better-supabase 0.5.1 → 0.6.0

package/dist/edge/index.d.ts

@@ -1,7 +1,32 @@
-import { P as TableKey, n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
-import { t as BetterSupabase } from "../define-Bp_BZa5h.js";
-import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-BR1fJWOB.js";
-import { a as ResourceRouteOptions } from "../resource-DNRFP7KR.js";
+import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
+import { t as BetterSupabase } from "../define-CJJkkr1-.js";
+import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-CeVeeXwz.js";
+import { t as AuthSession } from "../view-DbxLNu8L.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DoBijysA.js";
+import { s as BlockRequireOptions } from "../kit-B5tid-q5.js";
+import { t as Validated } from "../shared-DDSjEGDR.js";
+import { a as ResourceRouteOptions } from "../resource-D6Uc7Sk7.js";
+import { AnyEntry, Contributions } from "@supabase/middleware";
+import { WithCorsConfig } from "@supabase/middleware/cors";
+//#region src/bridges/edge.d.ts
+/** The platform context Workers pass as the third `fetch` argument. */
+interface EdgeExecutionContext {
+  waitUntil(promise: Promise<unknown>): void;
+}
+/** `Deno.serve` passes `(request, info)`, Workers `fetch` passes `(request, env, ctx)`. */
+type EdgeHandler = (request: Request, env?: unknown, executionContext?: EdgeExecutionContext) => Promise<Response>;
+/**
+ * Runs an entry array around `handler` as a fetch handler for Supabase Edge
+ * Functions, Deno, Bun and Workers. The host's second argument seeds the
+ * context, so on Workers `getEnv` inside the entries reads the bindings.
+ *
+ * ```ts
+ * Deno.serve(toEdge([withBetterSupabase(server)], async (req, ctx) =>
+ *   Response.json(await ctx.db.notes.findMany().orThrow())))
+ * ```
+ */
+export declare function toEdge<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, handler: (request: Request, ctx: Contributions<Entries>, executionContext: EdgeExecutionContext | undefined, env: unknown) => Response | Promise<Response>): EdgeHandler;
+//#endregion
 //#region src/edge/index.d.ts
 export interface CorsOptions {
   /** Allowed origins, or `*`. Defaults to `*`. */
@@ -23,28 +48,61 @@ export interface EdgeOptions extends ServerOptions {
    */
   readonly waitUntil?: (promise: Promise<unknown>) => void;
 }
-/** The platform context Workers pass as the third `fetch` argument. */
-export interface EdgeExecutionContext {
-  waitUntil(promise: Promise<unknown>): void;
-}
-/** `Deno.serve` passes `(request, info)`, Workers `fetch` passes `(request, env, ctx)`. */
-export type EdgeHandler = (request: Request, env?: unknown, executionContext?: EdgeExecutionContext) => Promise<Response>;
 export type ResourceMap<M extends AnyModels> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T> | true; };
 export interface ResourcesOptions extends MiddlewareOptions {
   /** Path before the resources, e.g. `/api` (Supabase: `/<function-name>`). */
   readonly basePath?: string;
 }
+type ParamNames<K extends string> = K extends `${string}:${infer Name}/${infer Rest}` ? Name | ParamNames<Rest> : K extends `${string}:${infer Name}` ? Name : never;
+/**
+ * The params a route key declares: one per `:name` segment, and `*` for a
+ * final wildcard. `RouteParams<"GET /orgs/:org/files/*">` is
+ * `{ org: string; "*": string }`.
+ */
+export type RouteParams<K extends string> = { readonly [N in ParamNames<K> | (K extends `${string}/*` ? "*" : never)]: string; };
+/** A route handler: the request, the caller's context and the path params. */
+export type EdgeRouteHandler<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Params = Readonly<Record<string, string>>> = (request: Request, ctx: ServerContext<M, F, E, C, P> & {
+  readonly params: Params;
+  readonly session: AuthSession<C, P>;
+  readonly tenant: string | undefined;
+}) => unknown;
+/** A route with its own guard: `allow`, `aal`, `scopes`, `requireTenant`, `authorize`. */
+export interface EdgeRoute<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Params = Readonly<Record<string, string>>> extends BlockRequireOptions<C, P> {
+  readonly handler: EdgeRouteHandler<M, F, E, C, P, Params>;
+}
+/**
+ * Routes by `"METHOD /path"` (or `"/path"` for every method). `:name`
+ * segments are params, a final `*` matches the rest of the path.
+ */
+export type EdgeRoutes<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> = Readonly<Record<string, EdgeRouteHandler<M, F, E, C, P> | EdgeRoute<M, F, E, C, P>>>;
 export interface BetterEdge<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
   /**
    * A fetch handler (`Deno.serve`, Workers `fetch`) running as the caller.
    * `Result`s become JSON or Problem Details; `undefined` becomes 204.
    */
   handler(fn: (request: Request, ctx: ServerContext<M, F, E, C, P>) => unknown, options?: MiddlewareOptions): EdgeHandler;
+  /**
+   * A router: each route runs as the caller, behind the shared guard in
+   * `options` and its own. An unknown path answers 404 and a known path
+   * with another method 405, both before auth resolves. `ctx.params` is
+   * typed from the key: `"GET /customers/:id"` gets `params.id`.
+   *
+   * ```ts
+   * Deno.serve(bs.routes({
+   *   'GET /customers': (req, ctx) => ctx.db.customers.findMany(),
+   *   'GET /customers/:id': (req, ctx) => ctx.db.customers.find(ctx.params.id),
+   *   'POST /invites': { requireTenant: true, handler: (req, ctx) => invite(req, ctx) },
+   * }, { basePath: '/api' }))
+   * ```
+   */
+  routes<K extends string>(routes: { readonly [Key in K]: EdgeRouteHandler<M, F, E, C, P, RouteParams<Key>> | EdgeRoute<M, F, E, C, P, RouteParams<Key>>; }, options?: ResourcesOptions): EdgeHandler;
   /** REST resources matching `createOpenApi`, e.g. `Deno.serve(bs.resources({ customers: true }))`. */
   resources(map: ResourceMap<M>, options?: ResourcesOptions): EdgeHandler;
 }
 export declare const SUPABASE_CORS_HEADERS: readonly string[];
+/** `CorsOptions` as `withCors` from `@supabase/middleware/cors` takes them. */
+export declare function corsConfig(cors: CorsOptions): WithCorsConfig;
 /** Fetch-handler integration for Supabase Edge Functions, Deno, Bun and Workers. */
 export declare function createEdge<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: EdgeOptions): BetterEdge<M, F, E, C, P>;
 //#endregion
-export type { GuardOptions, MiddlewareOptions, ResourceRouteOptions };
+export type { BlockRequireOptions, EdgeExecutionContext, EdgeHandler, GuardOptions, MiddlewareOptions, ResourceRouteOptions };

package/dist/edge/index.js

@@ -1,7 +1,104 @@
-import { n as dbError } from "../errors-DtwXa6b8.js";
-import { a as problemResponse } from "../problem-BW1KhzSG.js";
-import { d as guard, n as createServer, p as respond, r as extendServer, u as defaultExpose } from "../server-B1mZ7CgQ.js";
-import { t as defineResource } from "../resource-mqfJW4YF.js";
+import { n as dbError } from "../errors-B11Duf73.js";
+import { r as err } from "../result-DzUbqgdW.js";
+import { a as problemResponse } from "../problem-BreOl8b8.js";
+import { a as unexpectedResponse, c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { a as respond, t as defaultExpose } from "../respond-BUgsXNgk.js";
+import { t as withBetterSupabase } from "../composite-DhE66P5u.js";
+import { t as defineResource } from "../resource-BsvzCMlX.js";
+import { i as requireCaller } from "../kit-Fm-Fv7q5.js";
+import { t as EVERY_CALLER } from "../framework-CONDyPYx.js";
+import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
+import { withCors } from "@supabase/middleware/cors";
+//#region src/bridges/edge.ts
+/**
+* Runs an entry array around `handler` as a fetch handler for Supabase Edge
+* Functions, Deno, Bun and Workers. The host's second argument seeds the
+* context, so on Workers `getEnv` inside the entries reads the bindings.
+*
+* ```ts
+* Deno.serve(toEdge([withBetterSupabase(server)], async (req, ctx) =>
+*   Response.json(await ctx.db.notes.findMany().orThrow())))
+* ```
+*/
+function toEdge(entries, handler) {
+	const EXECUTION = Symbol("toEdge.execution");
+	const ENV = Symbol("toEdge.env");
+	const run = pipeline(entries, (request, ctx) => Promise.resolve(handler(request, ctx, ctx[EXECUTION], ctx[ENV])));
+	return (request, env, executionContext) => run(request.body ? bufferRequest(request) : request, {
+		...seedContext(env),
+		[EXECUTION]: executionContext,
+		[ENV]: env
+	});
+}
+//#endregion
+//#region src/edge/routes.ts
+const METHOD = /^([A-Z]+)\s+(\/.*)$/;
+function split(path) {
+	return path.split("/").filter((segment) => segment !== "");
+}
+/** Parses `"METHOD /path"` keys once; static routes sort before params. */
+function compileRoutes(routes) {
+	const compiled = [];
+	for (const [key, value] of Object.entries(routes)) {
+		const matched = METHOD.exec(key.trim());
+		const method = matched?.[1];
+		const path = matched?.[2] ?? key.trim();
+		if (!path.startsWith("/")) throw new TypeError(`better-supabase: route "${key}" must be "/path" or "METHOD /path"`);
+		const segments = split(path);
+		const rest = segments.at(-1) === "*";
+		if (rest) segments.pop();
+		const { handler, ...options } = typeof value === "function" ? { handler: value } : value;
+		compiled.push({
+			method,
+			segments,
+			rest,
+			handler,
+			options
+		});
+	}
+	const weight = (route) => route.segments.filter((segment) => segment.startsWith(":")).length + (route.rest ? 100 : 0);
+	return compiled.toSorted((a, b) => weight(a) - weight(b));
+}
+function paramsOf(segments, rest, parts) {
+	if (rest ? parts.length < segments.length : parts.length !== segments.length) return void 0;
+	const params = {};
+	for (const [index, segment] of segments.entries()) {
+		const part = parts[index] ?? "";
+		if (segment.startsWith(":")) try {
+			params[segment.slice(1)] = decodeURIComponent(part);
+		} catch {
+			return;
+		}
+		else if (segment !== part) return void 0;
+	}
+	if (rest) params["*"] = parts.slice(segments.length).join("/");
+	return params;
+}
+/**
+* The route for `method` and `path`: a match, the allowed methods when the
+* path matches under another method (`HEAD` falls back to `GET`), or `"none"`.
+*/
+function matchRoute(routes, method, path) {
+	const parts = split(path);
+	const allowed = /* @__PURE__ */ new Set();
+	let fallback;
+	for (const route of routes) {
+		const params = paramsOf(route.segments, route.rest, parts);
+		if (!params) continue;
+		if (route.method === void 0 || route.method === method) return {
+			route,
+			params
+		};
+		if (method === "HEAD" && route.method === "GET") fallback ??= {
+			route,
+			params
+		};
+		allowed.add(route.method);
+	}
+	if (fallback) return fallback;
+	return allowed.size > 0 ? [...allowed] : "none";
+}
+//#endregion
 //#region src/edge/index.ts
 const SUPABASE_CORS_HEADERS = [
 	"authorization",
@@ -9,89 +106,107 @@ const SUPABASE_CORS_HEADERS = [
 	"apikey",
 	"content-type"
 ];
-/** The CORS headers for a request's origin; the fixed ones are joined once. */
-function corsFor(cors) {
-	const allowed = cors.origin ?? "*";
-	const origins = new Set(typeof allowed === "string" ? [allowed] : allowed);
-	const fixed = {
-		"access-control-allow-headers": (cors.headers ?? SUPABASE_CORS_HEADERS).join(", "),
-		"access-control-allow-methods": (cors.methods ?? [
+/** `CorsOptions` as `withCors` from `@supabase/middleware/cors` takes them. */
+function corsConfig(cors) {
+	return {
+		origin: cors.origin === void 0 || typeof cors.origin === "string" ? cors.origin ?? "*" : [...cors.origin],
+		allowedHeaders: [...cors.headers ?? SUPABASE_CORS_HEADERS],
+		methods: [...cors.methods ?? [
 			"GET",
 			"POST",
 			"PATCH",
 			"DELETE",
 			"OPTIONS"
-		]).join(", "),
-		...cors.maxAge === void 0 ? {} : { "access-control-max-age": String(cors.maxAge) }
-	};
-	const any = {
-		"access-control-allow-origin": "*",
-		...fixed
-	};
-	return (request) => {
-		if (allowed === "*") return any;
-		const origin = request.headers.get("origin");
-		if (!origin || !origins.has(origin)) return;
-		return {
-			"access-control-allow-origin": origin,
-			...fixed,
-			vary: "origin"
-		};
+		]],
+		...cors.maxAge === void 0 ? {} : { maxAge: cors.maxAge }
 	};
 }
-function withHeaders(response, headers) {
-	let target = response;
-	try {
-		for (const [name, value] of Object.entries(headers)) target.headers.set(name, value);
-	} catch {
-		target = new Response(response.body, response);
-		for (const [name, value] of Object.entries(headers)) target.headers.set(name, value);
-	}
-	return target;
-}
 /** Fetch-handler integration for Supabase Edge Functions, Deno, Bun and Workers. */
 function createEdge(betterSupabase, options = {}) {
 	const server = createServer(betterSupabase, options);
 	const expose = options.exposeErrors ?? defaultExpose();
 	const cors = options.cors === true ? {} : options.cors === false ? void 0 : options.cors;
-	const corsHeaders = cors ? corsFor(cors) : void 0;
+	const withCorsConfig = cors ? corsConfig(cors) : void 0;
 	const serve = (run, handlerOptions, early) => {
-		return async (request, _env, executionContext) => {
-			const extra = corsHeaders?.(request);
-			if (cors && request.method === "OPTIONS") return new Response(null, {
-				status: 204,
-				headers: extra ?? {}
-			});
-			const answered = early?.(request);
-			if (answered) return extra ? withHeaders(answered, extra) : answered;
-			const ctx = await server.context(request, { refresh: handlerOptions.refresh ?? false });
+		const authorized = toEdge([withBetterSupabase(server, {
+			...handlerOptions,
+			expose
+		})], async (request, ctx) => {
 			const instance = new URL(request.url).pathname;
-			const denied = guard(ctx.auth, handlerOptions.allow, handlerOptions.aal, handlerOptions.scopes);
-			let response;
 			try {
-				response = denied ? problemResponse(denied, {
+				return await respond(() => run(request, ctx.bs, ctx.tenant), {
 					instance,
 					expose
-				}) : await run(request, ctx);
+				});
 			} catch (cause) {
-				response = problemResponse(dbError("unexpected", expose && cause instanceof Error ? cause.message : "Internal server error"), {
+				return unexpectedResponse(cause, {
 					instance,
 					expose
 				});
 			}
-			response = ctx.apply(response);
-			const { events } = betterSupabase;
-			const waitUntil = options.waitUntil ?? executionContext?.waitUntil.bind(executionContext);
-			if (events.pending && waitUntil) waitUntil(events.settled());
-			return extra ? withHeaders(response, extra) : response;
+		});
+		const routed = (request, env, executionContext) => Promise.resolve(early?.(request) ?? authorized(request, env, executionContext));
+		const answer = withCorsConfig ? toEdge([withCors(withCorsConfig)], (request, _ctx, executionContext, env) => routed(request, env, executionContext)) : routed;
+		return async (request, env, executionContext) => {
+			const response = await answer(request, env, executionContext);
+			flushEvents(server, options.waitUntil ?? executionContext?.waitUntil.bind(executionContext));
+			return response;
 		};
 	};
 	return extendServer(server, {
 		handler(fn, handlerOptions = {}) {
-			return serve((request, ctx) => respond(() => fn(request, ctx), {
-				instance: new URL(request.url).pathname,
-				expose
-			}), handlerOptions);
+			return serve(fn, handlerOptions);
+		},
+		routes(routes, routesOptions = {}) {
+			const base = (routesOptions.basePath ?? "").replace(/\/$/, "");
+			const compiled = compileRoutes(routes);
+			const { allow, aal, scopes, ...middlewareOptions } = routesOptions;
+			const shared = {
+				...allow === void 0 ? {} : { allow },
+				...aal === void 0 ? {} : { aal },
+				...scopes === void 0 ? {} : { scopes }
+			};
+			const find = (request) => {
+				const { pathname } = new URL(request.url);
+				const path = base === "" ? pathname : pathname === base || pathname.startsWith(`${base}/`) ? pathname.slice(base.length) || "/" : void 0;
+				const found = path === void 0 ? void 0 : matchRoute(compiled, request.method, path);
+				if (found === void 0 || found === "none") return problemResponse(dbError("not_found", `No route for ${pathname}`), { instance: pathname });
+				if (!("route" in found)) return Response.json({
+					type: "about:blank",
+					title: "Method Not Allowed",
+					status: 405,
+					detail: `${request.method} is not allowed on ${pathname}`,
+					instance: pathname
+				}, {
+					status: 405,
+					headers: {
+						allow: found.join(", "),
+						"content-type": "application/problem+json"
+					}
+				});
+				return found;
+			};
+			return serve(async (request, ctx, tenant) => {
+				const found = find(request);
+				if (found instanceof Response) return found;
+				const { route, params } = found;
+				const caller = await requireCaller(ctx.auth, {
+					...shared,
+					...route.options
+				}, tenant);
+				if ("kind" in caller) return err(caller);
+				return route.handler(request, withExtra(ctx, {
+					params,
+					session: caller.session,
+					tenant
+				}));
+			}, {
+				...middlewareOptions,
+				allow: EVERY_CALLER
+			}, (request) => {
+				const found = find(request);
+				return found instanceof Response ? found : void 0;
+			});
 		},
 		resources(map, resourcesOptions = {}) {
 			const base = (resourcesOptions.basePath ?? "").replace(/\/$/, "");
@@ -100,33 +215,34 @@ function createEdge(betterSupabase, options = {}) {
 				if (!resource) continue;
 				handlers.set(table, defineResource(betterSupabase, table, resource === true ? {} : resource));
 			}
-			const routes = /* @__PURE__ */ new WeakMap();
-			const notFound = (request) => {
+			const match = (request) => {
 				const { pathname } = new URL(request.url);
 				const [table, id, extra] = (pathname.startsWith(`${base}/`) ? pathname.slice(base.length + 1) : void 0)?.split("/") ?? [];
 				const handler = table ? handlers.get(table) : void 0;
 				if (!handler || extra !== void 0 || id !== void 0 && !handler.keyParam) return problemResponse(dbError("not_found", `No route for ${pathname}`), { instance: pathname });
-				let key;
 				try {
-					key = id === void 0 || id === "" ? void 0 : decodeURIComponent(id);
+					return {
+						handler,
+						id: id === void 0 || id === "" ? void 0 : decodeURIComponent(id),
+						instance: pathname
+					};
 				} catch {
 					return problemResponse(dbError("invalid_input", `Malformed id in ${pathname}`), { instance: pathname });
 				}
-				routes.set(request, {
-					handler,
-					id: key,
-					instance: pathname
-				});
 			};
 			return serve((request, ctx) => {
-				const { handler, id, instance } = routes.get(request);
-				return handler.handle(request, ctx.db, id, {
-					instance,
+				const route = match(request);
+				if (route instanceof Response) return route;
+				return route.handler.handle(request, ctx.db, route.id, {
+					instance: route.instance,
 					expose
 				});
-			}, resourcesOptions, notFound);
+			}, resourcesOptions, (request) => {
+				const route = match(request);
+				return route instanceof Response ? route : void 0;
+			});
 		}
 	});
 }
 //#endregion
-export { SUPABASE_CORS_HEADERS, createEdge };
+export { SUPABASE_CORS_HEADERS, corsConfig, createEdge, toEdge };

package/dist/elysia/index.d.ts

@@ -0,0 +1,59 @@
+import { n as RouteGuardOptions } from "../refusal-D1rgbzNq.js";
+import { t as Validated } from "../shared-DDSjEGDR.js";
+import { AnyEntry, Contributions } from "@supabase/middleware";
+//#region src/bridges/elysia.d.ts
+interface ElysiaBridge<Entries extends readonly AnyEntry[]> {
+  /**
+   * Runs the entries around the app's fetch (`app.handle`), so short
+   * circuits answer before Elysia routes and the route's response passes
+   * back through the entries.
+   */
+  wrap(handle: (request: Request) => Promise<Response>): (request: Request, env?: unknown) => Promise<Response>;
+  /**
+   * The contributions for a request `wrap` is serving. Throws for any other
+   * request, so a route reached without the entries fails closed.
+   * Expose it with `.derive(({ request }) => bridge.context(request))`.
+   */
+  context(request: Request): Contributions<Entries>;
+}
+/**
+ * Runs an entry array around an Elysia app. Elysia has no middleware slot
+ * that sees the response it produces, so the bridge wraps the app's fetch
+ * and hands the contributions to routes through `context(request)`.
+ *
+ * ```ts
+ * const bridge = toElysia([withBetterSupabase(server)])
+ * const app = new Elysia().derive(({ request }) => bridge.context(request)).get('/notes', ({ db }) => ...)
+ * export default { fetch: bridge.wrap((request) => app.handle(request)) }
+ * ```
+ */
+export declare function toElysia<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>): ElysiaBridge<Entries>;
+//#endregion
+//#region src/elysia/guard.d.ts
+/**
+ * A `beforeHandle` hook that refuses callers outside `options`: Problem
+ * Details, or a redirect to `signIn` or `mfa`.
+ *
+ * ```ts
+ * app.get('/admin', handler, { beforeHandle: guard(bridge, { roles: ['admin'] }) })
+ * ```
+ */
+export declare function guard<Entries extends readonly AnyEntry[]>(bridge: ElysiaBridge<Entries>, options?: RouteGuardOptions): (context: {
+  readonly request: Request;
+}) => Promise<Response | undefined>;
+/**
+ * An `onError` hook that answers thrown `DbException`s (from `.orThrow()`)
+ * with Problem Details and leaves every other error to Elysia.
+ *
+ * ```ts
+ * new Elysia().onError(problemOnError())
+ * ```
+ */
+export declare function problemOnError(options?: {
+  readonly expose?: boolean;
+}): (context: {
+  readonly error: unknown;
+  readonly request: Request;
+}) => Response | undefined;
+//#endregion
+export type { ElysiaBridge, RouteGuardOptions };

package/dist/elysia/index.js

@@ -0,0 +1,62 @@
+import { t as around } from "../shared-CBxosKK3.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-CeJWxmkH.js";
+import { bufferRequest } from "@supabase/middleware";
+//#region src/bridges/elysia.ts
+/**
+* Runs an entry array around an Elysia app. Elysia has no middleware slot
+* that sees the response it produces, so the bridge wraps the app's fetch
+* and hands the contributions to routes through `context(request)`.
+*
+* ```ts
+* const bridge = toElysia([withBetterSupabase(server)])
+* const app = new Elysia().derive(({ request }) => bridge.context(request)).get('/notes', ({ db }) => ...)
+* export default { fetch: bridge.wrap((request) => app.handle(request)) }
+* ```
+*/
+function toElysia(entries) {
+	const run = around(entries);
+	const contexts = /* @__PURE__ */ new WeakMap();
+	return {
+		wrap: (handle) => (incoming, env) => {
+			const request = incoming.body ? bufferRequest(incoming) : incoming;
+			return run(request, env, (contributions) => {
+				contexts.set(request, contributions);
+				return handle(request);
+			});
+		},
+		context(request) {
+			const contributions = contexts.get(request);
+			if (!contributions) throw new Error("better-supabase: this request did not pass through toElysia().wrap(); serve the app with the wrapped fetch");
+			return contributions;
+		}
+	};
+}
+//#endregion
+//#region src/elysia/guard.ts
+/**
+* A `beforeHandle` hook that refuses callers outside `options`: Problem
+* Details, or a redirect to `signIn` or `mfa`.
+*
+* ```ts
+* app.get('/admin', handler, { beforeHandle: guard(bridge, { roles: ['admin'] }) })
+* ```
+*/
+function guard(bridge, options = {}) {
+	return ({ request }) => {
+		const locals = guardedLocals(bridge.context(request));
+		return routeRefusal(locals, request, options);
+	};
+}
+/**
+* An `onError` hook that answers thrown `DbException`s (from `.orThrow()`)
+* with Problem Details and leaves every other error to Elysia.
+*
+* ```ts
+* new Elysia().onError(problemOnError())
+* ```
+*/
+function problemOnError(options = {}) {
+	return ({ error, request }) => errorResponse(error, request, options);
+}
+//#endregion
+export { guard, problemOnError, toElysia };

package/dist/embeddings-4ZvFzjsU.js

@@ -0,0 +1,127 @@
+import { t as DbException } from "./db-exception-CnWcYPxL.js";
+import { embedMany, jsonSchema, rerank, tool } from "ai";
+//#region src/ai-sdk/embeddings/embeddings.ts
+/** The name of an SDK model: the string itself, or `provider/modelId`. */
+function modelName(model) {
+	return typeof model === "string" ? model : `${model.provider}/${model.modelId}`;
+}
+/** An `Embedder` for the knowledge and memory blocks over `embedMany`. */
+function embedWith(model, options = {}) {
+	return {
+		apiVersion: 1,
+		model: options.name ?? modelName(model),
+		embed: async (values, embedOptions) => {
+			if (values.length === 0) return [];
+			const { embeddings } = await embedMany({
+				model,
+				values: [...values],
+				maxParallelCalls: options.maxParallelCalls ?? 4,
+				...options.providerOptions === void 0 ? {} : { providerOptions: options.providerOptions },
+				...embedOptions?.signal === void 0 ? {} : { abortSignal: embedOptions.signal }
+			});
+			return embeddings;
+		}
+	};
+}
+/** Reorders search hits with a reranking model, keeping the best `topN`. */
+function rerankWith(model, options = {}) {
+	return async (query, hits, rerankOptions) => {
+		if (hits.length <= 1) return hits;
+		const { ranking } = await rerank({
+			model,
+			query,
+			documents: hits.map((hit) => hit.content),
+			...options.topN === void 0 ? {} : { topN: options.topN },
+			...rerankOptions?.signal === void 0 ? {} : { abortSignal: rerankOptions.signal }
+		});
+		return ranking.flatMap((entry) => {
+			const hit = hits[entry.originalIndex];
+			return hit === void 0 ? [] : [{
+				...hit,
+				score: entry.score
+			}];
+		});
+	};
+}
+/**
+* A tool that searches the knowledge base as the caller. Each result id
+* is `documentId#index`, the `sourceId` that `toSourceParts` gives it.
+*/
+function searchTool(knowledge, organizationId, options = {}) {
+	const { description, rerank: reorder, onHits, ...search } = options;
+	return tool({
+		description: description ?? "Search the knowledge base for passages relevant to a query. Cite results by their id.",
+		inputSchema: jsonSchema({
+			type: "object",
+			properties: { query: {
+				type: "string",
+				description: "What to look for"
+			} },
+			required: ["query"],
+			additionalProperties: false
+		}),
+		execute: async ({ query }, { abortSignal }) => {
+			const found = await knowledge.search(organizationId, query, {
+				...search,
+				...abortSignal === void 0 ? {} : { signal: abortSignal }
+			});
+			if (!found.ok) throw new DbException(found.error);
+			const hits = reorder ? await reorder(query, found.data, abortSignal === void 0 ? void 0 : { signal: abortSignal }) : found.data;
+			onHits?.(hits);
+			return { results: hits.map((hit) => ({
+				id: sourceId(hit),
+				title: hit.title,
+				content: hit.content
+			})) };
+		}
+	});
+}
+const sourceId = (hit) => `${hit.documentId}#${String(hit.index)}`;
+/** One `source-document` part per document among the hits, in hit order. */
+function toSourceParts(hits) {
+	const seen = /* @__PURE__ */ new Set();
+	const parts = [];
+	for (const hit of hits) {
+		if (seen.has(hit.documentId)) continue;
+		seen.add(hit.documentId);
+		parts.push({
+			type: "source-document",
+			sourceId: sourceId(hit),
+			mediaType: "text/plain",
+			title: hit.title
+		});
+	}
+	return parts;
+}
+function supabaseSession(model) {
+	const Session = globalThis.Supabase?.ai?.Session;
+	if (typeof Session !== "function") throw new TypeError("supabaseEmbed runs in Supabase Edge Functions, where Supabase.ai.Session exists; pass session elsewhere");
+	return new Session(model);
+}
+/**
+* An `Embedder` over the model built into Supabase Edge Functions. Set the
+* module's `dimensions` option to the model's size (384 for `gte-small`).
+*/
+function supabaseEmbed(options = {}) {
+	const name = options.model ?? "gte-small";
+	let session = options.session;
+	return {
+		apiVersion: 1,
+		model: `supabase/${name}`,
+		embed: async (values) => {
+			session ??= supabaseSession(name);
+			const vectors = [];
+			for (const value of values) {
+				const output = await session.run(value, {
+					mean_pool: true,
+					normalize: true
+				});
+				if (!Array.isArray(output) || !output.every((x) => typeof x === "number")) throw new TypeError(`Supabase.ai.Session returned no vector for ${name}`);
+				vectors.push(output);
+			}
+			return vectors;
+		}
+	};
+}
+//#endregion
+export { supabaseEmbed as a, searchTool as i, modelName as n, toSourceParts as o, rerankWith as r, embedWith as t };