better-supabase 0.5.1 → 0.6.0

package/dist/h3/index.js

@@ -0,0 +1,55 @@
+import { i as toResponse, n as bufferInPlace, t as around } from "../shared-CBxosKK3.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-CeJWxmkH.js";
+//#region src/bridges/h3.ts
+/**
+* Runs an entry array as H3 2 middleware (`app.use(...)`, Nitro and Nuxt
+* server middleware). Every contributed key lands on `event.context`, and
+* the handler's value comes back as a `Response` (JSON for plain values)
+* so response-phase entries can add headers and cookies.
+*
+* ```ts
+* app.use(toH3([withBetterSupabase(server)]))
+* app.get('/notes', (event) => event.context.db.notes.findMany().orThrow())
+* ```
+*/
+function toH3(entries, options = {}) {
+	const run = around(entries);
+	return (event, next) => {
+		bufferInPlace(event.req);
+		const env = options.env ? options.env(event) : event.context.cloudflare?.env;
+		return run(event.req, env, async (contributions) => {
+			Object.assign(event.context, contributions);
+			const value = await next();
+			return toResponse(value, {
+				status: event.res?.status,
+				statusText: event.res?.statusText,
+				headers: event.res?.headers
+			});
+		});
+	};
+}
+//#endregion
+//#region src/h3/guard.ts
+/**
+* Route middleware that refuses callers outside `options`: Problem Details,
+* or a redirect to `signIn` or `mfa`. Runs after `toH3(...)`.
+*
+* ```ts
+* app.get('/admin', handler, { middleware: [guard({ roles: ['admin'] })] })
+* ```
+*/
+function guard(options = {}) {
+	return async (event, next) => {
+		return await routeRefusal(guardedLocals(event.context), event.req, options) ?? next();
+	};
+}
+/**
+* An `onError` handler for `new H3({ onError })` that answers thrown
+* `DbException`s (from `.orThrow()`) with Problem Details and leaves every
+* other error to H3.
+*/
+function problemOnError(options = {}) {
+	return (error, event) => errorResponse(error, event.req, options);
+}
+//#endregion
+export { guard, problemOnError, toH3 };

package/dist/h3/v1/index.d.ts

@@ -0,0 +1,63 @@
+import { n as RouteGuardOptions } from "../../refusal-D1rgbzNq.js";
+import { t as Validated } from "../../shared-DDSjEGDR.js";
+import { n as NodeRequestHead, t as NodeHeaderTarget } from "../../node-headers-AO06VhqH.js";
+import { AnyEntry, Contributions } from "@supabase/middleware";
+//#region src/h3/v1/index.d.ts
+/** The part of an H3 1 event (Nitro 2, Nuxt 3 and 4) the bridge reads and writes. */
+export interface H3V1Event<Context extends object = Record<string, unknown>> {
+  readonly node: {
+    readonly req: NodeRequestHead;
+    readonly res: NodeHeaderTarget;
+  };
+  readonly context: Context & {
+    /** Nitro's Cloudflare presets put the bindings here. */
+    readonly cloudflare?: {
+      readonly env?: unknown;
+    } | undefined;
+  };
+}
+export interface ToH3V1Options<Context extends object> {
+  /** The host's env object for `getEnv`; defaults to `event.context.cloudflare.env`. */
+  readonly env?: (event: H3V1Event<Context>) => unknown;
+  /** Read the protocol and host from `x-forwarded-*`. Defaults to false. */
+  readonly trustProxy?: boolean;
+}
+/**
+ * An H3 1 handler, typed structurally so the package does not import `h3`.
+ * It returns a `Response` to end the request or `undefined` to continue.
+ */
+export type H3V1Handler<Context extends object> = (event: H3V1Event<Context>) => Promise<Response | undefined>;
+/**
+ * Runs an entry array as Nitro 2 server middleware. A short circuit (a 401,
+ * a CORS preflight) ends the request; otherwise the entries' cookies and
+ * headers go on the response and every contribution lands on
+ * `event.context`. Response-phase entries (`withDbStats`) see an empty
+ * response under H3 1.
+ *
+ * ```ts title="server/middleware/supabase.ts"
+ * export default defineEventHandler(toH3V1([withBetterSupabase(server)]))
+ * ```
+ */
+export declare function toH3V1<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, options?: ToH3V1Options<Partial<Contributions<Entries>>>): H3V1Handler<Partial<Contributions<Entries>>>;
+/**
+ * Refuses callers outside `options`: Problem Details, or a redirect to
+ * `signIn` or `mfa`. Returns `undefined` for callers it lets through, so a
+ * route handler can return its result.
+ *
+ * ```ts title="server/api/admin.get.ts"
+ * const admins = guard({ roles: ['admin'] })
+ * export default defineEventHandler(async (event) =>
+ *   (await admins(event)) ?? event.context.db.members.findMany().orThrow())
+ * ```
+ */
+export declare function guard(options?: RouteGuardOptions): (event: H3V1Event<object>) => Promise<Response | undefined>;
+/**
+ * Answers thrown `DbException`s (from `.orThrow()`) with Problem Details
+ * and returns `undefined` for every other error, for a Nitro `error` hook
+ * or a handler's `catch`.
+ */
+export declare function problemOnError(options?: {
+  readonly expose?: boolean;
+}): (error: unknown, event: H3V1Event<object>) => Response | undefined;
+//#endregion
+export type { RouteGuardOptions };

package/dist/h3/v1/index.js

@@ -0,0 +1,49 @@
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../../refusal-CeJWxmkH.js";
+import { t as beforeRoute } from "../../before-route-CnR0C0Jr.js";
+import { n as headRequest, t as applyWebHeaders } from "../../node-headers-C71zNQHe.js";
+//#region src/h3/v1/index.ts
+/**
+* Runs an entry array as Nitro 2 server middleware. A short circuit (a 401,
+* a CORS preflight) ends the request; otherwise the entries' cookies and
+* headers go on the response and every contribution lands on
+* `event.context`. Response-phase entries (`withDbStats`) see an empty
+* response under H3 1.
+*
+* ```ts title="server/middleware/supabase.ts"
+* export default defineEventHandler(toH3V1([withBetterSupabase(server)]))
+* ```
+*/
+function toH3V1(entries, options = {}) {
+	const run = beforeRoute(entries);
+	return async (event) => {
+		const env = options.env ? options.env(event) : event.context.cloudflare?.env;
+		const outcome = await run(headRequest(event.node.req, options.trustProxy), env);
+		if (!outcome.reached) return outcome.response;
+		applyWebHeaders(event.node.res, outcome.headers);
+		Object.assign(event.context, outcome.contributions);
+	};
+}
+/**
+* Refuses callers outside `options`: Problem Details, or a redirect to
+* `signIn` or `mfa`. Returns `undefined` for callers it lets through, so a
+* route handler can return its result.
+*
+* ```ts title="server/api/admin.get.ts"
+* const admins = guard({ roles: ['admin'] })
+* export default defineEventHandler(async (event) =>
+*   (await admins(event)) ?? event.context.db.members.findMany().orThrow())
+* ```
+*/
+function guard(options = {}) {
+	return (event) => routeRefusal(guardedLocals(event.context), headRequest(event.node.req), options);
+}
+/**
+* Answers thrown `DbException`s (from `.orThrow()`) with Problem Details
+* and returns `undefined` for every other error, for a Nitro `error` hook
+* or a handler's `catch`.
+*/
+function problemOnError(options = {}) {
+	return (error, event) => errorResponse(error, headRequest(event.node.req), options);
+}
+//#endregion
+export { guard, problemOnError, toH3V1 };

package/dist/history-BZih6SFP.js

@@ -0,0 +1,64 @@
+import { r as aiMessageSchema } from "./message-CaKlqdsX.js";
+//#region src/blocks/ai-chat/history.ts
+/** Checks an untrusted value (a request body) against the canonical format. */
+function validateMessage(value) {
+	const result = aiMessageSchema["~standard"].validate(value);
+	if (result instanceof Promise) throw new TypeError("aiMessageSchema validates synchronously");
+	return result.issues ? {
+		ok: false,
+		issues: result.issues
+	} : {
+		ok: true,
+		message: result.value
+	};
+}
+/** The canonical messages of a path, in order, without the tree's fields. */
+function pathToHistory(path) {
+	return path.map((message) => ({
+		id: message.id,
+		role: message.role,
+		parts: message.parts,
+		...message.metadata === void 0 ? {} : { metadata: message.metadata }
+	}));
+}
+/** The output a `tool-result` gets when its call never finished. */
+const INTERRUPTED_TOOL_OUTPUT = "The tool call was interrupted.";
+/**
+* Closes every tool call that has no result yet, so a provider accepts the
+* history after a crash or a stop mid-call: each gets a `tool-result` with
+* `isError` right after it. A call waiting for approval is left alone.
+*/
+function repairDanglingToolCalls(messages) {
+	const answered = /* @__PURE__ */ new Set();
+	const waiting = /* @__PURE__ */ new Set();
+	for (const message of messages) for (const part of message.parts) {
+		if (part.type === "tool-result") answered.add(part.toolCallId);
+		if (part.type === "tool-approval" && part.state === "requested") waiting.add(part.toolCallId);
+	}
+	return messages.map((message) => {
+		if (!message.parts.some((part) => dangling(part, answered, waiting))) return message;
+		const parts = [];
+		for (const part of message.parts) {
+			parts.push(part);
+			if (part.type === "tool-call" && dangling(part, answered, waiting)) {
+				const result = {
+					type: "tool-result",
+					toolCallId: part.toolCallId,
+					toolName: part.toolName,
+					output: INTERRUPTED_TOOL_OUTPUT,
+					isError: true
+				};
+				parts.push(result);
+			}
+		}
+		return {
+			...message,
+			parts
+		};
+	});
+}
+function dangling(part, answered, waiting) {
+	return part.type === "tool-call" && part.providerExecuted !== true && !answered.has(part.toolCallId) && !waiting.has(part.toolCallId);
+}
+//#endregion
+export { validateMessage as i, pathToHistory as n, repairDanglingToolCalls as r, INTERRUPTED_TOOL_OUTPUT as t };

package/dist/hono/index.d.ts

@@ -1,9 +1,37 @@
-import { P as TableKey, n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
-import { t as BetterSupabase } from "../define-Bp_BZa5h.js";
-import { o as AuthState } from "../impersonation-BmePsuxz.js";
-import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-BR1fJWOB.js";
-import { a as ResourceRouteOptions } from "../resource-DNRFP7KR.js";
+import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
+import { r as AuthState } from "../resolve-KW8nCeL6.js";
+import { t as BetterSupabase } from "../define-CJJkkr1-.js";
+import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-CeVeeXwz.js";
+import { t as AuthSession } from "../view-DbxLNu8L.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DoBijysA.js";
+import { s as BlockRequireOptions } from "../kit-B5tid-q5.js";
+import { a as ResourceRouteOptions } from "../resource-D6Uc7Sk7.js";
+import { AnyEntry, Contributions, ValidateEntries } from "@supabase/middleware";
 import { Context, ErrorHandler, Hono, MiddlewareHandler } from "hono";
+//#region src/bridges/hono.d.ts
+/**
+ * The Hono middleware type when the entries compose, or the engine's error
+ * string when they don't, which surfaces at the `app.use` call.
+ */
+type HonoBridge<Entries extends readonly AnyEntry[]> = [ValidateEntries<Entries>] extends [true] ? MiddlewareHandler<{
+  Variables: Contributions<Entries>;
+}> : ValidateEntries<Entries>;
+/**
+ * Runs an entry array in Hono's middleware slot. The pipeline folds once,
+ * so entries keep their state across requests; each request publishes every
+ * contributed key on `c.var`, runs the rest of the Hono chain, and returns
+ * Hono's response back up through the entries, so response-phase entries
+ * (refreshed cookies, `withCors`) see it.
+ *
+ * ```ts
+ * const app = new Hono().use(toHono([withBetterSupabase(server)])).get('/notes', (c) => ...)
+ * ```
+ *
+ * Chain `.use()` into the routes it gates: Hono carries the contributed
+ * keys through the chained call's type.
+ */
+export declare function toHono<const Entries extends readonly AnyEntry[]>(entries: Entries): HonoBridge<Entries>;
+//#endregion
 //#region src/hono/index.d.ts
 /** Hono `Env` with the request's better-supabase context in `c.var`. */
 export interface HonoEnv<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
@@ -11,11 +39,20 @@ export interface HonoEnv<M extends AnyModels, F extends AnyFunctions, E, C = unk
     readonly bs: ServerContext<M, F, E, C, P>;
     readonly db: ServerContext<M, F, E, C, P>["db"];
     readonly auth: AuthState<C, P>;
+    /** The caller as plain data, safe to return in a response. */
+    readonly session: AuthSession<C, P>;
+    /** The active tenant: `ServerOptions.tenant`, then the tenant claim. */
+    readonly tenant: string | undefined;
   };
 }
 export interface HonoOptions extends ServerOptions {
   /** Include error details in problem responses. Defaults to `NODE_ENV === 'development'`. */
   readonly exposeErrors?: boolean;
+  /**
+   * Keeps the invocation alive for event sink sends a handler started.
+   * Defaults to `c.executionCtx.waitUntil` when the runtime passes one (Workers).
+   */
+  readonly waitUntil?: (promise: Promise<unknown>) => void;
 }
 export interface BetterHono<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
   /**
@@ -27,7 +64,19 @@ export interface BetterHono<M extends AnyModels, F extends AnyFunctions, E, C =
   app(): Hono<HonoEnv<M, F, E, C, P>>;
   /** Resolves the caller, enforces `allow` and sets `c.var.bs`, `c.var.db`, `c.var.auth`. */
   middleware(options?: MiddlewareOptions): MiddlewareHandler<HonoEnv<M, F, E, C, P>>;
-  /** Wraps a handler: `Result`s become JSON or Problem Details, `undefined` becomes 204. */
+  /**
+   * A route guard after `middleware()`: `allow`, `aal`, `scopes`,
+   * `requireTenant` and `authorize`. A refused caller gets Problem Details.
+   *
+   * ```ts
+   * app.post('/invites', bs.require({ requireTenant: true, roles: ['admin'] }), handler)
+   * ```
+   */
+  require: (options?: BlockRequireOptions<C, P>) => MiddlewareHandler<HonoEnv<M, F, E, C, P>>;
+  /**
+   * Wraps a handler: `Result`s and `AsyncResult`s become JSON or Problem
+   * Details, `undefined` becomes 204.
+   */
   handler(fn: (c: Context<HonoEnv<M, F, E, C, P>>, ctx: ServerContext<M, F, E, C, P>) => unknown, options?: {
     readonly status?: number;
   }): (c: Context<HonoEnv<M, F, E, C, P>>) => Promise<Response>;
@@ -46,4 +95,4 @@ export interface BetterHono<M extends AnyModels, F extends AnyFunctions, E, C =
 /** Hono integration: a server plus middleware, handlers and REST resources. */
 export declare function createHono<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: HonoOptions): BetterHono<M, F, E, C, P>;
 //#endregion
-export type { GuardOptions, MiddlewareOptions, ResourceRouteOptions };
+export type { BlockRequireOptions, GuardOptions, HonoBridge, MiddlewareOptions, ResourceRouteOptions };

package/dist/hono/index.js

@@ -1,42 +1,72 @@
-import { n as dbError, r as dbErrorOf } from "../errors-DtwXa6b8.js";
-import { a as problemResponse } from "../problem-BW1KhzSG.js";
-import { d as guard, i as rememberVerifiedFor, n as createServer, p as respond, r as extendServer, u as defaultExpose } from "../server-B1mZ7CgQ.js";
-import { t as defineResource } from "../resource-mqfJW4YF.js";
+import { r as dbErrorOf } from "../errors-B11Duf73.js";
+import { a as problemResponse } from "../problem-BreOl8b8.js";
+import { a as unexpectedResponse, c as extendServer, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { n as toSession } from "../view-BeFcRV6G.js";
+import { a as respond, t as defaultExpose } from "../respond-BUgsXNgk.js";
+import { t as withBetterSupabase } from "../composite-DhE66P5u.js";
+import { t as defineResource } from "../resource-BsvzCMlX.js";
+import { i as requireCaller } from "../kit-Fm-Fv7q5.js";
+import { r as handoffOf } from "../shared-CBxosKK3.js";
+import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
+//#region src/bridges/hono.ts
+const HANDOFF = Symbol("toHono.handoff");
+/** Copies every contributed key onto `c.var`. */
+function publishAll(c, ctx) {
+	for (const [key, value] of Object.entries(ctx)) c.set(key, value);
+}
+/**
+* The Hono middleware for `entries`. `publish` decides what lands on
+* `c.var`; `createHono` adds `auth` from `ctx.bs`.
+*/
+function honoMiddleware(entries, publish = publishAll) {
+	const run = pipeline(entries, async (_request, ctx) => {
+		const handoff = handoffOf(ctx, HANDOFF);
+		handoff.publish(handoff.c, ctx);
+		await handoff.next();
+		return handoff.c.res;
+	});
+	return async (c, next) => {
+		if (c.req.raw.body) c.req.raw = bufferRequest(c.req.raw);
+		const response = await run(c.req.raw, {
+			...seedContext(c.env),
+			[HANDOFF]: {
+				c,
+				next,
+				publish
+			}
+		});
+		if (response !== c.res) {
+			c.res = void 0;
+			c.res = response;
+		}
+	};
+}
+/**
+* Runs an entry array in Hono's middleware slot. The pipeline folds once,
+* so entries keep their state across requests; each request publishes every
+* contributed key on `c.var`, runs the rest of the Hono chain, and returns
+* Hono's response back up through the entries, so response-phase entries
+* (refreshed cookies, `withCors`) see it.
+*
+* ```ts
+* const app = new Hono().use(toHono([withBetterSupabase(server)])).get('/notes', (c) => ...)
+* ```
+*
+* Chain `.use()` into the routes it gates: Hono carries the contributed
+* keys through the chained call's type.
+*/
+function toHono(entries) {
+	return honoMiddleware(entries);
+}
+//#endregion
 //#region src/hono/index.ts
 function contextOf(c) {
 	const ctx = c.get("bs");
 	if (!ctx) throw new TypeError("better-supabase: no context on this request; add app.use(bs.middleware()) first");
 	return ctx;
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null;
-}
-function isJwtClaims(value) {
-	return isRecord(value) && typeof value["sub"] === "string";
-}
-function isUserClaims(value) {
-	return isRecord(value) && typeof value["id"] === "string";
-}
-/**
-* The bearer token `withSupabase` from `@supabase/server/adapters/hono`
-* verified for this request, with the claims it stored in
-* `c.var.supabaseContext`.
-*/
-function verifiedBySupabase(c) {
-	const supabase = c.var["supabaseContext"];
-	if (!isRecord(supabase) || supabase["authMode"] !== "user") return void 0;
-	const { jwtClaims, userClaims } = supabase;
-	const header = c.req.header("authorization");
-	const token = header?.startsWith("Bearer ") ? header.slice(7) : "";
-	if (!token || !isJwtClaims(jwtClaims) || !isUserClaims(userClaims)) return void 0;
-	return {
-		token,
-		claims: jwtClaims,
-		user: userClaims
-	};
-}
 /** Hono integration: a server plus middleware, handlers and REST resources. */
 function createHono(betterSupabase, options = {}) {
 	const server = createServer(betterSupabase, options);
@@ -49,12 +79,22 @@ function createHono(betterSupabase, options = {}) {
 			instance,
 			expose
 		});
-		const error = dbError("unexpected", expose ? cause.message : "Internal server error", { status: 500 });
-		return problemResponse(error, {
+		return unexpectedResponse(cause, {
 			instance,
 			expose
 		});
 	};
+	const waitUntilOf = (c) => {
+		if (options.waitUntil) return options.waitUntil;
+		try {
+			const executionContext = c.executionCtx;
+			return (promise) => {
+				executionContext.waitUntil(promise);
+			};
+		} catch {
+			return;
+		}
+	};
 	return extendServer(server, {
 		Env: void 0,
 		onError,
@@ -62,20 +102,32 @@ function createHono(betterSupabase, options = {}) {
 			return new Hono().onError(onError);
 		},
 		middleware(middlewareOptions = {}) {
+			const run = honoMiddleware([withBetterSupabase(server, {
+				...middlewareOptions,
+				expose
+			})], (c, ctx) => {
+				const bs = ctx.bs;
+				const { tenant } = ctx;
+				c.set("bs", bs);
+				c.set("db", bs.db);
+				c.set("auth", bs.auth);
+				c.set("session", toSession(bs.auth));
+				c.set("tenant", tenant);
+			});
 			return async (c, next) => {
-				const verified = verifiedBySupabase(c);
-				if (verified) rememberVerifiedFor(server, verified);
-				const ctx = await server.context(c.req.raw, { refresh: middlewareOptions.refresh ?? false });
-				const denied = guard(ctx.auth, middlewareOptions.allow, middlewareOptions.aal, middlewareOptions.scopes);
-				if (denied) return ctx.resolution.apply(problemResponse(denied, {
+				await run(c, next);
+				flushEvents(server, waitUntilOf(c));
+			};
+		},
+		require: (requireOptions = {}) => {
+			return async (c, next) => {
+				const ctx = contextOf(c);
+				const caller = await requireCaller(ctx.auth, requireOptions, c.get("tenant"));
+				if ("kind" in caller) return problemResponse(caller, {
 					instance: new URL(c.req.url).pathname,
 					expose
-				}));
-				c.set("bs", ctx);
-				c.set("db", ctx.db);
-				c.set("auth", ctx.auth);
-				await next();
-				c.res = ctx.apply(c.res);
+				});
+				return next();
 			};
 		},
 		handler(fn, handlerOptions = {}) {
@@ -102,4 +154,4 @@ function createHono(betterSupabase, options = {}) {
 	});
 }
 //#endregion
-export { createHono };
+export { createHono, toHono };