better-supabase 0.5.1 → 0.6.0

package/dist/next/index.js

@@ -1,16 +1,25 @@
-import { n as dbError } from "../errors-DtwXa6b8.js";
-import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-Bqob3WqT.js";
-import { o as isReadSet } from "../read-set-DQFt1N_Y.js";
-import { t as validate } from "../standard-D7r6dMUu.js";
-import { a as problemResponse } from "../problem-BW1KhzSG.js";
+import { t as DbException } from "../db-exception-CnWcYPxL.js";
+import { n as dbError } from "../errors-B11Duf73.js";
+import { r as err } from "../result-DzUbqgdW.js";
+import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-D_AD9GGu.js";
+import { o as isReadSet } from "../read-set-DuKWC9Mj.js";
 import { t as isList } from "../guards-BnzDvFrz.js";
+import { n as validate } from "../standard-BK0cqJ7y.js";
+import { a as problemResponse } from "../problem-BreOl8b8.js";
+import { i as claimsOf } from "../claims-PqzCxaTD.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { t as hasEntitlement } from "../entitlements-CTEBm7IB.js";
-import { a as withExtra, b as withPrimaryPin, d as guard, m as settle, n as createServer, p as respond, r as extendServer, u as defaultExpose, v as PRIMARY_COOKIE, y as primaryCookieOptions } from "../server-B1mZ7CgQ.js";
-import { a as checkAal, n as toSession } from "../view-Bn6HNKUe.js";
-import { t as supportSessions } from "../support-wHnK6zp-.js";
+import { t as tenantOf } from "../tenant-I1TEZ_BX.js";
+import { C as serverCore, c as extendServer, l as withExtra, n as flushEvents, p as supportCookieMaxAge, r as handle, s as createServer, t as bearerRequest, v as isPrefetch } from "../adapter-Bc1o3zyy.js";
+import { a as checkAal, n as toSession } from "../view-BeFcRV6G.js";
+import { o as settle, r as guard, t as defaultExpose } from "../respond-BUgsXNgk.js";
+import { t as supportSessions } from "../support-BivNqSpK.js";
+import { r as tagFor, t as cacheTagsOf } from "../tags-B99_U9Pp.js";
+import { n as formDataObject } from "../kit-Fm-Fv7q5.js";
 import { cache } from "react";
-import { cacheLife, cacheTag, revalidateTag, updateTag } from "next/cache.js";
+import { cacheLife, cacheTag, io, revalidateTag, updateTag } from "next/cache.js";
+import { forbidden } from "next/dist/client/components/forbidden.js";
+import { notFound } from "next/dist/client/components/not-found.js";
+import { unauthorized } from "next/dist/client/components/unauthorized.js";
 import { cookies, headers } from "next/headers.js";
 import { NextResponse, after } from "next/server.js";
 //#region src/next/collector.ts
@@ -37,13 +46,17 @@ var StatsCollector = class {
 	constructor(options) {
 		this.#options = options;
 	}
-	/** The recorder for a request id, created on first use. */
-	recorderFor(id) {
+	/**
+	* The recorder for a request id, created on first use. `options` sets the
+	* budget and logger of a new entry; the collector's own are the default.
+	*/
+	recorderFor(id, options) {
 		const existing = this.#entries.get(id);
 		if (existing) return existing.recorder;
 		this.#prune();
 		const entry = {
 			created: Date.now(),
+			options: options ?? this.#options,
 			recorder: new CollectedRecorder(() => {
 				this.#schedule(id);
 			})
@@ -55,19 +68,20 @@ var StatsCollector = class {
 		return this.#entries.get(id)?.recorder.snapshot();
 	}
 	#schedule(id) {
-		const { budget, warn } = this.#options;
 		const entry = this.#entries.get(id);
-		if (!entry || !warn || !budget) return;
+		if (!entry) return;
+		const { budget, warn, logger, idleMs } = entry.options;
+		if (!warn || !budget) return;
 		if (entry.timer) clearTimeout(entry.timer);
 		entry.timer = setTimeout(() => {
 			entry.timer = void 0;
 			const stats = entry.recorder.snapshot();
 			if (!overBudget(stats, budget)) return;
-			this.#options.logger.warn(`request ${id} made ${stats.calls} database calls in ${stats.waves} waves, over the budget of ${describeBudget(budget)}`, {
+			logger.warn(`request ${id} made ${stats.calls} database calls in ${stats.waves} waves, over the budget of ${describeBudget(budget)}`, {
 				requestId: id,
 				...stats
 			});
-		}, this.#options.idleMs ?? 250);
+		}, idleMs ?? 250);
 	}
 	#prune() {
 		const cutoff = Date.now() - (this.#options.ttlMs ?? 6e4);
@@ -81,13 +95,18 @@ var StatsCollector = class {
 };
 const SHARED = Symbol.for("better-supabase.next.stats-collector");
 /**
-* One collector per process. Next.js can load the proxy, pages and route
-* handlers as separate module instances, and they must see the same totals.
+* One store of request totals per process. Next.js can load the proxy, pages
+* and route handlers as separate module instances, and they must see the
+* same totals. Each caller's budget and logger apply to the requests it
+* starts, so a second app in the process keeps its own.
 */
 function sharedCollector(options) {
 	const scope = globalThis;
-	scope[SHARED] ??= new StatsCollector(options);
-	return scope[SHARED];
+	const shared = scope[SHARED] ??= new StatsCollector(options);
+	return {
+		recorderFor: (id) => shared.recorderFor(id, options),
+		get: (id) => shared.get(id)
+	};
 }
 function overBudget(stats, budget) {
 	return budget.calls !== void 0 && stats.calls > budget.calls || budget.waves !== void 0 && stats.waves > budget.waves;
@@ -150,55 +169,97 @@ const STATS_URL_HEADER = "x-bs-stats";
 function supportTag(sessionId) {
 	return `bs:support:${sessionId}`;
 }
+/** The shortest time the Next.js client router keeps a prefetched entry. */
+const MIN_CLIENT_STALE = 30;
 /**
 * `cacheLife` `stale` seconds for a view of `session`: `max`, but never past
-* the token's expiry, and at least `min`.
+* the token's expiry, and 0 once fewer than `min` seconds are left. A
+* signed-out view that a refresh would change (an `expired` or
+* `refresh_failed` cookie, or an `invalid` token) is 0 as well, so it never
+* joins the App Shell.
 */
 function sessionStale(session, options = {}, now = Date.now()) {
-	const min = options.min ?? 30;
+	const min = Math.max(MIN_CLIENT_STALE, options.min ?? MIN_CLIENT_STALE);
 	const max = options.max ?? 300;
-	if (session.kind !== "user" || session.expiresAt === null) return max;
-	const remaining = session.expiresAt - Math.floor(now / 1e3);
-	return Math.min(max, Math.max(min, remaining));
+	switch (session.kind) {
+		case "invalid": return 0;
+		case "anon": return session.reason === "expired" || session.reason === "refresh_failed" ? 0 : max;
+		case "service":
+		case "apiKey": return max;
+		case "user": {
+			if (session.expiresAt === null) return max;
+			const remaining = session.expiresAt - Math.floor(now / 1e3);
+			return remaining < min ? 0 : Math.min(max, remaining);
+		}
+		default: return session;
+	}
 }
 /** The tag `bs.cached()` puts on a user's entries. */
 function sessionTag(userId) {
 	return `bs:session:${userId}`;
 }
-/** `bs:<table>` or `bs:<table>:<id>`. Mutations invalidate both. */
-function tagFor(table, id) {
-	return id === void 0 ? `bs:${table}` : `bs:${table}:${String(id)}`;
+/**
+* The table tags of a read: the tenant's and every tenant's, or the table's.
+* A read across tenants (`"*"`) also carries the table's, which every
+* mutation invalidates, including one scoped to a single tenant.
+*/
+function tableTags(table, options) {
+	if (options.tenant === "*") return [tagFor(table), tagFor(table, void 0, options)];
+	return options.tenant === void 0 ? [tagFor(table)] : [tagFor(table, void 0, options), tagFor(table, void 0, { tenant: "*" })];
 }
-function invalidate(tag) {
+/** The next read waits for fresh data instead of serving the stale entry. */
+const EXPIRE_NOW = { expire: 0 };
+/**
+* Invalidates tags with `updateTag` (Server Actions), else `revalidateTag`
+* (Route Handlers), else not at all (jobs, scripts). The first tag decides
+* for the rest, so a mutation outside an action throws once, not per tag.
+*/
+function invalidateAll(tags, profile = EXPIRE_NOW) {
+	let index = 0;
 	try {
-		updateTag(tag);
-	} catch {
-		try {
-			revalidateTag(tag, "max");
-		} catch {}
-	}
+		for (; index < tags.length; index++) updateTag(tags[index]);
+		return;
+	} catch {}
+	try {
+		for (; index < tags.length; index++) revalidateTag(tags[index], profile);
+	} catch {}
 }
 /**
-* Invalidates `bs:<table>` for every table in the target and
-* `bs:<table>:<id>` for the changed rows. `createNext` attaches it unless
-* `cacheTags: false`.
+* Invalidates `bs:<table>` for every table in the target, the tenant's
+* `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has
+* no tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
+* tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
 */
-function nextCache() {
+function nextCache(options = {}) {
 	return {
 		name: "next",
 		invalidate: (target) => {
-			for (const table of target.tables) invalidate(tagFor(table));
-			for (const id of target.ids) invalidate(tagFor(target.table, id));
+			invalidateAll(cacheTagsOf(target), options.revalidate);
 		}
 	};
 }
-function formDataObject(form) {
-	const out = {};
-	for (const key of new Set(form.keys())) {
-		const values = form.getAll(key);
-		out[key] = values.length > 1 ? values : values[0];
+/** Whether `cause` is one of Next's own control-flow errors (they carry a `digest`). */
+function isNextInterrupt(cause) {
+	return cause instanceof Error && "digest" in cause && typeof cause.digest === "string";
+}
+/**
+* `unauthorized()` and `forbidden()` throw a plain error without
+* `experimental.authInterrupts`; `notFound()` is the fallback then.
+*/
+function authInterrupt(fn) {
+	try {
+		fn();
+	} catch (cause) {
+		if (isNextInterrupt(cause)) throw cause;
 	}
-	return out;
+	notFound();
+}
+/** The Next.js interrupt for a refused Server Component render. */
+function interrupt(error) {
+	if (error.kind === "unauthorized") authInterrupt(unauthorized);
+	if (error.kind === "forbidden") authInterrupt(forbidden);
+	if (error.kind === "not_found") notFound();
+	throw new DbException(error);
 }
 /**
 * A `proxy` `protect` that keeps signed-in users below `level` out of the
@@ -225,17 +286,35 @@ function requireAal(level, options = {}) {
 		return NextResponse.redirect(target);
 	};
 }
+function endedRedirect(request, path) {
+	const target = new URL(path, request.url);
+	target.searchParams.set("reason", "session_ended");
+	return NextResponse.redirect(target);
+}
+function shouldCheckSession(request, options = {}) {
+	if (request.method !== "GET" && request.method !== "HEAD") return false;
+	if (isPrefetch(request)) return false;
+	if (request.headers.get("sec-fetch-dest") === "document") return true;
+	return options.paths?.includes(request.nextUrl.pathname) ?? false;
+}
 /** Page loads, client navigations and server actions; never prefetches or assets. */
 function shouldRefresh(request) {
 	const h = request.headers;
 	if (request.method !== "GET" && request.method !== "HEAD") return h.has("next-action");
-	if (h.has("next-router-prefetch") || h.get("purpose") === "prefetch" || h.get("sec-purpose")?.includes("prefetch")) return false;
+	if (isPrefetch(request)) return false;
 	if (h.get("rsc") === "1") return true;
 	const dest = h.get("sec-fetch-dest");
 	if (dest) return dest === "document";
 	return h.get("accept")?.includes("text/html") ?? false;
 }
 /**
+* Event hubs that already invalidate Next.js cache tags. Every instance a
+* definition derives shares its hub, and `createNext` can run again for one
+* definition (hot reload, a definition in another package), so tags are
+* invalidated once per mutation.
+*/
+const nextCacheAttached = /* @__PURE__ */ new WeakSet();
+/**
 * The Next.js adapter: proxy, Server Components, route handlers, server
 * actions and cache tags, on top of `createServer`.
 *
@@ -245,9 +324,12 @@ function shouldRefresh(request) {
 */
 function createNext(betterSupabase, options = {}) {
 	const base = createServer(betterSupabase, options);
-	const pinMs = options.replicas?.pinMs ?? 5e3;
+	const core = serverCore(base);
 	const expose = options.exposeErrors ?? defaultExpose();
-	if (options.cacheTags !== false) betterSupabase.cache(nextCache());
+	if (options.cacheTags !== false && !nextCacheAttached.has(betterSupabase.events)) {
+		nextCacheAttached.add(betterSupabase.events);
+		betterSupabase.cache(nextCache());
+	}
 	const debug = options.debug;
 	const statsHeader = debug?.header ?? "x-bs-db-calls";
 	const statsRoute = debug?.route ?? "/api/bs-stats";
@@ -261,35 +343,62 @@ function createNext(betterSupabase, options = {}) {
 		const id = collector && request.headers.get("x-bs-request-id");
 		return id ? { stats: collector.recorderFor(id) } : {};
 	};
-	/** Keeps the function alive for event sink sends the handler started. */
-	const flushAfter = () => {
-		const { events } = betterSupabase;
-		if (!events.pending) return;
+	const waitUntil = (work) => {
 		try {
-			after(() => events.settled());
+			after(() => work);
 		} catch (cause) {
-			events.logger.warn("after() is unavailable; event sends may be cut off", { cause });
+			betterSupabase.events.logger.warn("after() is unavailable; event sends may be cut off", { cause });
 		}
 	};
+	/** Keeps the function alive for event sink sends the handler started. */
+	const flushAfter = () => {
+		flushEvents(betterSupabase, waitUntil);
+	};
+	/** Sets the context's cookies (the replica pin) through Next's cookie jar. */
+	const writeCookies = async (ctx) => {
+		const writes = ctx.cookies();
+		if (writes.length === 0) return;
+		const jar = await cookies();
+		for (const write of writes) jar.set(write.name, write.value, write.options);
+	};
 	const incomingRequest = async () => new Request("http://next.local/", { headers: new Headers(await headers()) });
 	/** One token verification per render scope backs `context()`, `session()` and `cached()`. */
 	const incoming = cache(async () => {
+		await io();
 		const request = await incomingRequest();
 		return {
 			request,
 			resolution: await base.resolve(request, { refresh: false })
 		};
 	});
-	const current = cache(async () => {
+	const tenantClaim = claimsOf(betterSupabase.meta).tenant;
+	/** The tenant `scoped` resolved for a context, when it wasn't the claim. */
+	const scopedTenants = /* @__PURE__ */ new WeakMap();
+	const tenantFor = (ctx, view) => scopedTenants.get(ctx) ?? tenantOf(view, tenantClaim);
+	/** `requireTenant` and `authorize`: the session and tenant, or why the caller is refused. */
+	const authorizeCaller = async (ctx, checks, input) => {
+		const view = toSession(ctx.auth);
+		const tenant = tenantFor(ctx, view);
+		if (checks.requireTenant && tenant === void 0) return dbError("forbidden", "Choose an organization first", { code: "NO_TENANT" });
+		if (checks.authorize && !await checks.authorize(view, input)) return dbError("forbidden", "You are not allowed to do this", { code: "NOT_AUTHORIZED" });
+		return {
+			session: view,
+			tenant
+		};
+	};
+	/** `null` runs `NextOptions.tenant`; a string is the caller's explicit tenant. */
+	const scoped = cache(async (explicit) => {
 		const { request, resolution } = await incoming();
-		const [tenant, support] = await Promise.all([options.tenant?.(request, resolution.auth), base.support.current(request, resolution.auth)]);
-		return base.contextFromResolution(resolution, request, {
+		const [tenant, support] = await Promise.all([explicit ?? options.tenant?.(request, resolution.auth), base.support.current(request, resolution.auth)]);
+		const ctx = core.context(resolution, request, {
 			...statsFor(request),
-			...tenant === void 0 ? {} : { tenant },
 			...support ? { support } : {}
-		});
+		}, tenant);
+		if (tenant !== void 0) scopedTenants.set(ctx, tenant);
+		return ctx;
 	});
-	const context = (request, contextOptions) => request ? base.context(request, contextOptions) : current();
+	const current = (tenant) => scoped(tenant ?? null);
+	const context = (first, contextOptions) => first instanceof Request ? base.context(first, contextOptions) : current(first?.tenant ?? contextOptions?.tenant);
 	/** In a support session, the target's view: `impersonator` names the admin. */
 	const session = cache(async () => toSession(options.support ? (await current()).auth : (await incoming()).resolution.auth));
 	const supportCookieName = options.support?.options.cookie?.name ?? "bs-support";
@@ -300,8 +409,8 @@ function createNext(betterSupabase, options = {}) {
 		secure: options.support?.options.cookie?.secure ?? true
 	};
 	const contextForSession = async (view, { token }) => {
-		const request = new Request("http://next.local/", { headers: token ? { authorization: `Bearer ${token}` } : {} });
-		const ctx = await base.context(request);
+		const ctx = await base.context(bearerRequest(token));
+		if (ctx.auth.kind === "invalid") return ctx;
 		if (ctx.auth.kind === "user" ? view.kind === "user" && view.user.id === ctx.auth.user.id : view.kind === ctx.auth.kind) return ctx;
 		return base.contextFor({
 			kind: "invalid",
@@ -312,7 +421,15 @@ function createNext(betterSupabase, options = {}) {
 	const withAccounts = withExtra(base, {
 		context,
 		deleteAccount: ((userId, deleteOptions) => base.deleteAccount(userId, deleteOptions).map((result) => {
-			invalidate(sessionTag(userId));
+			invalidateAll([sessionTag(userId)]);
+			return result;
+		})),
+		endSessions: ((userId) => base.endSessions(userId).map((result) => {
+			invalidateAll([sessionTag(userId)]);
+			return result;
+		})),
+		suspendAccount: ((userId, suspendOptions) => base.suspendAccount(userId, suspendOptions).map((result) => {
+			invalidateAll([sessionTag(userId)]);
 			return result;
 		}))
 	});
@@ -320,7 +437,7 @@ function createNext(betterSupabase, options = {}) {
 		session,
 		contextForSession,
 		async cached(cachedOptions = {}) {
-			const [view, ctx] = await Promise.all([session(), current()]);
+			const [view, ctx] = await Promise.all([session(), current(cachedOptions.tenant)]);
 			const life = cachedOptions.life;
 			const stale = sessionStale(view, life);
 			cacheLife({
@@ -328,36 +445,52 @@ function createNext(betterSupabase, options = {}) {
 				...life?.revalidate === void 0 ? {} : { revalidate: life.revalidate },
 				...life?.expire === void 0 ? {} : { expire: life.expire }
 			});
+			const tables = cachedOptions.tables ?? [];
+			const tenant = tables.length > 0 ? tenantFor(ctx, view) : void 0;
+			const first = tables[0];
 			const tags = [
 				...view.kind === "user" ? [sessionTag(view.user.id)] : [],
 				...ctx.support ? [supportTag(ctx.support.session.id)] : [],
-				...cachedOptions.tags ?? []
+				...cachedOptions.tags ?? [],
+				...tables.flatMap((table) => tableTags(table, tenant === void 0 ? {} : { tenant })),
+				...first !== void 0 && cachedOptions.id !== void 0 ? [tagFor(first, cachedOptions.id)] : []
 			];
 			if (tags.length > 0) cacheTag(...tags);
 			return withExtra(ctx, { session: view });
 		},
 		invalidateSession(userId, invalidateOptions = {}) {
-			invalidate(sessionTag(userId));
-			for (const tag of invalidateOptions.tags ?? []) invalidate(tag);
+			invalidateAll([sessionTag(userId), ...invalidateOptions.tags ?? []]);
 		},
 		async liveCount(spec, db) {
 			const result = await (db ?? (await current()).db).$run(spec);
 			return {
 				spec,
-				count: result.ok && typeof result.data === "number" ? result.data : null
+				count: result.ok && typeof result.data === "number" ? result.data : null,
+				at: Date.now()
 			};
 		},
 		async proxy(request, proxyOptions = {}) {
 			const started = performance.now();
 			const id = collector ? crypto.randomUUID() : void 0;
 			let verifyMs = 0;
-			const [early, resolution] = await Promise.all([proxyOptions.before?.(request), base.resolve(request, { refresh: shouldRefresh(request) }).then((resolved) => {
+			const sessionCheck = proxyOptions.endedSession === true ? {} : proxyOptions.endedSession;
+			const checkSession = sessionCheck !== void 0 && shouldCheckSession(request, sessionCheck);
+			const [early, resolution] = await Promise.all([proxyOptions.before?.(request), base.resolve(request, {
+				refresh: shouldRefresh(request),
+				...checkSession ? { checkSession } : {}
+			}).then((resolved) => {
 				verifyMs = performance.now() - started;
 				return resolved;
 			})]);
-			const custom = await proxyOptions.protect?.(resolution.auth, request);
+			const rendersSignedOut = proxyOptions.expiredPrefetch === "render" && resolution.auth.kind === "anon" && resolution.auth.reason === "expired" && isPrefetch(request);
+			const protectMethods = proxyOptions.protectMethods;
+			const runsProtect = protectMethods === true ? true : (protectMethods ?? ["GET", "HEAD"]).includes(request.method);
+			const custom = (resolution.sessionEnded === true && sessionCheck?.redirect !== void 0 && request.nextUrl.pathname !== sessionCheck.redirect ? endedRedirect(request, sessionCheck.redirect) : void 0) ?? (rendersSignedOut || !runsProtect ? void 0 : await proxyOptions.protect?.(resolution.auth, request));
 			const initial = custom ?? early;
-			if (!initial && resolution.cookies.length === 0 && !id && !proxyOptions.after && !proxyOptions.serverTiming) return NextResponse.next();
+			if (!initial && resolution.cookies.length === 0 && !id && !proxyOptions.after && !proxyOptions.serverTiming) {
+				flushAfter();
+				return NextResponse.next();
+			}
 			let response = resolution.apply(mutableResponse(initial ?? NextResponse.next()));
 			if (!custom && !isRedirect(response)) {
 				const forwarded = {};
@@ -377,35 +510,38 @@ function createNext(betterSupabase, options = {}) {
 				"bs-proxy": performance.now() - started,
 				"bs-verify": verifyMs
 			}));
+			flushAfter();
 			return response;
 		},
 		route(handler, guardOptions = {}) {
 			return async (request, segment) => {
-				const ctx = await base.context(request, statsFor(request));
-				const denied = guard(ctx.auth, guardOptions.allow, guardOptions.aal, guardOptions.scopes);
-				const instance = request.nextUrl.pathname;
-				if (denied) return problemResponse(denied, {
-					instance,
-					expose
-				});
-				const params = await segment.params;
+				let stats;
+				let current;
 				let response;
 				try {
-					response = await respond(() => handler(request, withExtra(ctx, { params })), {
-						instance,
-						expose
+					response = await handle(base, request, async (ctx) => {
+						current = ctx;
+						stats = () => ctx.stats();
+						const [params, caller] = await Promise.all([segment.params, authorizeCaller(ctx, guardOptions, request)]);
+						if ("kind" in caller) return err(caller);
+						return handler(request, withExtra(ctx, {
+							...caller,
+							params
+						}));
+					}, {
+						...guardOptions,
+						expose,
+						instance: request.nextUrl.pathname,
+						context: statsFor(request),
+						waitUntil,
+						rethrow: rethrowNextControlFlow
 					});
 				} catch (cause) {
-					rethrowNextControlFlow(cause);
-					response = problemResponse(dbError("unexpected", expose && cause instanceof Error ? cause.message : "Internal server error"), {
-						instance,
-						expose
-					});
+					if (current) await writeCookies(current);
+					throw cause;
 				}
-				response = withPrimaryPin(response, ctx.replica, pinMs);
-				flushAfter();
-				if (collector) try {
-					response.headers.set(statsHeader, formatStats(ctx.stats()));
+				if (collector && stats) try {
+					response.headers.set(statsHeader, formatStats(stats()));
 				} catch {}
 				return response;
 			};
@@ -426,8 +562,8 @@ function createNext(betterSupabase, options = {}) {
 		},
 		action(actionOptions, fn) {
 			return async (input) => {
-				const ctx = await current();
-				const denied = guard(ctx.auth, actionOptions.allow, actionOptions.aal, actionOptions.scopes);
+				const early = actionOptions.tenant && !options.support ? void 0 : await current();
+				const denied = guard(early?.auth ?? (await incoming()).resolution.auth, actionOptions.allow, actionOptions.aal, actionOptions.scopes);
 				if (denied) return {
 					ok: false,
 					data: null,
@@ -443,9 +579,22 @@ function createNext(betterSupabase, options = {}) {
 					};
 					parsed = checked.data;
 				}
-				const settled = await settle(() => fn(parsed, ctx));
-				flushAfter();
-				if (ctx.replica?.wrote) (await cookies()).set(PRIMARY_COOKIE, String(Date.now() + pinMs), primaryCookieOptions(pinMs));
+				const tenant = actionOptions.tenant?.(parsed);
+				const ctx = tenant === void 0 ? early ?? await current() : await current(tenant);
+				const caller = await authorizeCaller(ctx, actionOptions, parsed);
+				if ("kind" in caller) return {
+					ok: false,
+					data: null,
+					error: caller
+				};
+				const scope = ctx;
+				let settled;
+				try {
+					settled = await settle(() => fn(parsed, withExtra(scope, caller)));
+				} finally {
+					flushAfter();
+					await writeCookies(ctx);
+				}
 				return settled.ok ? {
 					ok: true,
 					data: settled.data,
@@ -457,6 +606,12 @@ function createNext(betterSupabase, options = {}) {
 				};
 			};
 		},
+		require: async (requireOptions = {}) => {
+			const ctx = await current(requireOptions.tenant);
+			const caller = guard(ctx.auth, requireOptions.allow, requireOptions.aal, requireOptions.scopes) ?? await authorizeCaller(ctx, requireOptions, void 0);
+			if ("kind" in caller) interrupt(caller);
+			return withExtra(ctx, caller);
+		},
 		async startSupport(request) {
 			const { resolution } = await incoming();
 			const started = await base.support.start(resolution.auth, request);
@@ -469,9 +624,9 @@ function createNext(betterSupabase, options = {}) {
 			const { session: support } = started.data;
 			(await cookies()).set(supportCookieName, support.id, {
 				...supportCookieOptions,
-				maxAge: Math.max(0, Math.floor((support.expiresAt.epochMilliseconds - Date.now()) / 1e3))
+				maxAge: supportCookieMaxAge(support)
 			});
-			if (resolution.auth.kind === "user") invalidate(sessionTag(resolution.auth.user.id));
+			if (resolution.auth.kind === "user") invalidateAll([sessionTag(resolution.auth.user.id)]);
 			return {
 				ok: true,
 				data: {
@@ -498,8 +653,7 @@ function createNext(betterSupabase, options = {}) {
 			};
 			const stopped = await base.support.stop(resolution.auth, id);
 			flushAfter();
-			invalidate(supportTag(id));
-			if (resolution.auth.kind === "user") invalidate(sessionTag(resolution.auth.user.id));
+			invalidateAll([supportTag(id), ...resolution.auth.kind === "user" ? [sessionTag(resolution.auth.user.id)] : []]);
 			return stopped.ok ? {
 				ok: true,
 				data: { ended: stopped.data.ended },
@@ -510,14 +664,14 @@ function createNext(betterSupabase, options = {}) {
 				error: stopped.error
 			};
 		},
-		cacheTag(table, id) {
-			cacheTag(tagFor(table), ...id === void 0 ? [] : [tagFor(table, id)]);
+		cacheTag(table, id, tagOptions = {}) {
+			cacheTag(...tableTags(table, tagOptions), ...id === void 0 ? [] : [tagFor(table, id)]);
 		},
-		cacheTags(target) {
+		cacheTags(target, tagOptions = {}) {
 			const specs = isReadSet(target) ? Object.values(target.specs) : isList(target) ? target : [target];
 			const tags = /* @__PURE__ */ new Set();
 			for (const spec of specs) {
-				for (const table of betterSupabase.tablesOf(spec)) tags.add(tagFor(table));
+				for (const table of betterSupabase.tablesOf(spec)) for (const tag of tableTags(table, tagOptions)) tags.add(tag);
 				const [id] = spec.args;
 				if (spec.method === "findById" && (typeof id === "string" || typeof id === "number")) tags.add(tagFor(spec.table, id));
 			}
@@ -546,4 +700,4 @@ function rethrowNextControlFlow(error) {
 	if ("cause" in error) rethrowNextControlFlow(error.cause);
 }
 //#endregion
-export { REQUEST_ID_HEADER, STATS_URL_HEADER, createNext, hasEntitlement, nextCache, requireAal, sessionStale, sessionTag, shouldRefresh, supportOf, supportSessions, supportTag, tagFor, toSession };
+export { REQUEST_ID_HEADER, STATS_URL_HEADER, createNext, nextCache, requireAal, sessionStale, sessionTag, shouldCheckSession, shouldRefresh, supportOf, supportSessions, supportTag, tagFor, tenantOf, toSession };

package/dist/node/index.d.ts

@@ -0,0 +1,4 @@
+import { n as RouteGuardOptions } from "../refusal-D1rgbzNq.js";
+import { i as toWebHeaders, r as applyWebHeaders, t as NodeHeaderTarget } from "../node-headers-AO06VhqH.js";
+import { _ as toNodeHandler, a as FastifyReplyLike, b as toWebRequest, c as KoaMiddleware, d as guard, f as koaGuard, g as toKoa, h as toFastify, i as FastifyHook, l as ToNodeOptions, m as toExpress, n as ExpressMiddleware, o as FastifyRequestLike, p as problemErrorHandler, r as ExpressResponse, s as KoaContextLike, t as ExpressErrorHandler, u as fastifyGuard, v as WebRequestOptions, y as sendWebResponse } from "../index-DDrYaUcq.js";
+export { ExpressErrorHandler, ExpressMiddleware, ExpressResponse, FastifyHook, FastifyReplyLike, FastifyRequestLike, KoaContextLike, KoaMiddleware, type NodeHeaderTarget, type RouteGuardOptions, ToNodeOptions, type WebRequestOptions, applyWebHeaders, fastifyGuard, guard, koaGuard, problemErrorHandler, sendWebResponse, toExpress, toFastify, toKoa, toNodeHandler, toWebHeaders, toWebRequest };