better-supabase 0.5.0 → 0.6.0

package/dist/powersync/index.js

@@ -0,0 +1,199 @@
+import { n as dbError } from "../errors-B11Duf73.js";
+import { r as err } from "../result-DzUbqgdW.js";
+import { n as watch, t as sqliteTables } from "../watch-Xuxrvxq-.js";
+import { a as sqliteCompiler, c as quoteSqliteIdent, i as checkSqlite, l as sqliteValue, n as postgrestTimestamp, o as compileSqlite, r as powersyncExecutor, s as likeToGlob, t as fromSqliteError } from "../executor-Bq28caBo.js";
+//#region src/powersync/auth.ts
+/**
+* Syncs while a user is signed in: connects on sign-in, and on sign-out
+* (or a different user) disconnects and clears the local database. An app
+* that starts signed out clears it too, since the rows may belong to a user
+* whose session ended while the app was closed. Steps
+* run one at a time in order. Returns a function that stops following the
+* session and disconnects.
+*
+* ```ts
+* useEffect(() => syncWithAuth(powersync, bs.auth, { connector }), []);
+* ```
+*/
+function syncWithAuth(db, auth, options) {
+	const clear = options.clearOnSignOut ?? true;
+	let user;
+	let stopped = false;
+	let queue = Promise.resolve();
+	const enqueue = (step) => {
+		queue = queue.then(step).catch((cause) => {
+			options.onError?.(cause);
+		});
+	};
+	const leave = () => clear ? db.disconnectAndClear() : db.disconnect();
+	const follow = () => {
+		if (stopped) return;
+		const snapshot = auth.current();
+		if (snapshot.status === "loading") return;
+		const next = snapshot.status === "signed-in" ? snapshot.user.id : null;
+		if (next === user) return;
+		const previous = user;
+		user = next;
+		if (previous === void 0 ? next === null && clear : previous !== null) enqueue(leave);
+		if (next !== null) enqueue(() => db.connect(options.connector));
+	};
+	follow();
+	const unsubscribe = auth.subscribe(follow);
+	return () => {
+		stopped = true;
+		unsubscribe();
+		enqueue(() => db.disconnect());
+	};
+}
+//#endregion
+//#region src/powersync/connector.ts
+const OUTCOMES = {
+	network: "retry",
+	timeout: "retry",
+	aborted: "retry",
+	rate_limited: "retry",
+	quota_exceeded: "retry",
+	serialization: "retry",
+	unauthorized: "retry",
+	unexpected: "retry",
+	conflict: "conflict",
+	stale: "conflict",
+	foreign_key: "conflict",
+	not_found: "discard",
+	forbidden: "discard",
+	check: "discard",
+	not_null: "discard",
+	exclusion: "discard",
+	invalid_input: "discard",
+	invalid_value: "discard",
+	raised: "discard",
+	invalid_request: "discard",
+	max_affected: "discard",
+	validation: "discard",
+	multiple_rows: "discard",
+	unsupported: "discard"
+};
+/**
+* The default for a failed upload: transient errors retry, a newer server
+* row is a conflict, and a change the server will never accept is
+* discarded so it doesn't block the queue.
+*/
+function uploadOutcome(kind) {
+	return OUTCOMES[kind];
+}
+function rejectedStore() {
+	let changes = [];
+	const listeners = /* @__PURE__ */ new Set();
+	const set = (next) => {
+		changes = next;
+		for (const listener of [...listeners]) listener();
+	};
+	return {
+		current: () => changes,
+		subscribe: (listener) => {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		},
+		dismiss: (change) => {
+			set(change ? changes.filter((each) => each !== change) : []);
+		},
+		add: (change) => {
+			set([...changes, change]);
+		}
+	};
+}
+function replay(route, entry) {
+	if (typeof route === "function") return route(entry);
+	const data = entry.opData ?? {};
+	switch (entry.op) {
+		case "PUT": return route.upsert({
+			...data,
+			id: entry.id
+		});
+		case "PATCH": return route.update(entry.id, data);
+		case "DELETE": return route.delete(entry.id);
+		default: return Promise.resolve(err(dbError("unsupported", `better-supabase: unknown PowerSync op ${entry.op}`)));
+	}
+}
+/**
+* A PowerSync connector that authenticates with the Supabase session and
+* replays queued changes through repositories. Changes upload in batches;
+* a transient error keeps the batch queued for PowerSync's retry, and
+* refused changes land in `rejected` instead of blocking the queue. A table
+* without a route stops the upload with an error, so no change is dropped
+* silently. When the session is gone (the refresh token was revoked), the
+* upload stops until the user signs in again.
+*
+* ```ts
+* const connector = createUploadConnector({
+*   endpoint: process.env.EXPO_PUBLIC_POWERSYNC_URL,
+*   supabase,
+*   tables: { customers: bs.db.customers },
+* });
+* await powersync.connect(connector);
+* ```
+*/
+function createUploadConnector(options) {
+	const rejected = rejectedStore();
+	const batchSize = options.batchSize ?? 100;
+	const signedIn = async () => {
+		const { data } = await options.supabase.auth.getSession();
+		return data.session !== null;
+	};
+	return {
+		rejected,
+		async fetchCredentials() {
+			const { data } = await options.supabase.auth.getSession();
+			const session = data.session;
+			if (!session) return null;
+			return {
+				endpoint: options.endpoint,
+				token: session.access_token,
+				...session.expires_at === void 0 ? {} : { expiresAt: /* @__PURE__ */ new Date(session.expires_at * 1e3) }
+			};
+		},
+		async uploadData(database) {
+			const batch = await database.getCrudBatch(batchSize);
+			if (!batch) return;
+			for (const entry of batch.crud) {
+				const route = options.tables[entry.table];
+				if (!route) throw new Error(`better-supabase: no upload route for PowerSync table "${entry.table}"; add it to createUploadConnector({ tables })`);
+				const result = await replay(route, entry);
+				if (result.ok) continue;
+				const { error } = result;
+				const outcome = options.classify?.(error, entry) ?? uploadOutcome(error.kind);
+				switch (outcome) {
+					case "retry":
+						if (error.kind === "unauthorized" && !await signedIn()) return;
+						throw new Error(error.message);
+					case "conflict": {
+						const change = {
+							entry,
+							error,
+							outcome
+						};
+						rejected.add(change);
+						options.onConflict?.(change);
+						break;
+					}
+					case "discard": {
+						const change = {
+							entry,
+							error,
+							outcome
+						};
+						rejected.add(change);
+						options.onDiscard?.(change);
+						break;
+					}
+					default: throw new TypeError(`Unhandled upload outcome ${String(outcome)}`);
+				}
+			}
+			await batch.complete();
+		}
+	};
+}
+//#endregion
+export { checkSqlite, compileSqlite, createUploadConnector, fromSqliteError, likeToGlob, postgrestTimestamp, powersyncExecutor, quoteSqliteIdent, sqliteCompiler, sqliteTables, sqliteValue, syncWithAuth, uploadOutcome, watch };

package/dist/powersync/react/index.d.ts

@@ -0,0 +1,87 @@
+import { b as DbError, f as Result } from "../../result-D7y2fT87.js";
+import { t as PowerSyncDatabaseLike } from "../../executor-CaWigTyR.js";
+import { i as RejectedStore, r as RejectedChange } from "../../connector-Dv8kK0MO.js";
+//#region src/powersync/react/index.d.ts
+export interface UseWatchOptions<T> {
+  readonly db: PowerSyncDatabaseLike;
+  /** The repository call, e.g. `() => list.run(local, query)`. */
+  readonly query: () => PromiseLike<Result<T>>;
+  /** SQLite tables whose changes rerun the query (`sqliteTables()`). */
+  readonly tables: readonly string[];
+  /** Values the query reads; a change restarts the watch. */
+  readonly deps?: readonly unknown[];
+  readonly throttleMs?: number;
+  /** False pauses the watch and keeps the last result. Defaults to true. */
+  readonly enabled?: boolean;
+}
+export interface WatchState<T> {
+  readonly result: Result<T> | undefined;
+  readonly data: T | undefined;
+  readonly error: DbError | undefined;
+  /** No result yet for the current `deps`. */
+  readonly loading: boolean;
+}
+/**
+ * A live repository call over PowerSync's SQLite database: reruns when
+ * one of `tables` changes, keeps unchanged rows' identity, and restarts
+ * when `deps` change.
+ *
+ * ```tsx
+ * const { data, loading } = useWatch({
+ *   db: powersync,
+ *   query: () => customerList.run(local, { ...customerList.defaults, search }),
+ *   tables,
+ *   deps: [search],
+ * });
+ * ```
+ */
+export declare function useWatch<T>(options: UseWatchOptions<T>): WatchState<T>;
+/** The part of PowerSync's `SyncStatus` `useSyncStatus` reads. */
+export interface SyncStatusLike {
+  readonly connected: boolean;
+  readonly connecting?: boolean;
+  readonly hasSynced?: boolean | undefined;
+  readonly dataFlowStatus: {
+    readonly uploading: boolean;
+    readonly downloading: boolean;
+    readonly uploadError?: Error | undefined;
+    readonly downloadError?: Error | undefined;
+  };
+}
+/** The part of a PowerSync database `useSyncStatus` subscribes to. */
+export interface SyncStatusSource {
+  readonly currentStatus: SyncStatusLike;
+  registerListener(listener: {
+    statusChanged?: (status: SyncStatusLike) => void;
+  }): () => void;
+}
+export interface SyncState {
+  readonly connected: boolean;
+  readonly connecting: boolean;
+  /** The first full sync finished; before it, local reads may be empty. */
+  readonly hasSynced: boolean;
+  readonly uploading: boolean;
+  readonly downloading: boolean;
+  readonly error: Error | undefined;
+}
+/**
+ * PowerSync's connection and sync progress, for a status badge or a
+ * "syncing" banner. Re-renders only when one of the fields changes.
+ */
+export declare function useSyncStatus(db: SyncStatusSource): SyncState;
+export interface Conflicts {
+  /** Changes the server refused, oldest first. */
+  readonly changes: readonly RejectedChange[];
+  /** Forgets one change after the UI handled it, or all of them. */
+  readonly dismiss: (change?: RejectedChange) => void;
+}
+/**
+ * The changes `createUploadConnector` could not upload: conflicts with a
+ * newer server row and changes the server refused. Show them next to the
+ * row, then `dismiss` them.
+ */
+export declare function useConflicts(connector: {
+  readonly rejected: RejectedStore;
+}): Conflicts;
+//#endregion
+export type { RejectedChange, RejectedStore };

package/dist/powersync/react/index.js

@@ -0,0 +1,108 @@
+"use client";
+import { n as watch } from "../../watch-Xuxrvxq-.js";
+import { useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
+//#region src/powersync/react/index.ts
+/**
+* A live repository call over PowerSync's SQLite database: reruns when
+* one of `tables` changes, keeps unchanged rows' identity, and restarts
+* when `deps` change.
+*
+* ```tsx
+* const { data, loading } = useWatch({
+*   db: powersync,
+*   query: () => customerList.run(local, { ...customerList.defaults, search }),
+*   tables,
+*   deps: [search],
+* });
+* ```
+*/
+function useWatch(options) {
+	const { db, tables, throttleMs } = options;
+	const enabled = options.enabled ?? true;
+	const key = JSON.stringify([tables, options.deps ?? []]);
+	const [state, setState] = useState({
+		key,
+		result: void 0
+	});
+	const latest = useRef({
+		query: options.query,
+		tables
+	});
+	latest.current = {
+		query: options.query,
+		tables
+	};
+	useEffect(() => {
+		if (!enabled) return;
+		return watch(db, () => latest.current.query(), {
+			tables: latest.current.tables,
+			onResult: (result) => {
+				setState({
+					key,
+					result
+				});
+			},
+			...throttleMs === void 0 ? {} : { throttleMs }
+		});
+	}, [
+		db,
+		key,
+		enabled,
+		throttleMs
+	]);
+	const result = state.result;
+	return {
+		result,
+		data: result?.ok ? result.data : void 0,
+		error: result && !result.ok ? result.error : void 0,
+		loading: state.key !== key || result === void 0
+	};
+}
+function stateOf(status) {
+	const flow = status.dataFlowStatus;
+	return {
+		connected: status.connected,
+		connecting: status.connecting ?? false,
+		hasSynced: status.hasSynced ?? false,
+		uploading: flow.uploading,
+		downloading: flow.downloading,
+		error: flow.uploadError ?? flow.downloadError
+	};
+}
+function sameState(a, b) {
+	return a.connected === b.connected && a.connecting === b.connecting && a.hasSynced === b.hasSynced && a.uploading === b.uploading && a.downloading === b.downloading && a.error === b.error;
+}
+/**
+* PowerSync's connection and sync progress, for a status badge or a
+* "syncing" banner. Re-renders only when one of the fields changes.
+*/
+function useSyncStatus(db) {
+	const store = useMemo(() => statusStore(db), [db]);
+	return useSyncExternalStore(store.subscribe, store.read, store.read);
+}
+/** Keeps the last snapshot while its fields stay equal, as `useSyncExternalStore` needs. */
+function statusStore(db) {
+	let snapshot = stateOf(db.currentStatus);
+	return {
+		read: () => {
+			const next = stateOf(db.currentStatus);
+			if (!sameState(snapshot, next)) snapshot = next;
+			return snapshot;
+		},
+		subscribe: (listener) => db.registerListener({ statusChanged: listener })
+	};
+}
+/**
+* The changes `createUploadConnector` could not upload: conflicts with a
+* newer server row and changes the server refused. Show them next to the
+* row, then `dismiss` them.
+*/
+function useConflicts(connector) {
+	const { rejected } = connector;
+	return {
+		changes: useSyncExternalStore(rejected.subscribe, rejected.current, rejected.current),
+		dismiss: rejected.dismiss
+	};
+}
+//#endregion
+export { useConflicts, useSyncStatus, useWatch };

package/dist/{problem-BW1KhzSG.js → problem-BreOl8b8.js}

@@ -1,4 +1,4 @@
-import { n as dbError } from "./errors-DtwXa6b8.js";
+import { n as dbError } from "./errors-B11Duf73.js";
 //#region src/core/problem.ts
 const PROBLEM_TYPE_BASE = "https://bettersupabase.com/problems/";
 const PROBLEM_CONTENT_TYPE = "application/problem+json";
@@ -22,7 +22,10 @@ const TITLES = {
 	validation: "Validation failed",
 	multiple_rows: "More than one row matched",
 	stale: "Row changed since it was read",
+	max_affected: "Too many rows affected",
 	rate_limited: "Too many requests",
+	quota_exceeded: "Quota exceeded",
+	unsupported: "Not supported by this executor",
 	unexpected: "Unexpected error"
 };
 /** Kinds whose message may contain internals (SQL, hostnames), hidden unless `expose` is set. */
@@ -50,6 +53,9 @@ function toProblem(error, options = {}) {
 	if ("required" in error) problem["required"] = error.required;
 	if ("scopes" in error) problem["scopes"] = error.scopes;
 	if ("retryAfter" in error) problem["retryAfter"] = error.retryAfter;
+	if ("meter" in error) problem["meter"] = error.meter;
+	if ("limit" in error) problem["limit"] = error.limit;
+	if ("maxAffected" in error) problem["maxAffected"] = error.maxAffected;
 	return problem;
 }
 /**
@@ -69,7 +75,9 @@ function problemResponse(error, options = {}) {
 		headers.set("www-authenticate", `Bearer realm="${realm}", error="insufficient_scope", scope="${scope}"`);
 	}
 	if ("retryAfter" in error && !headers.has("retry-after")) headers.set("retry-after", String(error.retryAfter));
-	return new Response(JSON.stringify(toProblem(error, options)), {
+	const problem = toProblem(error, options);
+	const body = options.format ? options.format(problem, error) : problem;
+	return new Response(JSON.stringify(body), {
 		status: error.status,
 		headers
 	});
@@ -94,7 +102,10 @@ function fromProblem(problem) {
 		"column",
 		"required",
 		"scopes",
-		"retryAfter"
+		"retryAfter",
+		"meter",
+		"limit",
+		"maxAffected"
 	]) if (problem[key] !== void 0) extra[key] = problem[key];
 	extra["issues"] = problem.issues ?? [];
 	if (kind !== "validation") delete extra["issues"];

package/dist/{problem-Blxe8S31.d.ts → problem-DD8LZFjc.d.ts}

@@ -1,4 +1,4 @@
-import { _ as DbError, v as DbErrorKind, w as ValidationIssue } from "./executor-BunPOO-k.js";
+import { E as ValidationIssue, b as DbError, x as DbErrorKind } from "./result-D7y2fT87.js";
 //#region src/core/problem.d.ts
 /** RFC 9457 Problem Details, with the `DbError` fields as extension members. */
 interface ProblemDetails {
@@ -19,8 +19,13 @@ interface ProblemDetails {
   readonly required?: "aal1" | "aal2";
   /** The OAuth scopes a `forbidden` answer needs. */
   readonly scopes?: readonly string[];
-  /** Seconds until a `rate_limited` caller may retry. */
+  /** Seconds until a `rate_limited` or `quota_exceeded` caller may retry. */
   readonly retryAfter?: number;
+  /** The meter a `quota_exceeded` answer ran out of, and its limit. */
+  readonly meter?: string;
+  readonly limit?: number;
+  /** The row limit a `max_affected` write exceeded. */
+  readonly maxAffected?: number;
 }
 declare const PROBLEM_TYPE_BASE = "https://bettersupabase.com/problems/";
 declare const PROBLEM_CONTENT_TYPE = "application/problem+json";
@@ -30,10 +35,23 @@ interface ProblemOptions {
   /** Include messages of internal errors. Defaults to false. */
   readonly expose?: boolean;
 }
+/**
+ * Rewrites the Problem Details a block answers with into the app's own error
+ * body, such as its `type` URIs and error codes. The status, `Retry-After`
+ * and `WWW-Authenticate` headers stay as they are.
+ */
+type ProblemFormat = (problem: ProblemDetails, error: DbError) => Readonly<Record<string, unknown>>;
+/** The `problem` option of the blocks that answer HTTP requests. */
+interface BlockProblemOptions {
+  /** The app's error body for the block's error responses. Defaults to RFC 9457 Problem Details. */
+  readonly problem?: ProblemFormat;
+}
 interface ProblemResponseOptions extends ProblemOptions {
   readonly headers?: ConstructorParameters<typeof Headers>[0];
   /** `realm` of the RFC 6750 challenge on 401. */
   readonly realm?: string;
+  /** Rewrites the body; see `ProblemFormat`. */
+  readonly format?: ProblemFormat | undefined;
 }
 /** Converts a `DbError` to Problem Details. */
 declare function toProblem(error: DbError, options?: ProblemOptions): ProblemDetails;
@@ -46,4 +64,4 @@ declare function isProblem(value: unknown): value is ProblemDetails;
 /** Turns a Problem Details body back into a `DbError` (client side). */
 declare function fromProblem(problem: ProblemDetails): DbError;
 //#endregion
-export { ProblemResponseOptions as a, problemResponse as c, ProblemOptions as i, toProblem as l, PROBLEM_TYPE_BASE as n, fromProblem as o, ProblemDetails as r, isProblem as s, PROBLEM_CONTENT_TYPE as t };
+export { ProblemFormat as a, fromProblem as c, toProblem as d, ProblemDetails as i, isProblem as l, PROBLEM_CONTENT_TYPE as n, ProblemOptions as o, PROBLEM_TYPE_BASE as r, ProblemResponseOptions as s, BlockProblemOptions as t, problemResponse as u };

package/dist/provider-BH5UWZJ6.d.ts

@@ -0,0 +1,113 @@
+/// <reference lib="esnext.temporal" />
+import { b as DbError, t as AsyncResult } from "./result-D7y2fT87.js";
+import { r as AuthState } from "./resolve-KW8nCeL6.js";
+//#region src/credentials/provider.d.ts
+/**
+ * Names a credential without holding it. Tables store this as a
+ * `credential_ref jsonb` column; `provider` picks the `CredentialProvider`
+ * and the other keys are that provider's.
+ */
+type CredentialRef = {
+  readonly provider: string;
+  /**
+   * The tenant that owns the credential. A provider resolves, sets and
+   * revokes a ref with `tenant` only inside that tenant's namespace, so a
+   * tenant admin who picks a ref can never name another tenant's or the
+   * app's secret.
+   */
+  readonly tenant?: string;
+} & Readonly<Record<string, unknown>>;
+/** `ref` bound to `tenant`'s namespace. */
+declare function tenantCredentialRef<R extends CredentialRef>(tenant: string, ref: R): R & {
+  readonly tenant: string;
+};
+/**
+ * Whether `ref` belongs to `tenant`: its `tenant` is exactly that tenant.
+ * Without a tenant (an app-level row), only a ref without one belongs.
+ */
+declare function credentialRefInTenant(ref: CredentialRef, tenant: string | undefined): boolean;
+/** The error for a ref that names a credential outside the row's tenant. */
+declare function foreignCredentialRef(tenant: string | undefined): DbError;
+/** Whose credential to use: the app's own, or one a user connected. */
+type CredentialSubject = {
+  readonly type: "app";
+} | {
+  readonly type: "user";
+  readonly id: string;
+  readonly issuer?: string;
+};
+interface GetTokenOptions {
+  readonly subject: CredentialSubject;
+  readonly scopes?: readonly string[];
+  readonly installationId?: string;
+  readonly signal?: AbortSignal;
+}
+interface CredentialToken {
+  readonly token: string;
+  /** Unset when the provider doesn't know when the token expires. */
+  readonly expiresAt?: Temporal.Instant;
+  /** Headers that authenticate a request with this token. */
+  readonly headers: Readonly<Record<string, string>>;
+}
+interface CredentialCapabilities {
+  /** The ref holds one credential per user subject. */
+  readonly userSubjects: boolean;
+  /** `startAuthorization` can send the user to connect the account. */
+  readonly authorization: boolean;
+  readonly revoke: boolean;
+  /** `verifyInbound` can check requests the third party sends. */
+  readonly inbound: boolean;
+}
+interface StartAuthorizationOptions {
+  readonly subject: CredentialSubject;
+  readonly redirectUri: string;
+  readonly scopes?: readonly string[];
+  readonly state?: string;
+}
+interface CompleteAuthorizationOptions {
+  readonly subject: CredentialSubject;
+  /** The callback request, or its URL, that carries the code and state. */
+  readonly callback: Request | URL | string;
+}
+/**
+ * Resolves `CredentialRef`s to tokens. Versioned: a breaking change to this
+ * contract ships a new `apiVersion`. Errors are `DbError`s: `invalid_input`
+ * for a ref the provider doesn't handle, `not_found` when no credential is
+ * stored, `forbidden` when the subject may not use it.
+ */
+interface CredentialProvider {
+  readonly apiVersion: 1;
+  readonly name: string;
+  getToken(ref: CredentialRef, options: GetTokenOptions): AsyncResult<CredentialToken>;
+  capabilities(ref: CredentialRef): CredentialCapabilities;
+  /** The URL to send the user to; only when `capabilities(ref).authorization`. */
+  startAuthorization?(ref: CredentialRef, options: StartAuthorizationOptions): AsyncResult<{
+    readonly url: string;
+  }>;
+  completeAuthorization?(ref: CredentialRef, options: CompleteAuthorizationOptions): AsyncResult<void>;
+  /** Forgets the stored credential; `false` when there was none. */
+  revoke(ref: CredentialRef, options: {
+    readonly subject: CredentialSubject;
+  }): AsyncResult<boolean>;
+  /** Checks a request the third party sent (a webhook) against the ref's secret. */
+  verifyInbound?(request: Request, ref: CredentialRef): AsyncResult<boolean>;
+  /**
+   * Stores or replaces the credential a ref names, for `subject` when the
+   * ref is per user. Optional: a provider without it can't take a secret
+   * from the app (an OAuth-only provider, say).
+   */
+  set?(ref: CredentialRef, value: string, options?: SetCredentialOptions): AsyncResult<void>;
+}
+interface SetCredentialOptions {
+  readonly subject?: CredentialSubject;
+  readonly description?: string;
+}
+/**
+ * The subject for a request: the user behind a session or a user-bound API
+ * key, the app for the service role, and `undefined` for anyone else.
+ */
+declare function subjectFor(context: {
+  readonly auth: AuthState;
+}): CredentialSubject | undefined;
+//#endregion
+export { CredentialSubject as a, SetCredentialOptions as c, foreignCredentialRef as d, subjectFor as f, CredentialRef as i, StartAuthorizationOptions as l, CredentialCapabilities as n, CredentialToken as o, tenantCredentialRef as p, CredentialProvider as r, GetTokenOptions as s, CompleteAuthorizationOptions as t, credentialRefInTenant as u };

package/dist/provider-Di3sRutW.js

@@ -0,0 +1,57 @@
+import { n as dbError } from "./errors-B11Duf73.js";
+//#region src/credentials/provider.ts
+/** `ref` bound to `tenant`'s namespace. */
+function tenantCredentialRef(tenant, ref) {
+	return {
+		...ref,
+		tenant
+	};
+}
+/**
+* Whether `ref` belongs to `tenant`: its `tenant` is exactly that tenant.
+* Without a tenant (an app-level row), only a ref without one belongs.
+*/
+function credentialRefInTenant(ref, tenant) {
+	const owner = ref.tenant;
+	return tenant === void 0 ? owner === void 0 : typeof owner === "string" && owner === tenant;
+}
+/** The error for a ref that names a credential outside the row's tenant. */
+function foreignCredentialRef(tenant) {
+	return dbError("forbidden", tenant === void 0 ? "An app-level credential_ref can't name a tenant's credential" : `The credential_ref names a credential outside tenant "${tenant}"`, { hint: "CREDENTIAL_REF_FOREIGN" });
+}
+/** Checks the provider's `apiVersion` before the server uses it. */
+function credentialProviderOf(provider) {
+	const version = provider.apiVersion;
+	if (version !== 1) throw new TypeError(`credentials "${provider.name}" targets credential provider API ${String(version)}; this better-supabase supports 1. Upgrade better-supabase or use a release of the provider for API 1.`);
+	return provider;
+}
+/**
+* The subject for a request: the user behind a session or a user-bound API
+* key, the app for the service role, and `undefined` for anyone else.
+*/
+function subjectFor(context) {
+	const { auth } = context;
+	switch (auth.kind) {
+		case "user": {
+			const issuer = auth.claims.iss;
+			return typeof issuer === "string" && issuer.length > 0 ? {
+				type: "user",
+				id: auth.claims.sub,
+				issuer
+			} : {
+				type: "user",
+				id: auth.claims.sub
+			};
+		}
+		case "apiKey": return auth.userId === void 0 ? void 0 : {
+			type: "user",
+			id: auth.userId
+		};
+		case "service": return { type: "app" };
+		case "anon":
+		case "invalid": return;
+		default: return auth;
+	}
+}
+//#endregion
+export { tenantCredentialRef as a, subjectFor as i, credentialRefInTenant as n, foreignCredentialRef as r, credentialProviderOf as t };

package/dist/query/index.d.ts

@@ -1,2 +1,4 @@
-import { a as MutationOptionsOf, c as QueryKeyOf, d as createQueries, f as invalidateOnMutation, h as invalidateTables, i as InfiniteOptionsOf, l as QueryOptionsOf, m as BetterQueryMeta, n as clearOnUserChange, o as QueriesOptions, p as queryCache, r as BetterQueries, s as QueryHelpers, t as UserChangeSource, u as TableQueries } from "../index-DgILJRXj.js";
-export { type BetterQueries, type BetterQueryMeta, type InfiniteOptionsOf, type MutationOptionsOf, type QueriesOptions, type QueryHelpers, type QueryKeyOf, type QueryOptionsOf, type TableQueries, type UserChangeSource, clearOnUserChange, createQueries, invalidateOnMutation, invalidateTables, queryCache };
+import { t as escapeLike } from "../escape-like-ImTK0ps_.js";
+import { n as invalidateTables, t as BetterQueryMeta } from "../invalidate-BBqhpxyB.js";
+import { _ as invalidateOnMutation, a as UserChangeSource, c as InfiniteExtras, d as QueriesOptions, f as QueryHelpers, g as createQueries, h as TableQueries, i as optimistic, l as InfiniteOptionsOf, m as QueryOptionsOf, n as OptimisticSnapshot, o as clearOnUserChange, p as QueryKeyOf, r as OptimisticTarget, s as BetterQueries, t as OptimisticHandlers, u as MutationOptionsOf, v as queryCache } from "../index-Bepi-Hgg.js";
+export { type BetterQueries, type BetterQueryMeta, type InfiniteExtras, type InfiniteOptionsOf, type MutationOptionsOf, type OptimisticHandlers, type OptimisticSnapshot, type OptimisticTarget, type QueriesOptions, type QueryHelpers, type QueryKeyOf, type QueryOptionsOf, type TableQueries, type UserChangeSource, clearOnUserChange, createQueries, escapeLike, invalidateOnMutation, invalidateTables, optimistic, queryCache };

package/dist/query/index.js

@@ -1,3 +1,4 @@
-import { n as invalidateTables, t as clearOnUserChange } from "../user-change-CHFEUro1.js";
-import { n as invalidateOnMutation, r as queryCache, t as createQueries } from "../query-CCbo44lG.js";
-export { clearOnUserChange, createQueries, invalidateOnMutation, invalidateTables, queryCache };
+import { t as escapeLike } from "../escape-like-DHfx6jRr.js";
+import { r as invalidateTables, t as clearOnUserChange } from "../user-change-XzvgafU4.js";
+import { i as queryCache, n as createQueries, r as invalidateOnMutation, t as optimistic } from "../query-BQ-NaZon.js";
+export { clearOnUserChange, createQueries, escapeLike, invalidateOnMutation, invalidateTables, optimistic, queryCache };