better-supabase 0.7.0 → 0.8.0

package/dist/model-messages-Cxw_Up4f.js

@@ -0,0 +1,206 @@
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { a as meta } from "./messages-CJoHHCWT.js";
+//#region src/ai-sdk/model-messages.ts
+const FETCHABLE_URL = /^(?:https?|data):/u;
+function fileUrl(data) {
+	if (data instanceof URL) return data.href;
+	if (typeof data === "string") return FETCHABLE_URL.test(data) ? data : void 0;
+	if (isRecord(data) && data["type"] === "url") return fileUrl(data["url"]);
+}
+function outputOf(output) {
+	switch (output.type) {
+		case "text":
+		case "json":
+		case "content": return {
+			output: output.value,
+			isError: false
+		};
+		case "error-text":
+		case "error-json": return {
+			output: output.value,
+			isError: true
+		};
+		case "execution-denied": {
+			const reason = output.reason ?? "The tool call was denied.";
+			return {
+				output: reason,
+				isError: true,
+				denied: reason
+			};
+		}
+		default: return output;
+	}
+}
+/** Collects one turn's parts, keeping one approval part per tool call. */
+var TurnParts = class {
+	parts = [];
+	#approvalAt = /* @__PURE__ */ new Map();
+	#callOf = /* @__PURE__ */ new Map();
+	constructor(approvals) {
+		for (const approval of approvals) this.#callOf.set(approval.approvalId, approval.toolCallId);
+	}
+	approval(part) {
+		this.#callOf.set(part.approvalId, part.toolCallId);
+		const at = this.#approvalAt.get(part.toolCallId);
+		if (at === void 0) {
+			this.#approvalAt.set(part.toolCallId, this.parts.length);
+			this.parts.push(part);
+		} else this.parts[at] = part;
+	}
+	callOf(approvalId) {
+		return this.#callOf.get(approvalId);
+	}
+	result(toolCallId, toolName, output) {
+		const result = outputOf(output);
+		if (result.denied !== void 0) {
+			const at = this.#approvalAt.get(toolCallId);
+			const current = at === void 0 ? void 0 : this.parts[at];
+			this.approval({
+				type: "tool-approval",
+				toolCallId,
+				approvalId: current?.type === "tool-approval" ? current.approvalId : `approval-${toolCallId}`,
+				state: "denied",
+				reason: result.denied
+			});
+		}
+		this.parts.push({
+			type: "tool-result",
+			toolCallId,
+			toolName,
+			output: result.output,
+			...result.isError ? { isError: true } : {}
+		});
+	}
+};
+function assistantParts(message, turn) {
+	if (typeof message.content === "string") {
+		if (message.content !== "") turn.parts.push({
+			type: "text",
+			text: message.content,
+			state: "done"
+		});
+		return;
+	}
+	for (const part of message.content) switch (part.type) {
+		case "text":
+		case "reasoning":
+			turn.parts.push({
+				type: part.type,
+				text: part.text,
+				state: "done"
+			});
+			break;
+		case "file": {
+			const url = fileUrl(part.data);
+			if (url !== void 0) turn.parts.push({
+				type: "file",
+				mediaType: part.mediaType,
+				url,
+				...part.filename === void 0 ? {} : { filename: part.filename }
+			});
+			break;
+		}
+		case "reasoning-file": {
+			const url = fileUrl(part.data);
+			if (url !== void 0) turn.parts.push({
+				type: "data",
+				name: "ui.reasoning-file",
+				data: {
+					mediaType: part.mediaType,
+					url
+				}
+			});
+			break;
+		}
+		case "custom":
+			turn.parts.push({
+				type: "data",
+				name: "ui.custom",
+				data: { kind: part.kind }
+			});
+			break;
+		case "tool-call":
+			turn.parts.push({
+				type: "tool-call",
+				toolCallId: part.toolCallId,
+				toolName: part.toolName,
+				input: part.input ?? {},
+				...part.providerExecuted === void 0 ? {} : { providerExecuted: part.providerExecuted }
+			});
+			break;
+		case "tool-result":
+			turn.result(part.toolCallId, part.toolName, part.output);
+			break;
+		case "tool-approval-request":
+			turn.approval({
+				type: "tool-approval",
+				toolCallId: part.toolCallId,
+				approvalId: part.approvalId,
+				state: "requested"
+			});
+			break;
+		default: return part;
+	}
+}
+function toolMessageParts(message, turn) {
+	for (const part of message.content) switch (part.type) {
+		case "tool-result":
+			turn.result(part.toolCallId, part.toolName, part.output);
+			break;
+		case "tool-approval-response": {
+			const toolCallId = turn.callOf(part.approvalId);
+			if (toolCallId !== void 0) turn.approval({
+				type: "tool-approval",
+				toolCallId,
+				approvalId: part.approvalId,
+				state: part.approved ? "approved" : "denied",
+				...part.reason === void 0 ? {} : { reason: part.reason }
+			});
+			break;
+		}
+		default: return part;
+	}
+}
+/**
+* One answer in the canonical form, from the model messages an agent added
+* in a turn (`result.messages` after the history). Each assistant message
+* starts a step whose id is `<id>:<n>`, so saving the answer again after
+* another step updates the same message.
+*/
+function fromModelMessages(id, messages, options = {}) {
+	const approvals = options.approvals ?? [];
+	const turn = new TurnParts(approvals);
+	let step = 0;
+	for (const message of messages) if (message.role === "assistant") {
+		turn.parts.push({
+			type: "step",
+			boundary: "start",
+			stepId: `${id}:${step}`
+		});
+		step += 1;
+		assistantParts(message, turn);
+	} else if (message.role === "tool") toolMessageParts(message, turn);
+	for (const approval of approvals) turn.approval({
+		type: "tool-approval",
+		toolCallId: approval.toolCallId,
+		approvalId: approval.approvalId,
+		state: approval.state,
+		...approval.reason === void 0 ? {} : { reason: approval.reason }
+	});
+	for (const source of options.sources ?? []) turn.parts.push({
+		type: "source",
+		sourceType: source.sourceType,
+		id: source.id,
+		...source.url === void 0 ? {} : { url: source.url },
+		...source.title === void 0 ? {} : { title: source.title },
+		...source.mediaType === void 0 ? {} : { mediaType: source.mediaType },
+		...meta(source.providerMetadata)
+	});
+	return {
+		id,
+		role: "assistant",
+		parts: turn.parts
+	};
+}
+//#endregion
+export { fromModelMessages as t };

package/dist/model-messages-D4GZllOD.d.ts

@@ -0,0 +1,34 @@
+import { f as AiToolApprovalPart, i as AiMessage } from "./message-B0fNJgq8.js";
+import { ModelMessage } from "ai";
+//#region src/ai-sdk/model-messages.d.ts
+/** A source a model step cited, as `StepResult.sources` holds it. */
+interface ModelSource {
+  readonly sourceType: "url" | "document";
+  readonly id: string;
+  readonly url?: string;
+  readonly title?: string;
+  readonly mediaType?: string;
+  readonly providerMetadata?: unknown;
+}
+/** An approval decision the messages may no longer carry. */
+interface ModelApproval {
+  readonly approvalId: string;
+  readonly toolCallId: string;
+  readonly state: AiToolApprovalPart["state"];
+  readonly reason?: string;
+}
+interface FromModelMessagesOptions {
+  /** The sources the steps cited; model messages don't keep them. */
+  readonly sources?: readonly ModelSource[];
+  /** Decisions to apply over the approval parts the messages hold. */
+  readonly approvals?: readonly ModelApproval[];
+}
+/**
+ * One answer in the canonical form, from the model messages an agent added
+ * in a turn (`result.messages` after the history). Each assistant message
+ * starts a step whose id is `<id>:<n>`, so saving the answer again after
+ * another step updates the same message.
+ */
+declare function fromModelMessages(id: string, messages: readonly ModelMessage[], options?: FromModelMessagesOptions): AiMessage;
+//#endregion
+export { fromModelMessages as i, ModelApproval as n, ModelSource as r, FromModelMessagesOptions as t };

package/dist/modules-DksjZyMW.js

@@ -0,0 +1,77 @@
+//#region src/config/defaults.ts
+/**
+* Every default `resolveConfig` fills in. Other modules (the SQL module
+* registry, the CLI) read their fallbacks from here instead of repeating the
+* literals.
+*/
+const CONFIG_DEFAULTS = {
+	output: "src/lib/supabase/generated.ts",
+	schemas: ["public"],
+	casing: "snake",
+	postgrestVersion: "13",
+	codecs: {
+		timestamptz: "string",
+		int8: "number",
+		numeric: "number"
+	},
+	sql: {
+		dir: "supabase/schemas",
+		prefix: "900_better_supabase",
+		testsDir: "supabase/tests"
+	},
+	seed: {
+		entry: "supabase/seed.ts",
+		output: "supabase/seeds/000_better_supabase.sql"
+	},
+	openapi: {
+		entry: "src/lib/openapi.ts",
+		output: "openapi.json"
+	},
+	specs: { failOn: "error" },
+	doctor: {
+		format: "text",
+		sources: ["src/**/*.{ts,tsx}"],
+		policyHelperLimit: 5
+	},
+	gen: { watchInterval: 2e3 },
+	env: { output: ".env.local" }
+};
+//#endregion
+//#region src/config/json.ts
+/**
+* The JSON Schema document for a `json[...].schema` entry. A Standard
+* Schema converts for `target` (2020-12 by default); a JSON Schema object is
+* returned as it is.
+*/
+function resolveJsonSchema(source, target = "draft-2020-12") {
+	const standard = source["~standard"];
+	if (standard === void 0) return source;
+	const jsonSchema = standard.jsonSchema;
+	if (typeof jsonSchema?.input !== "function") throw new TypeError("json[...].schema: this Standard Schema library does not implement Standard JSON Schema; pass a JSON Schema object instead");
+	return jsonSchema.input({ target });
+}
+//#endregion
+//#region src/config/modules.ts
+/** URL tenancy: the tenant comes from the request (a slug), not a stored setting. */
+const DEFAULT_ACTIVE_TENANT = "resolver";
+const MODULE_SCHEMA = "better_supabase";
+function resolveModule(config = {}) {
+	return {
+		mode: config.mode ?? "managed",
+		schema: config.schema ?? MODULE_SCHEMA,
+		tables: config.tables ?? {},
+		columns: config.columns ?? {},
+		...config.idType === void 0 ? {} : { idType: config.idType },
+		permissions: config.permissions ?? {},
+		options: config.options ?? {},
+		hooks: {
+			schema: config.hooks?.schema ?? "public",
+			functions: config.hooks?.functions ?? {}
+		},
+		events: config.events ?? true,
+		audit: config.audit ?? true,
+		...config.api === void 0 ? {} : { api: typeof config.api === "string" ? { schema: config.api } : config.api }
+	};
+}
+//#endregion
+export { CONFIG_DEFAULTS as i, resolveModule as n, resolveJsonSchema as r, DEFAULT_ACTIVE_TENANT as t };

package/dist/nestjs/index.d.ts

@@ -1,6 +1,6 @@
-import { n as RouteGuardOptions } from "../refusal-DhSU2Vvr.js";
+import { n as RouteGuardOptions } from "../refusal-CFI8-5nf.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
-import { l as ToNodeOptions } from "../index-CdZKQF98.js";
+import { l as ToNodeOptions } from "../index-R274XFlg.js";
 import { AnyEntry } from "@supabase/middleware";
 import { IncomingMessage, ServerResponse } from "node:http";
 //#region src/nestjs/index.d.ts

package/dist/nestjs/index.js

@@ -1,4 +1,4 @@
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-CeJWxmkH.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-K78A1Vmq.js";
 import { t as beforeRoute } from "../before-route-CnR0C0Jr.js";
 import { t as applyWebHeaders } from "../node-headers-C71zNQHe.js";
 import { n as toWebRequest, t as sendWebResponse } from "../http-Cv4T29xh.js";

package/dist/next/index.d.ts

@@ -1,16 +1,20 @@
-import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
-import { r as AuthState } from "../resolve-ChTYeTEl.js";
-import { B as DbStats, K as ReadSet, it as QuerySpec, t as BetterSupabase, u as CacheAdapter } from "../define-CJJkkr1-.js";
-import { A as supportSessions, C as ActiveSupport, D as SupportPolicy, E as SupportOptions, O as SupportSessions, i as ServerContext, k as SupportStartRequest, n as ContextOptions, o as ServerOptions, t as BetterServer } from "../server-ZSJ9rCcV.js";
-import { n as AmrEntry, s as Impersonator, t as Aal } from "../mfa-Daak8ukG.js";
-import { t as tenantOf } from "../tenant-BxNFk9bx.js";
-import { n as toSession, t as AuthSession } from "../view-CF7ihnkg.js";
-import { n as AuthKind, r as GuardOptions } from "../respond-DprrgyXX.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-CkNzZUqv.js";
-import { r as LiveCountSeed, t as CountRunner } from "../index-DunNRdnT.js";
-import { r as MembershipClaim } from "../entitlements-BKSVGtrG.js";
-import { i as tagFor, t as TagOptions } from "../tags-Cx-LnIQP.js";
-import { n as supportOf, t as SupportView } from "../support-view-CVOJJLpc.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-CoE5Zwy4.js";
+import { r as AuthState } from "../resolve-MxXVWyhd.js";
+import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
+import { Wt as DbStats, at as QuerySpec, q as ReadSet, s as CacheAdapter, t as BetterSupabase } from "../define-DmcfoNXB.js";
+import { n as AmrEntry, s as Impersonator, t as Aal } from "../mfa-SZc9YYyb.js";
+import { D as SupportSessions, E as SupportPolicy, O as SupportStartRequest, T as SupportOptions, i as ServerContext, k as supportSessions, n as ContextOptions, s as ServerOptions, t as BetterServer, x as ActiveSupport } from "../server-types-CrAmZ8jv.js";
+import { t as tenantOf } from "../tenant-CM368LXb.js";
+import { n as toSession, t as AuthSession } from "../view-TpXEUcVN.js";
+import { n as AuthKind, r as GuardOptions } from "../respond-Cw-zanCm.js";
+import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-W99LCPBS.js";
+import { r as LiveCountSeed, t as CountRunner } from "../index-BCHR4Ucl.js";
+import { r as MembershipClaim } from "../entitlements-Ds8qoYZ-.js";
+import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-CqB6GWGT.js";
+import { t as ResourceMap } from "../resources-DZSk8tXJ.js";
+import { t as defineAction } from "../resource-execute-rbKvuCsY.js";
+import { i as tagFor, t as TagOptions } from "../tags-BO9LjtWG.js";
+import { n as supportOf, t as SupportView } from "../support-view-scqMgtOo.js";
 import { NextRequest } from "next/server.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/collector.d.ts
@@ -21,7 +25,31 @@ interface DbBudget {
   readonly waves?: number;
 }
 //#endregion
-//#region src/next/create.d.ts
+//#region src/next/resources.d.ts
+interface NextResourcesOptions extends GuardOptions {
+  /** The catch-all route's path, e.g. `/api` for `app/api/[...path]/route.ts`. */
+  readonly basePath?: string;
+  /**
+   * Refresh an expired session cookie and send the new cookies. Off by
+   * default because the proxy refreshes everything it matches.
+   */
+  readonly refresh?: boolean;
+}
+/** A route handler of the resources' catch-all route. */
+type NextResourceHandler = (request: Request) => Promise<Response>;
+/**
+ * The exports of `app/api/[...path]/route.ts`:
+ * `export const { GET, POST, PATCH, PUT, DELETE } = bs.resources({ ... })`.
+ */
+interface NextResourceRoutes {
+  readonly GET: NextResourceHandler;
+  readonly POST: NextResourceHandler;
+  readonly PATCH: NextResourceHandler;
+  readonly PUT: NextResourceHandler;
+  readonly DELETE: NextResourceHandler;
+}
+//#endregion
+//#region src/next/types.d.ts
 interface NextOptions extends ServerOptions {
   /** Invalidate `tagFor(table)` cache tags after mutations. Defaults to true. */
   readonly cacheTags?: boolean;
@@ -40,8 +68,6 @@ interface NextDebugOptions {
   /** Where `bs.debugRoute()` is mounted. Defaults to `/api/bs-stats`. */
   readonly route?: string;
 }
-/** Response header with the URL of the request's totals on `bs.debugRoute()`. */
-export declare const STATS_URL_HEADER = "x-bs-stats";
 interface ProxyOptions<C = unknown, P = unknown> {
   /**
    * Another middleware to compose with, such as next-intl's. It runs on the
@@ -84,7 +110,7 @@ interface EndedSessionOptions {
     readonly banned?: string;
   };
 }
-interface ActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R> {
+interface ActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R, Ref> {
   /** Validates the input (plain object or `FormData`) with any Standard Schema. */
   readonly input?: S;
   /**
@@ -95,7 +121,7 @@ interface ActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P =
    */
   readonly tenant?: (input: ActionParsed<S>) => string | undefined;
 }
-interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean> extends GuardOptions, AuthorizeOptions<NextRequest, C, P, R> {
+interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<NextRequest, C, P, R, Ref> {
   /**
    * Refresh an expired session cookie in the route and send the new cookies
    * with its response. For routes the proxy's matcher skips; off by default
@@ -103,7 +129,7 @@ interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean> ex
    */
   readonly refresh?: boolean;
 }
-interface RequireOptions<C = unknown, P = unknown, R extends boolean = boolean> extends GuardOptions, AuthorizeOptions<undefined, C, P, R> {
+interface RequireOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<undefined, C, P, R, Ref> {
   /** The active tenant, as for `bs.context({ tenant })`. */
   readonly tenant?: string;
 }
@@ -116,7 +142,7 @@ interface ScopeOptions {
    */
   readonly tenant?: string;
 }
-interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
+interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Ref = string> extends BetterServer<M, F, E, C, P> {
   /** `proxy.ts`: refreshes sessions for page loads and server actions. */
   proxy(request: NextRequest, options?: ProxyOptions<C, P>): Promise<Response>;
   /**
@@ -180,7 +206,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
   /** Route handler with auth, Result unwrapping and Problem Details errors. */
   route<Params = Record<string, string | string[]>, R extends boolean = false>(handler: (request: NextRequest, ctx: ServerContext<M, F, E, C, P> & AuthorizedContext<C, P, R> & {
     readonly params: Params;
-  }) => unknown, options?: RouteOptions<C, P, R>): (request: NextRequest, segment: {
+  }) => unknown, options?: RouteOptions<C, P, R, Ref>): (request: NextRequest, segment: {
     readonly params: Promise<Params>;
   }) => Promise<Response>;
   /**
@@ -193,7 +219,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * );
    * ```
    */
-  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: ActionOptions<S, C, P, R>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C, P> & AuthorizedContext<C, P, R>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: ActionOptions<S, C, P, R, Ref>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C, P> & AuthorizedContext<C, P, R>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
   /**
    * For Server Components: the caller's context, or the Next.js interrupt
    * for a refused caller. `unauthorized` calls `unauthorized()`, `forbidden`
@@ -204,7 +230,21 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * const { db, tenant } = await bs.require({ requireTenant: true, roles: ['admin'] });
    * ```
    */
-  require<R extends boolean = false>(options?: RequireOptions<C, P, R>): Promise<ServerContext<M, F, E, C, P> & AuthorizedContext<C, P, R>>;
+  require<R extends boolean = false>(options?: RequireOptions<C, P, R, Ref>): Promise<ServerContext<M, F, E, C, P> & AuthorizedContext<C, P, R>>;
+  /**
+   * REST resources for a catch-all route, matching the API model:
+   * collections, items and actions, as the caller (RLS), behind the guard in
+   * `options`, with Problem Details errors. An unknown path answers 404
+   * before auth resolves.
+   *
+   * ```ts title="app/api/[...path]/route.ts"
+   * export const { GET, POST, PATCH, PUT, DELETE } = bs.resources(
+   *   { customers: true },
+   *   { basePath: "/api" },
+   * );
+   * ```
+   */
+  resources(map: ResourceMap<M, Ref, ServerContext<M, F, E, C, P>["db"]>, options?: NextResourcesOptions): NextResourceRoutes;
   /**
    * Tags the current `"use cache"` scope with a table (and row) tag. With a
    * `tenant`, mutations in other tenants leave the entry cached.
@@ -240,8 +280,6 @@ interface SupportStarted {
   /** ISO 8601. */
   readonly expiresAt: string;
 }
-/** The tag `bs.cached()` adds to entries rendered in a support session. */
-export declare function supportTag(sessionId: string): string;
 interface SessionStaleOptions {
   /**
    * With fewer seconds left on the token, the view is not reused at all (0):
@@ -253,14 +291,6 @@ interface SessionStaleOptions {
   /** 300 (5 minutes) joins the route's App Shell. Defaults to 300. */
   readonly max?: number;
 }
-/**
- * `cacheLife` `stale` seconds for a view of `session`: `max`, but never past
- * the token's expiry, and 0 once fewer than `min` seconds are left. A
- * signed-out view that a refresh would change (an `expired` or
- * `refresh_failed` cookie, or an `invalid` token) is 0 as well, so it never
- * joins the App Shell.
- */
-export declare function sessionStale(session: AuthSession, options?: SessionStaleOptions, now?: number): number;
 interface CachedOptions<T extends string = string> extends ScopeOptions {
   /**
    * The active tenant, as for `bs.context({ tenant })`. Next.js keys the
@@ -292,8 +322,6 @@ interface CachedOptions<T extends string = string> extends ScopeOptions {
 type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> = ServerContext<M, F, E, C, P> & {
   readonly session: AuthSession<C, P>;
 };
-/** The tag `bs.cached()` puts on a user's entries. */
-export declare function sessionTag(userId: string): string;
 interface NextCacheOptions {
   /**
    * How a mutation outside a Server Action (a route handler, a webhook)
@@ -305,13 +333,6 @@ interface NextCacheOptions {
     readonly expire?: number;
   };
 }
-/**
- * Invalidates `bs:<table>` for every table in the target, the tenant's
- * `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has
- * no tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
- * tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
- */
-export declare function nextCache(options?: NextCacheOptions): CacheAdapter;
 interface RequireAalOptions {
   /**
    * Page that enrolls or challenges a second factor. Signed-in users below
@@ -322,30 +343,59 @@ interface RequireAalOptions {
   /** Paths that need the level. Defaults to every path but `redirect`. */
   readonly match?: (pathname: string) => boolean;
 }
+//#endregion
+//#region src/next/create.d.ts
 /**
- * A `proxy` `protect` that keeps signed-in users below `level` out of the
- * matched paths. The JWT carries no factor list, so this also sends users
- * without a factor to `redirect` to enroll one. Anonymous callers pass;
- * combine it with your sign-in redirect.
+ * The Next.js adapter: proxy, Server Components, route handlers, server
+ * actions and cache tags, on top of `createServer`.
  *
  * ```ts
- * bs.proxy(request, {
- *   protect: requireAal('aal2', { redirect: '/mfa', match: (path) => path.startsWith('/settings') }),
- * });
+ * export const bs = createNext(betterSupabase);
  * ```
  */
-export declare function requireAal(level: Aal, options?: RequireAalOptions): (auth: AuthState, request: NextRequest) => Response | undefined;
+export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, A extends AnyAuthorizer | undefined = undefined>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: NextOptions & {
+  readonly authorizer?: A;
+}): BetterNext<M, F, E, C, P, PermissionRef<A>>;
+//#endregion
+//#region src/next/cache.d.ts
+/** The tag `bs.cached()` adds to entries rendered in a support session. */
+export declare function supportTag(sessionId: string): string;
+/**
+ * `cacheLife` `stale` seconds for a view of `session`: `max`, but never past
+ * the token's expiry, and 0 once fewer than `min` seconds are left. A
+ * signed-out view that a refresh would change (an `expired` or
+ * `refresh_failed` cookie, or an `invalid` token) is 0 as well, so it never
+ * joins the App Shell.
+ */
+export declare function sessionStale(session: AuthSession, options?: SessionStaleOptions, now?: number): number;
+/** The tag `bs.cached()` puts on a user's entries. */
+export declare function sessionTag(userId: string): string;
+/**
+ * Invalidates `bs:<table>` for every table in the target, the tenant's
+ * `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has
+ * no tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
+ * tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
+ */
+export declare function nextCache(options?: NextCacheOptions): CacheAdapter;
+//#endregion
+//#region src/next/support.d.ts
+/** Response header with the URL of the request's totals on `bs.debugRoute()`. */
+export declare const STATS_URL_HEADER = "x-bs-stats";
 export declare function shouldCheckSession(request: NextRequest, options?: EndedSessionOptions): boolean;
 /** Page loads, client navigations and server actions; never prefetches or assets. */
 export declare function shouldRefresh(request: Request): boolean;
 /**
- * The Next.js adapter: proxy, Server Components, route handlers, server
- * actions and cache tags, on top of `createServer`.
+ * A `proxy` `protect` that keeps signed-in users below `level` out of the
+ * matched paths. The JWT carries no factor list, so this also sends users
+ * without a factor to `redirect` to enroll one. Anonymous callers pass;
+ * combine it with your sign-in redirect.
  *
  * ```ts
- * export const bs = createNext(betterSupabase);
+ * bs.proxy(request, {
+ *   protect: requireAal('aal2', { redirect: '/mfa', match: (path) => path.startsWith('/settings') }),
+ * });
  * ```
  */
-export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: NextOptions): BetterNext<M, F, E, C, P>;
+export declare function requireAal(level: Aal, options?: RequireAalOptions): (auth: AuthState, request: NextRequest) => Response | undefined;
 //#endregion
-export { type Aal, type ActionOptions, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthSession, type AuthorizeOptions, type AuthorizedContext, type BetterNext, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EndedSessionOptions, type GuardOptions, type Impersonator, type LiveCountSeed, type MembershipClaim, type NextCacheOptions, type NextDebugOptions, type NextOptions, type ProxyOptions, type RequireAalOptions, type RequireOptions, type RouteOptions, type ScopeOptions, type SessionStaleOptions, type SupportOptions, type SupportPolicy, type SupportSessions, type SupportStartRequest, type SupportStarted, type SupportView, type TagOptions, supportOf, supportSessions, tagFor, tenantOf, toSession };
+export { type Aal, type ActionArgs, type ActionOptions, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthSession, type AuthorizeOptions, type AuthorizedContext, type BetterNext, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EndedSessionOptions, type GuardOptions, type Impersonator, type LiveCountSeed, type MembershipClaim, type NextCacheOptions, type NextDebugOptions, type NextOptions, type NextResourceHandler, type NextResourceRoutes, type NextResourcesOptions, type ProxyOptions, type RequireAalOptions, type RequireOptions, type ResourceAction, type ResourceContext, type ResourceHooks, type ResourceMap, type ResourceRouteOptions, type RouteOptions, type ScopeOptions, type SessionStaleOptions, type SupportOptions, type SupportPolicy, type SupportSessions, type SupportStartRequest, type SupportStarted, type SupportView, type TagOptions, defineAction, supportOf, supportSessions, tagFor, tenantOf, toSession };