better-supabase 0.5.0 → 0.6.0

package/dist/field-errors-BFOa7WhB.d.ts

@@ -0,0 +1,99 @@
+import { b as DbError } from "./result-D7y2fT87.js";
+import { it as QuerySpec } from "./define-CJJkkr1-.js";
+import { n as TemplateValues } from "./template-CwO38Do8.js";
+import { a as ClientAuth } from "./bind-Bu_ZNa3W.js";
+import { T as TopicMessage, _ as RealtimeClient, a as LiveSource, g as PresenceSubscription, p as PresenceOptions, r as LiveCountSeed, y as SubscribeOptions } from "./index-DunNRdnT.js";
+import { SupabaseClient } from "@supabase/supabase-js";
+import { QueryClient } from "@tanstack/query-core";
+//#region src/bindings/client.d.ts
+/** The parts of `createClient()` the bindings need. */
+interface ClientLike {
+  readonly betterSupabase: LiveSource;
+  readonly supabase: SupabaseClient;
+  readonly auth: ClientAuth;
+  readonly db: object;
+  readonly queries: object;
+}
+/** What a `bs.action()` Server Action or server function resolves to. */
+type ActionResultOf<T> = {
+  readonly ok: true;
+  readonly data: T;
+  readonly error: null;
+} | {
+  readonly ok: false;
+  readonly data: null;
+  readonly error: DbError;
+};
+/**
+ * The input `useAction` passes: a `bs.action()` with an `input` schema also
+ * accepts `FormData`, which belongs to `useActionForm`.
+ */
+type ActionInputOf<I> = [Exclude<I, FormData>] extends [never] ? I : Exclude<I, FormData>;
+interface UseActionOptions<I, T> {
+  readonly onSuccess?: (data: T, input: I) => void;
+  readonly onError?: (error: DbError, input: I) => void;
+}
+interface BroadcastOptions extends Omit<SubscribeOptions, "onStatus"> {
+  /**
+   * A supabase-js client to subscribe with, for apps without the provider.
+   * It resubscribes when the client's user changes. Defaults to the
+   * provider's client.
+   */
+  readonly client?: SupabaseClient;
+  /** The query client `invalidate` refetches with. Defaults to the provider's. */
+  readonly queryClient?: QueryClient;
+  /**
+   * Refetch after each message: table keys (every query that read one of
+   * them), or a function returning query keys. Needs a `queryClient`, here
+   * or on the provider.
+   */
+  readonly invalidate?: readonly string[] | ((message: TopicMessage) => readonly (readonly unknown[])[]);
+}
+interface LiveQueryHookOptions {
+  /**
+   * Tenant for tenant-scoped tables. Defaults to the `config.claims.tenant`
+   * claim (`tenant_id`, top-level or in `app_metadata`).
+   */
+  readonly tenant?: string;
+  /** Defaults to 100 ms. */
+  readonly debounceMs?: number;
+}
+interface LiveCountHookOptions extends LiveQueryHookOptions {
+  /** The count to show before the first fetch, e.g. from the server. */
+  readonly initial?: number;
+}
+interface PresenceHookOptions<I> {
+  /**
+   * The state this client shares while joined. It is tracked after the
+   * join and tracked again when its JSON changes; `null` stays untracked.
+   */
+  readonly state?: I | null;
+  /** A supabase-js client for apps without the provider. */
+  readonly client?: SupabaseClient;
+}
+/** The parts of a `defineTopic(..., { presence })` topic the bindings use. */
+interface PresenceTopic<P extends string, I, O> {
+  topic(values: TemplateValues<P>): string;
+  match(topic: string): TemplateValues<P> | null;
+  subscribe(client: RealtimeClient, values: TemplateValues<P>, handlers: Readonly<Record<string, never>>, options?: SubscribeOptions & PresenceOptions<O>): PresenceSubscription<I, O>;
+}
+/** A count spec or a `bs.liveCount()` seed. */
+type LiveCountSource = QuerySpec<string, "count", number> | LiveCountSeed | null | undefined;
+interface ActionState<I, T> {
+  /** True while a run is in flight. */
+  readonly pending: boolean;
+  /** The inputs of the runs in flight, e.g. to dim one table row. */
+  readonly pendingInputs: readonly I[];
+  /** The input of the latest run in flight. */
+  readonly pendingInput: I | undefined;
+  /** The data of the last successful run. */
+  readonly data: T | undefined;
+  /** The error of the last run, until the next one starts. */
+  readonly error: DbError | undefined;
+}
+//#endregion
+//#region src/react/field-errors.d.ts
+/** The first message per top-level field of a `validation` error. */
+declare function fieldErrorsOf(error: DbError | undefined): Readonly<Partial<Record<string, string>>>;
+//#endregion
+export { BroadcastOptions as a, LiveCountSource as c, PresenceTopic as d, UseActionOptions as f, ActionState as i, LiveQueryHookOptions as l, ActionInputOf as n, ClientLike as o, ActionResultOf as r, LiveCountHookOptions as s, fieldErrorsOf as t, PresenceHookOptions as u };

package/dist/field-errors-VF1yb8yI.js

@@ -0,0 +1,13 @@
+//#region src/react/field-errors.ts
+/** The first message per top-level field of a `validation` error. */
+function fieldErrorsOf(error) {
+	if (error?.kind !== "validation") return {};
+	const fields = {};
+	for (const issue of error.issues) {
+		const key = issue.path?.[0];
+		if (typeof key === "string" && fields[key] === void 0) fields[key] = issue.message;
+	}
+	return fields;
+}
+//#endregion
+export { fieldErrorsOf as t };

package/dist/framework-CONDyPYx.js

@@ -0,0 +1,51 @@
+import { n as toSession } from "./view-BeFcRV6G.js";
+import { t as withBetterSupabase } from "./composite-DhE66P5u.js";
+//#region src/server/framework.ts
+/** Every caller: the framework factories guard per loader, action or route instead. */
+const EVERY_CALLER = [
+	"user",
+	"anonymous",
+	"anon",
+	"service",
+	"apiKey"
+];
+/** The `withBetterSupabase` entry the framework factories run, admitting every caller. */
+function frameworkEntry(server, options, expose) {
+	return withBetterSupabase(server, {
+		refresh: options.refresh ?? "navigation",
+		allow: EVERY_CALLER,
+		expose,
+		...options.checkSession === void 0 ? {} : { checkSession: options.checkSession },
+		...options.cookieScopes === void 0 ? {} : { cookieScopes: options.cookieScopes },
+		...options.encode === void 0 ? {} : { encode: options.encode },
+		...options.waitUntil === void 0 ? {} : { waitUntil: options.waitUntil }
+	});
+}
+/** The contributions plus the serializable `session`. */
+function localsOf(contributions) {
+	const base = contributions;
+	return {
+		...base,
+		session: toSession(base.bs.auth)
+	};
+}
+function isWaitUntilHost(value) {
+	return typeof value === "object" && value !== null && "waitUntil" in value && typeof value.waitUntil === "function";
+}
+/** `platform.context.waitUntil` on Cloudflare, `platform.waitUntil` elsewhere. */
+function platformWaitUntil(platform) {
+	if (typeof platform !== "object" || platform === null) return void 0;
+	const context = "context" in platform ? platform.context : platform;
+	if (!isWaitUntilHost(context)) return void 0;
+	return (promise) => {
+		context.waitUntil(promise);
+	};
+}
+/** The form body as `FormData`, JSON as a value, nothing as `undefined`. */
+async function actionInput(request) {
+	const type = request.headers.get("content-type") ?? "";
+	if (type.includes("application/json")) return request.json();
+	if (type.includes("form-data") || type.includes("application/x-www-form-urlencoded")) return request.formData();
+}
+//#endregion
+export { platformWaitUntil as a, localsOf as i, actionInput as n, frameworkEntry as r, EVERY_CALLER as t };

package/dist/framework-DuVb4Xa8.d.ts

@@ -0,0 +1,25 @@
+import { a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
+import { o as ServerOptions } from "./server-CeVeeXwz.js";
+import { t as AuthSession } from "./view-DbxLNu8L.js";
+import { a as SessionEntryConfig, n as BetterSupabaseContributions } from "./composite-Bt1YK3Ke.js";
+import { t as RefusalRedirects } from "./refusal-D1rgbzNq.js";
+//#region src/server/framework.d.ts
+/** What the framework factories (`createSvelteKit`, `createReactRouter`, `createTanStackStart`) take. */
+interface FrameworkOptions extends ServerOptions, RefusalRedirects, Pick<SessionEntryConfig, "checkSession" | "cookieScopes" | "encode"> {
+  /**
+   * When the middleware refreshes an expired session cookie. Defaults to
+   * `'navigation'`: page loads, client navigations and form posts.
+   */
+  readonly refresh?: SessionEntryConfig["refresh"];
+  /** Include internal error messages in Problem Details. Defaults to development only. */
+  readonly exposeErrors?: boolean;
+  /** Keeps the invocation alive for event sink sends, e.g. the Workers `ctx.waitUntil`. */
+  readonly waitUntil?: (promise: Promise<unknown>) => void;
+}
+/** The keys the framework factories put on `locals` or `context`. */
+type FrameworkLocals<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> = BetterSupabaseContributions<M, F, E, C, P> & {
+  /** The caller as plain data, safe to return from a loader to the browser. */
+  readonly session: AuthSession<C, P>;
+};
+//#endregion
+export { FrameworkOptions as n, FrameworkLocals as t };

package/dist/gateway-C1ssRHnf.d.ts

@@ -0,0 +1,130 @@
+/// <reference lib="esnext.temporal" />
+import { b as DbError } from "./result-D7y2fT87.js";
+import { m as JobHandler } from "./queue-CLJurhdy.js";
+import { g as AiModelInput, i as AiChat } from "./ai-chat-7amvXjmQ.js";
+import { i as Usage, m as UsageStatus, s as UsageEntry } from "./usage-CrvrL2vw.js";
+import { JSONValue, LanguageModelUsage } from "ai";
+//#region src/ai-sdk/gateway.d.ts
+/** Who a generation is for, as the AI Gateway reports spend. */
+interface GatewayContext {
+  readonly userId?: string;
+  readonly organizationId?: string;
+  readonly chatId?: string;
+  /** What the generation is for, such as `chat` or `summary`. */
+  readonly feature?: string;
+}
+/** The AI Gateway's own options (`providerOptions.gateway`). */
+type GatewayOptions = {
+  readonly [key: string]: JSONValue | undefined;
+};
+/**
+ * `providerOptions` for `streamText` and agents that attribute the spend in
+ * the AI Gateway: `user` is the user id, and `tags` name the tenant, the chat
+ * and the feature. `extra` adds gateway options such as `order` or
+ * `zeroDataRetention`; its `tags` are appended.
+ */
+declare function gatewayOptions(context: GatewayContext, extra?: GatewayOptions): {
+  readonly gateway: GatewayOptions;
+};
+/** Token counts and the gateway's cost of one generation. */
+interface AiUsage {
+  readonly inputTokens: number;
+  readonly outputTokens: number;
+  readonly totalTokens: number;
+  readonly cachedInputTokens: number;
+  readonly reasoningTokens: number;
+  /** The gateway's generation id, for `costBackfill` when the cost isn't known yet. */
+  readonly generationId: string | undefined;
+  /** The cost in millionths of a US dollar, when the gateway reported it. */
+  readonly costMicroUsd: number | undefined;
+}
+/** What `usageOf` reads: a `streamText` or `generateText` result, awaited. */
+interface UsageSource {
+  readonly totalUsage?: Partial<LanguageModelUsage> | undefined;
+  readonly usage?: Partial<LanguageModelUsage> | undefined;
+  readonly providerMetadata?: unknown;
+}
+/** The usage of a finished generation, with the gateway's cost when it has one. */
+declare function usageOf(source: UsageSource): AiUsage;
+/** The usage meters `usageEntries` writes, by default `ai.input_tokens` and `ai.output_tokens`. */
+interface AiUsageMeters {
+  readonly input?: string;
+  readonly output?: string;
+  /** Micro-USD; left out unless named. */
+  readonly cost?: string;
+}
+/** The entries to pass to `usage.recordMany` for a generation. */
+declare function usageEntries(usage: AiUsage, meters?: AiUsageMeters): UsageEntry[];
+/**
+ * A 429 Problem Details response for a quota or rate limit: pass the
+ * `quota_exceeded` or `rate_limited` error a block returned, or the
+ * `UsageStatus` of a meter with nothing left. It carries `Retry-After`.
+ */
+declare function problem429(decision: DbError | UsageStatus, now?: Temporal.Instant): Response;
+/**
+ * The quota check `createAssistant` runs before a generation: the error when
+ * `meter` has nothing left for the tenant, otherwise `undefined`.
+ */
+declare function usageQuota(usage: Pick<Usage, "current">, meter: string): (organizationId: string) => Promise<DbError | undefined>;
+/** The AI Gateway calls the job handlers make (`gateway` from `ai`). */
+interface GatewayClient {
+  getGenerationInfo(params: {
+    id: string;
+  }): PromiseLike<{
+    readonly totalCost: number;
+    readonly model?: string;
+    readonly promptTokens?: number;
+    readonly completionTokens?: number;
+  }>;
+  getAvailableModels(): PromiseLike<{
+    readonly models: readonly GatewayModelEntry[];
+  }>;
+}
+/** One model of `gateway.getAvailableModels()`. */
+interface GatewayModelEntry {
+  readonly id: string;
+  readonly name: string;
+  readonly description?: string | null;
+  readonly pricing?: Readonly<Record<string, string | undefined>> | null;
+  readonly modelType?: string | null;
+}
+/** The payload of a cost backfill job. */
+interface CostBackfillPayload {
+  readonly generationId: string;
+  /** With `usage` and `meter`, the cost is also recorded on the tenant's meter. */
+  readonly organizationId?: string;
+}
+interface CostBackfillOptions {
+  /** The chat block with a service transport. */
+  readonly chats: Pick<AiChat, "runs">;
+  readonly gateway: Pick<GatewayClient, "getGenerationInfo">;
+  readonly usage?: Pick<Usage, "record">;
+  /** The micro-USD meter, such as `ai.cost`. */
+  readonly meter?: string;
+}
+/**
+ * A job handler that looks up a generation's cost in the AI Gateway and
+ * writes it to the run (`runs.setCost`). Enqueue it when `usageOf` found no
+ * cost; it throws so the queue retries while the gateway doesn't know it yet.
+ */
+declare function costBackfill(options: CostBackfillOptions): JobHandler<CostBackfillPayload>;
+interface ModelCatalogRefreshOptions {
+  /** The chat block with a service transport. */
+  readonly chats: Pick<AiChat, "models">;
+  readonly gateway: Pick<GatewayClient, "getAvailableModels">;
+  /** Keeps a model; defaults to language models. */
+  readonly filter?: (model: GatewayModelEntry) => boolean;
+  /** Plans per model id, for models only some plans may use. */
+  readonly plans?: (model: GatewayModelEntry) => readonly string[] | undefined;
+  /** Deletes catalog rows the gateway no longer lists. Defaults to false. */
+  readonly prune?: boolean;
+}
+/** The catalog row for a gateway model. */
+declare function modelInputOf(model: GatewayModelEntry, plans?: readonly string[]): AiModelInput;
+/**
+ * A job handler that copies the AI Gateway's model list into the chat
+ * block's catalog (`models.upsert`); schedule it daily.
+ */
+declare function modelCatalogRefresh(options: ModelCatalogRefreshOptions): JobHandler<unknown>;
+//#endregion
+export { usageOf as _, GatewayClient as a, GatewayOptions as c, costBackfill as d, gatewayOptions as f, usageEntries as g, problem429 as h, CostBackfillPayload as i, ModelCatalogRefreshOptions as l, modelInputOf as m, AiUsageMeters as n, GatewayContext as o, modelCatalogRefresh as p, CostBackfillOptions as r, GatewayModelEntry as s, AiUsage as t, UsageSource as u, usageQuota as v };

package/dist/graph-BGyLLFLX.js

@@ -0,0 +1,265 @@
+//#region src/blocks/workflow-builder/graph.ts
+/** Kept local: the static executor runs this file inside the workflow VM. */
+const isGraphRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const WORKFLOW_NODE_KINDS = [
+	"trigger",
+	"step",
+	"sleep",
+	"approval",
+	"condition"
+];
+const OPERATORS = [
+	"equals",
+	"notEquals",
+	"exists",
+	"truthy",
+	"greaterThan",
+	"lessThan",
+	"contains"
+];
+const DURATION = /^(\d+)(ms|s|m|h|d)$/;
+const UNIT_MS = /* @__PURE__ */ new Map([
+	["ms", 1],
+	["s", 1e3],
+	["m", 6e4],
+	["h", 36e5],
+	["d", 864e5]
+]);
+/** A sleep duration in milliseconds; `undefined` when `value` isn't one. */
+function durationMs(value) {
+	if (typeof value === "number") return Number.isFinite(value) && value > 0 ? Math.round(value) : void 0;
+	if (typeof value !== "string") return void 0;
+	const match = DURATION.exec(value.trim());
+	if (match === null) return void 0;
+	const factor = UNIT_MS.get(match[2] ?? "");
+	const ms = Number(match[1]) * (factor ?? 0);
+	return ms > 0 ? ms : void 0;
+}
+const CONDITION_PATH = /^(input|results)(\.[^.]+)*$/;
+/** The node's condition, or `undefined` when its config isn't one. */
+function conditionOf(node) {
+	const config = node.config;
+	if (config === void 0) return void 0;
+	const path = config["path"];
+	const op = OPERATORS.find((known) => known === config["op"]);
+	if (typeof path !== "string" || op === void 0) return void 0;
+	if (!CONDITION_PATH.test(path)) return void 0;
+	return {
+		path,
+		op,
+		value: config["value"]
+	};
+}
+/** Reads `path` (`input...` or `results...`) from the run's data. */
+function readPath(scope, path) {
+	const [root, ...rest] = path.split(".");
+	let value = root === "input" ? scope.input : scope.results;
+	for (const key of rest) if (Array.isArray(value)) value = value[Number(key)];
+	else if (isGraphRecord(value)) value = value[key];
+	else return void 0;
+	return value;
+}
+/** Whether `condition` holds for the run's data. */
+function evaluateCondition(condition, scope) {
+	const actual = readPath(scope, condition.path);
+	const expected = condition.value;
+	switch (condition.op) {
+		case "equals": return JSON.stringify(actual) === JSON.stringify(expected);
+		case "notEquals": return JSON.stringify(actual) !== JSON.stringify(expected);
+		case "exists": return actual !== void 0 && actual !== null;
+		case "truthy": return Boolean(actual);
+		case "greaterThan": return typeof actual === "number" && typeof expected === "number" && actual > expected;
+		case "lessThan": return typeof actual === "number" && typeof expected === "number" && actual < expected;
+		case "contains":
+			if (typeof actual === "string") return typeof expected === "string" && actual.includes(expected);
+			return Array.isArray(actual) && actual.some((item) => JSON.stringify(item) === JSON.stringify(expected));
+		default: {
+			const unknown = condition.op;
+			throw new TypeError(`workflow-builder: unknown operator "${String(unknown)}"`);
+		}
+	}
+}
+/** Whether an approval payload approves: anything but `{ approved: false }`. */
+const approved = (payload) => !(isGraphRecord(payload) && payload["approved"] === false);
+/**
+* The nodes in an order that runs every source before its targets, keeping
+* the graph's order among independent nodes; `undefined` when edges form a
+* cycle.
+*/
+function topologicalOrder(graph) {
+	const indegree = new Map(graph.nodes.map((node) => [node.id, 0]));
+	const targets = /* @__PURE__ */ new Map();
+	for (const edge of graph.edges) {
+		if (!indegree.has(edge.source) || !indegree.has(edge.target)) continue;
+		indegree.set(edge.target, (indegree.get(edge.target) ?? 0) + 1);
+		targets.set(edge.source, [...targets.get(edge.source) ?? [], edge.target]);
+	}
+	const byId = new Map(graph.nodes.map((node) => [node.id, node]));
+	const order = [];
+	const ready = graph.nodes.filter((node) => indegree.get(node.id) === 0);
+	while (ready.length > 0) {
+		const node = ready.shift();
+		if (node === void 0) break;
+		order.push(node);
+		for (const target of targets.get(node.id) ?? []) {
+			const left = (indegree.get(target) ?? 0) - 1;
+			indegree.set(target, left);
+			const next = byId.get(target);
+			if (left === 0 && next !== void 0) ready.push(next);
+		}
+	}
+	return order.length === graph.nodes.length ? order : void 0;
+}
+/** `value` as a node, or `undefined` when its id or kind is missing. */
+function nodeOf(value) {
+	if (!isGraphRecord(value)) return void 0;
+	const id = value["id"];
+	const kind = WORKFLOW_NODE_KINDS.find((known) => known === value["kind"]);
+	if (typeof id !== "string" || kind === void 0) return void 0;
+	const { label, step, config, position } = value;
+	return {
+		id,
+		kind,
+		...typeof label === "string" ? { label } : {},
+		...typeof step === "string" ? { step } : {},
+		...isGraphRecord(config) ? { config } : {},
+		...isGraphRecord(position) && typeof position["x"] === "number" && typeof position["y"] === "number" ? { position: {
+			x: position["x"],
+			y: position["y"]
+		} } : {}
+	};
+}
+/** `value` as an edge, or `undefined` when its ends are missing. */
+function edgeOf(value) {
+	if (!isGraphRecord(value)) return void 0;
+	const { id, source, target, branch } = value;
+	if (typeof source !== "string" || typeof target !== "string") return;
+	return {
+		id: typeof id === "string" ? id : `${source}->${target}`,
+		source,
+		target,
+		...branch === "true" || branch === "false" ? { branch } : {}
+	};
+}
+/** Node ids reach generated source and SQL; `validate_workflow_graph` uses the same pattern. */
+const NODE_ID = /^[A-Za-z0-9_-]{1,100}$/;
+const BRANCHING = /* @__PURE__ */ new Set(["condition", "approval"]);
+/**
+* Problems that keep `graph` from running, as messages; empty when it can.
+* Pass the step library's names to check that every step node uses one
+* (`publish` checks it again in SQL).
+*/
+function validateGraph(graph, steps) {
+	if (!isGraphRecord(graph) || !Array.isArray(graph["nodes"]) || !Array.isArray(graph["edges"])) return ["A graph has a nodes array and an edges array"];
+	const errors = [];
+	const library = steps === void 0 ? void 0 : new Set(steps);
+	const nodes = /* @__PURE__ */ new Map();
+	let triggers = 0;
+	for (const value of graph["nodes"]) {
+		const id = isGraphRecord(value) ? value["id"] : void 0;
+		if (!isGraphRecord(value) || typeof id !== "string" || !NODE_ID.test(id)) {
+			errors.push("Every node has an id of 1 to 100 letters, digits, underscores or hyphens");
+			continue;
+		}
+		if (nodes.has(id)) errors.push(`Node ${id} appears twice`);
+		const node = nodeOf(value);
+		if (node === void 0) {
+			errors.push(`Node ${id} has an unknown kind`);
+			continue;
+		}
+		nodes.set(id, node);
+		switch (node.kind) {
+			case "trigger":
+				triggers += 1;
+				break;
+			case "step":
+				if (typeof node.step !== "string" || node.step.length === 0) errors.push(`Node ${id} names no step`);
+				else if (library !== void 0 && !library.has(node.step)) errors.push(`Node ${id} uses step ${node.step}, which is not in the step library`);
+				break;
+			case "sleep":
+				if (durationMs(node.config?.["duration"]) === void 0) errors.push(`Node ${id} has no valid duration`);
+				break;
+			case "approval": break;
+			case "condition":
+				if (conditionOf(node) === void 0) errors.push(`Node ${id} has no valid condition`);
+				break;
+			default: {
+				const unknown = node.kind;
+				errors.push(`Node ${id} has an unknown kind ${String(unknown)}`);
+			}
+		}
+	}
+	if (triggers !== 1) errors.push("A graph has exactly one trigger node");
+	const edgeIds = /* @__PURE__ */ new Set();
+	const edges = [];
+	for (const value of graph["edges"]) {
+		const id = isGraphRecord(value) && typeof value["id"] === "string" ? value["id"] : "?";
+		if (!isGraphRecord(value) || typeof value["source"] !== "string" || typeof value["target"] !== "string" || !nodes.has(value["source"]) || !nodes.has(value["target"])) {
+			errors.push(`Edge ${id} joins a node that does not exist`);
+			continue;
+		}
+		if (edgeIds.has(id)) errors.push(`Edge ${id} appears twice`);
+		edgeIds.add(id);
+		const source = nodes.get(value["source"]);
+		const target = nodes.get(value["target"]);
+		const branch = value["branch"];
+		if (branch !== void 0) {
+			if (branch !== "true" && branch !== "false") errors.push(`Edge ${id} has a branch other than "true" or "false"`);
+			else if (source !== void 0 && !BRANCHING.has(source.kind)) errors.push(`Edge ${id} branches from a ${source.kind} node`);
+		}
+		if (target?.kind === "trigger") errors.push(`Edge ${id} leads into the trigger node`);
+		edges.push({
+			id,
+			source: value["source"],
+			target: value["target"]
+		});
+	}
+	if (errors.length === 0 && topologicalOrder({
+		nodes: [...nodes.values()],
+		edges
+	}) === void 0) errors.push("The graph has a cycle");
+	return errors;
+}
+const nodeContent = (node) => JSON.stringify([
+	node.kind,
+	node.step,
+	node.label,
+	node.config
+]);
+const edgeKey = (edge) => `${edge.source}->${edge.target}${edge.branch === void 0 ? "" : `:${edge.branch}`}`;
+/** What changed from `before` to `after`, by node id and by edge ends. */
+function diffGraphs(before, after) {
+	const old = new Map(before.nodes.map((node) => [node.id, node]));
+	const now = new Map(after.nodes.map((node) => [node.id, node]));
+	const oldEdges = new Set(before.edges.map(edgeKey));
+	const newEdges = new Set(after.edges.map(edgeKey));
+	return {
+		nodes: {
+			added: [...now.keys()].filter((id) => !old.has(id)),
+			removed: [...old.keys()].filter((id) => !now.has(id)),
+			changed: [...now.values()].filter((node) => {
+				const previous = old.get(node.id);
+				return previous !== void 0 && nodeContent(previous) !== nodeContent(node);
+			}).map((node) => node.id)
+		},
+		edges: {
+			added: [...newEdges].filter((key) => !oldEdges.has(key)),
+			removed: [...oldEdges].filter((key) => !newEdges.has(key))
+		}
+	};
+}
+/** `value` as a graph, or an empty one when it isn't shaped like one. */
+function graphOf(value) {
+	if (!isGraphRecord(value)) return {
+		nodes: [],
+		edges: []
+	};
+	const nodes = Array.isArray(value["nodes"]) ? value["nodes"] : [];
+	const edges = Array.isArray(value["edges"]) ? value["edges"] : [];
+	return {
+		nodes: nodes.flatMap((node) => nodeOf(node) ?? []),
+		edges: edges.flatMap((edge) => edgeOf(edge) ?? [])
+	};
+}
+//#endregion
+export { evaluateCondition as a, topologicalOrder as c, durationMs as i, validateGraph as l, conditionOf as n, graphOf as o, diffGraphs as r, isGraphRecord as s, approved as t };

package/dist/h3/index.d.ts

@@ -0,0 +1,59 @@
+import { n as RouteGuardOptions } from "../refusal-D1rgbzNq.js";
+import { t as Validated } from "../shared-DDSjEGDR.js";
+import { AnyEntry, Contributions } from "@supabase/middleware";
+//#region src/bridges/h3.d.ts
+/** The part of an H3 2 event the bridge reads and writes. */
+interface H3Event<Context extends object> {
+  readonly req: Request;
+  readonly context: Context & {
+    /** Nitro's Cloudflare presets put the bindings here. */
+    readonly cloudflare?: {
+      readonly env?: unknown;
+    } | undefined;
+  };
+  /** The status and headers a handler set with `event.res`, kept on a plain return value. */
+  readonly res?: {
+    readonly status?: number | undefined;
+    readonly statusText?: string | undefined;
+    readonly headers?: Headers | undefined;
+  } | undefined;
+}
+interface ToH3Options<Context extends object> {
+  /** The host's env object for `getEnv`; defaults to `event.context.cloudflare.env`. */
+  readonly env?: (event: H3Event<Context>) => unknown;
+}
+/** H3 2 middleware, typed structurally so the package does not import `h3`. */
+type H3Middleware<Context extends object> = (event: H3Event<Context>, next: () => unknown) => Promise<Response>;
+/**
+ * Runs an entry array as H3 2 middleware (`app.use(...)`, Nitro and Nuxt
+ * server middleware). Every contributed key lands on `event.context`, and
+ * the handler's value comes back as a `Response` (JSON for plain values)
+ * so response-phase entries can add headers and cookies.
+ *
+ * ```ts
+ * app.use(toH3([withBetterSupabase(server)]))
+ * app.get('/notes', (event) => event.context.db.notes.findMany().orThrow())
+ * ```
+ */
+export declare function toH3<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, options?: ToH3Options<Partial<Contributions<Entries>>>): H3Middleware<Partial<Contributions<Entries>>>;
+//#endregion
+//#region src/h3/guard.d.ts
+/**
+ * Route middleware that refuses callers outside `options`: Problem Details,
+ * or a redirect to `signIn` or `mfa`. Runs after `toH3(...)`.
+ *
+ * ```ts
+ * app.get('/admin', handler, { middleware: [guard({ roles: ['admin'] })] })
+ * ```
+ */
+export declare function guard(options?: RouteGuardOptions): (event: H3Event<object>, next: () => unknown) => Promise<unknown>;
+/**
+ * An `onError` handler for `new H3({ onError })` that answers thrown
+ * `DbException`s (from `.orThrow()`) with Problem Details and leaves every
+ * other error to H3.
+ */
+export declare function problemOnError(options?: {
+  readonly expose?: boolean;
+}): (error: unknown, event: H3Event<object>) => Response | undefined;
+//#endregion
+export type { H3Event, H3Middleware, RouteGuardOptions, ToH3Options };