better-supabase 0.3.0 → 0.4.0

package/dist/{stats-D78UQ8Yu.js → stats-C_YxA2r1.js}

@@ -1,10 +1,11 @@
-import { c as mapDbError, n as dbError } from "./errors-Bl3rkOzo.js";
-import { a as invalidRequest, n as simplifyOrFalse } from "./simplify-LakqK1vH.js";
+import { c as mapDbError, n as dbError } from "./errors-L0xK41y_.js";
+import { a as invalidRequest, n as simplifyOrFalse } from "./simplify-Cqvfr9dj.js";
 import { i as temporalText } from "./temporal-BwshQk0W.js";
-import { i as ok, n as err, o as toDbError } from "./result-DWXatkd6.js";
+import { i as ok, n as err, o as toDbError } from "./result-Bj6yt33D.js";
 //#region src/compile/postgrest.ts
 function scalar(value) {
 	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
 	const temporalValue = temporalText(value);
 	if (temporalValue !== void 0) return temporalValue;
 	if (typeof value === "number" || typeof value === "bigint" || typeof value === "boolean") return String(value);
@@ -275,11 +276,21 @@ function filterEmbed(alias, condition, inner) {
 		children: []
 	};
 }
+const columnTexts = /* @__PURE__ */ new WeakMap();
+/** The rendered column list, cached per (shared, immutable) column array. */
+function columnText(columns) {
+	let text = columnTexts.get(columns);
+	if (text === void 0) {
+		text = columns.map(({ alias, column, cast }) => {
+			const source = cast ? `${column}::${cast}` : column;
+			return alias === column ? source : `${alias}:${source}`;
+		}).join(",");
+		columnTexts.set(columns, text);
+	}
+	return text;
+}
 function columnList(columns) {
-	return columns.map(({ alias, column, cast }) => {
-		const source = cast ? `${column}::${cast}` : column;
-		return alias === column ? source : `${alias}:${source}`;
-	});
+	return columns.length > 0 ? [columnText(columns)] : [];
 }
 /** `key:column.sum()::text`, PostgREST's aggregate syntax (PostgREST 12+). */
 function measureList(measures) {
@@ -298,6 +309,7 @@ function renderEmbeds(embeds) {
 	});
 }
 function renderSelect(selection, embeds) {
+	if (!selection.aggregate && embeds.length === 0) return selection.columns.length > 0 ? columnText(selection.columns) : "*";
 	const parts = [
 		...columnList(selection.columns),
 		...selection.aggregate ? aggregateList(selection.aggregate) : [],
@@ -350,8 +362,21 @@ function compilePostgrest(op) {
 //#region src/core/postgrest-executor.ts
 function scope(client, schema) {
 	const loose = client;
-	return schema !== "public" && loose.schema ? loose.schema(schema) : loose;
+	if (schema === "public" || !loose.schema) return loose;
+	let schemas = scopedClients.get(client);
+	if (!schemas) {
+		schemas = /* @__PURE__ */ new Map();
+		scopedClients.set(client, schemas);
+	}
+	let scoped = schemas.get(schema);
+	if (!scoped) {
+		scoped = loose.schema(schema);
+		schemas.set(schema, scoped);
+	}
+	return scoped;
 }
+/** `schema()` builds a new client on every call; one per client and schema is enough. */
+const scopedClients = /* @__PURE__ */ new WeakMap();
 function fromTable(client, schema, table) {
 	return scope(client, schema).from(table);
 }

package/dist/storage/index.d.ts

@@ -2,5 +2,5 @@ import { b as PermdockBucketPolicy } from "../types-DONv9SHN.js";
 import { n as StoragePath, t as PathIn } from "../path-Cv__-OTj.js";
 import { t as PermdockCatalog } from "../permdock-sql-DImJULY-.js";
 import { n as TemplateValues, t as TemplateParams } from "../template-mbvlysOo.js";
-import { C as parseSize, S as fromStorageError, _ as TtlPreset, a as BucketDrift, b as UrlOptions, c as ReplaceOptions, d as StorageClient, f as StoredObject, g as TransformOptions, h as TTL, i as BucketConfig, l as ReplaceResult, m as SweepResult, n as Bucket, o as BucketPolicy, p as SweepOptions, r as BucketClient, s as ObjectTarget, t as ActualBucket, u as Reservation, v as UploadBody, x as defineBucket, y as UploadOptions } from "../index-CTTMS6_1.js";
-export { type ActualBucket, type Bucket, type BucketClient, type BucketConfig, type BucketDrift, type BucketPolicy, type ObjectTarget, type PathIn, type PermdockBucketPolicy, type PermdockCatalog, type ReplaceOptions, type ReplaceResult, type Reservation, type StorageClient, type StoragePath, type StoredObject, type SweepOptions, type SweepResult, TTL, type TemplateParams, type TemplateValues, type TransformOptions, type TtlPreset, type UploadBody, type UploadOptions, type UrlOptions, defineBucket, fromStorageError, parseSize };
+import { C as fromStorageError, S as defineBucket, _ as TransformOptions, a as BucketConnectOptions, b as UploadOptions, c as ObjectTarget, d as Reservation, f as StorageClient, g as TTL, h as SweepResult, i as BucketConfig, l as ReplaceOptions, m as SweepOptions, n as Bucket, o as BucketDrift, p as StoredObject, r as BucketClient, s as BucketPolicy, t as ActualBucket, u as ReplaceResult, v as TtlPreset, w as parseSize, x as UrlOptions, y as UploadBody } from "../index-528Ugmyp.js";
+export { type ActualBucket, type Bucket, type BucketClient, type BucketConfig, type BucketConnectOptions, type BucketDrift, type BucketPolicy, type ObjectTarget, type PathIn, type PermdockBucketPolicy, type PermdockCatalog, type ReplaceOptions, type ReplaceResult, type Reservation, type StorageClient, type StoragePath, type StoredObject, type SweepOptions, type SweepResult, TTL, type TemplateParams, type TemplateValues, type TransformOptions, type TtlPreset, type UploadBody, type UploadOptions, type UrlOptions, defineBucket, fromStorageError, parseSize };

package/dist/storage/index.js

@@ -1,9 +1,9 @@
-import { n as dbError, o as isDbError, t as DbException } from "../errors-Bl3rkOzo.js";
+import { n as dbError, o as isDbError, t as DbException } from "../errors-L0xK41y_.js";
 import { r as optionalTemporal } from "../temporal-BwshQk0W.js";
-import { n as temporalMissing } from "../temporal-required-CMxeSVPo.js";
-import { i as ok, n as err, o as toDbError, t as AsyncResult } from "../result-DWXatkd6.js";
-import { i as tenantClaimPaths } from "../claims-CoTobNC-.js";
-import { a as sqlIdent, i as slug, o as sqlString, r as parseTemplate, t as permdockCheck } from "../permdock-sql-Bta_G0v-.js";
+import { n as temporalMissing } from "../temporal-required-CBNHT6ni.js";
+import { i as ok, n as err, o as toDbError, t as AsyncResult } from "../result-Bj6yt33D.js";
+import { i as tenantClaimPaths } from "../claims-BAf6c7is.js";
+import { a as sqlIdent, i as slug, o as sqlString, r as parseTemplate, t as permdockCheck } from "../permdock-sql-C4KFzLc9.js";
 //#region src/storage/bucket.ts
 /** Storage operations that list objects; every other `select` is a read. */
 const LIST_OPERATIONS = [
@@ -309,7 +309,7 @@ function defineBucket(config) {
 			});
 			return issues;
 		},
-		connect: (client) => connectBucket(bucket, client, resolve)
+		connect: (client, options) => connectBucket(bucket, client, resolve, options)
 	};
 	return bucket;
 }
@@ -328,8 +328,9 @@ function ttlSeconds(ttl) {
 function isErrorResult(value) {
 	return typeof value === "object" && value !== null && value.ok === false && "error" in value;
 }
-function connectBucket(bucket, client, resolve) {
+function connectBucket(bucket, client, resolve, connectOptions = {}) {
 	const api = () => client.storage.from(bucket.id);
+	const signed = connectOptions.cacheSignedUrls ? /* @__PURE__ */ new Map() : void 0;
 	const run = (fn) => AsyncResult.from(async () => {
 		try {
 			const { data, error } = await fn();
@@ -398,10 +399,27 @@ function connectBucket(bucket, client, resolve) {
 	}));
 	const signedUrl = (target, options) => AsyncResult.from(async () => {
 		const path = resolve(target);
-		return run(() => api().createSignedUrl(path, ttlSeconds(options?.ttl), {
+		const ttl = ttlSeconds(options?.ttl);
+		const key = signed ? JSON.stringify([
+			path,
+			ttl,
+			options?.transform,
+			options?.download
+		]) : "";
+		const cached = signed?.get(key);
+		if (cached && cached.until > Date.now()) return ok(cached.url);
+		const result = await run(() => api().createSignedUrl(path, ttl, {
 			...download(options?.download),
 			...options?.transform ? { transform: { ...options.transform } } : {}
 		})).map((data) => data.signedUrl);
+		if (signed && result.ok) {
+			const margin = Math.min(60, ttl / 10);
+			signed.set(key, {
+				url: result.data,
+				until: Date.now() + (ttl - margin) * 1e3
+			});
+		}
+		return result;
 	});
 	return {
 		bucket,

package/dist/{tables-Dhha3BXM.js → tables-Cb-3_VWc.js}

@@ -42,6 +42,20 @@ function visitCondition(condition, tables) {
 * followed through chains of cascades.
 */
 function invalidationTargets(meta, table) {
+	let byTable = targetsByMeta.get(meta);
+	if (!byTable) {
+		byTable = /* @__PURE__ */ new Map();
+		targetsByMeta.set(meta, byTable);
+	}
+	let targets = byTable.get(table);
+	if (!targets) {
+		targets = Object.freeze(computeTargets(meta, table));
+		byTable.set(table, targets);
+	}
+	return targets;
+}
+const targetsByMeta = /* @__PURE__ */ new WeakMap();
+function computeTargets(meta, table) {
 	const targets = /* @__PURE__ */ new Set([table]);
 	const queue = [table];
 	for (let key = queue.shift(); key !== void 0; key = queue.shift()) {

package/dist/{temporal-required-CMxeSVPo.js → temporal-required-CBNHT6ni.js}

@@ -1,4 +1,4 @@
-import { n as dbError, t as DbException } from "./errors-Bl3rkOzo.js";
+import { n as dbError, t as DbException } from "./errors-L0xK41y_.js";
 import { r as optionalTemporal, t as TEMPORAL_MISSING } from "./temporal-BwshQk0W.js";
 //#region src/core/temporal-required.ts
 /** The error for a runtime without Temporal, naming the polyfill to load. */

package/dist/testing/index.d.ts

@@ -1,13 +1,12 @@
 import { A as SchemaMeta, N as TableKey, R as Update, g as Insert, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
-import { r as Executor } from "../executor-DynmIWhq.js";
-import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-DUbydmJa.js";
-import { h as RequestContext, n as AnyPlugin } from "../plugin-DVRB8qNE.js";
+import { r as Executor } from "../executor-B5IoUxLE.js";
+import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-CRS2MRV3.js";
+import { h as RequestContext, n as AnyPlugin } from "../plugin-bNhvJwRh.js";
 import { b as ResolvedConfig, d as Generator, f as GeneratorInput } from "../config-C1CYcm6o.js";
-import "../index-Cf-D2jk1.js";
-import { t as SqlClient } from "../executor-B26lgbHD.js";
-import { r as Postgres } from "../pool-B9qsLyFR.js";
-import { n as AuthResolver } from "../resolve-BRciX2jK.js";
-import { r as EventSink, t as CloudEvent } from "../index-GV77NpRP.js";
+import { t as SqlClient } from "../executor-CZ7ImRiD.js";
+import { t as BetterPostgres } from "../pool-DFwEQwmN.js";
+import { n as AuthResolver } from "../resolve-BAqQcwMW.js";
+import { r as EventSink, t as CloudEvent } from "../index-D5IfUIDh.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { webcrypto } from "node:crypto";
 //#region src/testing/jwt.d.ts
@@ -26,7 +25,7 @@ interface TestJwtClaims {
 export declare function signTestJwt(secret: string, claims: TestJwtClaims): Promise<string>;
 /**
  * Accepts `signTestJwt` tokens as users, for API servers tested against the
- * local stack: `createServer(sb, { auth: { resolvers: [localAuth(secret)] } })`.
+ * local stack: `createServer(betterSupabase, { auth: { resolvers: [localAuth(secret)] } })`.
  * Tokens that are not HS256-signed with `secret` fall through. Test-only.
  */
 export declare function localAuth(secret: string): AuthResolver;
@@ -82,7 +81,7 @@ interface LocalStack {
   /** Service-role key for `expectTenantIsolation`; defaults to `$SUPABASE_SECRET_KEY`. */
   readonly secretKey?: string;
   /** Enables `sql`: the same user over direct Postgres. */
-  readonly postgres?: Postgres;
+  readonly postgres?: BetterPostgres;
 }
 interface TestUser<M extends AnyModels, F extends AnyFunctions, E> {
   readonly token: string;
@@ -101,11 +100,11 @@ interface TestUser<M extends AnyModels, F extends AnyFunctions, E> {
  * still uses the shared JWT secret.
  *
  * ```ts
- * const alice = await asUser(sb, { sub: aliceId, tenant_id: acme });
+ * const alice = await asUser(betterSupabase, { sub: aliceId, tenant_id: acme });
  * expect(await alice.db.customers.count().orThrow()).toBe(3);
  * ```
  */
-export declare function asUser<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>, claims: TestJwtClaims, stack?: LocalStack): Promise<TestUser<M, F, E>>;
+export declare function asUser<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>, claims: TestJwtClaims, stack?: LocalStack): Promise<TestUser<M, F, E>>;
 //#endregion
 //#region src/testing/budget.d.ts
 /** The part of a Playwright `Response` the budget check reads. */
@@ -148,7 +147,7 @@ interface MeasuredRender {
 /**
  * Measures every document and RSC navigation response during `during` and
  * fails when one render makes more database calls or waves than allowed.
- * Needs `createNext(sb, { debug })` and `next.debugRoute()` in the app.
+ * Needs `createNext(betterSupabase, { debug })` and `bs.debugRoute()` in the app.
  */
 export declare function expectDbBudget(page: BudgetPage, expectation: DbBudgetExpectation): Promise<readonly MeasuredRender[]>;
 //#endregion
@@ -171,7 +170,7 @@ export declare class ConformanceError extends Error {
 type AnySupabase = BetterSupabase<any, any, any, any>;
 interface TestExecutorOptions {
   /** A definition whose schema matches the executor's database. Install no plugins. */
-  readonly sb: AnySupabase;
+  readonly betterSupabase: AnySupabase;
   /** App key of a table with rows the executor can read. Defaults to the first table. */
   readonly table?: string;
   /** A row to insert and delete again, to check writes. Skips write checks when omitted. */
@@ -183,7 +182,7 @@ interface TestExecutorOptions {
  * than thrown, and (with `create`) a write round trip.
  *
  * ```ts
- * it('conforms', () => testExecutor(myExecutor, { sb, table: 'tags', create: { name: 'x' } }));
+ * it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
  * ```
  */
 export declare function testExecutor(executor: Executor, options: TestExecutorOptions): Promise<ConformanceReport>;
@@ -228,7 +227,7 @@ interface TestGeneratorOptions {
 export declare function testGenerator(generator: Generator, options: TestGeneratorOptions): Promise<ConformanceReport>;
 interface TestPluginOptions {
   /** The definition without this plugin. */
-  readonly sb: AnySupabase;
+  readonly betterSupabase: AnySupabase;
   /** Table to exercise. Defaults to the first table. */
   readonly table?: string;
   /** Context the plugin needs, such as `{ tenant }` for `tenant()`. */
@@ -273,12 +272,12 @@ interface TenantIsolationOptions<M extends AnyModels> {
 /**
  * Checks row-level security between two tenants against a running stack: for
  * each table, a user of one tenant must not select, insert, update or delete
- * the other tenant's rows. Runs without `sb`'s plugins, so the `tenant()`
+ * the other tenant's rows. Runs without `betterSupabase`'s plugins, so the `tenant()`
  * plugin can't hide a missing policy. Throws a `ConformanceError` naming each
  * table and command that leaks; removes every row it created.
  *
  * ```ts
- * await expectTenantIsolation(sb, {
+ * await expectTenantIsolation(betterSupabase, {
  *   tenants: [
  *     { id: ACME, claims: { sub: alice, tenant_id: ACME } },
  *     { id: GLOBEX, claims: { sub: bob, tenant_id: GLOBEX } },
@@ -292,7 +291,7 @@ interface TenantIsolationOptions<M extends AnyModels> {
  * });
  * ```
  */
-export declare function expectTenantIsolation<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>, options: TenantIsolationOptions<M>): Promise<ConformanceReport>;
+export declare function expectTenantIsolation<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>, options: TenantIsolationOptions<M>): Promise<ConformanceReport>;
 //#endregion
 //#region src/testing/seed.d.ts
 /** Named rows per table, in app casing: `{ customers: { acme: { ... } } }`. */
@@ -316,12 +315,12 @@ export declare function isSeed(value: unknown): value is Seed<unknown>;
  * casing and Insert types; `better-supabase seed` renders them to SQL.
  *
  * ```ts
- * export const seed = defineSeed(sb, {
+ * export const seed = defineSeed(betterSupabase, {
  *   organizations: { acme: { id: ACME, name: 'Acme' } },
  *   customers: { first: { organizationId: ACME, name: 'First customer' } },
  * });
  * ```
  */
-export declare function defineSeed<M extends AnyModels, D, F extends AnyFunctions, E, const S extends SeedFixtures<M>>(sb: BetterSupabase<M, D, F, E>, fixtures: S & ExactSeed<M, S>): Seed<S>;
+export declare function defineSeed<M extends AnyModels, D, F extends AnyFunctions, E, const S extends SeedFixtures<M>>(betterSupabase: BetterSupabase<M, D, F, E>, fixtures: S & ExactSeed<M, S>): Seed<S>;
 //#endregion
 export type { BudgetPage, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, Seed, SeedFixtures, SigningJwk, TenantIsolationOptions, TestAuthResolverOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestJwtClaims, TestPluginOptions, TestSigner, TestUser };

package/dist/testing/index.js

@@ -1,20 +1,20 @@
-import { n as dbError } from "../errors-Bl3rkOzo.js";
+import { n as dbError } from "../errors-L0xK41y_.js";
 import { i as temporalText } from "../temporal-BwshQk0W.js";
-import { t as temporal } from "../temporal-required-CMxeSVPo.js";
-import { i as ok } from "../result-DWXatkd6.js";
-import { t as BetterSupabase } from "../define-DF341GDj.js";
-import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-CQeB1eSf.js";
-import { r as resolveConfig } from "../config-Be4GwsqI.js";
+import { t as temporal } from "../temporal-required-CBNHT6ni.js";
+import { i as ok } from "../result-Bj6yt33D.js";
+import { t as BetterSupabase } from "../define-Bh0AqTik.js";
+import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-D2gsioCY.js";
+import { r as resolveConfig } from "../config-BpxDfnbg.js";
 import { t as isList } from "../guards-BnzDvFrz.js";
 import { ENV_VARIABLES } from "../env/index.js";
-import { n as postgresExecutor } from "../executor-C57jx2pn.js";
+import { n as postgresExecutor } from "../executor-CVt6dD0B.js";
 import { toCloudEvents } from "../events/index.js";
 import { createClient } from "@supabase/supabase-js";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 //#region src/testing/jwt.ts
-const encoder = new TextEncoder();
+const encoder = /* @__PURE__ */ new TextEncoder();
 /**
 * Signs an HS256 access token the local Supabase stack accepts. Test-only:
 * production tokens come from Supabase Auth.
@@ -44,7 +44,7 @@ async function signTestJwt(secret, claims) {
 }
 /**
 * Accepts `signTestJwt` tokens as users, for API servers tested against the
-* local stack: `createServer(sb, { auth: { resolvers: [localAuth(secret)] } })`.
+* local stack: `createServer(betterSupabase, { auth: { resolvers: [localAuth(secret)] } })`.
 * Tokens that are not HS256-signed with `secret` fall through. Test-only.
 */
 function localAuth(secret) {
@@ -198,11 +198,11 @@ async function signFor(stack, url, claims) {
 * still uses the shared JWT secret.
 *
 * ```ts
-* const alice = await asUser(sb, { sub: aliceId, tenant_id: acme });
+* const alice = await asUser(betterSupabase, { sub: aliceId, tenant_id: acme });
 * expect(await alice.db.customers.count().orThrow()).toBe(3);
 * ```
 */
-async function asUser(sb, claims, stack = {}) {
+async function asUser(betterSupabase, claims, stack = {}) {
 	const url = stack.url ?? env$1(...ENV_VARIABLES.url) ?? "http://127.0.0.1:54321";
 	const publishableKey = stack.publishableKey ?? env$1(...ENV_VARIABLES.publishableKey, "SUPABASE_ANON_KEY");
 	if (!publishableKey) throw new TypeError("asUser needs publishableKey or $SUPABASE_PUBLISHABLE_KEY. Run `better-supabase env` to write it to .env.local.");
@@ -225,8 +225,8 @@ async function asUser(sb, claims, stack = {}) {
 		token,
 		claims: full,
 		supabase,
-		db: sb.connect(supabase, context),
-		sql: stack.postgres ? sb.connect(postgresExecutor(stack.postgres.asUser(full)), context) : void 0
+		db: betterSupabase.connect(supabase, context),
+		sql: stack.postgres ? betterSupabase.connect(postgresExecutor(stack.postgres.asUser(full)), context) : void 0
 	};
 }
 //#endregion
@@ -246,7 +246,7 @@ function settle(promise, ms) {
 /**
 * Measures every document and RSC navigation response during `during` and
 * fails when one render makes more database calls or waves than allowed.
-* Needs `createNext(sb, { debug })` and `next.debugRoute()` in the app.
+* Needs `createNext(betterSupabase, { debug })` and `bs.debugRoute()` in the app.
 */
 async function expectDbBudget(page, expectation) {
 	const seen = [];
@@ -267,12 +267,12 @@ async function expectDbBudget(page, expectation) {
 	} finally {
 		page.off("response", listener);
 	}
-	if (seen.length === 0) throw new Error("expectDbBudget: no response carried x-bs-request-id. Enable createNext(sb, { debug: { enabled: true } }) and run the proxy.");
+	if (seen.length === 0) throw new Error("expectDbBudget: no response carried x-bs-request-id. Enable createNext(betterSupabase, { debug: { enabled: true } }) and run the proxy.");
 	await Promise.all(seen.map(({ response }) => settle(response.finished(), expectation.timeoutMs ?? 1e4)));
 	const renders = [];
 	for (const { response, id, url } of seen) {
 		const reply = await page.request.get(url);
-		if (!reply.ok()) throw new Error(`expectDbBudget: ${url} answered ${reply.status()}. Mount next.debugRoute() at that path.`);
+		if (!reply.ok()) throw new Error(`expectDbBudget: ${url} answered ${reply.status()}. Mount bs.debugRoute() at that path.`);
 		renders.push({
 			url: response.url(),
 			requestId: id,
@@ -348,17 +348,17 @@ const recorder = (ops) => ({
 		}));
 	}
 });
-/** The operation `run` sends to the executor, built by `sb` without touching a database. */
-async function captureOp(sb, run) {
+/** The operation `run` sends to the executor, built by `betterSupabase` without touching a database. */
+async function captureOp(betterSupabase, run) {
 	const ops = [];
-	await run(sb.connect(recorder(ops)));
+	await run(betterSupabase.connect(recorder(ops)));
 	const [op] = ops;
 	if (!op) throw new Error("the repository call did not reach the executor");
 	return op;
 }
-function tableKey(sb, table) {
-	const key = table ?? Object.keys(sb.meta.tables)[0];
-	if (!key || !(key in sb.meta.tables)) throw new TypeError(`better-supabase: unknown table "${String(key)}"`);
+function tableKey(betterSupabase, table) {
+	const key = table ?? Object.keys(betterSupabase.meta.tables)[0];
+	if (!key || !(key in betterSupabase.meta.tables)) throw new TypeError(`better-supabase: unknown table "${String(key)}"`);
 	return key;
 }
 const hasName = (subject) => ["has a name", () => {
@@ -370,14 +370,14 @@ const hasName = (subject) => ["has a name", () => {
 * than thrown, and (with `create`) a write round trip.
 *
 * ```ts
-* it('conforms', () => testExecutor(myExecutor, { sb, table: 'tags', create: { name: 'x' } }));
+* it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
 * ```
 */
 function testExecutor(executor, options) {
-	const { sb } = options;
-	const table = tableKey(sb, options.table);
+	const { betterSupabase } = options;
+	const table = tableKey(betterSupabase, options.table);
 	const context = { errorMappers: [] };
-	const read = () => captureOp(sb, (db) => db[table]["findMany"]({ limit: 2 }));
+	const read = () => captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 2 }));
 	const create = options.create;
 	return conform(`Executor "${executor.name}"`, [
 		hasName(executor),
@@ -396,7 +396,7 @@ function testExecutor(executor, options) {
 			}
 		}],
 		["counts rows", async () => {
-			const op = await captureOp(sb, (db) => db[table]["count"]());
+			const op = await captureOp(betterSupabase, (db) => db[table]["count"]());
 			const result = await executor.execute(op, context);
 			expect(result.ok, `count failed: ${result.ok ? "" : result.error.message}`);
 			expect(typeof result.data.count === "number" && result.data.count >= 0, "count must be a number");
@@ -444,7 +444,7 @@ function testExecutor(executor, options) {
 		}],
 		executor.batch && ["batch returns one result per operation, in order", async () => {
 			const rows = await read();
-			const count = await captureOp(sb, (db) => db[table]["count"]());
+			const count = await captureOp(betterSupabase, (db) => db[table]["count"]());
 			const missing = {
 				...rows,
 				table: {
@@ -464,12 +464,12 @@ function testExecutor(executor, options) {
 			expect(third?.ok === false, "a failing operation must fail on its own, as a result");
 		}],
 		create && ["round-trips a write", async () => {
-			const repository = sb.connect(executor)[table];
+			const repository = betterSupabase.connect(executor)[table];
 			const created = await repository["create"](create);
 			expect(created.ok, `create failed: ${JSON.stringify(created.error)}`);
 			const row = created.data;
 			for (const [key, value] of Object.entries(create)) expect(same(row[key], value), `created row has ${key} = ${JSON.stringify(row[key])}`);
-			const [primary] = sb.meta.tables[table].primaryKey;
+			const [primary] = betterSupabase.meta.tables[table].primaryKey;
 			expect(primary, "write checks need a table with a primary key");
 			const removed = await repository["delete"](row[primary]);
 			expect(removed.ok, `delete failed: ${JSON.stringify(removed.error)}`);
@@ -643,12 +643,12 @@ function testGenerator(generator, options) {
 * results intact when it wraps them.
 */
 function testPlugin(plugin, options) {
-	const { sb } = options;
-	const table = tableKey(sb, options.table);
+	const { betterSupabase } = options;
+	const table = tableKey(betterSupabase, options.table);
 	const context = options.context ?? {};
 	const hook = (op) => ({
 		table: op.table,
-		schema: sb.meta,
+		schema: betterSupabase.meta,
 		context,
 		options: {},
 		now: () => temporal().Instant.fromEpochMilliseconds(0)
@@ -660,18 +660,18 @@ function testPlugin(plugin, options) {
 			expect(plugin.apiVersion === 1, `apiVersion is ${String(plugin.apiVersion)}`);
 		}],
 		["installs and builds repositories", () => {
-			const db = sb.use(plugin).connect(recorder([]), context);
-			for (const key of Object.keys(sb.meta.tables)) expect(db[key], `db.${key} is missing`);
+			const db = betterSupabase.use(plugin).connect(recorder([]), context);
+			for (const key of Object.keys(betterSupabase.meta.tables)) expect(db[key], `db.${key} is missing`);
 		}],
 		plugin.transformQuery && ["transformQuery is pure and deterministic", async () => {
-			const op = await captureOp(sb, (db) => db[table]["findMany"]({ limit: 1 }));
+			const op = await captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 1 }));
 			const first = plugin.transformQuery(frozenCopy(op), hook(op));
 			const second = plugin.transformQuery(frozenCopy(op), hook(op));
 			expect(typeof first === "object" && first !== null && first.kind === op.kind, "must return an operation of the same kind");
 			expect(same(first, second), "two calls with the same input differ");
 		}],
 		plugin.beforeMutation && create && ["beforeMutation is pure and deterministic", async () => {
-			const op = await captureOp(sb, (db) => db[table]["create"](create));
+			const op = await captureOp(betterSupabase, (db) => db[table]["create"](create));
 			if (op.kind === "select") throw new Violation("create did not produce a mutation");
 			const first = await plugin.beforeMutation(frozenCopy(op), hook(op));
 			const second = await plugin.beforeMutation(frozenCopy(op), hook(op));
@@ -679,7 +679,7 @@ function testPlugin(plugin, options) {
 			expect(same(first, second), "two calls with the same input differ");
 		}],
 		plugin.wrapExecutor && ["wrapExecutor keeps results intact", async () => {
-			const op = await captureOp(sb, (db) => db[table]["findMany"]({ limit: 1 }));
+			const op = await captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 1 }));
 			const data = {
 				rows: [{ marker: "conformance" }],
 				count: 1
@@ -723,12 +723,12 @@ function env(names) {
 /**
 * Checks row-level security between two tenants against a running stack: for
 * each table, a user of one tenant must not select, insert, update or delete
-* the other tenant's rows. Runs without `sb`'s plugins, so the `tenant()`
+* the other tenant's rows. Runs without `betterSupabase`'s plugins, so the `tenant()`
 * plugin can't hide a missing policy. Throws a `ConformanceError` naming each
 * table and command that leaks; removes every row it created.
 *
 * ```ts
-* await expectTenantIsolation(sb, {
+* await expectTenantIsolation(betterSupabase, {
 *   tenants: [
 *     { id: ACME, claims: { sub: alice, tenant_id: ACME } },
 *     { id: GLOBEX, claims: { sub: bob, tenant_id: GLOBEX } },
@@ -742,9 +742,9 @@ function env(names) {
 * });
 * ```
 */
-async function expectTenantIsolation(sb, options) {
+async function expectTenantIsolation(betterSupabase, options) {
 	const stack = options.stack ?? {};
-	const bare = new BetterSupabase(sb.schema);
+	const bare = new BetterSupabase(betterSupabase.schema);
 	const url = stack.url ?? env(ENV_VARIABLES.url) ?? "http://127.0.0.1:54321";
 	const secretKey = stack.secretKey ?? env(ENV_VARIABLES.secretKey);
 	if (!secretKey) throw new TypeError("expectTenantIsolation needs stack.secretKey or $SUPABASE_SECRET_KEY to seed rows.");
@@ -884,14 +884,14 @@ function statement(table, rows) {
 * casing and Insert types; `better-supabase seed` renders them to SQL.
 *
 * ```ts
-* export const seed = defineSeed(sb, {
+* export const seed = defineSeed(betterSupabase, {
 *   organizations: { acme: { id: ACME, name: 'Acme' } },
 *   customers: { first: { organizationId: ACME, name: 'First customer' } },
 * });
 * ```
 */
-function defineSeed(sb, fixtures) {
-	const meta = sb.meta;
+function defineSeed(betterSupabase, fixtures) {
+	const meta = betterSupabase.meta;
 	const statements = () => {
 		const keys = Object.keys(fixtures).filter((key) => fixtures[key] !== void 0);
 		for (const key of keys) {

package/dist/{version-BfpG2gks.js → version-Bmf7_FzM.js}

@@ -1,4 +1,4 @@
 //#region src/core/version.ts
-const VERSION = "0.0.0";
+const VERSION = "0.4.0";
 //#endregion
 export { VERSION as t };

package/dist/{view-3Po_PVlr.d.ts → view-B64o81wp.d.ts}

@@ -1,6 +1,6 @@
-import { p as DbError } from "./result-c2OYgCV2.js";
-import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-x3V3vGh-.js";
-import { i as InvalidReason, r as AuthState } from "./resolve-BRciX2jK.js";
+import { p as DbError } from "./result-CqEsbgYs.js";
+import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-C7MNQ1Ob.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-BAqQcwMW.js";
 import { JWTClaims, UserClaims } from "@supabase/server";
 //#region src/auth/actor.d.ts
 /** One level of an RFC 8693 `act` chain: who acts, and who acted before it. */
@@ -35,13 +35,13 @@ type AuthSession<C = unknown, P = unknown> = {
   readonly user: UserClaims;
   /**
    * The verified JWT payload, including custom access token hook claims,
-   * typed and validated by `sb.claims(schema)`.
+   * typed and validated by `betterSupabase.claims(schema)`.
    */
   readonly claims: JWTClaims & C;
   /** Seconds since epoch, from the token's `exp`. */
   readonly expiresAt: number | null;
   /**
-   * `user_metadata` parsed by `sb.userMetadata(schema)`, for display.
+   * `user_metadata` parsed by `betterSupabase.userMetadata(schema)`, for display.
    * Absent without a schema or when the metadata fails it. Users
    * write this data with `auth.updateUser()`: never base access on it.
    */

package/dist/{view-wZ-9qIUz.js → view-BrJI2LKp.js}

@@ -1,4 +1,4 @@
-import { g as delegationOf, h as actorOf, n as amrOf, t as aalOf, v as impersonatorOf } from "./mfa-BxoR1RkN.js";
+import { _ as delegationOf, g as actorOf, n as amrOf, t as aalOf, y as impersonatorOf } from "./mfa-byfjruR9.js";
 //#region src/auth/view.ts
 /** Drops the token from an `AuthState`, leaving only serializable fields. */
 function toSession(auth) {

package/dist/webhooks/index.d.ts

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { N as TableKey, O as Row, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
-import { o as Result } from "../result-c2OYgCV2.js";
-import { t as BetterSupabase } from "../define-DUbydmJa.js";
+import { o as Result } from "../result-CqEsbgYs.js";
+import { t as BetterSupabase } from "../define-CRS2MRV3.js";
 //#region src/webhooks/verify.d.ts
 interface VerifiedWebhook<T = unknown> {
   readonly id: string;
@@ -149,6 +149,6 @@ export declare function isDatabaseWebhook(value: unknown): value is DatabaseWebh
  * Reads a database webhook payload for `table` as an app-cased change.
  * Returns `null` for other tables or payloads that aren't database webhooks.
  */
-export declare function databaseChange<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(sb: BetterSupabase<M, D, F, E>, table: T, payload: unknown): DatabaseChange<Row<M, T>> | null;
+export declare function databaseChange<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(betterSupabase: BetterSupabase<M, D, F, E>, table: T, payload: unknown): DatabaseChange<Row<M, T>> | null;
 //#endregion
 export type { AuthHookError, AuthHookKind, AuthHooks, DatabaseChange, DatabaseWebhookPayload, VerifiedWebhook, VerifyOptions, WebhookInput };

package/dist/webhooks/index.js

@@ -1,2 +1,2 @@
-import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../webhooks-CAIFQSTM.js";
+import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../webhooks-Bh_Jf_-l.js";
 export { authHook, databaseChange, hookError, isDatabaseWebhook, signWebhook, timingSafeEqual, verifySharedSecret, verifyWebhook };