better-supabase 0.5.0 → 0.6.0

package/dist/astro/index.d.ts

@@ -0,0 +1,86 @@
+import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
+import { t as BetterSupabase } from "../define-CJJkkr1-.js";
+import { t as BetterServer } from "../server-CeVeeXwz.js";
+import { j as StorageImageOptions } from "../index-D48jVS-N.js";
+import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
+import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-DuVb4Xa8.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/astro/index.d.ts
+/** The part of Astro's `APIContext` (middleware, pages, endpoints, actions) the integration uses. */
+export interface AstroContextLike {
+  readonly request: Request;
+  readonly locals: object;
+}
+export interface AstroOptions extends FrameworkOptions {
+  /** The host's env object for `getEnv`; defaults to `locals.runtime.env` (Cloudflare). */
+  readonly platformEnv?: (context: AstroContextLike) => unknown;
+}
+export interface BetterAstro<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
+  /**
+   * Astro middleware: verifies the caller, refreshes the session cookie on
+   * navigations and form posts, and puts `db`, `bs`, `auth`, `tenant` and
+   * `session` on `locals`. Response-phase entries see the page's response.
+   *
+   * ```ts title="src/middleware.ts"
+   * export const onRequest = bs.onRequest
+   * ```
+   */
+  readonly onRequest: (context: AstroContextLike, next: () => Promise<Response>) => Promise<Response>;
+  /** The request's `locals`, typed. */
+  locals(context: AstroContextLike): FrameworkLocals<M, F, E, C, P>;
+  /**
+   * The refusal for a caller `options` refuses (a redirect to `signIn` or
+   * `mfa`, else Problem Details), or `undefined`. Return it from a page's
+   * frontmatter or an endpoint.
+   *
+   * ```astro
+   * ---
+   * const refused = await bs.guard(Astro, { roles: ['admin'] })
+   * if (refused) return refused
+   * ---
+   * ```
+   */
+  guard(context: AstroContextLike, options?: BlockRequireOptions<C, P>): Promise<Response | undefined>;
+  /**
+   * The caller, or a thrown refusal `Response`, for endpoints that return
+   * whatever is thrown.
+   */
+  require<R extends boolean = false>(context: AstroContextLike, options?: BlockRequireOptions<C, P, R>): Promise<FrameworkLocals<M, F, E, C, P> & AuthorizedContext<C, P, R>>;
+  /**
+   * The `handler` of `defineAction`, returning an `ActionResult`:
+   *
+   * ```ts title="src/actions/index.ts"
+   * export const server = {
+   *   addNote: defineAction({ accept: 'form', handler: bs.action({ input: NoteInput }, (input, { db }) => db.notes.create(input)) }),
+   * }
+   * ```
+   */
+  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: BlockActionOptions<S, C, P, R>, fn: (input: ActionParsed<S>, ctx: FrameworkLocals<M, F, E, C, P> & AuthorizedContext<C, P, R>) => T): (input: unknown, context: AstroContextLike) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+}
+/** Astro integration: middleware, page guards and Actions. */
+export declare function createAstro<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: AstroOptions): BetterAstro<M, F, E, C, P>;
+/** What Astro passes to an image service's `getURL`. */
+export interface AstroImageTransform {
+  readonly src: string | {
+    readonly src: string;
+  };
+  readonly width?: number | undefined;
+  readonly height?: number | undefined;
+  readonly quality?: number | "low" | "mid" | "high" | "max" | undefined;
+}
+/** An Astro external image service, typed structurally. */
+export interface AstroImageService {
+  getURL(options: AstroImageTransform): string;
+}
+/**
+ * An external image service that renders public Storage objects through
+ * Supabase image transformations; other sources pass through.
+ *
+ * ```ts title="src/image-service.ts"
+ * export default createImageService({ url: import.meta.env.PUBLIC_SUPABASE_URL })
+ * ```
+ */
+export declare function createImageService(options: StorageImageOptions): AstroImageService;
+//#endregion
+export type { ActionResult, RefusalRedirects };

package/dist/astro/index.js

@@ -0,0 +1,93 @@
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { t as defaultExpose } from "../respond-BUgsXNgk.js";
+import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
+import { t as storageImageUrl } from "../image-url-pIVlO6R1.js";
+import { t as around } from "../shared-CBxosKK3.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-CONDyPYx.js";
+import { r as refusalResponse } from "../refusal-CeJWxmkH.js";
+//#region src/astro/index.ts
+function runtimeEnv(locals) {
+	const runtime = "runtime" in locals ? locals.runtime : void 0;
+	return typeof runtime === "object" && runtime !== null && "env" in runtime ? runtime.env : void 0;
+}
+/** Astro integration: middleware, page guards and Actions. */
+function createAstro(betterSupabase, options = {}) {
+	const server = createServer(betterSupabase, options);
+	const expose = options.exposeErrors ?? defaultExpose();
+	const run = around([frameworkEntry(server, options, expose)]);
+	const scopeOf = (context) => {
+		if (!("bs" in context.locals)) throw new TypeError("better-supabase: no context; export bs.onRequest from src/middleware.ts");
+		return context.locals;
+	};
+	const refusalOf = async (context, requireOptions) => {
+		const scope = scopeOf(context);
+		return {
+			scope,
+			caller: await requireCaller(scope.bs.auth, requireOptions, scope.tenant)
+		};
+	};
+	return extendServer(server, {
+		onRequest: async (context, next) => {
+			const env = options.platformEnv ? options.platformEnv(context) : runtimeEnv(context.locals);
+			try {
+				return await run(context.request, env, (contributions) => {
+					Object.assign(context.locals, localsOf(contributions));
+					return next();
+				});
+			} finally {
+				flushEvents(server, options.waitUntil);
+			}
+		},
+		locals: scopeOf,
+		guard: async (context, requireOptions = {}) => {
+			const { caller } = await refusalOf(context, requireOptions);
+			return "kind" in caller ? refusalResponse(caller, context.request, options, expose) : void 0;
+		},
+		require: async (context, requireOptions = {}) => {
+			const { scope, caller } = await refusalOf(context, requireOptions);
+			if ("kind" in caller) throw refusalResponse(caller, context.request, options, expose);
+			return {
+				...scope,
+				...caller
+			};
+		},
+		action(actionOptions, fn) {
+			return async (input, context) => {
+				const scope = scopeOf(context);
+				return await runAction(scope.bs.auth, actionOptions, input, scope.tenant, (parsed, caller) => fn(parsed, {
+					...scope,
+					...caller
+				}));
+			};
+		}
+	});
+}
+const QUALITY_PRESETS = {
+	low: 40,
+	mid: 60,
+	high: 80,
+	max: 100
+};
+/**
+* An external image service that renders public Storage objects through
+* Supabase image transformations; other sources pass through.
+*
+* ```ts title="src/image-service.ts"
+* export default createImageService({ url: import.meta.env.PUBLIC_SUPABASE_URL })
+* ```
+*/
+function createImageService(options) {
+	const imageUrl = storageImageUrl(options);
+	return { getURL(transform) {
+		const src = typeof transform.src === "string" ? transform.src : transform.src.src;
+		if (transform.width === void 0) return src;
+		const quality = typeof transform.quality === "string" ? QUALITY_PRESETS[transform.quality] : transform.quality;
+		return imageUrl(src, {
+			width: transform.width,
+			height: transform.height,
+			quality
+		}) ?? src;
+	} };
+}
+//#endregion
+export { createAstro, createImageService };

package/dist/attributes-5dYul0u0.js

@@ -0,0 +1,13 @@
+//#region src/workflow-sdk/attributes.ts
+/** The attributes the Supabase World's status trigger copies into `workflow_runs`. */
+const WORKFLOW_ATTRIBUTES = {
+	tenant: "bs.tenant",
+	actor: "bs.actor",
+	key: "bs.key",
+	/** The builder definition a run started from; its alerts match on it. */
+	definition: "bs.definition",
+	/** The builder version number a run started from. */
+	version: "bs.version"
+};
+//#endregion
+export { WORKFLOW_ATTRIBUTES as t };

package/dist/auth-link-BjFPqwLz.d.ts

@@ -0,0 +1,97 @@
+import { Provider } from "@supabase/supabase-js";
+//#region src/client/native/auth-link.d.ts
+/** An auth error: supabase-js `AuthError`s and the errors a link carries. */
+interface AuthFailure {
+  readonly message: string;
+  readonly code?: string | undefined;
+  readonly status?: number | undefined;
+}
+interface AuthReply {
+  readonly error: AuthFailure | null;
+}
+/** The part of a supabase-js client the deep-link helpers call. */
+interface AuthLinkClient {
+  readonly auth: {
+    exchangeCodeForSession(code: string): Promise<AuthReply>;
+    setSession(tokens: {
+      access_token: string;
+      refresh_token: string;
+    }): Promise<AuthReply>;
+    verifyOtp(params: {
+      token_hash: string;
+      type: "signup" | "invite" | "magiclink" | "recovery" | "email_change" | "email";
+    }): Promise<AuthReply>;
+  };
+}
+/** What a link did: nothing (not an auth link), a session, or an error. */
+type AuthLinkResult = {
+  readonly type: "none";
+} | {
+  readonly type: "signed-in";
+  readonly via: "code" | "tokens" | "otp";
+} | {
+  readonly type: "error";
+  readonly error: AuthFailure;
+};
+/**
+ * The query and fragment parameters of a URL. Parsed by hand: Hermes'
+ * `URL` and `URLSearchParams` leave parts unimplemented.
+ */
+declare function linkParams(url: string): ReadonlyMap<string, string>;
+/**
+ * Finishes a sign-in from a deep link: an OAuth or PKCE `code`, implicit
+ * flow tokens in the fragment, or a magic link's `token_hash`. Returns
+ * `none` for links that carry none of them, so it can see every URL.
+ *
+ * ```ts
+ * Linking.addEventListener('url', ({ url }) => void handleAuthDeepLink(supabase, url));
+ * ```
+ */
+declare function handleAuthDeepLink(supabase: AuthLinkClient, url: string): Promise<AuthLinkResult>;
+/** The part of `expo-web-browser` OAuth sign-in uses. */
+interface WebBrowserLike {
+  openAuthSessionAsync(url: string, redirectUrl?: string | null): Promise<{
+    readonly type: string;
+    readonly url?: string;
+  }>;
+}
+/** The part of a supabase-js client OAuth sign-in calls. */
+interface OAuthClient extends AuthLinkClient {
+  readonly auth: AuthLinkClient["auth"] & {
+    signInWithOAuth(credentials: {
+      provider: Provider;
+      options: {
+        redirectTo: string;
+        skipBrowserRedirect: true;
+        scopes?: string;
+        queryParams?: Record<string, string>;
+      };
+    }): Promise<{
+      readonly data: {
+        readonly url: string | null;
+      } | {
+        readonly url?: null;
+      };
+      readonly error: AuthFailure | null;
+    }>;
+  };
+}
+interface OAuthSignInOptions {
+  /** The app's deep link back, e.g. `Linking.createURL('auth/callback')`. Add it to the redirect allow list. */
+  readonly redirectTo: string;
+  readonly scopes?: string;
+  readonly queryParams?: Readonly<Record<string, string>>;
+}
+/**
+ * OAuth on a device: opens the provider in an auth session, then finishes
+ * the sign-in from the redirect. A cancelled or dismissed browser returns
+ * `none`.
+ *
+ * ```ts
+ * import * as WebBrowser from 'expo-web-browser';
+ * await signInWithOAuthBrowser(supabase, WebBrowser, 'github', { redirectTo: Linking.createURL('auth/callback') });
+ * ```
+ */
+declare function signInWithOAuthBrowser(supabase: OAuthClient, browser: WebBrowserLike, provider: Provider, options: OAuthSignInOptions): Promise<AuthLinkResult>;
+//#endregion
+export { OAuthSignInOptions as a, linkParams as c, OAuthClient as i, signInWithOAuthBrowser as l, AuthLinkClient as n, WebBrowserLike as o, AuthLinkResult as r, handleAuthDeepLink as s, AuthFailure as t };

package/dist/auth-link-DrDX9KOT.js

@@ -0,0 +1,114 @@
+//#region src/client/native/auth-link.ts
+const OTP_TYPES = /* @__PURE__ */ new Set([
+	"signup",
+	"invite",
+	"magiclink",
+	"recovery",
+	"email_change",
+	"email"
+]);
+function isOtpType(value) {
+	return OTP_TYPES.has(value);
+}
+/**
+* The query and fragment parameters of a URL. Parsed by hand: Hermes'
+* `URL` and `URLSearchParams` leave parts unimplemented.
+*/
+function linkParams(url) {
+	const params = /* @__PURE__ */ new Map();
+	const hash = url.indexOf("#");
+	const query = url.indexOf("?");
+	const parts = [query === -1 ? "" : url.slice(query + 1, hash > query ? hash : void 0), hash === -1 ? "" : url.slice(hash + 1)];
+	for (const part of parts) for (const pair of part.split("&")) {
+		if (pair === "") continue;
+		const at = pair.indexOf("=");
+		const name = at === -1 ? pair : pair.slice(0, at);
+		const value = at === -1 ? "" : pair.slice(at + 1);
+		try {
+			params.set(decodeURIComponent(name.replaceAll("+", " ")), decodeURIComponent(value.replaceAll("+", " ")));
+		} catch {}
+	}
+	return params;
+}
+const settle = async (reply, via) => {
+	const { error } = await reply;
+	return error ? {
+		type: "error",
+		error
+	} : {
+		type: "signed-in",
+		via
+	};
+};
+/**
+* Finishes a sign-in from a deep link: an OAuth or PKCE `code`, implicit
+* flow tokens in the fragment, or a magic link's `token_hash`. Returns
+* `none` for links that carry none of them, so it can see every URL.
+*
+* ```ts
+* Linking.addEventListener('url', ({ url }) => void handleAuthDeepLink(supabase, url));
+* ```
+*/
+function handleAuthDeepLink(supabase, url) {
+	const params = linkParams(url);
+	const failure = params.get("error_description") ?? params.get("error");
+	if (failure !== void 0) {
+		const code = params.get("error_code") ?? params.get("error");
+		return Promise.resolve({
+			type: "error",
+			error: {
+				message: failure,
+				...code ? { code } : {}
+			}
+		});
+	}
+	const code = params.get("code");
+	if (code) return settle(supabase.auth.exchangeCodeForSession(code), "code");
+	const access = params.get("access_token");
+	const refresh = params.get("refresh_token");
+	if (access && refresh) return settle(supabase.auth.setSession({
+		access_token: access,
+		refresh_token: refresh
+	}), "tokens");
+	const tokenHash = params.get("token_hash");
+	const type = params.get("type");
+	if (tokenHash && type && isOtpType(type)) return settle(supabase.auth.verifyOtp({
+		token_hash: tokenHash,
+		type
+	}), "otp");
+	return Promise.resolve({ type: "none" });
+}
+/**
+* OAuth on a device: opens the provider in an auth session, then finishes
+* the sign-in from the redirect. A cancelled or dismissed browser returns
+* `none`.
+*
+* ```ts
+* import * as WebBrowser from 'expo-web-browser';
+* await signInWithOAuthBrowser(supabase, WebBrowser, 'github', { redirectTo: Linking.createURL('auth/callback') });
+* ```
+*/
+async function signInWithOAuthBrowser(supabase, browser, provider, options) {
+	const { data, error } = await supabase.auth.signInWithOAuth({
+		provider,
+		options: {
+			redirectTo: options.redirectTo,
+			skipBrowserRedirect: true,
+			...options.scopes ? { scopes: options.scopes } : {},
+			...options.queryParams ? { queryParams: { ...options.queryParams } } : {}
+		}
+	});
+	if (error) return {
+		type: "error",
+		error
+	};
+	if (!data.url) return {
+		type: "error",
+		error: { message: "No OAuth URL was returned" }
+	};
+	const session = await browser.openAuthSessionAsync(data.url, options.redirectTo);
+	if (session.type !== "success" || !session.url) return { type: "none" };
+	return handleAuthDeepLink(supabase, session.url);
+}
+//#endregion
+export { linkParams as n, signInWithOAuthBrowser as r, handleAuthDeepLink as t };

package/dist/authorization-BFCqamMs.d.ts

@@ -0,0 +1,172 @@
+import { i as DisabledRow } from "./modules-DpPwzC7E.js";
+//#region src/config/authorization.d.ts
+/**
+ * SQL expression templates the SQL modules and the access policies call.
+ * `{permission}` is a text expression (a literal or a parameter), `{user}` a
+ * uuid expression, `{tenant}` an expression of the tenant id type and
+ * `{role}` a text expression. `{scope}` is the scope's name unquoted, so it
+ * can be part of a function name (`app.ids_{scope}({permission})`); write
+ * `'{scope}'` to pass it as text.
+ */
+interface AuthorizationFunctions {
+  /**
+   * The ids of the `{scope}` instances where the caller holds
+   * `{permission}`, as a set: it is used as
+   * `select t.id::text from <template> as t(id)`.
+   */
+  readonly idsWith: string;
+  /** Whether the caller holds `{permission}` platform-wide. */
+  readonly isPlatform: string;
+  /** `idsWith` for `{user}`, so `can_user` answers for another user. */
+  readonly idsWithFor?: string;
+  /** `isPlatform` for `{user}`. */
+  readonly isPlatformFor?: string;
+  /** The ids of the `{scope}` instances the caller is a member of, as a set. */
+  readonly memberIds?: string;
+  /** `memberIds` for `{user}`, which the access token hook calls as `supabase_auth_admin`. */
+  readonly memberIdsFor?: string;
+  /** Whether the caller may assign `{role}` in `{tenant}`. */
+  readonly canAssign?: string;
+  /** Whether `{user}` may assign `{role}` in `{tenant}`. */
+  readonly canAssignFor?: string;
+  /**
+   * The permission keys `{user}` holds in `{tenant}`, as a `text[]`. It
+   * fills `member_permissions` and the `permissions` claim; without it
+   * both are empty.
+   */
+  readonly permissionsFor?: string;
+  /**
+   * Whether the caller may decide the tool call `{tool}` (text) waits on in
+   * `{tenant}`. Without it only the chat's owner and the service role decide.
+   */
+  readonly canApprove?: string;
+}
+/** One scope the provider decides permissions in, such as `organization`. */
+interface AuthorizationScope {
+  /** Lower case letters, digits and `_`, starting with a letter. */
+  readonly name: string;
+  /** The Postgres type of the scope's ids: `uuid`, `text`, `bigint` or `integer`. */
+  readonly idType?: string;
+  /** The scope this one sits in; the root scope has none. */
+  readonly parent?: string;
+}
+/** A function the templates call, which must exist and be executable by `role`. */
+interface AuthorizationRequirement {
+  /** `schema.name`. */
+  readonly function: string;
+  /** The argument types, such as `text` or `uuid, text`. */
+  readonly args?: string;
+  readonly role: string;
+}
+/** A permission key the provider defines. */
+interface AuthorizationPermission {
+  readonly key: string;
+  /**
+   * `true` when the SQL functions answer for the key completely. A key with
+   * row conditions they don't check is `false`, and policies refuse it.
+   * Unset means unknown, which counts as `false`.
+   */
+  readonly sqlComplete?: boolean;
+  /** The scopes it can be granted at. */
+  readonly scopes?: readonly string[];
+}
+/** A table of memberships the provider reads. */
+interface AuthorizationMembership {
+  /** `schema.table`. */
+  readonly table: string;
+  readonly userColumn: string;
+  /** The scope column, or the scope every row is in. */
+  readonly scope: {
+    readonly column: string;
+  } | {
+    readonly value: string;
+  };
+  readonly idColumn: string;
+}
+/** A membership table whose role column points into a roles table. */
+interface AuthorizationRoleSource {
+  /** `schema.table` of the memberships. */
+  readonly table: string;
+  readonly role: {
+    readonly column: string;
+    readonly through: {
+      /** `schema.table` of the roles. */
+      readonly table: string;
+      readonly id: string;
+      readonly column: string;
+    };
+  };
+}
+/** The access token hook the provider generates. */
+interface AuthorizationTokenHook {
+  /** `schema.name`. */
+  readonly function: string;
+  /** The claim it writes the active tenant id to. */
+  readonly tenantClaim?: string;
+  /** Claims it writes itself, which a second writer would contradict. */
+  readonly ownedClaims: readonly string[];
+  /** Claims it fills from other functions, such as `features` from `better_supabase.feature_claims`. */
+  readonly registeredClaims?: readonly {
+    readonly name: string;
+    /** `schema.name`. */
+    readonly function: string;
+  }[];
+  /** A byte budget over some claims, which doctor `--as` measures (BS405). */
+  readonly budget?: {
+    readonly claims: readonly string[];
+    readonly bytes: number;
+    /** A claim the hook sets to `true` when it dropped entries to stay within the budget. */
+    readonly truncatedClaim?: string;
+  };
+  /** Comment lines the provider's generated files contain, so doctor recognises them. */
+  readonly markers?: {
+    /** In the file that defines the hook. */
+    readonly hook?: string;
+    /** In the migration that grants the hook's functions. */
+    readonly grants?: string;
+  };
+  /** The command that writes the hook's grants, for BS404. */
+  readonly grantsCommand?: string;
+}
+/**
+ * An authorization system the SQL modules, the policies and doctor delegate
+ * to. It is plain data, usually built from the provider's own output files.
+ */
+interface AuthorizationProvider {
+  readonly apiVersion: 1;
+  /** The provider's name, for messages. */
+  readonly name: string;
+  readonly scopes: readonly AuthorizationScope[];
+  /** The scope tenants are. */
+  readonly tenantScope: string;
+  readonly functions: AuthorizationFunctions;
+  readonly requires?: readonly AuthorizationRequirement[];
+  readonly permissions?: readonly AuthorizationPermission[];
+  readonly memberships?: readonly AuthorizationMembership[];
+  /** Rows that say whether a user or a tenant is active. */
+  readonly suspension?: {
+    readonly user?: DisabledRow;
+    readonly tenant?: DisabledRow;
+  };
+  readonly roleSources?: readonly AuthorizationRoleSource[];
+  /** `schema.table.column` of every column that decides access (BS213). */
+  readonly decidingColumns?: readonly string[];
+  readonly tokenHook?: AuthorizationTokenHook;
+  /** How `canApprove` decisions are made. */
+  readonly approvals?: {
+    /** The user who asked for the tool call can't approve it. Default `false`. */
+    readonly distinctApprover?: boolean;
+  };
+  /** What the provider found wrong while building this, for doctor. */
+  readonly problems?: readonly string[];
+}
+/**
+ * The error for a provider built for another API version, or `undefined`
+ * for version 1.
+ */
+declare function providerApiProblem(provider: {
+  readonly name?: unknown;
+  readonly apiVersion?: unknown;
+}): string | undefined;
+//#endregion
+export { AuthorizationRequirement as a, AuthorizationTokenHook as c, AuthorizationProvider as i, providerApiProblem as l, AuthorizationMembership as n, AuthorizationRoleSource as o, AuthorizationPermission as r, AuthorizationScope as s, AuthorizationFunctions as t };

package/dist/before-route-CnR0C0Jr.js

@@ -0,0 +1,30 @@
+import { t as around } from "./shared-CBxosKK3.js";
+//#region src/bridges/before-route.ts
+/**
+* Runs the entries ahead of a framework that owns the route and the
+* response (Express, Fastify, Koa, Nitro 2, SolidStart, NestJS). A short
+* circuit is the answer; otherwise the framework copies the headers and
+* hands the contributions to the route. Response-phase entries see an
+* empty response, so `withDbStats` and `withServerTiming` report nothing here.
+*/
+function beforeRoute(entries) {
+	const run = around(entries);
+	return async (request, env) => {
+		let contributions;
+		const marker = new Response(null);
+		const response = await run(request, env, (handed) => {
+			contributions = handed;
+			return Promise.resolve(marker);
+		});
+		return contributions === void 0 ? {
+			reached: false,
+			response
+		} : {
+			reached: true,
+			contributions,
+			headers: response.headers
+		};
+	};
+}
+//#endregion
+export { beforeRoute as t };

package/dist/bind-Bu_ZNa3W.d.ts

@@ -0,0 +1,62 @@
+import { a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
+import { b as Db, t as BetterSupabase } from "./define-CJJkkr1-.js";
+import { s as BetterQueries } from "./index-Bepi-Hgg.js";
+import { SupabaseClient } from "@supabase/supabase-js";
+//#region src/client/bind.d.ts
+interface AuthUser {
+  readonly id: string;
+  readonly email?: string;
+  readonly role?: string;
+}
+/**
+ * What the UI needs to know. Claims are decoded, not verified: RLS enforces
+ * access. A token refresh that changes only `exp`, `iat`, `nbf` or `jti`
+ * keeps the previous snapshot, so read expiry from the session, not here.
+ */
+type AuthSnapshot = {
+  readonly status: "loading";
+  readonly user: null;
+  readonly claims: null;
+} | {
+  readonly status: "signed-out";
+  readonly user: null;
+  readonly claims: null;
+} | {
+  readonly status: "signed-in";
+  readonly user: AuthUser;
+  readonly claims: Readonly<Record<string, unknown>>;
+};
+interface ClientAuth {
+  readonly current: () => AuthSnapshot;
+  /** `useSyncExternalStore`-compatible. */
+  readonly subscribe: (listener: () => void) => () => void;
+}
+interface BetterClient<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
+  /** The definition the client was created from (schema metadata, specs, live queries). */
+  readonly betterSupabase: BetterSupabase<M, unknown, F, E, C, P>;
+  readonly supabase: SupabaseClient;
+  /** Repositories with the current session's actor and claims. */
+  readonly db: Db<M, F, E, SupabaseClient>;
+  /** TanStack Query option factories over `db`. */
+  readonly queries: BetterQueries<M, E, F>;
+  readonly auth: ClientAuth;
+  /**
+   * Stops following `supabase`'s session. Call it when the client goes away
+   * before the app does: Fast Refresh, tests, a client per account.
+   */
+  readonly dispose: () => void;
+}
+interface BindClientOptions {
+  /**
+   * `staleTime` for every query option in `queries`. Above zero, a remount
+   * or a window focus reuses cached rows instead of refetching them.
+   */
+  readonly staleTime?: number;
+}
+/**
+ * Repositories that follow `supabase`'s session, TanStack Query options and
+ * an auth store, for a supabase-js client you created yourself.
+ */
+declare function bindClient<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, supabase: SupabaseClient, options?: BindClientOptions): BetterClient<M, F, E, C, P>;
+//#endregion
+export { ClientAuth as a, BindClientOptions as i, AuthUser as n, bindClient as o, BetterClient as r, AuthSnapshot as t };