better-supabase 0.5.1 → 0.6.0

package/dist/index-D48jVS-N.d.ts

@@ -0,0 +1,246 @@
+import { b as DbError, f as Result, t as AsyncResult } from "./result-D7y2fT87.js";
+import { n as StoragePath } from "./path-Cv__-OTj.js";
+import { a as BucketConnectOptions, h as StorageClient, i as BucketConfig, n as Bucket, r as BucketClient, s as BucketPolicy } from "./bucket-Cl46E3jS.js";
+import { SupabaseClient } from "@supabase/supabase-js";
+//#region src/storage/errors.d.ts
+/** Maps a Storage error (`StorageApiError`, fetch failures) to a `DbError`. */
+declare function fromStorageError(raw: unknown, table?: string): DbError;
+//#endregion
+//#region src/storage/image-url.d.ts
+interface StorageImageOptions {
+  /** Project URL, e.g. `import.meta.env.PUBLIC_SUPABASE_URL`. */
+  readonly url: string;
+  /** Resize mode for the transform. Defaults to Storage's own (`cover`). */
+  readonly resize?: "cover" | "contain" | "fill";
+}
+/** The size and quality to render an image at. */
+interface StorageImageSize {
+  readonly width: number;
+  readonly height?: number | undefined;
+  readonly quality?: number | undefined;
+}
+/**
+ * Turns public Storage object URLs into Supabase image transformation URLs
+ * (`/render/image/public`) at a given size. Any other URL (local files,
+ * other hosts, signed URLs) comes back as `undefined`: a signed URL's token
+ * covers the transform it was signed with, so sign it with `renderUrl()`.
+ *
+ * ```ts
+ * const imageUrl = storageImageUrl({ url: SUPABASE_URL })
+ * imageUrl(avatar, { width: 96 }) ?? avatar
+ * ```
+ */
+declare function storageImageUrl(options: StorageImageOptions): (src: string, size: StorageImageSize) => string | undefined;
+//#endregion
+//#region src/storage/registry.d.ts
+/** Any bucket definition from `defineBucket` or a preset. */
+type AnyBucket = Bucket<string>;
+type BucketMap = Readonly<Record<string, AnyBucket>>;
+/** The bucket ids of a registry's buckets. */
+type BucketIdOf<B extends BucketMap> = B[keyof B]["id"];
+/** The bucket of a registry whose id is `I`. */
+type BucketWithId<B extends BucketMap, I extends string> = Extract<B[keyof B], {
+  readonly id: I;
+}>;
+/** A stored object as rows keep it: the bucket id and the object path. */
+interface StoredRef {
+  /** The bucket id, e.g. a `bucket_id` column. */
+  readonly bucket: string;
+  readonly path: string;
+}
+/** A stored reference whose bucket is registered and whose path matches one of its templates. */
+interface ResolvedRef<B extends BucketMap> {
+  readonly bucket: B[keyof B];
+  readonly path: StoragePath<BucketIdOf<B>>;
+}
+/** A resolved reference with a client of its bucket. */
+interface ConnectedRef<B extends BucketMap> extends ResolvedRef<B> {
+  readonly storage: BucketClient<string, BucketIdOf<B>>;
+}
+interface Buckets<B extends BucketMap> {
+  /** The bucket definitions, by the names given. */
+  readonly buckets: B;
+  /** Every registered bucket id, in the order given. */
+  readonly ids: readonly BucketIdOf<B>[];
+  /** Whether `id` names a registered bucket. */
+  has(id: string): id is BucketIdOf<B>;
+  /** The bucket with this id, or `invalid_input` for an id no bucket has. */
+  byId<I extends BucketIdOf<B>>(id: I): Result<BucketWithId<B, I>>;
+  byId(id: string): Result<B[keyof B]>;
+  /**
+   * Checks a stored `{ bucket, path }`: the bucket must be registered and the
+   * path must match one of its templates. Either failure is `invalid_input`.
+   */
+  resolve(ref: StoredRef): Result<ResolvedRef<B>>;
+  /**
+   * `resolve`, then `connect` the bucket and check the path with the
+   * connected client, so a bucket with `tenant` also refuses another
+   * tenant's path (`forbidden`). No request is made.
+   */
+  connectStored(client: StorageClient, ref: StoredRef, options?: BucketConnectOptions): Result<ConnectedRef<B>>;
+}
+/**
+ * A registry of bucket definitions by id, for rows that store a bucket id
+ * next to an object path (files, attachments, sources). An id no bucket
+ * has, and a path outside the bucket's templates, are errors, never a
+ * fallback bucket.
+ *
+ * ```ts
+ * export const buckets = defineBuckets({ files, attachments, logos });
+ *
+ * const ref = buckets.connectStored(supabase, {
+ *   bucket: row.bucketId,
+ *   path: row.path,
+ * }, { context: db.$context });
+ * if (ref.ok) await ref.data.storage.signedUrl(ref.data.path);
+ * ```
+ */
+declare function defineBuckets<const B extends BucketMap>(buckets: B): Buckets<B>;
+//#endregion
+//#region src/storage/presets.d.ts
+/** The image types browsers display everywhere. */
+declare const IMAGE_TYPES: readonly string[];
+interface ImageBucketOptions<P extends string, Id extends string> {
+  readonly id?: Id;
+  /** The path template; keep the preset's placeholders the policy relies on. */
+  readonly path?: P | readonly [P, ...P[]];
+  /** Defaults to `true`: images load from their public URL without signing. */
+  readonly public?: boolean;
+  readonly fileSizeLimit?: string | number;
+  readonly allowedMimeTypes?: readonly string[];
+  /** Replaces the preset's policy. */
+  readonly policy?: BucketPolicy;
+}
+type AvatarBucketOptions<P extends string, Id extends string> = ImageBucketOptions<P, Id>;
+interface OrganizationLogoBucketOptions<P extends string, Id extends string> extends ImageBucketOptions<P, Id> {
+  /**
+   * The permission that may upload, replace and delete a logo, checked
+   * through the access contract. Defaults to `organization.update`, the
+   * `organizations` module's update permission.
+   */
+  readonly permission?: string;
+  /**
+   * The tenant segment connected clients are held to. `false` lets one
+   * client upload for any organization the policy allows. Defaults to
+   * `{ param: 'organizationId' }`.
+   */
+  readonly tenant?: BucketConfig["tenant"] | false;
+}
+declare const AVATAR_PATH = "{userId}/avatar-{version}.{ext}";
+declare const LOGO_PATH = "{organizationId}/logo-{version}.{ext}";
+/**
+ * A bucket for profile pictures: `{userId}/avatar-{version}.{ext}`, public,
+ * 2 MiB of images, written only by their owner (the `owner` policy).
+ */
+declare function avatarBucket<const P extends string = typeof AVATAR_PATH, const Id extends string = "avatars">(options?: AvatarBucketOptions<P, Id>): Bucket<P, Id>;
+/**
+ * A bucket for organization logos: `{organizationId}/logo-{version}.{ext}`, public,
+ * 2 MiB of images, written by members with the update permission through
+ * the access contract (`tenant_ids_with`), so it follows the app's roles.
+ */
+declare function organizationLogoBucket<const P extends string = typeof LOGO_PATH, const Id extends string = "organization-logos">(options?: OrganizationLogoBucketOptions<P, Id>): Bucket<P, Id>;
+//#endregion
+//#region src/storage/analytics-bucket.d.ts
+/** The Iceberg REST catalog of an analytics bucket, from `storage.analytics.from(id)`. */
+type AnalyticsCatalog = ReturnType<SupabaseClient["storage"]["analytics"]["from"]>;
+interface AnalyticsBucketClient {
+  /** Creates the bucket when it is missing. Needs the secret key. */
+  apply(): AsyncResult<{
+    readonly created: boolean;
+  }>;
+  /** The bucket's Iceberg catalog: namespaces and tables, each call returning `{ data, error }`. */
+  catalog(): AnalyticsCatalog;
+}
+interface AnalyticsBucket<Id extends string> {
+  readonly id: Id;
+  connect(client: StorageClient): AnalyticsBucketClient;
+}
+/**
+ * A Storage analytics bucket: Apache Iceberg tables that query engines read
+ * through the Iceberg REST catalog.
+ *
+ * ```ts
+ * export const events = defineAnalyticsBucket({ id: "events" });
+ * await events.connect(admin).apply().orThrow();
+ * ```
+ */
+declare function defineAnalyticsBucket<const Id extends string>(config: {
+  readonly id: Id;
+}): AnalyticsBucket<Id>;
+//#endregion
+//#region src/storage/vector-bucket.d.ts
+type VectorDistance = "cosine" | "euclidean" | "dotproduct";
+interface VectorIndexConfig {
+  /** Number of values in every vector, e.g. 1536 for `text-embedding-3-small`. */
+  readonly dimension: number;
+  /** Defaults to `cosine`. */
+  readonly distanceMetric?: VectorDistance;
+  /** Metadata keys stored with each vector but not usable in `filter`. */
+  readonly nonFilterableMetadataKeys?: readonly string[];
+}
+interface VectorBucketConfig<Id extends string, I extends Readonly<Record<string, VectorIndexConfig>>> {
+  readonly id: Id;
+  readonly indexes: I;
+}
+type VectorMetadata = Readonly<Record<string, unknown>>;
+interface VectorRecord<M extends VectorMetadata = VectorMetadata> {
+  readonly key: string;
+  readonly vector: readonly number[];
+  readonly metadata?: M;
+}
+interface VectorHit<M extends VectorMetadata = VectorMetadata> {
+  readonly key: string;
+  /** Set by `query()`: smaller is closer for every metric. */
+  readonly distance?: number;
+  readonly metadata?: M;
+  readonly vector?: readonly number[];
+}
+interface VectorQueryOptions {
+  /** Number of matches, defaults to 10. */
+  readonly topK?: number;
+  /** A metadata filter, e.g. `{ organizationId: "o1" }` or `{ year: { $gte: 2024 } }`. */
+  readonly filter?: VectorMetadata;
+  /** Return each match's metadata. Defaults to `true`. */
+  readonly metadata?: boolean;
+}
+interface VectorIndexClient<M extends VectorMetadata = VectorMetadata> {
+  readonly name: string;
+  readonly dimension: number;
+  /** Inserts or replaces vectors by key, in batches of 500. */
+  put(records: readonly VectorRecord<M>[]): AsyncResult<number>;
+  /** The nearest vectors, closest first. */
+  query(vector: readonly number[], options?: VectorQueryOptions): AsyncResult<readonly VectorHit<M>[]>;
+  /** Vectors by key; missing keys are left out. */
+  get(keys: readonly string[], options?: {
+    readonly vector?: boolean;
+  }): AsyncResult<readonly VectorHit<M>[]>;
+  remove(keys: readonly string[]): AsyncResult<readonly string[]>;
+}
+interface VectorBucketClient<I extends string> {
+  /** Creates the bucket and any missing index. An index with another dimension or metric is a `conflict`. */
+  apply(): AsyncResult<{
+    readonly created: readonly string[];
+  }>;
+  index<M extends VectorMetadata = VectorMetadata>(name: I): VectorIndexClient<M>;
+}
+interface VectorBucket<Id extends string, I extends Readonly<Record<string, VectorIndexConfig>>> {
+  readonly id: Id;
+  readonly indexes: I;
+  connect(client: StorageClient): VectorBucketClient<keyof I & string>;
+}
+/**
+ * A Storage vector bucket with typed indexes. Storage keeps the vectors
+ * outside Postgres; use the `vector-search` module for pgvector in a table.
+ *
+ * ```ts
+ * export const embeddings = defineVectorBucket({
+ *   id: "embeddings",
+ *   indexes: { documents: { dimension: 1536 } },
+ * });
+ * const docs = embeddings.connect(admin).index("documents");
+ * await docs.put([{ key: doc.id, vector, metadata: { organizationId } }]);
+ * ```
+ */
+declare function defineVectorBucket<const Id extends string, const I extends Readonly<Record<string, VectorIndexConfig>>>(config: VectorBucketConfig<Id, I>): VectorBucket<Id, I>;
+//#endregion
+export { defineBuckets as A, BucketIdOf as C, ConnectedRef as D, Buckets as E, StorageImageSize as M, storageImageUrl as N, ResolvedRef as O, fromStorageError as P, AnyBucket as S, BucketWithId as T, IMAGE_TYPES as _, VectorHit as a, avatarBucket as b, VectorMetadata as c, defineVectorBucket as d, AnalyticsBucket as f, AvatarBucketOptions as g, defineAnalyticsBucket as h, VectorDistance as i, StorageImageOptions as j, StoredRef as k, VectorQueryOptions as l, AnalyticsCatalog as m, VectorBucketClient as n, VectorIndexClient as o, AnalyticsBucketClient as p, VectorBucketConfig as r, VectorIndexConfig as s, VectorBucket as t, VectorRecord as u, ImageBucketOptions as v, BucketMap as w, organizationLogoBucket as x, OrganizationLogoBucketOptions as y };

package/dist/index-DDrYaUcq.d.ts

@@ -0,0 +1,138 @@
+import { n as RouteGuardOptions } from "./refusal-D1rgbzNq.js";
+import { t as Validated } from "./shared-DDSjEGDR.js";
+import { AnyEntry, Contributions } from "@supabase/middleware";
+import { IncomingMessage, ServerResponse } from "node:http";
+//#region src/node/http.d.ts
+interface WebRequestOptions {
+  /**
+   * Read the protocol and host from `x-forwarded-proto` and
+   * `x-forwarded-host`. Turn it on behind a proxy you control. Defaults to false.
+   */
+  readonly trustProxy?: boolean;
+  /** Stream the request body into the `Request`. Defaults to true. */
+  readonly body?: boolean;
+}
+/**
+ * A Node `IncomingMessage` as a Web `Request`. Express, Fastify and Koa
+ * pass theirs (`req`, `request.raw`, `ctx.req`). With `body: false` the
+ * stream stays unread, for middleware that runs before a body parser.
+ */
+declare function toWebRequest(req: IncomingMessage, options?: WebRequestOptions): Request;
+/** Writes a Web `Response` to a Node `ServerResponse`, streaming the body. */
+declare function sendWebResponse(res: ServerResponse, response: Response): Promise<void>;
+//#endregion
+//#region src/node/index.d.ts
+interface ToNodeOptions<Req = IncomingMessage> extends Omit<WebRequestOptions, "body"> {
+  /** The host's env object for `getEnv`; defaults to `process.env` through `getEnv`. */
+  readonly env?: (req: Req) => unknown;
+}
+/**
+ * A `node:http` request listener running the entries around `handler`.
+ * Response-phase entries see the handler's response, so refreshed cookies
+ * and `withDbStats` totals reach the client.
+ *
+ * ```ts
+ * createServer(toNodeHandler([withBetterSupabase(server)], (request, { db }) => db.notes.findMany()))
+ * ```
+ */
+declare function toNodeHandler<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, handler: (request: Request, contributions: Contributions<Entries>) => unknown, options?: ToNodeOptions): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+/** The part of an Express response the middleware writes. */
+interface ExpressResponse extends ServerResponse {
+  /** Express's per-request locals; the contributions land here. */
+  locals: Record<string, unknown>;
+}
+/** Express (or Connect) middleware, typed structurally. */
+type ExpressMiddleware = (req: IncomingMessage, res: ExpressResponse, next: (error?: unknown) => void) => void;
+/** An Express error handler, typed structurally. */
+type ExpressErrorHandler = (error: unknown, req: IncomingMessage, res: ExpressResponse, next: (error?: unknown) => void) => void;
+/**
+ * Express middleware that puts every contribution on `res.locals`
+ * (`res.locals.db`, `res.locals.bs`). Mount it before the routes.
+ *
+ * ```ts
+ * app.use(toExpress([withBetterSupabase(server)]))
+ * app.get('/notes', async (req, res) => res.json(await res.locals.db.notes.findMany().orThrow()))
+ * ```
+ */
+declare function toExpress<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, options?: ToNodeOptions): ExpressMiddleware;
+/**
+ * Express route middleware that refuses callers outside `options`:
+ * Problem Details, or a redirect to `signIn` or `mfa`. Runs after `toExpress`.
+ *
+ * ```ts
+ * app.get('/admin', guard({ roles: ['admin'] }), handler)
+ * ```
+ */
+declare function guard(options?: RouteGuardOptions): ExpressMiddleware;
+/**
+ * An Express error handler that answers thrown `DbException`s (from
+ * `.orThrow()`) with Problem Details and passes every other error on.
+ * Register it after the routes.
+ */
+declare function problemErrorHandler(options?: {
+  readonly expose?: boolean;
+}): ExpressErrorHandler;
+/** The part of a Fastify request the hook reads and writes. */
+interface FastifyRequestLike {
+  readonly raw: IncomingMessage;
+  /** The contributions land here: `request.locals.db`. */
+  locals?: Record<string, unknown>;
+}
+/** The part of a Fastify reply the hook writes. */
+interface FastifyReplyLike {
+  readonly raw: ServerResponse;
+  readonly sent: boolean;
+  code(status: number): FastifyReplyLike;
+  header(name: string, value: string | readonly string[]): FastifyReplyLike;
+  getHeader(name: string): number | string | string[] | undefined;
+  send(payload?: unknown): FastifyReplyLike;
+}
+/** A Fastify `onRequest` or `preHandler` hook, typed structurally. */
+type FastifyHook = (request: FastifyRequestLike, reply: FastifyReplyLike) => Promise<void>;
+/**
+ * A Fastify `onRequest` hook that puts every contribution on
+ * `request.locals`. Declare `locals` with `app.decorateRequest('locals', null)`.
+ *
+ * ```ts
+ * app.decorateRequest('locals', null)
+ * app.addHook('onRequest', toFastify([withBetterSupabase(server)]))
+ * app.get('/notes', (request) => request.locals.db.notes.findMany().orThrow())
+ * ```
+ */
+declare function toFastify<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, options?: ToNodeOptions<FastifyRequestLike>): FastifyHook;
+/**
+ * A Fastify `preHandler` hook that refuses callers outside `options`. Runs
+ * after `toFastify`.
+ */
+declare function fastifyGuard(options?: RouteGuardOptions): FastifyHook;
+/** The part of a Koa context the middleware reads and writes. */
+interface KoaContextLike {
+  readonly req: IncomingMessage;
+  readonly res: ServerResponse;
+  /** Koa's per-request state; the contributions land here. */
+  state: Record<string, unknown>;
+  status: number;
+  body: unknown;
+  set(name: string, value: string | readonly string[]): void;
+  get response(): {
+    get(name: string): string | string[] | undefined;
+  };
+}
+/** Koa middleware, typed structurally. */
+type KoaMiddleware = (ctx: KoaContextLike, next: () => Promise<unknown>) => Promise<void>;
+/**
+ * Koa middleware that puts every contribution on `ctx.state`, then awaits
+ * the rest of the chain. Thrown `DbException`s become Problem Details.
+ *
+ * ```ts
+ * app.use(toKoa([withBetterSupabase(server)]))
+ * app.use(async (ctx) => { ctx.body = await ctx.state.db.notes.findMany().orThrow() })
+ * ```
+ */
+declare function toKoa<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, options?: ToNodeOptions<KoaContextLike> & {
+  readonly expose?: boolean;
+}): KoaMiddleware;
+/** Koa middleware that refuses callers outside `options`. Runs after `toKoa`. */
+declare function koaGuard(options?: RouteGuardOptions): KoaMiddleware;
+//#endregion
+export { toNodeHandler as _, FastifyReplyLike as a, toWebRequest as b, KoaMiddleware as c, guard as d, koaGuard as f, toKoa as g, toFastify as h, FastifyHook as i, ToNodeOptions as l, toExpress as m, ExpressMiddleware as n, FastifyRequestLike as o, problemErrorHandler as p, ExpressResponse as r, KoaContextLike as s, ExpressErrorHandler as t, fastifyGuard as u, WebRequestOptions as v, sendWebResponse as y };

package/dist/index-DQh4VCc9.d.ts

@@ -0,0 +1,98 @@
+import { P as SchemaMeta, u as ClaimsMeta } from "./types-6BdhkmZe.js";
+import { h as Generator } from "./config-D44Y7PAv.js";
+//#region src/core/claims.d.ts
+declare const DEFAULT_CLAIMS: ClaimsMeta;
+/** Where an adapter reads each claim the SQL modules and the provider's hook write. */
+interface ClaimPaths {
+  /** The active tenant: the top-level claim, then the same key in `app_metadata`. */
+  readonly tenant: readonly [string, string];
+  /** `{ [tenantId]: string[] }` of plan features. */
+  readonly features: string;
+  /** The caller's memberships, a list of `{ scope, id, roles }` or a map of tenant id to role. */
+  readonly memberships: string;
+  /** The `scope` of tenant entries in the memberships list. */
+  readonly scope: string;
+}
+/**
+ * The claim paths for `config.claims`, with defaults. For a generated
+ * schema, pass `claimsOf(meta)`.
+ */
+declare function claimPaths(claims?: Partial<ClaimsMeta>): ClaimPaths;
+/** Where the active tenant is read from: the top-level claim, then `app_metadata`. */
+declare function tenantClaimPaths(tenant?: string): readonly [string, string];
+//#endregion
+//#region src/generators/shared.d.ts
+/** What field planning reads: the metadata and the typed-jsonb config. */
+interface SchemaSource {
+  readonly meta: SchemaMeta;
+  readonly config: {
+    readonly json: Readonly<Record<string, unknown>>;
+  };
+}
+interface CommentEntry {
+  readonly id: number;
+  readonly schema: string;
+  readonly name: string;
+  readonly comment: string | null;
+}
+/**
+ * The catalog parts docs read: `GeneratorInput` satisfies it. Runtime callers
+ * that only have `meta` (OpenAPI, MCP) pass none and get no docs.
+ */
+interface DocsSource extends SchemaSource {
+  readonly introspection?: {
+    readonly tables: readonly CommentEntry[];
+    readonly views: readonly CommentEntry[];
+    readonly materializedViews?: readonly CommentEntry[];
+    readonly columns: readonly {
+      readonly table_id: number;
+      readonly name: string;
+      readonly comment: string | null;
+      readonly check: string | null;
+    }[];
+  };
+  readonly extras?: {
+    readonly tables: readonly {
+      readonly schema: string;
+      readonly name: string;
+      readonly checks: readonly {
+        readonly definition: string;
+      }[];
+    }[];
+  };
+}
+//#endregion
+//#region src/generators/json-schema.d.ts
+interface JsonSchemaGeneratorOptions {
+  /** Output path relative to the project root. Defaults to `<output>.schema.json`. */
+  readonly output?: string;
+  /** `$id` of the document. */
+  readonly id?: string;
+}
+type JsonSchema = Record<string, unknown>;
+/** JSON Schema (2020-12) `$defs` for every table: `customersRow`, `customersInsert`, ... */
+declare function buildJsonSchema(input: DocsSource, id?: string): JsonSchema;
+/** Writes the JSON Schema document; `createOpenApi` reuses the same `$defs`. */
+declare function jsonSchema(options?: JsonSchemaGeneratorOptions): Generator;
+//#endregion
+//#region src/generators/valibot.d.ts
+interface ValibotGeneratorOptions {
+  /** Output path relative to the project root. Defaults to `<output>.valibot.ts`. */
+  readonly output?: string;
+  /** Schemas for typed jsonb columns: `{ 'customers.metadata': './schemas.ts#metadata' }`. */
+  readonly json?: Readonly<Record<string, string>>;
+}
+/** Valibot schemas for every table's Row, Insert and Update shape. */
+declare function valibot(options?: ValibotGeneratorOptions): Generator;
+//#endregion
+//#region src/generators/zod.d.ts
+interface ZodGeneratorOptions {
+  /** Output path relative to the project root. Defaults to `<output>.zod.ts`. */
+  readonly output?: string;
+  /** Schemas for typed jsonb columns: `{ 'customers.metadata': './schemas.ts#metadata' }`. */
+  readonly json?: Readonly<Record<string, string>>;
+}
+/** Zod 4 schemas for every table's Row, Insert and Update shape. */
+declare function zod(options?: ZodGeneratorOptions): Generator;
+//#endregion
+export { JsonSchemaGeneratorOptions as a, ClaimPaths as c, tenantClaimPaths as d, valibot as i, DEFAULT_CLAIMS as l, zod as n, buildJsonSchema as o, ValibotGeneratorOptions as r, jsonSchema as s, ZodGeneratorOptions as t, claimPaths as u };