; its output is what `run` receives. */
   readonly input?: StandardSchemaV1;
   /** Opaque data for the `authorize` and `visible` hooks. Never sent to clients. */
   readonly meta?: unknown;
-  run(args: never, ctx: ToolContext<M, F, E>): unknown;
+  run(args: never, ctx: ToolContext<M, F, E, C, P>): unknown;
 }
 /** What the `authorize` and `visible` hooks see of a tool. */
-export interface ToolRef {
+interface ToolRef {
   readonly info: ToolInfo;
   /** The tool's `meta`, e.g. a PermDock permission. `undefined` for table tools. */
   readonly meta: unknown;
 }
 /** The outcome of `authorize`. `scopes` turns a refusal into an OAuth challenge. */
-export type ToolDecision = {
+type ToolDecision = {
   readonly allowed: true;
 } | {
   readonly allowed: false;
@@ -50,7 +50,7 @@ export type ToolDecision = {
   /** OAuth scopes the call needs, sent in an `insufficient_scope` challenge. */
   readonly scopes?: readonly string[];
 };
-export interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E, I> {
+interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E, I, C = unknown, P = unknown> {
   readonly name: string;
   readonly title?: string;
   readonly description: string;
@@ -64,10 +64,10 @@ export interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E,
   readonly annotations?: ToolAnnotations;
   /** Opaque data for the `authorize` and `visible` hooks. Never sent to clients. */
   readonly meta?: unknown;
-  run(args: I, ctx: ToolContext<M, F, E>): unknown;
+  run(args: I, ctx: ToolContext<M, F, E, C, P>): unknown;
 }
-export type ToolResources<M extends AnyModels> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T> | true; };
-export interface McpOptions<M extends AnyModels, F extends AnyFunctions, E> extends ServerOptions, GuardOptions {
+type ToolResources<M extends AnyModels> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T> | true; };
+interface McpOptions<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends ServerOptions, GuardOptions {
   readonly name: string;
   readonly version: string;
   readonly title?: string;
@@ -75,7 +75,7 @@ export interface McpOptions<M extends AnyModels, F extends AnyFunctions, E> exte
   readonly instructions?: string;
   /** Tables exposed as tools: `<table>_list`, `_get`, `_create`, `_update`, `_delete`. */
   readonly resources?: ToolResources<M>;
-  readonly tools?: readonly McpTool<M, F, E>[];
+  readonly tools?: readonly McpTool<M, F, E, C, P>[];
   /**
    * Canonical URL of this MCP server (RFC 9728 `resource`). Defaults to the
    * request URL without query.
@@ -91,6 +91,13 @@ export interface McpOptions<M extends AnyModels, F extends AnyFunctions, E> exte
   readonly scopes?: readonly string[];
   /** Origins allowed to call the server (DNS rebinding protection). Defaults to any. */
   readonly allowedOrigins?: readonly string[];
+  /**
+   * Hostnames the `Host` header may name, without the port (DNS rebinding
+   * protection). List the production, preview and local hosts. Defaults to any.
+   */
+  readonly allowedHosts?: readonly string[];
+  /** A page that explains how to connect, published as RFC 9728 `resource_documentation`. */
+  readonly resourceDocumentation?: string;
   /** Custom jsonb types, as in `createOpenApi`. */
   readonly json?: Readonly<Record<string, unknown>>;
   /** Include internal error messages in tool results. Defaults to `NODE_ENV === 'development'`. */
@@ -101,27 +108,27 @@ export interface McpOptions<M extends AnyModels, F extends AnyFunctions, E> exte
    * validate in the repository). A refusal is a tool error; a refusal with
    * `scopes` is a 403 `insufficient_scope` challenge naming them.
    */
-  readonly authorize?: (ctx: ToolContext<M, F, E>, tool: ToolRef, args: unknown) => ToolDecision | Promise<ToolDecision>;
+  readonly authorize?: (ctx: ToolContext<M, F, E, C, P>, tool: ToolRef, args: unknown) => ToolDecision | Promise<ToolDecision>;
   /**
    * Whether the caller sees a tool in `tools/list`. A hidden tool is called
    * like an unknown one. Lists are cached per token (`cacheScope: 'private'`).
    */
-  readonly visible?: (ctx: ToolContext<M, F, E>, tool: ToolRef) => boolean | Promise<boolean>;
+  readonly visible?: (ctx: ToolContext<M, F, E, C, P>, tool: ToolRef) => boolean | Promise<boolean>;
 }
-export interface BetterMcp<M extends AnyModels, F extends AnyFunctions, E> extends BetterServer<M, F, E> {
+interface BetterMcp<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
   /** Everything in one handler: the MCP endpoint and `/.well-known/oauth-protected-resource`. */
   readonly fetch: (request: Request) => Promise<Response>;
   /** The Streamable HTTP endpoint (POST JSON-RPC). */
-  readonly handler: (request: Request) => Promise<Response>;
+  readonly endpoint: (request: Request) => Promise<Response>;
   /** RFC 9728 protected resource metadata. */
   metadata(request: Request): Response;
   readonly tools: readonly ToolInfo[];
   /** Adds a tool typed against this app's repositories. */
-  tool<I = Record<string, unknown>>(definition: ToolDefinition<M, F, E, I>): this;
+  tool<I = Record<string, unknown>>(definition: ToolDefinition<M, F, E, I, C, P>): this;
   /** Calls a tool directly, e.g. from tests or another transport. */
-  call(name: string, args: unknown, ctx: ToolContext<M, F, E>): Promise<ToolResult>;
+  call(name: string, args: unknown, ctx: ToolContext<M, F, E, C, P>): Promise<ToolResult>;
 }
-export interface ToolResult {
+interface ToolResult {
   readonly content: readonly {
     readonly type: "text";
     readonly text: string;
@@ -130,13 +137,13 @@ export interface ToolResult {
   readonly isError?: boolean;
 }
 /** A custom tool. Pass it in `createMcp({ tools: [...] })`. */
-export declare function defineTool<M extends AnyModels, F extends AnyFunctions, E, I = Record<string, unknown>>(definition: ToolDefinition<M, F, E, I>): McpTool<M, F, E>;
+export declare function defineTool<M extends AnyModels, F extends AnyFunctions, E, I = Record<string, unknown>, C = unknown, P = unknown>(definition: ToolDefinition<M, F, E, I, C, P>): McpTool<M, F, E, C, P>;
 /**
  * An MCP server (Streamable HTTP, stateless) whose tools run as the caller:
  * the Bearer token from the MCP client is verified and every query goes
  * through RLS. Answers 401 with RFC 9728 metadata so clients can sign in with
  * Supabase Auth's OAuth server.
  */
-export declare function createMcp<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>, options: McpOptions<M, F, E>): BetterMcp<M, F, E>;
+export declare function createMcp<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options: McpOptions<M, F, E, C, P>): BetterMcp<M, F, E, C, P>;
 //#endregion
-export type { GuardOptions, ResourceRouteOptions };
+export type { BetterMcp, GuardOptions, McpOptions, McpTool, ResourceRouteOptions, ToolAnnotations, ToolContext, ToolDecision, ToolDefinition, ToolInfo, ToolRef, ToolResources, ToolResult };

package/dist/mcp/index.js

@@ -1,12 +1,13 @@
-import { n as dbError } from "../errors-Bl3rkOzo.js";
-import { t as validate } from "../standard-FUi3Z3-7.js";
-import { o as toProblem } from "../problem-BTkTtRV9.js";
+import { n as dbError } from "../errors-L0xK41y_.js";
+import { t as base64ToText } from "../base64-D2gsioCY.js";
+import { t as validate } from "../standard-BRyBGTtp.js";
+import { o as toProblem } from "../problem-BihjPR0t.js";
 import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
-import { t as buildJsonSchema } from "../json-schema-BpYqkCKf.js";
-import { a as settle, c as withExtra, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-DMcbQwfN.js";
-import { t as defineResource } from "../resource-BHEWmQJK.js";
+import { t as buildJsonSchema } from "../json-schema-DP6V7cbr.js";
+import { a as guard, c as settle, i as defaultExpose, n as extendServer, r as withExtra, t as createServer } from "../server-BA75B0mT.js";
+import { t as defineResource } from "../resource-My_y-Syh.js";
 import { fromSupabaseUrl, unauthorizedResponse } from "@supabase/server/oauth-protected-resource";
-//#region src/mcp/index.ts
+//#region src/mcp/mcp.ts
 const MCP_PROTOCOL_VERSION = SPEC_PINS.mcp;
 const WELL_KNOWN = "/.well-known/oauth-protected-resource";
 /** Revisions before 2026-07-28 open with an `initialize` handshake. */
@@ -16,6 +17,16 @@ const LEGACY_VERSIONS = [
 	"2025-03-26"
 ];
 const SUPPORTED_VERSIONS = [MCP_PROTOCOL_VERSION, ...LEGACY_VERSIONS];
+/** The `Host` header's hostname is in the list; a missing or malformed header is not. */
+function hostAllowed(request, allowed) {
+	const host = request.headers.get("host");
+	if (!host) return false;
+	try {
+		return allowed.includes(new URL(`http://${host}`).hostname);
+	} catch {
+		return false;
+	}
+}
 /** A custom tool. Pass it in `createMcp({ tools: [...] })`. */
 function defineTool(definition) {
 	if (!/^[A-Za-z0-9_.-]{1,64}$/.test(definition.name)) throw new TypeError(`Invalid tool name "${definition.name}": use 1-64 letters, digits, "_", "-" or "."`);
@@ -67,15 +78,15 @@ const ANNOTATIONS = {
 		openWorldHint: false
 	}
 };
-function pageSchema(max) {
+function pageSchema(max, cursor) {
 	return {
 		type: "object",
 		properties: {
-			page: {
+			...cursor ? { after: { type: "string" } } : { page: {
 				type: "integer",
 				minimum: 1,
 				default: 1
-			},
+			} },
 			size: {
 				type: "integer",
 				minimum: 1,
@@ -99,7 +110,23 @@ function tableTools(resource, defs) {
 		required: [keyParam, ...Object.keys(more)],
 		additionalProperties: false
 	});
-	const page = {
+	const cursor = resource.pagination === "cursor";
+	const page = cursor ? {
+		type: "object",
+		properties: {
+			items: {
+				type: "array",
+				items: row
+			},
+			nextCursor: { type: ["string", "null"] },
+			hasMore: { type: "boolean" }
+		},
+		required: [
+			"items",
+			"nextCursor",
+			"hasMore"
+		]
+	} : {
 		type: "object",
 		properties: {
 			items: {
@@ -126,7 +153,7 @@ function tableTools(resource, defs) {
 	};
 	for (const operation of resource.operations) switch (operation) {
 		case "list": {
-			const { $schema: _, ...listSchema } = resource.list?.jsonSchema ?? pageSchema(resource.maxPageSize);
+			const { $schema: _, ...listSchema } = resource.list?.jsonSchema ?? pageSchema(resource.maxPageSize, cursor);
 			add("list", `List ${table} rows visible to the caller, one page at a time.`, listSchema, page);
 			break;
 		}
@@ -174,7 +201,7 @@ function headerName(value) {
 	const encoded = /^=\?base64\?(.*)\?=$/.exec(value)?.[1];
 	if (encoded === void 0) return value;
 	try {
-		return new TextDecoder().decode(Uint8Array.from(atob(encoded), (char) => char.charCodeAt(0)));
+		return base64ToText(encoded);
 	} catch {
 		return value;
 	}
@@ -204,17 +231,19 @@ function canonical(request) {
 * through RLS. Answers 401 with RFC 9728 metadata so clients can sign in with
 * Supabase Auth's OAuth server.
 */
-function createMcp(sb, options) {
-	const server = createServer(sb, options);
+function createMcp(betterSupabase, options) {
+	const server = createServer(betterSupabase, options);
 	const expose = options.exposeErrors ?? defaultExpose();
 	const defs = buildJsonSchema({
-		meta: sb.meta,
+		meta: betterSupabase.meta,
 		config: { json: options.json ?? {} }
 	})["$defs"];
 	const registry = /* @__PURE__ */ new Map();
+	let allTools;
 	const register = (entry) => {
 		if (registry.has(entry.info.name)) throw new TypeError(`Duplicate MCP tool "${entry.info.name}"`);
 		registry.set(entry.info.name, entry);
+		allTools = void 0;
 	};
 	const failure = (error) => textResult(toProblem(error, { expose }), true);
 	const refused = async (tool, args, ctx) => {
@@ -229,7 +258,7 @@ function createMcp(sb, options) {
 	const isVisible = async (tool, ctx) => !options.visible || options.visible(ctx, tool);
 	for (const [table, raw] of Object.entries(options.resources ?? {})) {
 		if (!raw) continue;
-		const resource = defineResource(sb, table, raw === true ? {} : raw);
+		const resource = defineResource(betterSupabase, table, raw === true ? {} : raw);
 		for (const { info, operation } of tableTools(resource, defs)) {
 			const ref = {
 				info,
@@ -275,8 +304,11 @@ function createMcp(sb, options) {
 		});
 	};
 	for (const tool of options.tools ?? []) addTool(tool);
-	const listTools = () => [...registry.values()].map((entry) => entry.info);
-	const visibleTools = async (ctx) => {
+	const listTools = () => allTools ??= [...registry.values()].map((entry) => entry.info);
+	/** Without a `visible` hook every caller sees the same list, built once. */
+	const visibleTools = async (context) => {
+		if (!options.visible) return listTools();
+		const ctx = context();
 		const entries = [...registry.values()];
 		const shown = await Promise.all(entries.map((entry) => isVisible(entry, ctx)));
 		return entries.filter((_, index) => shown[index]).map((e) => e.info);
@@ -349,9 +381,10 @@ function createMcp(sb, options) {
 			if (sent === null || headerName(sent) !== name) return mismatch(`Mcp-Name must be ${name}`);
 		}
 	};
-	const handler = async (request) => {
+	const endpoint = async (request) => {
 		const origin = request.headers.get("origin");
 		if (origin && options.allowedOrigins && !options.allowedOrigins.includes(origin)) return rpcError(null, INVALID_REQUEST, "Origin not allowed", 403);
+		if (options.allowedHosts && !hostAllowed(request, options.allowedHosts)) return rpcError(null, INVALID_REQUEST, "Host not allowed", 403);
 		if (request.method !== "POST") return new Response(null, {
 			status: 405,
 			headers: { allow: "POST" }
@@ -409,7 +442,7 @@ function createMcp(sb, options) {
 			}
 			case "ping": return modern ? notFound() : reply({});
 			case "tools/list": return reply({
-				tools: await visibleTools(toolContext()),
+				tools: await visibleTools(toolContext),
 				...modern ? {
 					ttlMs: LIST_TTL_MS,
 					cacheScope: "private"
@@ -432,18 +465,19 @@ function createMcp(sb, options) {
 		resource: resourceOf(request),
 		authorization_servers: [...authorizationServers()],
 		bearer_methods_supported: ["header"],
-		...scopes.length > 0 ? { scopes_supported: scopes } : {}
+		...scopes.length > 0 ? { scopes_supported: scopes } : {},
+		...options.resourceDocumentation === void 0 ? {} : { resource_documentation: options.resourceDocumentation }
 	}, { headers: { "access-control-allow-origin": "*" } });
 	const mcp = extendServer(server, {
 		get tools() {
-			return listTools();
+			return [...listTools()];
 		},
 		tool(definition) {
 			addTool(defineTool(definition));
 			return mcp;
 		},
 		call,
-		handler,
+		endpoint,
 		metadata,
 		fetch(request) {
 			const { pathname } = new URL(request.url);
@@ -454,7 +488,7 @@ function createMcp(sb, options) {
 					"access-control-allow-methods": "GET"
 				}
 			}) : metadata(request));
-			return handler(request);
+			return endpoint(request);
 		}
 	});
 	return mcp;

package/dist/{mfa-TVia554c.d.ts → mfa-C7MNQ1Ob.d.ts}

@@ -1,4 +1,4 @@
-import { p as DbError } from "./result-CTkCZ6JA.js";
+import { p as DbError } from "./result-CqEsbgYs.js";
 //#region src/auth/impersonation.d.ts
 /** The admin acting as the user, from the RFC 8693 `act` claim. */
 interface Impersonator {