better-supabase 0.5.0 → 0.6.0

package/dist/run-state-CgBKzYMW.js

@@ -0,0 +1,13 @@
+//#region src/core/run-state.ts
+/** The states a run ends in, in the order blocks list them. */
+const FINAL_RUN_STATES = [
+	"completed",
+	"failed",
+	"cancelled"
+];
+/** Reads a stored run state; a value outside `states` reads as `fallback`. */
+function runStateOf(value, states, fallback) {
+	return states.find((member) => member === value) ?? fallback;
+}
+//#endregion
+export { runStateOf as n, FINAL_RUN_STATES as t };

package/dist/search-CUWCRYKL.js

@@ -0,0 +1,9 @@
+//#region src/core/search.ts
+/** pgvector's text form, or `undefined` for anything that isn't a finite vector. */
+function vectorLiteral(vector) {
+	if (typeof vector === "string") return /^\[[^\]]+\]$/.test(vector.trim()) ? vector.trim() : void 0;
+	if (vector.length === 0 || !vector.every(Number.isFinite)) return void 0;
+	return `[${vector.join(",")}]`;
+}
+//#endregion
+export { vectorLiteral as t };

package/dist/server/index.d.ts

@@ -1,22 +1,79 @@
-import { n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
-import { _ as DbError } from "../executor-BunPOO-k.js";
-import { t as BetterSupabase, y as Db } from "../define-Bp_BZa5h.js";
-import { g as RequestContext } from "../plugin-o144f322.js";
-import { _ as readSession, a as ResolveAuthOptions, b as writeSession, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as StoredSession, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, y as sessionCookieName } from "../resolve-C15TJq77.js";
-import { a as SupportSession, c as sqlSupportStore, i as SupportListFilter, l as supportClaims, n as SupportCallerClaims, o as SupportSessionStore, r as SupportEndedBy, s as SupportStartInput, t as SqlSupportStoreOptions } from "../support-DT-OhSxD.js";
-import { A as clearSupportCookie, C as SupportOptions, D as supportSessions, E as SupportStartRequest, M as supportCookieValue, O as SUPPORT_COOKIE, S as SupportAuthorizeInput, T as SupportSessions, _ as ReplicaState, a as Settled, b as ActiveSupport, c as respond, d as ContextOptions, f as ServerContext, g as PRIMARY_COOKIE, h as createServer, i as RespondOptions, j as supportCookie, k as SupportCookieOptions, l as settle, m as TENANT_HEADER, n as GuardOptions, o as guard, p as ServerOptions, r as MiddlewareOptions, s as isResult, t as AuthKind, u as BetterServer, v as DeleteAccountOptions, w as SupportPolicy, x as SupportApi, y as DeleteAccountResult } from "../respond-D2OQl62-.js";
-import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-CusDgPaD.js";
-import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-D8iqWMr-.js";
-import { a as ProblemResponseOptions, c as problemResponse, i as ProblemOptions, l as toProblem, n as PROBLEM_TYPE_BASE, o as fromProblem, r as ProblemDetails, s as isProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-Blxe8S31.js";
-import { a as SessionDelegation, i as SessionActor, n as toSession, r as ActClaim, t as AuthSession } from "../view-BEf0diC5.js";
-import { n as supportOf, t as SupportView } from "../support-view-Da5peKFg.js";
-import { n as RefreshOutcome, r as refreshSession } from "../refresh-BTrQ_ZTp.js";
+import { b as DbError } from "../result-D7y2fT87.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
+import { m as RequestContext } from "../plugin-FGY8UhYm.js";
+import { _ as writeSession, a as CookieWrite, c as StoredSession, h as sessionCookieName, n as CookieOptions, p as readSession, r as CookieRecord, t as AUTH_CACHE_HEADERS } from "../session-ChiXDZdZ.js";
+import { a as ResolveAuthOptions, c as clientIp, i as InvalidReason, l as resolveAuth, n as AuthResolver, o as ResolvedState, r as AuthState, s as authContext, t as AuthResolution } from "../resolve-KW8nCeL6.js";
+import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DD8LZFjc.js";
+import { B as DbStats, b as Db, t as BetterSupabase } from "../define-CJJkkr1-.js";
+import { A as clearSupportCookie, B as sqlSupportStore, C as SupportOptions, D as supportSessions, E as SupportStartRequest, F as SupportEndedBy, I as SupportListFilter, L as SupportSession, M as supportCookieValue, N as SqlSupportStoreOptions, O as SUPPORT_COOKIE, P as SupportCallerClaims, R as SupportSessionStore, S as SupportAuthorizeInput, T as SupportSessions, V as supportClaims, _ as DeleteAccountOptions, a as ServerDbOptions, b as ActiveSupport, c as createServer, d as SuspendAccountOptions, f as SuspendAccountResult, g as ReplicaState, h as PRIMARY_COOKIE, i as ServerContext, j as supportCookie, k as SupportCookieOptions, l as extendServer, m as suspendAccount, n as ContextOptions, o as ServerOptions, p as endSessions, r as ForContextOptions, s as TENANT_HEADER, t as BetterServer, u as EndSessionsResult, v as DeleteAccountResult, w as SupportPolicy, x as SupportApi, y as deleteAccount, z as SupportStartInput } from "../server-CeVeeXwz.js";
+import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-Daak8ukG.js";
+import { n as SessionActor, r as SessionDelegation, t as ActClaim } from "../actor-CQTlc1Hh.js";
+import { n as toSession, t as AuthSession } from "../view-DbxLNu8L.js";
+import { a as SessionEntryConfig, c as withGuard, i as withBetterSupabase, l as ServerCore, n as BetterSupabaseContributions, o as withSession, r as BetterSupabaseEntry, s as GuardEntryConfig, t as BetterSupabaseConfig, u as serverCore } from "../composite-Bt1YK3Ke.js";
+import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-DoBijysA.js";
+import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-B5tid-q5.js";
+import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-D6Uc7Sk7.js";
+import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-Cx-LnIQP.js";
+import { n as supportOf, t as SupportView } from "../support-view-33Oi07TT.js";
+import { a as sessionStatus, c as refreshSession, i as clearSessionCookies, n as SessionStatus, r as SessionStatusOptions, s as RefreshOutcome, t as ClearSessionCookiesOptions } from "../ended-jLfvw8h-.js";
 import { SupabaseClient } from "@supabase/supabase-js";
-import { Middleware } from "@supabase/middleware";
+import { Middleware, SingleKeyEntry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
 import { PostgresApi } from "@supabase/server/middleware/postgres";
-//#region src/server/middleware.d.ts
-/** The `withSupabase` context keys `withBetterSupabase` reads. */
+//#region src/server/audit.d.ts
+/** The CloudEvents `source` of the events the server sends to its `audit` sink. */
+export declare const SERVER_EVENT_SOURCE = "/better-supabase/server";
+type AccountEventType = "account.suspended" | "account.unsuspended" | "account.deleted" | "account.sessions_ended";
+//#endregion
+//#region src/server/adapter.d.ts
+interface HandleOptions extends MiddlewareOptions {
+  /** Include error messages in problem responses. Defaults to `NODE_ENV === 'development'`. */
+  readonly expose?: boolean;
+  /** Problem Details `instance`. Defaults to the request path. */
+  readonly instance?: string;
+  /** Status for data responses. Defaults to 200 (204 without data). */
+  readonly status?: number;
+  /**
+   * Keeps the invocation alive for event sink sends the handler started:
+   * `EdgeRuntime.waitUntil`, the Workers `ctx.waitUntil` or Next's `after`.
+   */
+  readonly waitUntil?: (promise: Promise<unknown>) => void;
+  /** Passed to `server.context()`, e.g. a request-wide stats recorder. */
+  readonly context?: Omit<ContextOptions, "refresh">;
+  /**
+   * Sees every error the handler throws before it becomes a 500, so
+   * framework control flow (Next's `redirect()`) can be thrown again.
+   */
+  readonly rethrow?: (cause: unknown) => void;
+}
+/** Hands event sink sends still running to `waitUntil`; a no-op without either. */
+export declare function flushEvents(server: Pick<BetterServer<AnyModels, AnyFunctions, unknown>, "events">, waitUntil: ((promise: Promise<unknown>) => void) | undefined): void;
+/** The 500 for an error a handler threw; the message only when `expose` is set. */
+export declare function unexpectedResponse(cause: unknown, options: {
+  readonly instance?: string;
+  readonly expose: boolean;
+}): Response;
+/**
+ * Runs `run` as the request's caller, the way every built-in adapter does:
+ * resolves the context, applies the guard (401/403 Problem Details), turns
+ * the return value into a response with `respond()`, turns other thrown
+ * errors into a 500, adds the context's cookies with `ctx.apply()` and
+ * hands pending event sink sends to `waitUntil`.
+ *
+ * ```ts
+ * export default { fetch: (request, env, ctx) =>
+ *   handle(server, request, (c) => c.db.notes.findMany(), { waitUntil: (p) => ctx.waitUntil(p) }) }
+ * ```
+ */
+export declare function handle<M extends AnyModels, F extends AnyFunctions, E, C, P>(server: BetterServer<M, F, E, C, P>, request: Request, run: (ctx: ServerContext<M, F, E, C, P>) => unknown, options?: HandleOptions): Promise<Response>;
+/**
+ * Verifies a bare access token (an MCP transport's, a WebSocket's) without
+ * cookies or a refresh. An empty token resolves to `anon`.
+ */
+export declare function resolveToken<C, P>(server: Pick<BetterServer<AnyModels, AnyFunctions, unknown, C, P>, "resolve">, token: string | null | undefined): Promise<AuthState<C, P>>;
+//#endregion
+//#region src/server/entries/upstream.d.ts
+/** The `withSupabase` context keys `withBetterDb` and `withBetterPostgres` read. */
 interface SupabaseAuthContext {
   readonly jwtClaims: JWTClaims | null;
   readonly userClaims: UserClaims | null;
@@ -25,14 +82,16 @@ interface SupabaseAuthContext {
 /** Repository context from a `@supabase/server` context. */
 export declare function contextFromSupabase(ctx: SupabaseAuthContext): RequestContext;
 /**
- * `@supabase/middleware` entry contributing `ctx.db`: repositories bound to
- * `ctx.supabase` (the caller-scoped client from `withSupabase`).
+ * Entry contributing `ctx.db`: repositories bound to `ctx.supabase`, the
+ * caller-scoped client from `withSupabase`. Use it when `withSupabase`
+ * authenticates the request (bearer tokens only); `withBetterSupabase`
+ * covers cookie sessions too.
  *
  * ```ts
- * pipeline([withSupabase({ auth: 'user' }), withBetterSupabase(betterSupabase)()], (req, ctx) => ...)
+ * pipeline([withSupabase({ auth: 'user' }), withBetterDb(betterSupabase)()], (req, ctx) => ...)
  * ```
  */
-export declare function withBetterSupabase<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>): Middleware<"db", void, SupabaseAuthContext & {
+export declare function withBetterDb<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>): Middleware<"db", void, SupabaseAuthContext & {
   readonly supabase: SupabaseClient;
 }, Db<M, F, E, SupabaseClient>>;
 /**
@@ -43,6 +102,36 @@ export declare function withBetterPostgres<M extends AnyModels, D, F extends Any
   readonly postgres: PostgresApi;
 }, Db<M, F, E, undefined>>;
 //#endregion
+//#region src/server/entries/block.d.ts
+/**
+ * Entry contributing `ctx[key]`: a block service built from the keys the
+ * entries before it contribute, such as `ctx.postgresAdmin` from
+ * `withPostgresAdminClient` after `withBetterSupabase`. The service is built
+ * per request, on the pipeline's one Postgres pool, and runs under every
+ * framework bridge.
+ *
+ * ```ts
+ * pipeline(
+ *   [withBetterSupabase(bs), withPostgresAdminClient(), withBlock('jobs', (ctx) => createJobs(ctx.postgresAdmin, queues))],
+ *   (req, ctx) => ctx.jobs.drainRoute({ secret, handlers })(req),
+ * )
+ * ```
+ */
+export declare function withBlock<const Key extends string, In extends object, Service>(key: Key, create: (ctx: In) => Service): SingleKeyEntry<Key, In, Service>;
+//#endregion
+//#region src/server/entries/claims.d.ts
+/** `jwtClaims` as `withSupabase` contributes it: the verified token's payload, or `null`. */
+export declare function jwtClaimsOf<C>(auth: AuthState<C>): (JWTClaims & C) | null;
+/** `userClaims` as `withSupabase` contributes it, or `null` without a user. */
+export declare function userClaimsOf(auth: AuthState): UserClaims | null;
+/**
+ * `authMode` as `withSupabase` names it: `user` for a verified user token
+ * or a user's API key, `secret` for a secret key or an organization's API
+ * key, `none` otherwise (no credentials, or ones a
+ * guard refuses).
+ */
+export declare function authModeOf(auth: AuthState): AuthMode;
+//#endregion
 //#region src/auth/revocation.d.ts
 /** A client that can read `auth.sessions`, such as `createPostgres().admin`. */
 interface SessionLookup {
@@ -66,4 +155,37 @@ export declare function checkSession(sql: SessionLookup, auth: {
   readonly kind: string;
 }): Promise<DbError | undefined>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type ActClaim, type ActiveSupport, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type BetterServer, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type GuardOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type ReplicaState, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerOptions, type SessionActor, type SessionDelegation, type SessionLookup, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportView, TENANT_HEADER, aalOf, amrOf, authContext, checkAal, clearSupportCookie, clientIp, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, toProblem, toSession, writeSession };
+//#region src/server/entries/timing.d.ts
+/** The header `withDbStats` sets: `calls;waves;ms`, what `expectDbBudget` reads. */
+export declare const DB_CALLS_HEADER = "x-bs-db-calls";
+/** Parses the stats header back into numbers, or `undefined` when it is malformed. */
+export declare function parseDbStats(value: string | null | undefined): Pick<DbStats, "calls" | "waves" | "ms"> | undefined;
+/** Collects `Server-Timing` metrics for one request. */
+interface ServerTiming {
+  /** Adds a metric; `dur` in milliseconds. */
+  add(name: string, dur: number, description?: string): void;
+  /** Runs `fn` and records how long it took under `name`. */
+  measure<T>(name: string, fn: () => T | Promise<T>): Promise<T>;
+}
+/**
+ * Entry contributing `ctx.timing`, and adding `Server-Timing` to the
+ * response: `bs;dur=<ms>` for everything after it, plus the metrics handlers
+ * add with `ctx.timing.add()` or `measure()`. Put it first, so it times the
+ * whole request. Browsers show it in the network panel.
+ */
+export declare function withServerTiming(now?: () => number): SingleKeyEntry<"timing", Record<never, never>, ServerTiming>;
+/**
+ * Entry adding the request's database totals to the response, after the
+ * handler ran: `x-bs-db-calls: calls;waves;ms`, which `expectDbBudget(response)`
+ * reads, and a `bs-db` `Server-Timing` metric. Put it
+ * after `withBetterSupabase`, which contributes `ctx.bs`.
+ */
+export declare function withDbStats(options?: {
+  readonly header?: string;
+}): SingleKeyEntry<"dbStats", {
+  readonly bs: {
+    stats(): DbStats;
+  };
+}, () => DbStats>;
+//#endregion
+export { AUTH_CACHE_HEADERS, type Aal, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizeOptions, type AuthorizedContext, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, aalOf, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, createServer, defineResource, deleteAccount, endSessions, extendServer, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };

package/dist/server/index.js

@@ -1,14 +1,22 @@
-import { n as dbError } from "../errors-DtwXa6b8.js";
-import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-BW1KhzSG.js";
-import { n as impersonatorOf, r as userContext } from "../impersonation-VfaGc4Q_.js";
+import { n as dbError } from "../errors-B11Duf73.js";
+import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-BreOl8b8.js";
+import { i as userContext, r as impersonatorOf } from "../impersonation-DcqaTBHx.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { c as supportCookie, d as guard, f as isResult, l as supportCookieValue, m as settle, n as createServer, o as SUPPORT_COOKIE, p as respond, s as clearSupportCookie, t as TENANT_HEADER, v as PRIMARY_COOKIE } from "../server-Csx2sRjg.js";
-import { _ as writeSession, a as checkAal, d as AUTH_CACHE_HEADERS, g as sessionCookieName, i as amrOf, m as readSession, n as toSession, o as authContext, r as aalOf, s as clientIp, u as resolveAuth, v as refreshSession } from "../view-Bq64ki8-.js";
-import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-Dk6vdmEw.js";
-import { n as postgresExecutor } from "../executor-XycESQPH.js";
-import { t as defineResource } from "../resource-CRxxwkQq.js";
+import { n as postgresExecutor } from "../executor-De1Of3m3.js";
+import { C as serverCore, D as deleteAccount, E as suspendAccount, T as endSessions, _ as withSession, a as unexpectedResponse, b as shouldCheckSession, c as extendServer, d as clearSupportCookie, f as supportCookie, i as resolveToken, m as supportCookieValue, n as flushEvents, o as TENANT_HEADER, r as handle, s as createServer, u as SUPPORT_COOKIE, v as isPrefetch, w as SERVER_EVENT_SOURCE, x as shouldRefresh, y as refreshFor } from "../adapter-Bc1o3zyy.js";
+import { n as PRIMARY_COOKIE } from "../replicas-CwrYp5Zj.js";
+import { _ as writeSession, a as refreshSession, c as AUTH_CACHE_HEADERS, h as sessionCookieName, i as resolveAuth, n as clientIp, o as clearSessionCookies, p as readSession, s as sessionStatus, t as authContext } from "../resolve-D_IcnvFd.js";
+import { a as checkAal, i as amrOf, n as toSession, r as aalOf } from "../view-BeFcRV6G.js";
+import { a as respond, i as isResult, o as settle, r as guard } from "../respond-BUgsXNgk.js";
+import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-BivNqSpK.js";
+import { n as jwtClaimsOf, r as userClaimsOf, t as authModeOf } from "../claims-DDBQT6BK.js";
+import { n as withGuard, t as withBetterSupabase } from "../composite-DhE66P5u.js";
+import { t as defineResource } from "../resource-BsvzCMlX.js";
+import { i as withServerTiming, n as parseDbStats, r as withDbStats, t as DB_CALLS_HEADER } from "../timing-CyTQPubY.js";
+import { n as tagCache, r as tagFor, t as cacheTagsOf } from "../tags-B99_U9Pp.js";
+import { a as rolesAt, r as hasRole } from "../kit-Fm-Fv7q5.js";
 import { defineMiddleware } from "@supabase/middleware";
-//#region src/server/middleware.ts
+//#region src/server/entries/upstream.ts
 /** Repository context from a `@supabase/server` context. */
 function contextFromSupabase(ctx) {
 	switch (ctx.authMode) {
@@ -40,14 +48,16 @@ function contextFromSupabase(ctx) {
 	};
 }
 /**
-* `@supabase/middleware` entry contributing `ctx.db`: repositories bound to
-* `ctx.supabase` (the caller-scoped client from `withSupabase`).
+* Entry contributing `ctx.db`: repositories bound to `ctx.supabase`, the
+* caller-scoped client from `withSupabase`. Use it when `withSupabase`
+* authenticates the request (bearer tokens only); `withBetterSupabase`
+* covers cookie sessions too.
 *
 * ```ts
-* pipeline([withSupabase({ auth: 'user' }), withBetterSupabase(betterSupabase)()], (req, ctx) => ...)
+* pipeline([withSupabase({ auth: 'user' }), withBetterDb(betterSupabase)()], (req, ctx) => ...)
 * ```
 */
-function withBetterSupabase(betterSupabase) {
+function withBetterDb(betterSupabase) {
 	return defineMiddleware({
 		key: "db",
 		run: (_config) => (_req, ctx) => Promise.resolve({ db: betterSupabase.connect(ctx.supabase, contextFromSupabase(ctx)) })
@@ -64,6 +74,28 @@ function withBetterPostgres(betterSupabase) {
 	});
 }
 //#endregion
+//#region src/server/entries/block.ts
+/**
+* Entry contributing `ctx[key]`: a block service built from the keys the
+* entries before it contribute, such as `ctx.postgresAdmin` from
+* `withPostgresAdminClient` after `withBetterSupabase`. The service is built
+* per request, on the pipeline's one Postgres pool, and runs under every
+* framework bridge.
+*
+* ```ts
+* pipeline(
+*   [withBetterSupabase(bs), withPostgresAdminClient(), withBlock('jobs', (ctx) => createJobs(ctx.postgresAdmin, queues))],
+*   (req, ctx) => ctx.jobs.drainRoute({ secret, handlers })(req),
+* )
+* ```
+*/
+function withBlock(key, create) {
+	return defineMiddleware({
+		key,
+		run: () => (_request, ctx) => Promise.resolve({ [key]: create(ctx) })
+	})();
+}
+//#endregion
 //#region src/auth/revocation.ts
 const UUID = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
 const ACTIVE = `select exists (
@@ -88,4 +120,4 @@ async function checkSession(sql, auth) {
 	return row?.active === true ? void 0 : revoked;
 }
 //#endregion
-export { AUTH_CACHE_HEADERS, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, amrOf, authContext, checkAal, checkSession, clearSupportCookie, clientIp, contextFromSupabase, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, toProblem, toSession, withBetterPostgres, withBetterSupabase, writeSession };
+export { AUTH_CACHE_HEADERS, DB_CALLS_HEADER, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SERVER_EVENT_SOURCE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, amrOf, authContext, authModeOf, cacheTagsOf, checkAal, checkSession, clearSessionCookies, clearSupportCookie, clientIp, contextFromSupabase, createServer, defineResource, deleteAccount, endSessions, extendServer, flushEvents, fromProblem, guard, handle, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, jwtClaimsOf, parseDbStats, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, resolveToken, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, unexpectedResponse, userClaimsOf, withBetterDb, withBetterPostgres, withBetterSupabase, withBlock, withDbStats, withGuard, withServerTiming, withSession, writeSession };