better-supabase 0.5.1 → 0.6.0

package/dist/messages-DYP0sUTe.d.ts

@@ -0,0 +1,59 @@
+import { a as AiMessage, p as AiToolApprovalPart } from "./message-CfDoR0Y6.js";
+import { ModelMessage, UIMessage } from "ai";
+//#region src/ai-sdk/messages.d.ts
+/** The `format` the chat tree stores next to an AI SDK message it keeps as is. */
+declare const AI_SDK_UI_FORMAT = "ai-sdk-ui";
+/** The output a denied tool call gets in the canonical history. */
+declare const DENIED_TOOL_OUTPUT = "The tool call was denied.";
+/** Whether `value` has the shape of an AI SDK `UIMessage`. */
+declare function isUIMessage(value: unknown): value is UIMessage;
+/**
+ * The canonical form of an AI SDK `UIMessage`. Tool parts become a
+ * `tool-call`, then a `tool-approval` and a `tool-result` as far as the
+ * call got; parts with no canonical counterpart become `data` parts named
+ * `ui.<type>`.
+ */
+declare function fromUIMessage(message: UIMessage): AiMessage;
+/**
+ * The AI SDK form of a canonical message: the stored native message when the
+ * tree kept one (`format: "ai-sdk-ui"`), otherwise a conversion. A `tool`
+ * message becomes an assistant message.
+ */
+declare function toUIMessage(message: AiMessage): UIMessage;
+/**
+ * Converts a history. Tool results and approvals in later messages, such as
+ * the `tool` messages of other SDKs, update the tool part of the assistant
+ * message that made the call.
+ */
+declare function toUIMessages(messages: readonly AiMessage[]): UIMessage[];
+/** A source a model step cited, as `StepResult.sources` holds it. */
+interface ModelSource {
+  readonly sourceType: "url" | "document";
+  readonly id: string;
+  readonly url?: string;
+  readonly title?: string;
+  readonly mediaType?: string;
+  readonly providerMetadata?: unknown;
+}
+/** An approval decision the messages may no longer carry. */
+interface ModelApproval {
+  readonly approvalId: string;
+  readonly toolCallId: string;
+  readonly state: AiToolApprovalPart["state"];
+  readonly reason?: string;
+}
+interface FromModelMessagesOptions {
+  /** The sources the steps cited; model messages don't keep them. */
+  readonly sources?: readonly ModelSource[];
+  /** Decisions to apply over the approval parts the messages hold. */
+  readonly approvals?: readonly ModelApproval[];
+}
+/**
+ * One answer in the canonical form, from the model messages an agent added
+ * in a turn (`result.messages` after the history). Each assistant message
+ * starts a step whose id is `<id>:<n>`, so saving the answer again after
+ * another step updates the same message.
+ */
+declare function fromModelMessages(id: string, messages: readonly ModelMessage[], options?: FromModelMessagesOptions): AiMessage;
+//#endregion
+export { ModelSource as a, isUIMessage as c, ModelApproval as i, toUIMessage as l, DENIED_TOOL_OUTPUT as n, fromModelMessages as o, FromModelMessagesOptions as r, fromUIMessage as s, AI_SDK_UI_FORMAT as t, toUIMessages as u };

package/dist/mfa-Daak8ukG.d.ts

@@ -0,0 +1,54 @@
+import { b as DbError } from "./result-D7y2fT87.js";
+//#region src/auth/impersonation.d.ts
+/** The admin acting as the user, from the RFC 8693 `act` claim. */
+interface Impersonator {
+  /** `act.kind`: a support session or an impersonated session. */
+  readonly kind: "support" | "impersonation";
+  readonly id: string;
+  readonly reason?: string;
+  /** The support session, when the admin started one (`act.session_id`). */
+  readonly sessionId?: string;
+  /** Whether the support session blocks writes (`act.read_only`). */
+  readonly readOnly?: boolean;
+}
+/** `actingAs(userId, claims, { actor, reason })`: who acts, and why (recorded by the audit module). */
+interface ImpersonationOptions {
+  readonly actor: string;
+  readonly reason: string;
+}
+/**
+ * The admin in `claims.act`: a support session or an impersonated session
+ * (`actorOf` reads the same level, so the two always agree). `undefined`
+ * for a normal session, an OAuth client or agent chain, and an invalid `act`.
+ */
+declare function impersonatorOf(claims: Readonly<Record<string, unknown>>): Impersonator | undefined;
+//#endregion
+//#region src/auth/mfa.d.ts
+/** Authenticator assurance level: `aal2` once a second factor is verified in this session. */
+type Aal = "aal1" | "aal2";
+/** One way the user proved who they are in this session (the JWT `amr` claim). */
+interface AmrEntry {
+  /** `password`, `otp`, `oauth`, `totp`, `sso/saml`, `anonymous`, ... */
+  readonly method: string;
+  /** Seconds since epoch. */
+  readonly timestamp: number;
+  /** SSO provider id, for `sso/saml`. */
+  readonly provider?: string;
+}
+/** The session's assurance level from its claims; anything but `aal2` reads as `aal1`. */
+declare function aalOf(claims: Readonly<Record<string, unknown>>): Aal;
+/** The `amr` claim as typed entries, skipping malformed ones. */
+declare function amrOf(claims: Readonly<Record<string, unknown>>): readonly AmrEntry[];
+/**
+ * `undefined` when a user session meets `required`; otherwise a `forbidden`
+ * error with `required` and code `INSUFFICIENT_AAL`, for the client to start
+ * an MFA challenge. Non-user sessions pass: `allow` decides about them.
+ */
+declare function checkAal(auth: {
+  readonly kind: "user";
+  readonly claims: object;
+} | {
+  readonly kind: string;
+}, required: Aal): DbError | undefined;
+//#endregion
+export { checkAal as a, impersonatorOf as c, amrOf as i, AmrEntry as n, ImpersonationOptions as o, aalOf as r, Impersonator as s, Aal as t };

package/dist/modules-DpPwzC7E.d.ts

@@ -0,0 +1,192 @@
+//#region src/config/modules.d.ts
+/**
+ * `sql.modules` in `better-supabase.config.ts`: how each SQL module maps onto
+ * the app's database. A module's contract (the functions other modules and
+ * the TypeScript side call) stays the same in every mode; only the tables
+ * behind it change.
+ */
+/**
+ * `managed`: the module owns its tables. `adopt`: the module writes its functions
+ * and views over tables the app already has (`tables` and `columns`), never
+ * `create table`. `custom`: the app implements the contract functions itself;
+ * the module writes nothing and doctor checks the signatures (BS307).
+ */
+type ModuleMode = "managed" | "adopt" | "custom";
+/** Options every module takes. */
+interface ModuleConfig {
+  readonly mode?: ModuleMode;
+  /** Schema of the module's functions and managed tables. Defaults to `better_supabase`. */
+  readonly schema?: string;
+  /**
+   * Logical table to `table` or `schema.table`, e.g.
+   * `{ memberships: 'public.organization_users' }`. An unqualified name is in
+   * `schema`. `null` marks an optional table the app doesn't have.
+   */
+  readonly tables?: Readonly<Record<string, string | null>>;
+  /**
+   * Logical table to logical column to column name, e.g.
+   * `{ memberships: { tenant: 'organization_id', role: 'role_id' } }`.
+   * `null` marks an optional column the adopted table doesn't have.
+   */
+  readonly columns?: Readonly<Record<string, Readonly<Record<string, string | null>>>>;
+  /** Type of tenant ids: `uuid` (default), `text`, `bigint` or `integer`. */
+  readonly idType?: string;
+  /**
+   * Module action to permission key, checked through the access contract, e.g.
+   * `{ invite: 'organization.members.invite' }`.
+   */
+  readonly permissions?: Readonly<Record<string, string>>;
+  /** Module-specific options; each module's docs page lists them. */
+  readonly options?: Readonly<Record<string, unknown>>;
+  /**
+   * The app's optional `before_*` and `after_*` functions the module calls
+   * when they exist, e.g. `after_organization_create(organization, user)`. They are
+   * looked up in `schema` (default `public`); `functions` maps a hook name
+   * to another function, e.g. `{ after_organization_create: 'app.seed_organization' }`.
+   */
+  readonly hooks?: {
+    readonly schema?: string;
+    readonly functions?: Readonly<Record<string, string>>;
+  };
+  /**
+   * Whether the module writes its events to the outbox (`emit_event`) when
+   * the `outbox` module is installed. Defaults to true.
+   */
+  readonly events?: boolean;
+  /**
+   * Whether the module writes its actions to the audit log (`audit_event`)
+   * when the `audit` module is installed. Defaults to true.
+   */
+  readonly audit?: boolean;
+  /**
+   * A schema for the Data API, such as `api`: the module writes a
+   * `security invoker` wrapper there for each of its functions that `anon`
+   * or `authenticated` may execute (or only those in `functions`), so
+   * `rpcTransport(supabase, { schema: "api" })` reaches them without
+   * exposing the module schema (doctor BS312).
+   */
+  readonly api?: string | {
+    readonly schema: string;
+    readonly functions?: readonly string[];
+  };
+}
+/**
+ * Where the active tenant of a request comes from. Every source counts only
+ * while the caller is a member, so a stale claim or setting grants nothing.
+ */
+type ActiveTenantSource = "claim" | "resolver" | {
+  readonly profileColumn: string;
+  readonly key?: string;
+};
+/** URL tenancy: the tenant comes from the request (a slug), not a stored setting. */
+declare const DEFAULT_ACTIVE_TENANT: ActiveTenantSource;
+/**
+ * The access contract every module checks permissions through:
+ * `can(scope, id, permission)`, `tenant_ids_with(permission)`,
+ * `is_platform(permission)` and `can_user(user, scope, id, permission)`.
+ */
+/**
+ * A table whose row says whether a tenant or a user is active. Needs
+ * `disabledAt`, `status` with `active`, or both.
+ */
+interface DisabledRow {
+  /** `schema.table`. */
+  readonly table: string;
+  /** The column holding the tenant id or the user id. */
+  readonly id: string;
+  /** A nullable timestamp column; a row with a value is disabled. */
+  readonly disabledAt?: string;
+  /** A status column; only a row whose value is in `active` is active. */
+  readonly status?: string;
+  readonly active?: readonly string[];
+}
+interface AccessModuleConfig extends ModuleConfig {
+  /**
+   * `roles`: a fixed role list from `roles` (the default). `catalog`: role,
+   * permission and override tables (`tables.roles`, `permissions`,
+   * `rolePermissions`, `overrides`, `platformAssignments`). `provider`: the
+   * functions of the config's `authorization` provider. `custom`:
+   * expression templates in `functions`.
+   */
+  readonly model?: "roles" | "catalog" | "provider" | "custom";
+  /**
+   * `roles` model: role name to permission keys. `*` grants everything and
+   * `prefix.*` a prefix. Defaults to owner, admin, member and viewer.
+   */
+  readonly roles?: Readonly<Record<string, readonly string[]>>;
+  /**
+   * `custom` model: SQL expressions with `{scope}`, `{id}`, `{permission}`
+   * and `{user}` placeholders, e.g.
+   * `{ can: 'public.authorize_scope({scope}::public.scope_type, {id}, {permission})' }`.
+   */
+  readonly functions?: {
+    readonly can?: string;
+    readonly tenantIdsWith?: string;
+    readonly isPlatform?: string;
+    readonly canUser?: string;
+    /**
+     * `{tenant}` and `{role}`: whether the caller may assign the role.
+     * Required by the `custom` model. The `provider` model defaults to the
+     * provider's `canAssign`; without either, only the service role assigns
+     * roles unless the `tenant` module is installed, and doctor BS411 warns.
+     */
+    readonly canAssign?: string;
+    /**
+     * `{user}`, `{tenant}` and `{role}`: whether that user may assign the
+     * role, for SQL that acts later for a stored user (an invitation accept
+     * checking the inviter again), as `can_assign_as`. The `provider` model
+     * defaults to the provider's `canAssignFor`.
+     */
+    readonly canAssignFor?: string;
+    /** `{user}`: the permission claim for the access token hook. */
+    readonly permissionClaims?: string;
+  };
+  /**
+   * `roles` model: the JWT claim holding the caller's platform permission
+   * keys (an array). Defaults to `platform_permissions`.
+   */
+  readonly platformClaim?: string;
+  /**
+   * What disables a tenant or a user. A string is a column that disables
+   * when set, as `schema.table.column`, keyed by the table's `id` (tenant)
+   * or the column named in `userKey` (user). An object is an active row:
+   * only a row whose `disabledAt` is null and whose `status` is in `active`
+   * is active, and a missing row counts as disabled. Disabled tenants and
+   * users get no permissions. Under the `provider` model both default to the
+   * provider's `suspension`.
+   */
+  readonly disabled?: {
+    readonly tenant?: string | DisabledRow;
+    readonly user?: string | DisabledRow;
+    readonly userKey?: string;
+  };
+  readonly activeTenant?: ActiveTenantSource;
+}
+/** `sql.modules` in the config, keyed by module name. */
+interface ModulesConfig {
+  readonly access?: AccessModuleConfig;
+  /** `AccessModuleConfig` is listed so an `access` literal passes the excess-property check. */
+  readonly [module: string]: ModuleConfig | AccessModuleConfig | undefined;
+}
+/** A module's config with defaults applied. */
+interface ResolvedModule {
+  readonly mode: ModuleMode;
+  readonly schema: string;
+  readonly tables: Readonly<Record<string, string | null>>;
+  readonly columns: Readonly<Record<string, Readonly<Record<string, string | null>>>>;
+  readonly idType?: string;
+  readonly permissions: Readonly<Record<string, string>>;
+  readonly options: Readonly<Record<string, unknown>>;
+  readonly hooks: {
+    readonly schema: string;
+    readonly functions: Readonly<Record<string, string>>;
+  };
+  readonly events: boolean;
+  readonly audit: boolean;
+  readonly api?: {
+    readonly schema: string;
+    readonly functions?: readonly string[];
+  };
+}
+//#endregion
+export { ModuleConfig as a, ResolvedModule as c, DisabledRow as i, ActiveTenantSource as n, ModuleMode as o, DEFAULT_ACTIVE_TENANT as r, ModulesConfig as s, AccessModuleConfig as t };

package/dist/modules-dxrVK3ID.js

@@ -0,0 +1,228 @@
+import { t as DEFAULT_CLAIMS } from "./claims-PqzCxaTD.js";
+//#region src/config/authorization.ts
+/**
+* The error for a provider built for another API version, or `undefined`
+* for version 1.
+*/
+function providerApiProblem(provider) {
+	const version = provider.apiVersion;
+	if (version === 1) return void 0;
+	return `authorization "${typeof provider.name === "string" ? provider.name : "provider"}" targets authorization provider API ${String(version)}; this better-supabase supports 1. Upgrade better-supabase or use a release of the provider for API 1.`;
+}
+//#endregion
+//#region src/config/config.ts
+/** The JSON Schema document for a `json[...].schema` entry. */
+function resolveJsonSchema(source) {
+	const standard = source["~standard"];
+	if (standard === void 0) return source;
+	const jsonSchema = standard.jsonSchema;
+	if (typeof jsonSchema?.input !== "function") throw new TypeError("json[...].schema: this Standard Schema library does not implement Standard JSON Schema; pass a JSON Schema object instead");
+	return jsonSchema.input({ target: "draft-2020-12" });
+}
+function entitlementsOf(config = {}, provider) {
+	const customer = config.customer;
+	const dot = customer?.lastIndexOf(".") ?? -1;
+	if (customer !== void 0 && dot <= 0) throw new TypeError(`entitlements.customer must be "table.column", got "${customer}"`);
+	return {
+		...customer === void 0 ? {} : {
+			table: customer.slice(0, dot),
+			column: customer.slice(dot + 1)
+		},
+		key: config.key ?? "id",
+		memberships: config.memberships ?? (provider ? "provider" : "tenant"),
+		source: config.source ?? "stripe-sync",
+		...config.claim === void 0 ? {} : { claim: config.claim }
+	};
+}
+function vectorSearchOf(config = {}) {
+	return Object.entries(config).map(([table, entry]) => typeof entry === "string" ? {
+		table,
+		column: entry,
+		distance: "cosine"
+	} : {
+		table,
+		column: entry.column,
+		distance: entry.distance ?? "cosine",
+		...entry.type === void 0 ? {} : { type: entry.type },
+		...entry.key === void 0 ? {} : { key: entry.key },
+		...entry.hybrid === void 0 ? {} : { hybrid: entry.hybrid },
+		...entry.boost === void 0 ? {} : { boost: entry.boost },
+		...entry.prefilter === void 0 ? {} : { prefilter: entry.prefilter },
+		...entry.predicate === void 0 ? {} : { predicate: entry.predicate },
+		...entry.boostMode === void 0 ? {} : { boostMode: entry.boostMode },
+		...entry.order === void 0 ? {} : { order: entry.order }
+	});
+}
+function sqlModulesOf(config = []) {
+	if (isModuleList(config)) return {
+		modules: {},
+		moduleNames: config
+	};
+	return {
+		modules: config,
+		moduleNames: Object.keys(config)
+	};
+}
+function isModuleList(config) {
+	return Array.isArray(config);
+}
+const CONFIG_SCHEMA_URL = "https://unpkg.com/better-supabase/schemas/config-v1.json";
+/** Identity helper that types `better-supabase.config.ts`. */
+function defineConfig(config) {
+	return config;
+}
+function pick(value, defaults) {
+	if (value === void 0 || value === false) return void 0;
+	if (value === true) return defaults;
+	return {
+		...defaults,
+		...value
+	};
+}
+const ALL_PRIVILEGES = [
+	"select",
+	"insert",
+	"update",
+	"delete"
+];
+const isFunctionKey = (key) => key.endsWith(")");
+const EXPOSE_PRIVILEGE = /^(?:select|insert|update|delete|(?:select|insert|update)\s*\(\s*[a-z_][a-z0-9_$]*(?:\s*,\s*[a-z_][a-z0-9_$]*)*\s*\))$/;
+function checkedPrivileges(key, privileges) {
+	for (const privilege of privileges) {
+		const value = privilege;
+		if (typeof value !== "string" || !EXPOSE_PRIVILEGE.test(value)) throw new TypeError(`expose.${key}: "${String(value)}" is not a privilege. Use select, insert, update or delete, or name columns such as "update(title, body)"`);
+	}
+	return privileges;
+}
+function resolveExpose(key, entry) {
+	if (Array.isArray(entry)) return {
+		anon: [],
+		authenticated: checkedPrivileges(key, entry),
+		serviceRole: ALL_PRIVILEGES
+	};
+	if ("execute" in entry) throw new TypeError(`expose.${key}: \`execute\` is for functions; key it by its signature, such as ${key}(text)`);
+	const roles = entry;
+	return {
+		anon: checkedPrivileges(key, roles.anon ?? []),
+		authenticated: checkedPrivileges(key, roles.authenticated ?? []),
+		serviceRole: checkedPrivileges(key, roles.serviceRole ?? ALL_PRIVILEGES)
+	};
+}
+function resolveExposeFunction(key, entry) {
+	if (Array.isArray(entry) || !("execute" in entry)) throw new TypeError(`expose.${key}: a function takes { execute: ["authenticated"] }, not table privileges`);
+	return [...entry.execute, ...entry.serviceRole === false ? [] : ["service_role"]];
+}
+function generatorsOf(generators) {
+	for (const generator of generators ?? []) {
+		const version = generator.apiVersion;
+		if (version !== void 0 && version !== 1) throw new TypeError(`generator "${generator.name}" targets generator API ${String(version)}; this better-supabase supports 1. Upgrade better-supabase or use a release of the generator for API 1.`);
+	}
+	return generators ?? [];
+}
+function authorizationOf(provider) {
+	const problem = providerApiProblem(provider);
+	if (problem !== void 0) throw new TypeError(problem);
+	return provider;
+}
+/** Applies defaults. Paths stay relative to `root`. */
+function resolveConfig(config, root) {
+	const output = config.output ?? "src/lib/supabase/generated.ts";
+	return {
+		root,
+		source: config.source ?? {},
+		schemas: config.schemas ?? ["public"],
+		casing: config.casing ?? "snake",
+		tables: config.tables ?? {},
+		output,
+		databaseTypesOutput: output.replace(/[^/]+$/, "database.types.ts"),
+		postgrestVersion: config.postgrestVersion ?? "13",
+		json: config.json ?? {},
+		codecs: {
+			timestamptz: config.codecs?.timestamptz ?? "string",
+			int8: config.codecs?.int8 ?? "number",
+			numeric: config.codecs?.numeric ?? "number"
+		},
+		relations: { nullableUnderRls: config.relations?.nullableUnderRls ?? false },
+		sensitive: config.sensitive ?? [],
+		storagePaths: config.storagePaths ?? {},
+		functions: config.functions ?? {},
+		expose: Object.fromEntries(Object.entries(config.expose ?? {}).filter(([key]) => !isFunctionKey(key)).map(([table, entry]) => [table, resolveExpose(table, entry)])),
+		exposeFunctions: Object.fromEntries(Object.entries(config.expose ?? {}).filter(([key]) => isFunctionKey(key)).map(([fn, entry]) => [fn, resolveExposeFunction(fn, entry)])),
+		readSets: config.readSets ?? [],
+		generators: generatorsOf(config.generators),
+		plugins: {
+			timestamps: pick(config.plugins?.timestamps, {
+				createdAt: "created_at",
+				updatedAt: "updated_at"
+			}),
+			softDelete: pick(config.plugins?.softDelete, { column: "deleted_at" }),
+			tenant: pick(config.plugins?.tenant, { column: "organization_id" }),
+			actor: pick(config.plugins?.actor, {
+				createdBy: "created_by",
+				updatedBy: "updated_by",
+				impersonatedBy: "impersonated_by"
+			})
+		},
+		claims: {
+			...DEFAULT_CLAIMS,
+			...config.claims
+		},
+		buckets: config.buckets ?? {},
+		topics: config.topics ?? {},
+		realtime: {
+			tables: config.realtime?.tables ?? [],
+			global: config.realtime?.global ?? [],
+			users: config.realtime?.users ?? {},
+			...config.realtime?.policies === void 0 ? {} : { policies: config.realtime.policies }
+		},
+		entitlements: entitlementsOf(config.entitlements, config.authorization !== void 0),
+		...config.authorization === void 0 ? {} : { authorization: authorizationOf(config.authorization) },
+		vectorSearch: vectorSearchOf(config.vectorSearch),
+		sql: {
+			dir: config.sql?.dir ?? "supabase/schemas",
+			prefix: config.sql?.prefix ?? "900_better_supabase",
+			testsDir: config.sql?.testsDir ?? "supabase/tests",
+			...sqlModulesOf(config.sql?.modules)
+		},
+		seed: {
+			entry: config.seed?.entry ?? "supabase/seed.ts",
+			output: config.seed?.output ?? "supabase/seeds/000_better_supabase.sql"
+		},
+		openapi: {
+			entry: config.openapi?.entry ?? "src/lib/openapi.ts",
+			output: config.openapi?.output ?? "openapi.json"
+		},
+		doctor: {
+			ignore: config.doctor?.ignore ?? [],
+			strict: config.doctor?.strict ?? false,
+			sources: config.doctor?.sources ?? ["src/**/*.{ts,tsx}"],
+			policyHelperLimit: config.doctor?.policyHelperLimit ?? 5,
+			...config.doctor?.claimsLimit === void 0 ? {} : { claimsLimit: config.doctor.claimsLimit }
+		}
+	};
+}
+//#endregion
+//#region src/config/modules.ts
+/** URL tenancy: the tenant comes from the request (a slug), not a stored setting. */
+const DEFAULT_ACTIVE_TENANT = "resolver";
+const MODULE_SCHEMA = "better_supabase";
+function resolveModule(config = {}) {
+	return {
+		mode: config.mode ?? "managed",
+		schema: config.schema ?? MODULE_SCHEMA,
+		tables: config.tables ?? {},
+		columns: config.columns ?? {},
+		...config.idType === void 0 ? {} : { idType: config.idType },
+		permissions: config.permissions ?? {},
+		options: config.options ?? {},
+		hooks: {
+			schema: config.hooks?.schema ?? "public",
+			functions: config.hooks?.functions ?? {}
+		},
+		events: config.events ?? true,
+		audit: config.audit ?? true,
+		...config.api === void 0 ? {} : { api: typeof config.api === "string" ? { schema: config.api } : config.api }
+	};
+}
+//#endregion
+export { resolveConfig as a, defineConfig as i, resolveModule as n, resolveJsonSchema as o, CONFIG_SCHEMA_URL as r, providerApiProblem as s, DEFAULT_ACTIVE_TENANT as t };

package/dist/nestjs/index.d.ts

@@ -0,0 +1,68 @@
+import { n as RouteGuardOptions } from "../refusal-D1rgbzNq.js";
+import { t as Validated } from "../shared-DDSjEGDR.js";
+import { l as ToNodeOptions } from "../index-DDrYaUcq.js";
+import { AnyEntry } from "@supabase/middleware";
+import { IncomingMessage, ServerResponse } from "node:http";
+//#region src/nestjs/index.d.ts
+/** The part of Nest's `ArgumentsHost` and `ExecutionContext` the integration reads. */
+export interface ExecutionContextLike {
+  switchToHttp(): {
+    getRequest(): object;
+    getResponse(): object;
+  };
+}
+/** A Nest guard instance, for `@UseGuards(...)`. */
+export interface CanActivateLike {
+  canActivate(context: ExecutionContextLike): Promise<boolean>;
+}
+/** A Nest exception filter instance, for `@UseFilters(...)` or `app.useGlobalFilters(...)`. */
+export interface ExceptionFilterLike {
+  catch(exception: unknown, host: ExecutionContextLike): void;
+}
+/** Nest functional middleware: raw Node `req` and `res` under Express and Fastify. */
+export type NestMiddleware = (req: IncomingMessage, res: ServerResponse, next: (error?: unknown) => void) => void;
+/** The contributions `toNestMiddleware` stored for a request (Express or Fastify), if it ran. */
+export declare function contextOf(request: object): Readonly<Record<string, unknown>> | undefined;
+/**
+ * Nest middleware that runs the entries before the route: a short circuit
+ * (a 401, a CORS preflight) is the answer; otherwise the entries' cookies
+ * go on the response and `@Ctx()` reads the contributions.
+ *
+ * ```ts title="src/app.module.ts"
+ * export class AppModule implements NestModule {
+ *   configure(consumer: MiddlewareConsumer) {
+ *     consumer.apply(toNestMiddleware([withBetterSupabase(server)])).forRoutes('*')
+ *   }
+ * }
+ * ```
+ */
+export declare function toNestMiddleware<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, options?: ToNodeOptions): NestMiddleware;
+/**
+ * A parameter decorator for the request's contributions, or one of them:
+ * `@Ctx() ctx` or `@Ctx('db') db`.
+ *
+ * ```ts
+ * @Get('notes')
+ * list(@Ctx('db') db: Db) { return db.notes.findMany().orThrow() }
+ * ```
+ */
+export declare function Ctx(key?: string): ParameterDecorator;
+/**
+ * A guard instance that refuses callers outside `options`: Problem Details,
+ * or a 303 to `signIn` or `mfa`, thrown as Nest's `HttpException`.
+ *
+ * ```ts
+ * @UseGuards(guard({ roles: ['admin'] }))
+ * ```
+ */
+export declare function guard(options?: RouteGuardOptions): CanActivateLike;
+/**
+ * An exception filter that answers thrown `DbException`s (from
+ * `.orThrow()`) with Problem Details. Register it with `@Catch()` scope in
+ * mind: other exceptions are answered the way Nest's base filter does.
+ */
+export declare function problemFilter(options?: {
+  readonly expose?: boolean;
+}): ExceptionFilterLike;
+//#endregion
+export type { RouteGuardOptions };