better-supabase 0.7.1 → 0.9.0

package/dist/money-95Rff2vT.js

@@ -0,0 +1,185 @@
+import { t as ISO_4217_MINOR_UNITS } from "./iso4217-A8ev-CNW.js";
+//#region src/commerce/money.ts
+/** Thrown when two amounts in different currencies meet; lines never mix currencies. */
+var CurrencyMismatchError = class extends TypeError {
+	currencies;
+	constructor(a, b) {
+		super(`Can't combine ${a} and ${b}: amounts must share one currency`);
+		this.name = "CurrencyMismatchError";
+		this.currencies = [a, b];
+	}
+};
+const RATE = /^(\d+)(?:\.(\d+))?$/;
+const DECIMAL = /^(-)?(\d+)(?:\.(\d+))?$/;
+/** Whether `code` is an ISO 4217 code with minor units, such as `EUR`. */
+function isCurrency(code) {
+	return typeof code === "string" && Object.hasOwn(ISO_4217_MINOR_UNITS, code);
+}
+/** The number of minor units of `currency`: 2 for EUR, 0 for JPY, 3 for KWD. */
+function minorUnits(currency) {
+	if (!isCurrency(currency)) throw new RangeError(`"${String(currency)}" is not an ISO 4217 currency code with minor units`);
+	return ISO_4217_MINOR_UNITS[currency] ?? 0;
+}
+/** `Money` from an integer number of minor units: `money(1999n, "EUR")` is 19.99 EUR. */
+function money(amount, currency) {
+	minorUnits(currency);
+	if (typeof amount === "number" && !Number.isSafeInteger(amount)) throw new RangeError(`${amount} is not a whole number of minor units; use parseMoney for a decimal`);
+	return Object.freeze({
+		amount: BigInt(amount),
+		currency
+	});
+}
+/** Whether `value` is a `Money` with a bigint amount and a known currency. */
+function isMoney(value) {
+	return typeof value === "object" && value !== null && "amount" in value && "currency" in value && typeof value.amount === "bigint" && isCurrency(value.currency);
+}
+/**
+* Reads a decimal such as `"19.99"` in `currency`. More decimals than the
+* currency has minor units throw instead of rounding.
+*/
+function parseMoney(decimal, currency) {
+	const units = minorUnits(currency);
+	const match = DECIMAL.exec(decimal.trim());
+	if (!match) throw new RangeError(`"${decimal}" is not a decimal amount`);
+	const [, sign, whole = "0", fraction = ""] = match;
+	if (fraction.length > units) throw new RangeError(`"${decimal}" has more decimals than ${currency}'s ${units} minor units`);
+	const amount = BigInt(whole + fraction.padEnd(units, "0"));
+	return money(sign === "-" ? -amount : amount, currency);
+}
+/** The amount as a decimal string with every minor unit: `"19.90"`, `"500"` for JPY. */
+function toDecimal(value) {
+	const units = minorUnits(value.currency);
+	const negative = value.amount < 0n;
+	const digits = (negative ? -value.amount : value.amount).toString().padStart(units + 1, "0");
+	const whole = digits.slice(0, digits.length - units);
+	const fraction = units === 0 ? "" : `.${digits.slice(-units)}`;
+	return `${negative ? "-" : ""}${whole}${fraction}`;
+}
+/**
+* Formats with `Intl.NumberFormat`, passing the exact decimal string so
+* large amounts keep every digit.
+*/
+function formatMoney(value, locale, options = {}) {
+	return new Intl.NumberFormat(locale, {
+		...options,
+		style: "currency",
+		currency: value.currency
+	}).format(toDecimal(value));
+}
+/** `{ amount: "1999", currency: "EUR" }`, for JSON bodies and `jsonb` columns. */
+function moneyToJson(value) {
+	return {
+		amount: value.amount.toString(),
+		currency: value.currency
+	};
+}
+/** Reads `MoneyJson` back; throws for anything else. */
+function moneyFromJson(value) {
+	if (typeof value !== "object" || value === null || !("amount" in value) || !("currency" in value) || typeof value.amount !== "string" || typeof value.currency !== "string" || !/^-?\d+$/.test(value.amount)) throw new TypeError("Money JSON is { amount: \"<minor units>\", currency: \"<ISO 4217 code>\" }");
+	return money(BigInt(value.amount), value.currency);
+}
+const sameCurrency = (a, b) => {
+	if (a.currency !== b.currency) throw new CurrencyMismatchError(a.currency, b.currency);
+};
+function addMoney(a, b) {
+	sameCurrency(a, b);
+	return money(a.amount + b.amount, a.currency);
+}
+function subtractMoney(a, b) {
+	sameCurrency(a, b);
+	return money(a.amount - b.amount, a.currency);
+}
+/** The total of `values`, all in `currency`; zero for an empty list. */
+function sumMoney(values, currency) {
+	let total = money(0n, currency);
+	for (const value of values) total = addMoney(total, value);
+	return total;
+}
+/** `value` times a whole `quantity`, such as a unit price times the line's quantity. */
+function multiplyMoney(value, quantity) {
+	if (typeof quantity === "number" && !Number.isSafeInteger(quantity)) throw new RangeError(`${quantity} is not a whole quantity`);
+	return money(value.amount * BigInt(quantity), value.currency);
+}
+function negateMoney(value) {
+	return money(-value.amount, value.currency);
+}
+/** -1, 0 or 1; throws for different currencies. */
+function compareMoney(a, b) {
+	sameCurrency(a, b);
+	if (a.amount === b.amount) return 0;
+	return a.amount < b.amount ? -1 : 1;
+}
+/**
+* `numerator / denominator` rounded half to even (banker's rounding): ties
+* go to the even neighbour, so rounding many lines doesn't drift one way.
+*/
+function roundHalfEven(numerator, denominator) {
+	if (denominator === 0n) throw new RangeError("Division by zero");
+	const [n, d] = denominator < 0n ? [-numerator, -denominator] : [numerator, denominator];
+	const quotient = n / d;
+	const remainder = n % d;
+	const twice = 2n * (remainder < 0n ? -remainder : remainder);
+	if (twice < d) return quotient;
+	const away = n < 0n ? quotient - 1n : quotient + 1n;
+	if (twice > d) return away;
+	return quotient % 2n === 0n ? quotient : away;
+}
+/** Whether `rate` is a non-negative decimal fraction such as `"0.21"`. */
+function isRate(rate) {
+	return typeof rate === "string" && RATE.test(rate);
+}
+const rateParts = (rate) => {
+	const match = RATE.exec(rate);
+	if (!match) throw new RangeError(`"${rate}" is not a rate; write a decimal fraction such as "0.21"`);
+	const [, whole = "0", fraction = ""] = match;
+	return [BigInt(whole + fraction), 10n ** BigInt(fraction.length)];
+};
+/**
+* `value` times `rate` (a decimal fraction such as `"0.21"`), rounded half
+* to even. With `included: true`, `value` already contains the rate (a
+* tax-inclusive price) and the result is the part the rate accounts for:
+* `value * rate / (1 + rate)`.
+*/
+function applyRate(value, rate, options = {}) {
+	const [numerator, denominator] = rateParts(rate);
+	const divisor = options.included ? denominator + numerator : denominator;
+	return money(roundHalfEven(value.amount * numerator, divisor), value.currency);
+}
+/**
+* Splits `value` by `weights` so the parts add up to it exactly. Each part
+* is rounded down, and the leftover minor units go to the largest
+* remainders, earlier parts first on a tie.
+*/
+function allocateMoney(value, weights) {
+	const shares = weights.map((weight) => {
+		if (typeof weight === "number" && !Number.isSafeInteger(weight)) throw new RangeError(`${weight} is not a whole weight`);
+		const share = BigInt(weight);
+		if (share < 0n) throw new RangeError("Weights can't be negative");
+		return share;
+	});
+	const total = shares.reduce((sum, share) => sum + share, 0n);
+	if (total === 0n) throw new RangeError("Weights must add up to more than 0");
+	const negative = value.amount < 0n;
+	const amount = negative ? -value.amount : value.amount;
+	const parts = shares.map((share) => ({
+		base: amount * share / total,
+		remainder: amount * share % total
+	}));
+	let left = amount - parts.reduce((sum, part) => sum + part.base, 0n);
+	const order = parts.map((part, index) => ({
+		index,
+		remainder: part.remainder
+	})).toSorted((a, b) => a.remainder === b.remainder ? a.index - b.index : a.remainder > b.remainder ? -1 : 1);
+	const extra = /* @__PURE__ */ new Set();
+	for (const { index } of order) {
+		if (left === 0n) break;
+		extra.add(index);
+		left -= 1n;
+	}
+	return parts.map((part, index) => {
+		const share = part.base + (extra.has(index) ? 1n : 0n);
+		return money(negative ? -share : share, value.currency);
+	});
+}
+//#endregion
+export { roundHalfEven as _, compareMoney as a, toDecimal as b, isMoney as c, money as d, moneyFromJson as f, parseMoney as g, negateMoney as h, applyRate as i, isRate as l, multiplyMoney as m, addMoney as n, formatMoney as o, moneyToJson as p, allocateMoney as r, isCurrency as s, CurrencyMismatchError as t, minorUnits as u, subtractMoney as v, sumMoney as y };

package/dist/money-DFpWzQvk.d.ts

@@ -0,0 +1,76 @@
+//#region src/commerce/money.d.ts
+/**
+ * An amount in the currency's minor units (cents for EUR, yen for JPY) and an
+ * ISO 4217 code. SQL stores the same pair as `bigint` and `char(3)`.
+ */
+interface Money {
+  readonly amount: bigint;
+  readonly currency: string;
+}
+/** `Money` as JSON: the amount as a string of minor units, since JSON has no bigint. */
+interface MoneyJson {
+  readonly amount: string;
+  readonly currency: string;
+}
+/** Thrown when two amounts in different currencies meet; lines never mix currencies. */
+declare class CurrencyMismatchError extends TypeError {
+  readonly currencies: readonly [string, string];
+  constructor(a: string, b: string);
+}
+/** Whether `code` is an ISO 4217 code with minor units, such as `EUR`. */
+declare function isCurrency(code: unknown): code is string;
+/** The number of minor units of `currency`: 2 for EUR, 0 for JPY, 3 for KWD. */
+declare function minorUnits(currency: string): number;
+/** `Money` from an integer number of minor units: `money(1999n, "EUR")` is 19.99 EUR. */
+declare function money(amount: bigint | number, currency: string): Money;
+/** Whether `value` is a `Money` with a bigint amount and a known currency. */
+declare function isMoney(value: unknown): value is Money;
+/**
+ * Reads a decimal such as `"19.99"` in `currency`. More decimals than the
+ * currency has minor units throw instead of rounding.
+ */
+declare function parseMoney(decimal: string, currency: string): Money;
+/** The amount as a decimal string with every minor unit: `"19.90"`, `"500"` for JPY. */
+declare function toDecimal(value: Money): string;
+/**
+ * Formats with `Intl.NumberFormat`, passing the exact decimal string so
+ * large amounts keep every digit.
+ */
+declare function formatMoney(value: Money, locale?: Intl.LocalesArgument, options?: Omit<Intl.NumberFormatOptions, "style" | "currency">): string;
+/** `{ amount: "1999", currency: "EUR" }`, for JSON bodies and `jsonb` columns. */
+declare function moneyToJson(value: Money): MoneyJson;
+/** Reads `MoneyJson` back; throws for anything else. */
+declare function moneyFromJson(value: unknown): Money;
+declare function addMoney(a: Money, b: Money): Money;
+declare function subtractMoney(a: Money, b: Money): Money;
+/** The total of `values`, all in `currency`; zero for an empty list. */
+declare function sumMoney(values: readonly Money[], currency: string): Money;
+/** `value` times a whole `quantity`, such as a unit price times the line's quantity. */
+declare function multiplyMoney(value: Money, quantity: bigint | number): Money;
+declare function negateMoney(value: Money): Money;
+/** -1, 0 or 1; throws for different currencies. */
+declare function compareMoney(a: Money, b: Money): -1 | 0 | 1;
+/**
+ * `numerator / denominator` rounded half to even (banker's rounding): ties
+ * go to the even neighbour, so rounding many lines doesn't drift one way.
+ */
+declare function roundHalfEven(numerator: bigint, denominator: bigint): bigint;
+/** Whether `rate` is a non-negative decimal fraction such as `"0.21"`. */
+declare function isRate(rate: unknown): rate is string;
+/**
+ * `value` times `rate` (a decimal fraction such as `"0.21"`), rounded half
+ * to even. With `included: true`, `value` already contains the rate (a
+ * tax-inclusive price) and the result is the part the rate accounts for:
+ * `value * rate / (1 + rate)`.
+ */
+declare function applyRate(value: Money, rate: string, options?: {
+  readonly included?: boolean;
+}): Money;
+/**
+ * Splits `value` by `weights` so the parts add up to it exactly. Each part
+ * is rounded down, and the leftover minor units go to the largest
+ * remainders, earlier parts first on a tie.
+ */
+declare function allocateMoney(value: Money, weights: readonly (bigint | number)[]): Money[];
+//#endregion
+export { toDecimal as S, negateMoney as _, allocateMoney as a, subtractMoney as b, formatMoney as c, isRate as d, minorUnits as f, multiplyMoney as g, moneyToJson as h, addMoney as i, isCurrency as l, moneyFromJson as m, Money as n, applyRate as o, money as p, MoneyJson as r, compareMoney as s, CurrencyMismatchError as t, isMoney as u, parseMoney as v, sumMoney as x, roundHalfEven as y };

package/dist/money-codec-C_-K5ZUU.js

@@ -0,0 +1,41 @@
+import { n as dbError } from "./errors-8i6tSICm.js";
+import { a as bigintOf, x as optionalBigintOf } from "./block-helpers-CfG_MvDR.js";
+import { d as money, s as isCurrency } from "./money-95Rff2vT.js";
+//#region src/blocks/money-codec.ts
+/**
+* `Money` from an amount block functions send as text and its currency.
+* Throws for a number (precision is already lost), a missing amount or a
+* code ISO 4217 doesn't list.
+*/
+const moneyOf = (amount, currency, field = "amount") => money(bigintOf(amount, field), String(currency));
+/** `moneyOf`, or `undefined` when the amount is null. */
+function optionalMoneyOf(amount, currency, field = "amount") {
+	const found = optionalBigintOf(amount, field);
+	return found === void 0 ? void 0 : money(found, String(currency));
+}
+/** A `Money` as a function argument: minor units as text. */
+const amountText = (value) => value.amount.toString();
+/** An optional `Money` as a function argument, `null` when absent. */
+const optionalAmountText = (value) => value === void 0 || value === null ? null : amountText(value);
+/**
+* The `invalid_request` error for amounts that don't share `currency`, or
+* `undefined` when they all do. Amounts that are `undefined` are skipped.
+*/
+function currencyMismatch(currency, amounts) {
+	const present = amounts.filter((item) => item !== void 0);
+	const expected = currency ?? present[0]?.currency;
+	const other = present.find((item) => item.currency !== expected);
+	return other === void 0 || expected === void 0 ? void 0 : dbError("invalid_request", `Can't combine ${expected} and ${other.currency}: amounts must share one currency`, { hint: "CURRENCY_MISMATCH" });
+}
+/** The `invalid_request` error for a currency ISO 4217 doesn't list. */
+const unknownCurrency = (currency) => dbError("invalid_request", `${currency} is not an ISO 4217 currency code`, { hint: "CURRENCY_INVALID" });
+/**
+* Why amounts can't be written in `currency`, or `undefined` when they can:
+* the currency is unknown, or an amount is in another one.
+*/
+function amountsError(currency, amounts) {
+	if (currency !== void 0 && !isCurrency(currency)) return unknownCurrency(currency);
+	return currencyMismatch(currency, amounts);
+}
+//#endregion
+export { optionalAmountText as a, moneyOf as i, amountsError as n, optionalMoneyOf as o, currencyMismatch as r, unknownCurrency as s, amountText as t };

package/dist/nestjs/index.d.ts

@@ -1,6 +1,6 @@
-import { n as RouteGuardOptions } from "../refusal-DhSU2Vvr.js";
+import { n as RouteGuardOptions } from "../refusal-oD3ISM9h.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
-import { l as ToNodeOptions } from "../index-CdZKQF98.js";
+import { l as ToNodeOptions } from "../index-Brhm22eL.js";
 import { AnyEntry } from "@supabase/middleware";
 import { IncomingMessage, ServerResponse } from "node:http";
 //#region src/nestjs/index.d.ts

package/dist/nestjs/index.js

@@ -1,5 +1,5 @@
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-CeJWxmkH.js";
-import { t as beforeRoute } from "../before-route-CnR0C0Jr.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-br4Ma9Cf.js";
+import { t as beforeRoute } from "../before-route-B98js9m_.js";
 import { t as applyWebHeaders } from "../node-headers-C71zNQHe.js";
 import { n as toWebRequest, t as sendWebResponse } from "../http-Cv4T29xh.js";
 import { createRequire } from "node:module";

package/dist/next/index.d.ts

@@ -1,16 +1,22 @@
-import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
-import { r as AuthState } from "../resolve-ChTYeTEl.js";
-import { B as DbStats, K as ReadSet, it as QuerySpec, t as BetterSupabase, u as CacheAdapter } from "../define-CJJkkr1-.js";
-import { A as supportSessions, C as ActiveSupport, D as SupportPolicy, E as SupportOptions, O as SupportSessions, i as ServerContext, k as SupportStartRequest, n as ContextOptions, o as ServerOptions, t as BetterServer } from "../server-Bh0EVSwU.js";
-import { n as AmrEntry, s as Impersonator, t as Aal } from "../mfa-Daak8ukG.js";
-import { t as tenantOf } from "../tenant-BxNFk9bx.js";
-import { n as toSession, t as AuthSession } from "../view-CF7ihnkg.js";
-import { n as AuthKind, r as GuardOptions } from "../respond-DprrgyXX.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-CkNzZUqv.js";
-import { r as LiveCountSeed, t as CountRunner } from "../index-DunNRdnT.js";
-import { r as MembershipClaim } from "../entitlements-BKSVGtrG.js";
-import { i as tagFor, t as TagOptions } from "../tags-Cx-LnIQP.js";
-import { n as supportOf, t as SupportView } from "../support-view-CVOJJLpc.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-YfwpIE-d.js";
+import { r as AuthState } from "../resolve-w9EpHzuM.js";
+import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
+import { Wt as DbStats, at as QuerySpec, q as ReadSet, s as CacheAdapter, t as BetterSupabase } from "../define-DxHHbNEb.js";
+import { n as Impersonator } from "../impersonation-D5chOkrO.js";
+import { C as supportSessions, S as SupportStartRequest, b as SupportPolicy, g as ActiveSupport, i as ServerContext, n as ContextOptions, s as ServerOptions, t as BetterServer, x as SupportSessions, y as SupportOptions } from "../server-types-OohhIQb2.js";
+import { n as AmrEntry, t as Aal } from "../mfa-DtflCXEt.js";
+import { t as tenantOf } from "../tenant-DdmVhsff.js";
+import { n as toSession, t as AuthSession } from "../view-Dv0A949a.js";
+import { t as AuthOutageHook } from "../session-DiWHtYrO.js";
+import { n as AuthKind, r as GuardOptions } from "../respond-C7I8kLK_.js";
+import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-D5S7KNFe.js";
+import { r as LiveCountSeed, t as CountRunner } from "../index-BIi8i6BO.js";
+import { r as MembershipClaim } from "../entitlements-CbzCKalR.js";
+import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-D2vEQVXI.js";
+import { t as ResourceMap } from "../resources-BklF-rjz.js";
+import { t as defineAction } from "../resource-execute-D0yQ-8WR.js";
+import { i as tagFor, t as TagOptions } from "../tags-Dw8vKkcI.js";
+import { n as supportOf, t as SupportView } from "../support-view-BbcZR7Io.js";
 import { NextRequest } from "next/server.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/collector.d.ts
@@ -21,7 +27,31 @@ interface DbBudget {
   readonly waves?: number;
 }
 //#endregion
-//#region src/next/create.d.ts
+//#region src/next/resources.d.ts
+interface NextResourcesOptions extends GuardOptions {
+  /** The catch-all route's path, e.g. `/api` for `app/api/[...path]/route.ts`. */
+  readonly basePath?: string;
+  /**
+   * Refresh an expired session cookie and send the new cookies. Off by
+   * default because the proxy refreshes everything it matches.
+   */
+  readonly refresh?: boolean;
+}
+/** A route handler of the resources' catch-all route. */
+type NextResourceHandler = (request: Request) => Promise<Response>;
+/**
+ * The exports of `app/api/[...path]/route.ts`:
+ * `export const { GET, POST, PATCH, PUT, DELETE } = bs.resources({ ... })`.
+ */
+interface NextResourceRoutes {
+  readonly GET: NextResourceHandler;
+  readonly POST: NextResourceHandler;
+  readonly PATCH: NextResourceHandler;
+  readonly PUT: NextResourceHandler;
+  readonly DELETE: NextResourceHandler;
+}
+//#endregion
+//#region src/next/types.d.ts
 interface NextOptions extends ServerOptions {
   /** Invalidate `tagFor(table)` cache tags after mutations. Defaults to true. */
   readonly cacheTags?: boolean;
@@ -40,8 +70,6 @@ interface NextDebugOptions {
   /** Where `bs.debugRoute()` is mounted. Defaults to `/api/bs-stats`. */
   readonly route?: string;
 }
-/** Response header with the URL of the request's totals on `bs.debugRoute()`. */
-export declare const STATS_URL_HEADER = "x-bs-stats";
 interface ProxyOptions<C = unknown, P = unknown> {
   /**
    * Another middleware to compose with, such as next-intl's. It runs on the
@@ -74,6 +102,14 @@ interface ProxyOptions<C = unknown, P = unknown> {
    */
   readonly serverTiming?: boolean;
   readonly endedSession?: true | EndedSessionOptions;
+  /**
+   * Called when a refresh failed because the Auth server was unreachable,
+   * timed out or answered 5xx or 429. When the access token couldn't be
+   * kept (`event.kept` is false), a returned `Response` replaces the
+   * proxy's response, such as a 503 with `Retry-After`. A throw is logged
+   * and ignored.
+   */
+  readonly onAuthOutage?: AuthOutageHook;
 }
 interface EndedSessionOptions {
   readonly paths?: readonly string[];
@@ -84,7 +120,7 @@ interface EndedSessionOptions {
     readonly banned?: string;
   };
 }
-interface ActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R> {
+interface ActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R, Ref> {
   /** Validates the input (plain object or `FormData`) with any Standard Schema. */
   readonly input?: S;
   /**
@@ -95,7 +131,7 @@ interface ActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P =
    */
   readonly tenant?: (input: ActionParsed<S>) => string | undefined;
 }
-interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean> extends GuardOptions, AuthorizeOptions<NextRequest, C, P, R> {
+interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<NextRequest, C, P, R, Ref> {
   /**
    * Refresh an expired session cookie in the route and send the new cookies
    * with its response. For routes the proxy's matcher skips; off by default
@@ -103,7 +139,7 @@ interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean> ex
    */
   readonly refresh?: boolean;
 }
-interface RequireOptions<C = unknown, P = unknown, R extends boolean = boolean> extends GuardOptions, AuthorizeOptions<undefined, C, P, R> {
+interface RequireOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<undefined, C, P, R, Ref> {
   /** The active tenant, as for `bs.context({ tenant })`. */
   readonly tenant?: string;
 }
@@ -116,7 +152,7 @@ interface ScopeOptions {
    */
   readonly tenant?: string;
 }
-interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
+interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Ref = string> extends BetterServer<M, F, E, C, P> {
   /** `proxy.ts`: refreshes sessions for page loads and server actions. */
   proxy(request: NextRequest, options?: ProxyOptions<C, P>): Promise<Response>;
   /**
@@ -180,7 +216,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
   /** Route handler with auth, Result unwrapping and Problem Details errors. */
   route<Params = Record<string, string | string[]>, R extends boolean = false>(handler: (request: NextRequest, ctx: ServerContext<M, F, E, C, P> & AuthorizedContext<C, P, R> & {
     readonly params: Params;
-  }) => unknown, options?: RouteOptions<C, P, R>): (request: NextRequest, segment: {
+  }) => unknown, options?: RouteOptions<C, P, R, Ref>): (request: NextRequest, segment: {
     readonly params: Promise<Params>;
   }) => Promise<Response>;
   /**
@@ -193,7 +229,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * );
    * ```
    */
-  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: ActionOptions<S, C, P, R>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C, P> & AuthorizedContext<C, P, R>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: ActionOptions<S, C, P, R, Ref>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C, P> & AuthorizedContext<C, P, R>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
   /**
    * For Server Components: the caller's context, or the Next.js interrupt
    * for a refused caller. `unauthorized` calls `unauthorized()`, `forbidden`
@@ -204,7 +240,21 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * const { db, tenant } = await bs.require({ requireTenant: true, roles: ['admin'] });
    * ```
    */
-  require<R extends boolean = false>(options?: RequireOptions<C, P, R>): Promise<ServerContext<M, F, E, C, P> & AuthorizedContext<C, P, R>>;
+  require<R extends boolean = false>(options?: RequireOptions<C, P, R, Ref>): Promise<ServerContext<M, F, E, C, P> & AuthorizedContext<C, P, R>>;
+  /**
+   * REST resources for a catch-all route, matching the API model:
+   * collections, items and actions, as the caller (RLS), behind the guard in
+   * `options`, with Problem Details errors. An unknown path answers 404
+   * before auth resolves.
+   *
+   * ```ts title="app/api/[...path]/route.ts"
+   * export const { GET, POST, PATCH, PUT, DELETE } = bs.resources(
+   *   { customers: true },
+   *   { basePath: "/api" },
+   * );
+   * ```
+   */
+  resources(map: ResourceMap<M, Ref, ServerContext<M, F, E, C, P>["db"]>, options?: NextResourcesOptions): NextResourceRoutes;
   /**
    * Tags the current `"use cache"` scope with a table (and row) tag. With a
    * `tenant`, mutations in other tenants leave the entry cached.
@@ -240,8 +290,6 @@ interface SupportStarted {
   /** ISO 8601. */
   readonly expiresAt: string;
 }
-/** The tag `bs.cached()` adds to entries rendered in a support session. */
-export declare function supportTag(sessionId: string): string;
 interface SessionStaleOptions {
   /**
    * With fewer seconds left on the token, the view is not reused at all (0):
@@ -253,14 +301,6 @@ interface SessionStaleOptions {
   /** 300 (5 minutes) joins the route's App Shell. Defaults to 300. */
   readonly max?: number;
 }
-/**
- * `cacheLife` `stale` seconds for a view of `session`: `max`, but never past
- * the token's expiry, and 0 once fewer than `min` seconds are left. A
- * signed-out view that a refresh would change (an `expired` or
- * `refresh_failed` cookie, or an `invalid` token) is 0 as well, so it never
- * joins the App Shell.
- */
-export declare function sessionStale(session: AuthSession, options?: SessionStaleOptions, now?: number): number;
 interface CachedOptions<T extends string = string> extends ScopeOptions {
   /**
    * The active tenant, as for `bs.context({ tenant })`. Next.js keys the
@@ -292,8 +332,6 @@ interface CachedOptions<T extends string = string> extends ScopeOptions {
 type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> = ServerContext<M, F, E, C, P> & {
   readonly session: AuthSession<C, P>;
 };
-/** The tag `bs.cached()` puts on a user's entries. */
-export declare function sessionTag(userId: string): string;
 interface NextCacheOptions {
   /**
    * How a mutation outside a Server Action (a route handler, a webhook)
@@ -305,13 +343,6 @@ interface NextCacheOptions {
     readonly expire?: number;
   };
 }
-/**
- * Invalidates `bs:<table>` for every table in the target, the tenant's
- * `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has
- * no tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
- * tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
- */
-export declare function nextCache(options?: NextCacheOptions): CacheAdapter;
 interface RequireAalOptions {
   /**
    * Page that enrolls or challenges a second factor. Signed-in users below
@@ -322,30 +353,59 @@ interface RequireAalOptions {
   /** Paths that need the level. Defaults to every path but `redirect`. */
   readonly match?: (pathname: string) => boolean;
 }
+//#endregion
+//#region src/next/create.d.ts
 /**
- * A `proxy` `protect` that keeps signed-in users below `level` out of the
- * matched paths. The JWT carries no factor list, so this also sends users
- * without a factor to `redirect` to enroll one. Anonymous callers pass;
- * combine it with your sign-in redirect.
+ * The Next.js adapter: proxy, Server Components, route handlers, server
+ * actions and cache tags, on top of `createServer`.
  *
  * ```ts
- * bs.proxy(request, {
- *   protect: requireAal('aal2', { redirect: '/mfa', match: (path) => path.startsWith('/settings') }),
- * });
+ * export const bs = createNext(betterSupabase);
  * ```
  */
-export declare function requireAal(level: Aal, options?: RequireAalOptions): (auth: AuthState, request: NextRequest) => Response | undefined;
+export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, A extends AnyAuthorizer | undefined = undefined>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: NextOptions & {
+  readonly authorizer?: A;
+}): BetterNext<M, F, E, C, P, PermissionRef<A>>;
+//#endregion
+//#region src/next/cache.d.ts
+/** The tag `bs.cached()` adds to entries rendered in a support session. */
+export declare function supportTag(sessionId: string): string;
+/**
+ * `cacheLife` `stale` seconds for a view of `session`: `max`, but never past
+ * the token's expiry, and 0 once fewer than `min` seconds are left. A
+ * signed-out view that a refresh would change (an `expired` or
+ * `refresh_failed` cookie, or an `invalid` token) is 0 as well, so it never
+ * joins the App Shell.
+ */
+export declare function sessionStale(session: AuthSession, options?: SessionStaleOptions, now?: number): number;
+/** The tag `bs.cached()` puts on a user's entries. */
+export declare function sessionTag(userId: string): string;
+/**
+ * Invalidates `bs:<table>` for every table in the target, the tenant's
+ * `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has
+ * no tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
+ * tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
+ */
+export declare function nextCache(options?: NextCacheOptions): CacheAdapter;
+//#endregion
+//#region src/next/support.d.ts
+/** Response header with the URL of the request's totals on `bs.debugRoute()`. */
+export declare const STATS_URL_HEADER = "x-bs-stats";
 export declare function shouldCheckSession(request: NextRequest, options?: EndedSessionOptions): boolean;
 /** Page loads, client navigations and server actions; never prefetches or assets. */
 export declare function shouldRefresh(request: Request): boolean;
 /**
- * The Next.js adapter: proxy, Server Components, route handlers, server
- * actions and cache tags, on top of `createServer`.
+ * A `proxy` `protect` that keeps signed-in users below `level` out of the
+ * matched paths. The JWT carries no factor list, so this also sends users
+ * without a factor to `redirect` to enroll one. Anonymous callers pass;
+ * combine it with your sign-in redirect.
  *
  * ```ts
- * export const bs = createNext(betterSupabase);
+ * bs.proxy(request, {
+ *   protect: requireAal('aal2', { redirect: '/mfa', match: (path) => path.startsWith('/settings') }),
+ * });
  * ```
  */
-export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: NextOptions): BetterNext<M, F, E, C, P>;
+export declare function requireAal(level: Aal, options?: RequireAalOptions): (auth: AuthState, request: NextRequest) => Response | undefined;
 //#endregion
-export { type Aal, type ActionOptions, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthSession, type AuthorizeOptions, type AuthorizedContext, type BetterNext, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EndedSessionOptions, type GuardOptions, type Impersonator, type LiveCountSeed, type MembershipClaim, type NextCacheOptions, type NextDebugOptions, type NextOptions, type ProxyOptions, type RequireAalOptions, type RequireOptions, type RouteOptions, type ScopeOptions, type SessionStaleOptions, type SupportOptions, type SupportPolicy, type SupportSessions, type SupportStartRequest, type SupportStarted, type SupportView, type TagOptions, supportOf, supportSessions, tagFor, tenantOf, toSession };
+export { type Aal, type ActionArgs, type ActionOptions, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthSession, type AuthorizeOptions, type AuthorizedContext, type BetterNext, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EndedSessionOptions, type GuardOptions, type Impersonator, type LiveCountSeed, type MembershipClaim, type NextCacheOptions, type NextDebugOptions, type NextOptions, type NextResourceHandler, type NextResourceRoutes, type NextResourcesOptions, type ProxyOptions, type RequireAalOptions, type RequireOptions, type ResourceAction, type ResourceContext, type ResourceHooks, type ResourceMap, type ResourceRouteOptions, type RouteOptions, type ScopeOptions, type SessionStaleOptions, type SupportOptions, type SupportPolicy, type SupportSessions, type SupportStartRequest, type SupportStarted, type SupportView, type TagOptions, defineAction, supportOf, supportSessions, tagFor, tenantOf, toSession };