better-supabase 0.7.0 → 0.8.0

package/dist/{define-CJJkkr1-.d.ts → define-DmcfoNXB.d.ts}

@@ -1,12 +1,127 @@
 /// <reference lib="esnext.temporal" />
-import { b as DbError, p as ThrowMapper, t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
-import { A as Relations, B as UniqueKeyName, E as PrimaryKeyValue, F as Simplify, H as Update, L as TableKey, M as Row, N as Schema, P as SchemaMeta, R as TableMeta, V as UniqueWhere, a as AnyModels, i as AnyFunctions, k as RelationTypes, x as Insert } from "./types-6BdhkmZe.js";
-import { l as CountMode, r as Executor, v as Operation } from "./executor-DvsBbNBS.js";
-import { a as ExtensionOf, h as WithExtension, m as RequestContext, n as AnyPlugin, r as ApplyExtension } from "./plugin-FGY8UhYm.js";
-import { a as EventHub, i as EventHandler, o as EventName, s as MutationNotice, u as RpcNotice } from "./events-DWDhx77e.js";
+import { b as DbError, p as ThrowMapper, t as AsyncResult, w as ErrorMapper } from "./result-BchM1XZn.js";
+import { A as Relations, B as UniqueKeyName, E as PrimaryKeyValue, F as Simplify, H as Update, L as TableKey, M as Row, N as Schema, P as SchemaMeta, R as TableMeta, V as UniqueWhere, a as AnyModels, i as AnyFunctions, k as RelationTypes, x as Insert } from "./types-CoE5Zwy4.js";
+import { l as CountMode, r as Executor, v as Operation } from "./executor-Drzu3dBK.js";
+import { a as ExtensionOf, h as WithExtension, m as RequestContext, n as AnyPlugin, r as ApplyExtension } from "./plugin-CPK2HsbY.js";
+import { a as EventHub, i as EventHandler, o as EventName, s as MutationNotice, u as RpcNotice } from "./events-D1BOCll8.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as StandardSchemaV1 } from "./standard-CYsm7xpT.js";
-import { a as PostgrestPlan, i as PostgrestCompileOptions } from "./postgrest-BLVdEnfe.js";
+import { t as StandardSchemaV1 } from "./standard-lmkbOtPB.js";
+import { t as StorageApi } from "./storage-api-CB7Zl1Ci.js";
+import { a as PostgrestPlan, i as PostgrestCompileOptions } from "./postgrest-BUqLag2Q.js";
+//#region src/core/stats.d.ts
+/** Database work for one request (or one `db`). */
+interface DbStats {
+  /** Executor calls: repository operations and RPCs. */
+  readonly calls: number;
+  /**
+   * Sequential rounds. A wave starts when a call begins while nothing else
+   * is in flight, so `Promise.all` of three reads is one wave.
+   */
+  readonly waves: number;
+  /** App keys of the tables read or written, and `name()` for RPCs. */
+  readonly tables: readonly string[];
+  /** From the first call's start to the last call's end. */
+  readonly ms: number;
+}
+declare const EMPTY_STATS: DbStats;
+/**
+ * Counts calls and waves. A recorder with a `parent` also reports to it, so
+ * a request-wide recorder sees every scope's calls.
+ */
+declare class StatsRecorder {
+  #private;
+  constructor(parent?: StatsRecorder, now?: () => number);
+  /** Records a call to `table`; the returned function ends it. */
+  begin(table: string): () => void;
+  /** The totals so far. */
+  snapshot(): DbStats;
+}
+/** Wraps an executor so every call is recorded. */
+declare function recordStats(executor: Executor, recorder: StatsRecorder): Executor;
+//#endregion
+//#region src/core/define-types.d.ts
+interface SupabaseOptions {
+  /**
+   * Clock used by plugins (timestamps, soft delete) and for the `time` of
+   * block events on `betterSupabase.events`. Pass it to `createJobs` too.
+   */
+  readonly now?: () => Temporal.Instant;
+  /**
+   * The `Temporal` namespace, for runtimes without a global one (Hermes,
+   * Node 24) when patching `globalThis` is not an option:
+   * `import { Temporal } from 'temporal-polyfill'`. Defaults to `globalThis.Temporal`.
+   */
+  readonly temporal?: typeof Temporal;
+  /** Extra error mappers, run before plugin mappers. */
+  readonly errors?: readonly ErrorMapper[];
+  /** Receives errors from event handlers, hooks and cache adapters. Defaults to `console`. */
+  readonly logger?: Logger;
+  /**
+   * Debug records on `logger` for every query, database error, session
+   * refresh and auth resolution: table, operation, outcome, timing and row
+   * count, never tokens, row values, filters or error messages. Off by
+   * default; with it off, no handler runs.
+   */
+  readonly diagnostics?: boolean;
+  /** RPCs that change tables, keyed by function name. Prefer `betterSupabase.defineRpc()`. */
+  readonly rpc?: Readonly<Record<string, RpcDefinition>>;
+  /** Builds the error `.orThrow()` throws. Prefer `betterSupabase.mapError()`. */
+  readonly throwAs?: ThrowMapper;
+  /** Validates verified JWT claims on the server. Prefer `betterSupabase.claims()`, which also types them. */
+  readonly claims?: StandardSchemaV1;
+  /** Parses `user_metadata` into `session.profile`. Prefer `betterSupabase.userMetadata()`, which also types it. */
+  readonly userMetadata?: StandardSchemaV1;
+  /**
+   * PostgREST's `db-max-rows`: the most rows one read returns. An unbounded
+   * `findMany` that returns this many sets `truncated` on the `query` event
+   * and logs a warning once per table. Defaults to 1000, the hosted default.
+   */
+  readonly maxRows?: number;
+  /**
+   * The longest query string one PostgREST read sends, like supabase-js
+   * `db.urlLengthLimit`. Longer reads are split along their longest `in`
+   * list. Defaults to 6000 characters, or the client's `db.urlLengthLimit`
+   * when that is lower.
+   */
+  readonly urlLengthLimit?: number;
+  /**
+   * The PostgREST version the app talks to, as in `postgrestVersion` in
+   * the better-supabase config. `maxAffected` needs 13 or later, and fails
+   * with `invalid_request` before any request on an older version.
+   * Defaults to `"13"`.
+   */
+  readonly postgrestVersion?: string;
+}
+interface ConnectOptions {
+  /** Also records this connection's calls into a request-wide recorder. */
+  readonly stats?: StatsRecorder;
+  /**
+   * Runs operations instead of the client's own executor, while `$client`
+   * stays the client (e.g. routing reads to a replica).
+   */
+  readonly executor?: Executor;
+  /**
+   * Fails each repository call and `$rpc` after this many milliseconds with
+   * a `timeout` error. A call's own `timeout` replaces it.
+   */
+  readonly timeout?: number;
+  /**
+   * postgrest-js retries of idempotent requests for this connection; a
+   * call's own `retry` replaces it. Defaults to the client's setting.
+   */
+  readonly retry?: boolean;
+  /**
+   * Storage that runs as the same caller, as `db.$storage`. Defaults to
+   * the client's `storage`; pass it when connecting an `Executor`, such as
+   * direct Postgres as a user.
+   */
+  readonly storage?: StorageApi;
+}
+interface RpcDefinition {
+  /** App keys of the tables the function writes; their cached reads are invalidated on success. */
+  readonly invalidates: readonly string[];
+}
+//#endregion
 //#region src/ir/args.d.ts
 interface BaseOps<V> {
   readonly eq?: V;
@@ -415,37 +530,6 @@ type SearchScore<A> = A extends {
   readonly $score: number;
 } : unknown;
 //#endregion
-//#region src/core/stats.d.ts
-/** Database work for one request (or one `db`). */
-interface DbStats {
-  /** Executor calls: repository operations and RPCs. */
-  readonly calls: number;
-  /**
-   * Sequential rounds. A wave starts when a call begins while nothing else
-   * is in flight, so `Promise.all` of three reads is one wave.
-   */
-  readonly waves: number;
-  /** App keys of the tables read or written, and `name()` for RPCs. */
-  readonly tables: readonly string[];
-  /** From the first call's start to the last call's end. */
-  readonly ms: number;
-}
-declare const EMPTY_STATS: DbStats;
-/**
- * Counts calls and waves. A recorder with a `parent` also reports to it, so
- * a request-wide recorder sees every scope's calls.
- */
-declare class StatsRecorder {
-  #private;
-  constructor(parent?: StatsRecorder, now?: () => number);
-  /** Records a call to `table`; the returned function ends it. */
-  begin(table: string): () => void;
-  /** The totals so far. */
-  snapshot(): DbStats;
-}
-/** Wraps an executor so every call is recorded. */
-declare function recordStats(executor: Executor, recorder: StatsRecorder): Executor;
-//#endregion
 //#region src/core/repository-types.d.ts
 type FindExt<E, M extends AnyModels, T extends keyof M> = ApplyExtension<E, M, T, "findArgs">;
 type DeleteExt<E, M extends AnyModels, T extends keyof M> = ApplyExtension<E, M, T, "deleteArgs">;
@@ -670,6 +754,13 @@ type RawRpcOptions = Omit<RpcOptions<unknown>, "returns" | "raw"> & {
 interface DbHelpers<M extends AnyModels, F extends AnyFunctions, E, C> {
   /** The underlying client (supabase-js), for anything the repository lacks. */
   readonly $client: C;
+  /**
+   * Storage as the same caller: `connect()`'s `storage` option, or the
+   * client's `storage`. Pass it to `bucket.connect()` and the blocks, so
+   * Storage follows whatever the `Db` runs as. Throws when the connection
+   * has neither, such as a bare `Executor`.
+   */
+  readonly $storage: StorageApi;
   readonly $executor: Executor;
   readonly $context: RequestContext;
   /**
@@ -798,6 +889,12 @@ interface PostgrestExecutorOptions extends PostgrestCompileOptions {
    * client's setting, which is on.
    */
   readonly retry?: boolean;
+  /**
+   * When set, `rpc()` fails with an `unsupported` error carrying this
+   * message and sends no request: the backend has no database functions
+   * (Supabase Lite on SQLite).
+   */
+  readonly rpcUnavailable?: string;
 }
 /** Executes IR operations through a supabase-js client. */
 declare function postgrestExecutor(client: PostgrestClientLike, options?: PostgrestExecutorOptions): Executor;
@@ -805,78 +902,6 @@ declare function postgrestExecutor(client: PostgrestClientLike, options?: Postgr
 declare function explainPostgrest(op: Operation, options?: PostgrestCompileOptions): PostgrestPlan;
 //#endregion
 //#region src/core/define.d.ts
-interface SupabaseOptions {
-  /** Clock used by plugins (timestamps, soft delete). */
-  readonly now?: () => Temporal.Instant;
-  /**
-   * The `Temporal` namespace, for runtimes without a global one (Hermes,
-   * Node 24) when patching `globalThis` is not an option:
-   * `import { Temporal } from 'temporal-polyfill'`. Defaults to `globalThis.Temporal`.
-   */
-  readonly temporal?: typeof Temporal;
-  /** Extra error mappers, run before plugin mappers. */
-  readonly errors?: readonly ErrorMapper[];
-  /** Receives errors from event handlers, hooks and cache adapters. Defaults to `console`. */
-  readonly logger?: Logger;
-  /**
-   * Debug records on `logger` for every query, database error, session
-   * refresh and auth resolution: table, operation, outcome, timing and row
-   * count, never tokens, row values, filters or error messages. Off by
-   * default; with it off, no handler runs.
-   */
-  readonly diagnostics?: boolean;
-  /** RPCs that change tables, keyed by function name. Prefer `betterSupabase.defineRpc()`. */
-  readonly rpc?: Readonly<Record<string, RpcDefinition>>;
-  /** Builds the error `.orThrow()` throws. Prefer `betterSupabase.mapError()`. */
-  readonly throwAs?: ThrowMapper;
-  /** Validates verified JWT claims on the server. Prefer `betterSupabase.claims()`, which also types them. */
-  readonly claims?: StandardSchemaV1;
-  /** Parses `user_metadata` into `session.profile`. Prefer `betterSupabase.userMetadata()`, which also types it. */
-  readonly userMetadata?: StandardSchemaV1;
-  /**
-   * PostgREST's `db-max-rows`: the most rows one read returns. An unbounded
-   * `findMany` that returns this many sets `truncated` on the `query` event
-   * and logs a warning once per table. Defaults to 1000, the hosted default.
-   */
-  readonly maxRows?: number;
-  /**
-   * The longest query string one PostgREST read sends, like supabase-js
-   * `db.urlLengthLimit`. Longer reads are split along their longest `in`
-   * list. Defaults to 6000 characters, or the client's `db.urlLengthLimit`
-   * when that is lower.
-   */
-  readonly urlLengthLimit?: number;
-  /**
-   * The PostgREST version the app talks to, as in `postgrestVersion` in
-   * the better-supabase config. `maxAffected` needs 13 or later, and fails
-   * with `invalid_request` before any request on an older version.
-   * Defaults to `"13"`.
-   */
-  readonly postgrestVersion?: string;
-}
-interface ConnectOptions {
-  /** Also records this connection's calls into a request-wide recorder. */
-  readonly stats?: StatsRecorder;
-  /**
-   * Runs operations instead of the client's own executor, while `$client`
-   * stays the client (e.g. routing reads to a replica).
-   */
-  readonly executor?: Executor;
-  /**
-   * Fails each repository call and `$rpc` after this many milliseconds with
-   * a `timeout` error. A call's own `timeout` replaces it.
-   */
-  readonly timeout?: number;
-  /**
-   * postgrest-js retries of idempotent requests for this connection; a
-   * call's own `retry` replaces it. Defaults to the client's setting.
-   */
-  readonly retry?: boolean;
-}
-interface RpcDefinition {
-  /** App keys of the tables the function writes; their cached reads are invalidated on success. */
-  readonly invalidates: readonly string[];
-}
 /**
  * The isomorphic definition of your data layer: schema plus plugins. Holds no
  * secrets and no connection; `connect()` binds it to a client per request.
@@ -977,4 +1002,4 @@ declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F ext
  */
 declare function defineSupabase<M extends AnyModels, D, F extends AnyFunctions>(schema: Schema<M, D, F>, options?: SupabaseOptions): BetterSupabase<M, D, F>;
 //#endregion
-export { ReadSetResult as $, PageOf as A, OrderByArg as At, DbStats as B, DeleteExt as C, IncludeArg as Ct, OffsetPage as D, MeasureKey as Dt, ManyReturningArgs as E, MeasureArg as Et, UpdateArgs as F, RequestArgs as Ft, InferReadSetParams as G, StatsRecorder as H, UpsertArgs as I, SelectArg as It, ReadSetOptions as J, ReadSet as K, UpsertManyArgs as L, SortDirection as Lt, RepositoryOf as M, Payload as Mt, Returned as N, ReadArgs as Nt, OffsetPageArgs as O, MutableWhere as Ot, RpcOptions as P, RelationMeasureArg as Pt, ReadSetParams as Q, WriteArgs as R, SortSpec as Rt, DeleteArgs as S, FindOnlyArgs as St, ManyResult as T, JsonPathOps as Tt, recordStats as U, EMPTY_STATS as V, SearchArgs as W, ReadSetParamTypes as X, ReadSetParamType as Y, ReadSetParamValue as Z, ConflictTarget as _, CountArg as _t, defineSupabase as a, ReadMethod as at, Db as b, FindFirstArgs as bt, explainPostgrest as c, isQuerySpec as ct, CacheTarget as d, AggregateOrderBy as dt, defineReadSet as et, MemoryCache as f, AggregateOrderByArg as ft, rpcCacheTargets as g, ColumnOrderByArg as gt, rowKey as h, ColumnOrderBy as ht, SupabaseOptions as i, QuerySpec as it, Repository as j, OrderByInput as jt, OffsetRangeArgs as k, NumericMeasureArg as kt, postgrestExecutor as l, specTables as lt, memoryCache as m, AggregateRow as mt, ConnectOptions as n, readSetTables as nt, PostgrestClientLike as o, Specs as ot, cacheTargetOf as p, AggregateResult as pt, ReadSetAuth as q, RpcDefinition as r, InferResult as rt, PostgrestExecutorOptions as s, TableSpecs as st, BetterSupabase as t, isReadSet as tt, CacheAdapter as u, AggregateArgs as ut, CursorPage as v, CountArgs as vt, FindExt as w, IncludeArgs as wt, DbHelpers as x, FindManyArgs as xt, CursorPageArgs as y, FieldFilter as yt, WriteManyArgs as z, WhereInput as zt };
+export { ReadSetParams as $, OverloadedName as A, NumericMeasureArg as At, UpsertArgs as B, WhereInput as Bt, ManyReturningArgs as C, FindOnlyArgs as Ct, OffsetRangeArgs as D, MeasureArg as Dt, OffsetPageArgs as E, JsonPathOps as Et, RepositoryOf as F, RelationMeasureArg as Ft, SearchScore as G, EMPTY_STATS as Gt, WriteArgs as H, RpcDefinition as Ht, Returned as I, RequestArgs as It, ReadSetAuth as J, InferReadSetParams as K, StatsRecorder as Kt, RpcArgs as L, SelectArg as Lt, PlainName as M, OrderByInput as Mt, RawRpcOptions as N, Payload as Nt, OverloadArgs as O, MeasureKey as Ot, Repository as P, ReadArgs as Pt, ReadSetParamValue as Q, RpcOptions as R, SortDirection as Rt, ManyResult as S, FindManyArgs as St, OffsetPage as T, IncludeArgs as Tt, WriteManyArgs as U, SupabaseOptions as Ut, UpsertManyArgs as V, ConnectOptions as Vt, SearchArgs as W, DbStats as Wt, ReadSetParamType as X, ReadSetOptions as Y, ReadSetParamTypes as Z, Db as _, ColumnOrderByArg as _t, explainPostgrest as a, QuerySpec as at, DeleteExt as b, FieldFilter as bt, CacheTarget as c, TableSpecs as ct, memoryCache as d, AggregateArgs as dt, ReadSetResult as et, rowKey as f, AggregateOrderBy as ft, CursorPageArgs as g, ColumnOrderBy as gt, CursorPage as h, AggregateRow as ht, PostgrestExecutorOptions as i, InferResult as it, PageOf as j, OrderByArg as jt, OverloadReturns as k, MutableWhere as kt, MemoryCache as l, isQuerySpec as lt, ConflictTarget as m, AggregateResult as mt, defineSupabase as n, isReadSet as nt, postgrestExecutor as o, ReadMethod as ot, rpcCacheTargets as p, AggregateOrderByArg as pt, ReadSet as q, recordStats as qt, PostgrestClientLike as r, readSetTables as rt, CacheAdapter as s, Specs as st, BetterSupabase as t, defineReadSet as tt, cacheTargetOf as u, specTables as ut, DbHelpers as v, CountArg as vt, NoArgName as w, IncludeArg as wt, FindExt as x, FindFirstArgs as xt, DeleteArgs as y, CountArgs as yt, UpdateArgs as z, SortSpec as zt };

package/dist/edge/index.d.ts

@@ -1,11 +1,17 @@
-import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
-import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-ZSJ9rCcV.js";
-import { t as AuthSession } from "../view-CF7ihnkg.js";
-import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DprrgyXX.js";
-import { s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
+import { f as Result } from "../result-BchM1XZn.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-CoE5Zwy4.js";
+import { t as StandardSchemaV1 } from "../standard-lmkbOtPB.js";
+import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
+import { t as BetterSupabase } from "../define-DmcfoNXB.js";
+import { i as ServerContext, s as ServerOptions, t as BetterServer } from "../server-types-CrAmZ8jv.js";
+import { t as AuthSession } from "../view-TpXEUcVN.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-Cw-zanCm.js";
+import { s as BlockRequireOptions } from "../kit-W99LCPBS.js";
+import { t as FunctionContract } from "../function-contract-BcZenXMO.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
-import { a as ResourceRouteOptions } from "../resource-IPS5xi9q.js";
+import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-CqB6GWGT.js";
+import { t as ResourceMap } from "../resources-DZSk8tXJ.js";
+import { t as defineAction } from "../resource-execute-rbKvuCsY.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { WithCorsConfig } from "@supabase/middleware/cors";
 //#region src/bridges/edge.d.ts
@@ -27,6 +33,48 @@ type EdgeHandler = (request: Request, env?: unknown, executionContext?: EdgeExec
  */
 export declare function toEdge<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, handler: (request: Request, ctx: Contributions<Entries>, executionContext: EdgeExecutionContext | undefined, env: unknown) => Response | Promise<Response>): EdgeHandler;
 //#endregion
+//#region src/edge/function.d.ts
+/** A fetch handler that carries its contract in its type. */
+type TypedFunction<In, Out> = EdgeHandler & {
+  /** Type-only: never set at runtime. */
+  readonly "~contract"?: FunctionContract<In, Out>;
+};
+/**
+ * The contract of a `defineFunction` handler, for `functions<Contracts>()` in
+ * `better-supabase/client`.
+ */
+type ContractOf<T> = T extends TypedFunction<infer In, infer Out> ? FunctionContract<In, Out> : never;
+type Returned<Out> = Out | Result<Out> | Response | PromiseLike<Out | Result<Out> | Response> | undefined;
+interface FunctionDefinition<I extends StandardSchemaV1, Out, M extends AnyModels, F extends AnyFunctions, E, C, P> extends MiddlewareOptions {
+  /** Parses the JSON body. A body it rejects answers 422 with the issues. */
+  readonly input: I;
+  /**
+   * Checks what the handler returns before it is sent. A value it rejects
+   * answers 500, so a function never sends data its contract doesn't promise.
+   */
+  readonly output?: StandardSchemaV1<unknown, Out>;
+  /** Runs as the caller with the parsed input. Returns data or a `Result`. */
+  readonly handler: (input: StandardSchemaV1.InferOutput<I>, ctx: ServerContext<M, F, E, C, P> & {
+    readonly request: Request;
+  }) => Returned<Out>;
+}
+/**
+ * An Edge Function with a typed input and output: the body is parsed and
+ * checked with a Standard Schema (zod, valibot, arktype, ...) before the
+ * handler runs as the caller. Its type carries the contract, so the app calls
+ * it through `functions<Contracts>()` from `better-supabase/client`.
+ *
+ * ```ts
+ * const sendInvite = defineFunction(bs, {
+ *   input: z.object({ email: z.email() }),
+ *   handler: (input, ctx) => ctx.db.invites.create({ data: input }),
+ * });
+ * export type SendInvite = ContractOf<typeof sendInvite>;
+ * Deno.serve(sendInvite);
+ * ```
+ */
+export declare function defineFunction<I extends StandardSchemaV1, Out, M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown>(edge: Pick<BetterEdge<M, F, E, C, P>, "handler">, definition: FunctionDefinition<I, Out, M, F, E, C, P>): TypedFunction<StandardSchemaV1.InferInput<I>, Out>;
+//#endregion
 //#region src/edge/index.d.ts
 export interface CorsOptions {
   /** Allowed origins, or `*`. Defaults to `*`. */
@@ -48,7 +96,6 @@ export interface EdgeOptions extends ServerOptions {
    */
   readonly waitUntil?: (promise: Promise<unknown>) => void;
 }
-export type ResourceMap<M extends AnyModels> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T> | true; };
 export interface ResourcesOptions extends MiddlewareOptions {
   /** Path before the resources, e.g. `/api` (Supabase: `/<function-name>`). */
   readonly basePath?: string;
@@ -75,7 +122,7 @@ export interface EdgeRoute<M extends AnyModels, F extends AnyFunctions, E, C = u
  * segments are params, a final `*` matches the rest of the path.
  */
 export type EdgeRoutes<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> = Readonly<Record<string, EdgeRouteHandler<M, F, E, C, P> | EdgeRoute<M, F, E, C, P>>>;
-export interface BetterEdge<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
+export interface BetterEdge<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Ref = string> extends BetterServer<M, F, E, C, P> {
   /**
    * A fetch handler (`Deno.serve`, Workers `fetch`) running as the caller.
    * `Result`s become JSON or Problem Details; `undefined` becomes 204.
@@ -96,13 +143,19 @@ export interface BetterEdge<M extends AnyModels, F extends AnyFunctions, E, C =
    * ```
    */
   routes<K extends string>(routes: { readonly [Key in K]: EdgeRouteHandler<M, F, E, C, P, RouteParams<Key>> | EdgeRoute<M, F, E, C, P, RouteParams<Key>>; }, options?: ResourcesOptions): EdgeHandler;
-  /** REST resources matching `createOpenApi`, e.g. `Deno.serve(bs.resources({ customers: true }))`. */
-  resources(map: ResourceMap<M>, options?: ResourcesOptions): EdgeHandler;
+  /**
+   * REST resources matching the API model, e.g.
+   * `Deno.serve(bs.resources({ customers: true }))`: collection, item and
+   * action paths. An unknown path answers 404 before auth resolves.
+   */
+  resources(map: ResourceMap<M, Ref, ServerContext<M, F, E, C, P>["db"]>, options?: ResourcesOptions): EdgeHandler;
 }
 export declare const SUPABASE_CORS_HEADERS: readonly string[];
 /** `CorsOptions` as `withCors` from `@supabase/middleware/cors` takes them. */
 export declare function corsConfig(cors: CorsOptions): WithCorsConfig;
 /** Fetch-handler integration for Supabase Edge Functions, Deno, Bun and Workers. */
-export declare function createEdge<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: EdgeOptions): BetterEdge<M, F, E, C, P>;
+export declare function createEdge<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, A extends AnyAuthorizer | undefined = undefined>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: EdgeOptions & {
+  readonly authorizer?: A;
+}): BetterEdge<M, F, E, C, P, PermissionRef<A>>;
 //#endregion
-export type { BlockRequireOptions, EdgeExecutionContext, EdgeHandler, GuardOptions, MiddlewareOptions, ResourceRouteOptions };
+export { type ActionArgs, type BlockRequireOptions, type ContractOf, type EdgeExecutionContext, type EdgeHandler, type FunctionContract, type FunctionDefinition, type GuardOptions, type MiddlewareOptions, type ResourceAction, type ResourceContext, type ResourceHooks, type ResourceMap, type ResourceRouteOptions, type TypedFunction, defineAction };

package/dist/edge/index.js

@@ -1,12 +1,15 @@
-import { n as dbError } from "../errors-B11Duf73.js";
-import { r as err } from "../result-DzUbqgdW.js";
-import { a as problemResponse } from "../problem-BreOl8b8.js";
-import { a as unexpectedResponse, c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-B-tL8hqg.js";
-import { a as respond, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { t as withBetterSupabase } from "../composite-C6I8ZyaF.js";
-import { t as defineResource } from "../resource-BsvzCMlX.js";
-import { i as requireCaller } from "../kit-Fm-Fv7q5.js";
-import { t as EVERY_CALLER } from "../framework-BDCpJI7o.js";
+import { n as dbError } from "../errors-2M6CKMP4.js";
+import { a as ok, r as err } from "../result-DEqHCMKP.js";
+import { n as validate } from "../standard-DkzZUneg.js";
+import { o as problemResponse } from "../problem-CJvFeGu7.js";
+import { a as unexpectedResponse, c as extendServer, o as withFlush, s as createServer } from "../adapter-CN45ibbV.js";
+import { a as respond, o as settle, t as defaultExpose } from "../respond-volM3ByS.js";
+import { t as withBetterSupabase } from "../composite-zTe0TCqj.js";
+import { r as defineAction } from "../resource-DA811u_4.js";
+import { i as requireCaller } from "../kit-BhHr9T9v.js";
+import { t as withExtra } from "../extra-CGQ2_q3S.js";
+import { t as resourceRouter } from "../resources-BVYPnuLo.js";
+import { t as EVERY_CALLER } from "../framework-3ey3QmrO.js";
 import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { withCors } from "@supabase/middleware/cors";
 //#region src/bridges/edge.ts
@@ -99,6 +102,47 @@ function matchRoute(routes, method, path) {
 	return allowed.size > 0 ? [...allowed] : "none";
 }
 //#endregion
+//#region src/edge/function.ts
+async function readInput(request) {
+	if (request.method === "GET" || request.method === "HEAD") return ok(void 0);
+	const text = await request.text();
+	if (text === "") return ok(void 0);
+	try {
+		return ok(JSON.parse(text));
+	} catch {
+		return err(dbError("invalid_input", "The request body is not JSON"));
+	}
+}
+/**
+* An Edge Function with a typed input and output: the body is parsed and
+* checked with a Standard Schema (zod, valibot, arktype, ...) before the
+* handler runs as the caller. Its type carries the contract, so the app calls
+* it through `functions<Contracts>()` from `better-supabase/client`.
+*
+* ```ts
+* const sendInvite = defineFunction(bs, {
+*   input: z.object({ email: z.email() }),
+*   handler: (input, ctx) => ctx.db.invites.create({ data: input }),
+* });
+* export type SendInvite = ContractOf<typeof sendInvite>;
+* Deno.serve(sendInvite);
+* ```
+*/
+function defineFunction(edge, definition) {
+	const { input, output, handler, ...options } = definition;
+	return edge.handler(async (request, ctx) => {
+		const body = await readInput(request);
+		if (!body.ok) return body;
+		const parsed = await validate(input, body.data, "input");
+		if (!parsed.ok) return parsed;
+		const settled = await settle(() => handler(parsed.data, withExtra(ctx, { request })));
+		if (!settled.ok) return err(settled.error);
+		if (output === void 0 || settled.data instanceof Response) return settled.data;
+		const checked = await validate(output, settled.data, "output");
+		return checked.ok ? checked.data : err(dbError("unexpected", "The function returned data its output rejects"));
+	}, options);
+}
+//#endregion
 //#region src/edge/index.ts
 const SUPABASE_CORS_HEADERS = [
 	"authorization",
@@ -148,9 +192,7 @@ function createEdge(betterSupabase, options = {}) {
 		const routed = (request, env, executionContext) => Promise.resolve(early?.(request) ?? authorized(request, env, executionContext));
 		const answer = withCorsConfig ? toEdge([withCors(withCorsConfig)], (request, _ctx, executionContext, env) => routed(request, env, executionContext)) : routed;
 		return async (request, env, executionContext) => {
-			const response = await answer(request, env, executionContext);
-			flushEvents(server, options.waitUntil ?? executionContext?.waitUntil.bind(executionContext));
-			return response;
+			return withFlush(server, options.waitUntil ?? executionContext?.waitUntil.bind(executionContext), () => answer(request, env, executionContext));
 		};
 	};
 	return extendServer(server, {
@@ -193,7 +235,7 @@ function createEdge(betterSupabase, options = {}) {
 				const caller = await requireCaller(ctx.auth, {
 					...shared,
 					...route.options
-				}, tenant);
+				}, tenant, options.authorizer);
 				if ("kind" in caller) return err(caller);
 				return route.handler(request, withExtra(ctx, {
 					params,
@@ -209,40 +251,24 @@ function createEdge(betterSupabase, options = {}) {
 			});
 		},
 		resources(map, resourcesOptions = {}) {
-			const base = (resourcesOptions.basePath ?? "").replace(/\/$/, "");
-			const handlers = /* @__PURE__ */ new Map();
-			for (const [table, resource] of Object.entries(map)) {
-				if (!resource) continue;
-				handlers.set(table, defineResource(betterSupabase, table, resource === true ? {} : resource));
-			}
-			const match = (request) => {
-				const { pathname } = new URL(request.url);
-				const [table, id, extra] = (pathname.startsWith(`${base}/`) ? pathname.slice(base.length + 1) : void 0)?.split("/") ?? [];
-				const handler = table ? handlers.get(table) : void 0;
-				if (!handler || extra !== void 0 || id !== void 0 && !handler.keyParam) return problemResponse(dbError("not_found", `No route for ${pathname}`), { instance: pathname });
-				try {
-					return {
-						handler,
-						id: id === void 0 || id === "" ? void 0 : decodeURIComponent(id),
-						instance: pathname
-					};
-				} catch {
-					return problemResponse(dbError("invalid_input", `Malformed id in ${pathname}`), { instance: pathname });
-				}
-			};
+			const { basePath, ...middlewareOptions } = resourcesOptions;
+			const router = resourceRouter(betterSupabase, map, {
+				...basePath === void 0 ? {} : { basePath },
+				...options.authorizer === void 0 ? {} : { authorizer: options.authorizer }
+			});
 			return serve((request, ctx) => {
-				const route = match(request);
+				const route = router.match(request);
 				if (route instanceof Response) return route;
-				return route.handler.handle(request, ctx.db, route.id, {
+				return route.handler.serve(request, ctx.db, route.segments, {
 					instance: route.instance,
 					expose
 				});
-			}, resourcesOptions, (request) => {
-				const route = match(request);
+			}, middlewareOptions, (request) => {
+				const route = router.match(request);
 				return route instanceof Response ? route : void 0;
 			});
 		}
 	});
 }
 //#endregion
-export { SUPABASE_CORS_HEADERS, corsConfig, createEdge, toEdge };
+export { SUPABASE_CORS_HEADERS, corsConfig, createEdge, defineAction, defineFunction, toEdge };

package/dist/elysia/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../refusal-DhSU2Vvr.js";
+import { n as RouteGuardOptions } from "../refusal-CFI8-5nf.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 //#region src/bridges/elysia.d.ts

package/dist/elysia/index.js

@@ -1,5 +1,5 @@
 import { t as around } from "../shared-CBxosKK3.js";
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-CeJWxmkH.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-K78A1Vmq.js";
 import { bufferRequest } from "@supabase/middleware";
 //#region src/bridges/elysia.ts
 /**

package/dist/{embeddings-C9KGQnXt.d.ts → embeddings-B4vhS-dY.d.ts}

@@ -1,4 +1,4 @@
-import { n as Embedder, o as KnowledgeHit, r as Knowledge, u as KnowledgeSearchOptions } from "./knowledge-BXBbT0Tr.js";
+import { n as Embedder, o as KnowledgeHit, r as Knowledge, u as KnowledgeSearchOptions } from "./knowledge-CAReFpRA.js";
 import { EmbeddingModel, RerankingModel, SourceDocumentUIPart, Tool, embedMany } from "ai";
 //#region src/ai-sdk/embeddings/embeddings.d.ts
 type ProviderOptions = Parameters<typeof embedMany>[0]["providerOptions"];

package/dist/{ended-XjeGQ5XW.d.ts → ended-CcvcRqEd.d.ts}

@@ -1,4 +1,6 @@
+import { m as RequestContext } from "./plugin-CPK2HsbY.js";
 import { c as StoredSession, n as CookieOptions } from "./session-ChiXDZdZ.js";
+import { r as AuthState } from "./resolve-MxXVWyhd.js";
 //#region src/auth/refresh.d.ts
 interface RefreshOptions {
   readonly url: string;
@@ -41,6 +43,10 @@ type RefreshOutcome = {
  */
 declare function refreshSession(refreshToken: string, options: RefreshOptions): Promise<RefreshOutcome>;
 //#endregion
+//#region src/auth/context.d.ts
+/** The repository context (`actor`, `claims`) for an auth state. */
+declare function authContext(auth: AuthState): RequestContext;
+//#endregion
 //#region src/auth/ended.d.ts
 /** `banned`: Auth rejected the token with `error_code: "user_banned"`. */
 type SessionStatus = "active" | "ended" | "banned" | "unknown";
@@ -60,4 +66,4 @@ interface ClearSessionCookiesOptions {
 declare function sessionStatus(input: Request | string, options: SessionStatusOptions): Promise<SessionStatus>;
 declare function clearSessionCookies<R extends Response>(request: Request, response: R, options: ClearSessionCookiesOptions): R;
 //#endregion
-export { sessionStatus as a, refreshSession as c, clearSessionCookies as i, SessionStatus as n, RefreshOptions as o, SessionStatusOptions as r, RefreshOutcome as s, ClearSessionCookiesOptions as t };
+export { sessionStatus as a, RefreshOutcome as c, clearSessionCookies as i, refreshSession as l, SessionStatus as n, authContext as o, SessionStatusOptions as r, RefreshOptions as s, ClearSessionCookiesOptions as t };

package/dist/{entitlements-DRl6ZJUm.js → entitlements-BYFf0Cdh.js}

@@ -1,5 +1,5 @@
-import { t as AsyncResult } from "./result-DzUbqgdW.js";
-import { C as run } from "./block-helpers-DWHxHsEQ.js";
+import { t as AsyncResult } from "./result-DEqHCMKP.js";
+import { E as run } from "./block-helpers-Cy3pB96I.js";
 //#region src/blocks/entitlements/entitlements.ts
 /** The Stripe event sent when a customer's active entitlements change. */
 const ENTITLEMENTS_UPDATED = "entitlements.active_entitlement_summary.updated";

package/dist/{entitlements-BKSVGtrG.d.ts → entitlements-Ds8qoYZ-.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSession } from "./view-CF7ihnkg.js";
+import { t as AuthSession } from "./view-TpXEUcVN.js";
 //#region src/auth/entitlements.d.ts
 /**
  * One entry of the `memberships` claim when a hook writes it as a list.

package/dist/env/index.d.ts

@@ -1,2 +1,2 @@
-import { a as EnvResult, c as InlineJwks, d as loadEnv, f as parseEnv, i as EnvOptions, l as PublicEnv, m as toServerEnv, n as ENV_VARIABLES, o as EnvSource, p as publicEnv, r as EnvIssue, s as EnvValidationError, t as BetterSupabaseEnv, u as envSchema } from "../index-CLg87OBW.js";
+import { a as EnvResult, c as InlineJwks, d as loadEnv, f as parseEnv, i as EnvOptions, l as PublicEnv, m as toServerEnv, n as ENV_VARIABLES, o as EnvSource, p as publicEnv, r as EnvIssue, s as EnvValidationError, t as BetterSupabaseEnv, u as envSchema } from "../index-BUK7jUzR.js";
 export { BetterSupabaseEnv, ENV_VARIABLES, EnvIssue, EnvOptions, EnvResult, EnvSource, EnvValidationError, InlineJwks, PublicEnv, envSchema, loadEnv, parseEnv, publicEnv, toServerEnv };