better-supabase 0.7.1 → 0.9.0

package/dist/next/index.js

@@ -1,27 +1,112 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../errors-B11Duf73.js";
-import { r as err } from "../result-DzUbqgdW.js";
-import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-D_AD9GGu.js";
-import { o as isReadSet } from "../read-set-DuKWC9Mj.js";
-import { t as isList } from "../guards-BnzDvFrz.js";
-import { n as validate } from "../standard-BK0cqJ7y.js";
-import { a as problemResponse } from "../problem-BreOl8b8.js";
+import { n as dbError } from "../errors-8i6tSICm.js";
+import { r as err } from "../result-BlgnMB0H.js";
+import { t as isList } from "../guards-6F2bCtQR.js";
+import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-D6vkb89f.js";
+import { o as isReadSet } from "../read-set-GEb-i0On.js";
+import { n as validate } from "../standard-B5fe2gnW.js";
+import { o as problemResponse } from "../problem-pIiL3WbE.js";
 import { i as claimsOf } from "../claims-PqzCxaTD.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { t as tenantOf } from "../tenant-I1TEZ_BX.js";
-import { C as serverCore, c as extendServer, l as withExtra, n as flushEvents, p as supportCookieMaxAge, r as handle, s as createServer, t as bearerRequest, v as isPrefetch } from "../adapter-iKgjHVPx.js";
-import { a as checkAal, n as toSession } from "../view-BeFcRV6G.js";
-import { o as settle, r as guard, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { t as supportSessions } from "../support-ig_K4PvS.js";
+import { t as tenantOf } from "../tenant-B-fiItlJ.js";
+import { T as serverCore, b as isPrefetch, c as extendServer, n as flushEvents, p as supportCookieMaxAge, r as handle, s as createServer, t as bearerRequest, v as outageResponse } from "../adapter-CEjmtazZ.js";
+import { a as checkAal, n as toSession } from "../view-DZ63nqwt.js";
+import { o as settle, r as guard, t as defaultExpose } from "../respond-DdhZ9Wbn.js";
+import { t as supportSessions } from "../support-BsKkvA92.js";
+import { r as defineAction } from "../resource-C8r5xGqY.js";
 import { r as tagFor, t as cacheTagsOf } from "../tags-B99_U9Pp.js";
-import { n as formDataObject } from "../kit-Fm-Fv7q5.js";
+import { i as requireCaller, n as formDataObject, t as authorizeCaller } from "../kit-MUK34-ZG.js";
+import { t as withExtra } from "../extra-CGQ2_q3S.js";
+import { n as resourceRouter } from "../resources-BlZdLsWQ.js";
 import { cache } from "react";
 import { cacheLife, cacheTag, io, revalidateTag, updateTag } from "next/cache.js";
+import { cookies, headers } from "next/headers.js";
+import { NextResponse, after } from "next/server.js";
 import { forbidden } from "next/dist/client/components/forbidden.js";
 import { notFound } from "next/dist/client/components/not-found.js";
 import { unauthorized } from "next/dist/client/components/unauthorized.js";
-import { cookies, headers } from "next/headers.js";
-import { NextResponse, after } from "next/server.js";
+//#region src/next/cache.ts
+/** The tag `bs.cached()` adds to entries rendered in a support session. */
+function supportTag(sessionId) {
+	return `bs:support:${sessionId}`;
+}
+/** The shortest time the Next.js client router keeps a prefetched entry. */
+const MIN_CLIENT_STALE = 30;
+/**
+* `cacheLife` `stale` seconds for a view of `session`: `max`, but never past
+* the token's expiry, and 0 once fewer than `min` seconds are left. A
+* signed-out view that a refresh would change (an `expired` or
+* `refresh_failed` cookie, or an `invalid` token) is 0 as well, so it never
+* joins the App Shell.
+*/
+function sessionStale(session, options = {}, now = Date.now()) {
+	const min = Math.max(MIN_CLIENT_STALE, options.min ?? MIN_CLIENT_STALE);
+	const max = options.max ?? 300;
+	switch (session.kind) {
+		case "invalid": return 0;
+		case "anon": return session.reason === "expired" || session.reason === "refresh_failed" ? 0 : max;
+		case "service":
+		case "apiKey": return max;
+		case "user": {
+			if (session.expiresAt === null) return max;
+			const remaining = session.expiresAt - Math.floor(now / 1e3);
+			return remaining < min ? 0 : Math.min(max, remaining);
+		}
+		default: return session;
+	}
+}
+/** The tag `bs.cached()` puts on a user's entries. */
+function sessionTag(userId) {
+	return `bs:session:${userId}`;
+}
+/**
+* The table tags of a read: the tenant's and every tenant's, or the table's.
+* A read across tenants (`"*"`) also carries the table's, which every
+* mutation invalidates, including one scoped to a single tenant.
+*/
+function tableTags(table, options) {
+	if (options.tenant === "*") return [tagFor(table), tagFor(table, void 0, options)];
+	return options.tenant === void 0 ? [tagFor(table)] : [tagFor(table, void 0, options), tagFor(table, void 0, { tenant: "*" })];
+}
+/** The next read waits for fresh data instead of serving the stale entry. */
+const EXPIRE_NOW = { expire: 0 };
+/**
+* Invalidates tags with `updateTag` (Server Actions), else `revalidateTag`
+* (Route Handlers), else not at all (jobs, scripts). The first tag decides
+* for the rest, so a mutation outside an action throws once, not per tag.
+*/
+function invalidateAll(tags, profile = EXPIRE_NOW) {
+	let index = 0;
+	try {
+		for (; index < tags.length; index++) updateTag(tags[index]);
+		return;
+	} catch {}
+	try {
+		for (; index < tags.length; index++) revalidateTag(tags[index], profile);
+	} catch {}
+}
+/**
+* Invalidates `bs:<table>` for every table in the target, the tenant's
+* `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has
+* no tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
+* tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
+*/
+function nextCache(options = {}) {
+	return {
+		name: "next",
+		invalidate: (target) => {
+			invalidateAll(cacheTagsOf(target), options.revalidate);
+		}
+	};
+}
+/**
+* Event hubs that already invalidate Next.js cache tags. Every instance a
+* definition derives shares its hub, and `createNext` can run again for one
+* definition (hot reload, a definition in another package), so tags are
+* invalidated once per mutation.
+*/
+const nextCacheAttached = /* @__PURE__ */ new WeakSet();
+//#endregion
 //#region src/next/collector.ts
 /** Forwarded by the proxy so every scope of one render shares an id. */
 const REQUEST_ID_HEADER = "x-bs-request-id";
@@ -102,7 +187,8 @@ const SHARED = Symbol.for("better-supabase.next.stats-collector");
 */
 function sharedCollector(options) {
 	const scope = globalThis;
-	const shared = scope[SHARED] ??= new StatsCollector(options);
+	const shared = scope[SHARED] ?? new StatsCollector(options);
+	scope[SHARED] = shared;
 	return {
 		recorderFor: (id) => shared.recorderFor(id, options),
 		get: (id) => shared.get(id)
@@ -119,6 +205,51 @@ function formatStats(stats) {
 	return `${stats.calls};${stats.waves};${stats.ms}`;
 }
 //#endregion
+//#region src/next/control-flow.ts
+/** Whether `cause` is one of Next's own control-flow errors (they carry a `digest`). */
+function isNextInterrupt(cause) {
+	return cause instanceof Error && "digest" in cause && typeof cause.digest === "string";
+}
+/**
+* `unauthorized()` and `forbidden()` throw a plain error without
+* `experimental.authInterrupts`; `notFound()` is the fallback then.
+*/
+function authInterrupt(fn) {
+	try {
+		fn();
+	} catch (cause) {
+		if (isNextInterrupt(cause)) throw cause;
+	}
+	notFound();
+}
+/** The Next.js interrupt for a refused Server Component render. */
+function interrupt(error) {
+	if (error.kind === "unauthorized") authInterrupt(unauthorized);
+	if (error.kind === "forbidden") authInterrupt(forbidden);
+	if (error.kind === "not_found") notFound();
+	throw new DbException(error);
+}
+const NEXT_DIGESTS = /* @__PURE__ */ new Set([
+	"NEXT_REDIRECT",
+	"NEXT_HTTP_ERROR_FALLBACK",
+	"DYNAMIC_SERVER_USAGE",
+	"BAILOUT_TO_CLIENT_SIDE_RENDERING",
+	"HANGING_PROMISE_REJECTION",
+	"NEXT_PRERENDER_INTERRUPTED"
+]);
+const REACT_POSTPONE = Symbol.for("react.postpone");
+/**
+* `unstable_rethrow` without `next/navigation`: that entry loads the client
+* router context, which Turbopack can't resolve inside route handlers. The
+* digests are the ones Next 16 checks.
+*/
+function rethrowNextControlFlow(error) {
+	if (typeof error !== "object" || error === null) return;
+	const digest = "digest" in error ? error.digest : void 0;
+	if (typeof digest === "string" && NEXT_DIGESTS.has(digest.split(";", 1)[0] ?? "") || "$$typeof" in error && error.$$typeof === REACT_POSTPONE || error instanceof Error && error.message.includes("needs to bail out of prerendering")) throw error;
+	if ("cause" in error) rethrowNextControlFlow(error.cause);
+}
+//#endregion
 //#region src/next/proxy.ts
 const OVERRIDE = "x-middleware-override-headers";
 const REQUEST_PREFIX = "x-middleware-request-";
@@ -162,104 +293,41 @@ function serverTimingValue(metrics) {
 	return Object.entries(metrics).map(([name, ms]) => `${name};dur=${ms.toFixed(1)}`).join(", ");
 }
 //#endregion
-//#region src/next/create.ts
-/** Response header with the URL of the request's totals on `bs.debugRoute()`. */
-const STATS_URL_HEADER = "x-bs-stats";
-/** The tag `bs.cached()` adds to entries rendered in a support session. */
-function supportTag(sessionId) {
-	return `bs:support:${sessionId}`;
-}
-/** The shortest time the Next.js client router keeps a prefetched entry. */
-const MIN_CLIENT_STALE = 30;
-/**
-* `cacheLife` `stale` seconds for a view of `session`: `max`, but never past
-* the token's expiry, and 0 once fewer than `min` seconds are left. A
-* signed-out view that a refresh would change (an `expired` or
-* `refresh_failed` cookie, or an `invalid` token) is 0 as well, so it never
-* joins the App Shell.
-*/
-function sessionStale(session, options = {}, now = Date.now()) {
-	const min = Math.max(MIN_CLIENT_STALE, options.min ?? MIN_CLIENT_STALE);
-	const max = options.max ?? 300;
-	switch (session.kind) {
-		case "invalid": return 0;
-		case "anon": return session.reason === "expired" || session.reason === "refresh_failed" ? 0 : max;
-		case "service":
-		case "apiKey": return max;
-		case "user": {
-			if (session.expiresAt === null) return max;
-			const remaining = session.expiresAt - Math.floor(now / 1e3);
-			return remaining < min ? 0 : Math.min(max, remaining);
-		}
-		default: return session;
-	}
-}
-/** The tag `bs.cached()` puts on a user's entries. */
-function sessionTag(userId) {
-	return `bs:session:${userId}`;
-}
-/**
-* The table tags of a read: the tenant's and every tenant's, or the table's.
-* A read across tenants (`"*"`) also carries the table's, which every
-* mutation invalidates, including one scoped to a single tenant.
-*/
-function tableTags(table, options) {
-	if (options.tenant === "*") return [tagFor(table), tagFor(table, void 0, options)];
-	return options.tenant === void 0 ? [tagFor(table)] : [tagFor(table, void 0, options), tagFor(table, void 0, { tenant: "*" })];
-}
-/** The next read waits for fresh data instead of serving the stale entry. */
-const EXPIRE_NOW = { expire: 0 };
-/**
-* Invalidates tags with `updateTag` (Server Actions), else `revalidateTag`
-* (Route Handlers), else not at all (jobs, scripts). The first tag decides
-* for the rest, so a mutation outside an action throws once, not per tag.
-*/
-function invalidateAll(tags, profile = EXPIRE_NOW) {
-	let index = 0;
-	try {
-		for (; index < tags.length; index++) updateTag(tags[index]);
-		return;
-	} catch {}
-	try {
-		for (; index < tags.length; index++) revalidateTag(tags[index], profile);
-	} catch {}
-}
-/**
-* Invalidates `bs:<table>` for every table in the target, the tenant's
-* `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has
-* no tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
-* tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
-*/
-function nextCache(options = {}) {
+//#region src/next/resources.ts
+/** One handler for every method; the resource router picks the operation. */
+function resourceRoutes(serve) {
 	return {
-		name: "next",
-		invalidate: (target) => {
-			invalidateAll(cacheTagsOf(target), options.revalidate);
-		}
+		GET: serve,
+		POST: serve,
+		PATCH: serve,
+		PUT: serve,
+		DELETE: serve
 	};
 }
-/** Whether `cause` is one of Next's own control-flow errors (they carry a `digest`). */
-function isNextInterrupt(cause) {
-	return cause instanceof Error && "digest" in cause && typeof cause.digest === "string";
+//#endregion
+//#region src/next/support.ts
+/** Response header with the URL of the request's totals on `bs.debugRoute()`. */
+const STATS_URL_HEADER = "x-bs-stats";
+function endedRedirect(request, path, reason) {
+	const target = new URL(path, request.url);
+	target.searchParams.set("reason", reason);
+	return NextResponse.redirect(target);
 }
-/**
-* `unauthorized()` and `forbidden()` throw a plain error without
-* `experimental.authInterrupts`; `notFound()` is the fallback then.
-*/
-function authInterrupt(fn) {
-	try {
-		fn();
-	} catch (cause) {
-		if (isNextInterrupt(cause)) throw cause;
-	}
-	notFound();
+function shouldCheckSession(request, options = {}) {
+	if (request.method !== "GET" && request.method !== "HEAD") return false;
+	if (isPrefetch(request)) return false;
+	if (request.headers.get("sec-fetch-dest") === "document") return true;
+	return options.paths?.includes(request.nextUrl.pathname) ?? false;
 }
-/** The Next.js interrupt for a refused Server Component render. */
-function interrupt(error) {
-	if (error.kind === "unauthorized") authInterrupt(unauthorized);
-	if (error.kind === "forbidden") authInterrupt(forbidden);
-	if (error.kind === "not_found") notFound();
-	throw new DbException(error);
+/** Page loads, client navigations and server actions; never prefetches or assets. */
+function shouldRefresh(request) {
+	const h = request.headers;
+	if (request.method !== "GET" && request.method !== "HEAD") return h.has("next-action");
+	if (isPrefetch(request)) return false;
+	if (h.get("rsc") === "1") return true;
+	const dest = h.get("sec-fetch-dest");
+	if (dest) return dest === "document";
+	return h.get("accept")?.includes("text/html") ?? false;
 }
 /**
 * A `proxy` `protect` that keeps signed-in users below `level` out of the
@@ -286,34 +354,8 @@ function requireAal(level, options = {}) {
 		return NextResponse.redirect(target);
 	};
 }
-function endedRedirect(request, path, reason) {
-	const target = new URL(path, request.url);
-	target.searchParams.set("reason", reason);
-	return NextResponse.redirect(target);
-}
-function shouldCheckSession(request, options = {}) {
-	if (request.method !== "GET" && request.method !== "HEAD") return false;
-	if (isPrefetch(request)) return false;
-	if (request.headers.get("sec-fetch-dest") === "document") return true;
-	return options.paths?.includes(request.nextUrl.pathname) ?? false;
-}
-/** Page loads, client navigations and server actions; never prefetches or assets. */
-function shouldRefresh(request) {
-	const h = request.headers;
-	if (request.method !== "GET" && request.method !== "HEAD") return h.has("next-action");
-	if (isPrefetch(request)) return false;
-	if (h.get("rsc") === "1") return true;
-	const dest = h.get("sec-fetch-dest");
-	if (dest) return dest === "document";
-	return h.get("accept")?.includes("text/html") ?? false;
-}
-/**
-* Event hubs that already invalidate Next.js cache tags. Every instance a
-* definition derives shares its hub, and `createNext` can run again for one
-* definition (hot reload, a definition in another package), so tags are
-* invalidated once per mutation.
-*/
-const nextCacheAttached = /* @__PURE__ */ new WeakSet();
+//#endregion
+//#region src/next/create.ts
 /**
 * The Next.js adapter: proxy, Server Components, route handlers, server
 * actions and cache tags, on top of `createServer`.
@@ -375,17 +417,8 @@ function createNext(betterSupabase, options = {}) {
 	/** The tenant `scoped` resolved for a context, when it wasn't the claim. */
 	const scopedTenants = /* @__PURE__ */ new WeakMap();
 	const tenantFor = (ctx, view) => scopedTenants.get(ctx) ?? tenantOf(view, tenantClaim);
-	/** `requireTenant` and `authorize`: the session and tenant, or why the caller is refused. */
-	const authorizeCaller = async (ctx, checks, input) => {
-		const view = toSession(ctx.auth);
-		const tenant = tenantFor(ctx, view);
-		if (checks.requireTenant && tenant === void 0) return dbError("forbidden", "Choose an organization first", { code: "NO_TENANT" });
-		if (checks.authorize && !await checks.authorize(view, input)) return dbError("forbidden", "You are not allowed to do this", { code: "NOT_AUTHORIZED" });
-		return {
-			session: view,
-			tenant
-		};
-	};
+	/** `requireTenant`, `roles`, `permission` and `authorize`, for the context's tenant. */
+	const authorizeCaller$1 = (ctx, checks, input) => authorizeCaller(ctx.auth, checks, input, tenantFor(ctx, toSession(ctx.auth)), options.authorizer);
 	/** `null` runs `NextOptions.tenant`; a string is the caller's explicit tenant. */
 	const scoped = cache(async (explicit) => {
 		const { request, resolution } = await incoming();
@@ -485,7 +518,7 @@ function createNext(betterSupabase, options = {}) {
 			const rendersSignedOut = proxyOptions.expiredPrefetch === "render" && resolution.auth.kind === "anon" && resolution.auth.reason === "expired" && isPrefetch(request);
 			const protectMethods = proxyOptions.protectMethods;
 			const runsProtect = protectMethods === true ? true : (protectMethods ?? ["GET", "HEAD"]).includes(request.method);
-			const custom = (resolution.sessionEnded === true && sessionCheck?.redirect !== void 0 && request.nextUrl.pathname !== sessionCheck.redirect ? endedRedirect(request, sessionCheck.redirect, resolution.sessionEndedReason === "banned" ? sessionCheck.reasons?.banned ?? "account_banned" : sessionCheck.reasons?.ended ?? "session_ended") : void 0) ?? (rendersSignedOut || !runsProtect ? void 0 : await proxyOptions.protect?.(resolution.auth, request));
+			const custom = (resolution.sessionEnded === true && sessionCheck?.redirect !== void 0 && request.nextUrl.pathname !== sessionCheck.redirect ? endedRedirect(request, sessionCheck.redirect, resolution.sessionEndedReason === "banned" ? sessionCheck.reasons?.banned ?? "account_banned" : sessionCheck.reasons?.ended ?? "session_ended") : void 0) ?? await outageResponse(proxyOptions.onAuthOutage, resolution, request, betterSupabase.events.logger) ?? (rendersSignedOut || !runsProtect ? void 0 : await proxyOptions.protect?.(resolution.auth, request));
 			const initial = custom ?? early;
 			if (!initial && resolution.cookies.length === 0 && !id && !proxyOptions.after && !proxyOptions.serverTiming) {
 				flushAfter();
@@ -522,7 +555,7 @@ function createNext(betterSupabase, options = {}) {
 					response = await handle(base, request, async (ctx) => {
 						current = ctx;
 						stats = () => ctx.stats();
-						const [params, caller] = await Promise.all([segment.params, authorizeCaller(ctx, guardOptions, request)]);
+						const [params, caller] = await Promise.all([segment.params, authorizeCaller$1(ctx, guardOptions, request)]);
 						if ("kind" in caller) return err(caller);
 						return handler(request, withExtra(ctx, {
 							...caller,
@@ -546,6 +579,28 @@ function createNext(betterSupabase, options = {}) {
 				return response;
 			};
 		},
+		resources(map, resourcesOptions = {}) {
+			const { basePath, ...guardOptions } = resourcesOptions;
+			const router = resourceRouter(betterSupabase, map, {
+				...basePath === void 0 ? {} : { basePath },
+				...options.authorizer === void 0 ? {} : { authorizer: options.authorizer }
+			});
+			return resourceRoutes(async (request) => {
+				const route = router.match(request);
+				if (route instanceof Response) return route;
+				return handle(base, request, (ctx) => route.handler.serve(request, ctx.db, route.segments, {
+					instance: route.instance,
+					expose
+				}), {
+					...guardOptions,
+					expose,
+					instance: route.instance,
+					context: statsFor(request),
+					waitUntil,
+					rethrow: rethrowNextControlFlow
+				});
+			});
+		},
 		debugRoute() {
 			return (request) => {
 				const id = new URL(request.url).searchParams.get("id");
@@ -581,7 +636,7 @@ function createNext(betterSupabase, options = {}) {
 				}
 				const tenant = actionOptions.tenant?.(parsed);
 				const ctx = tenant === void 0 ? early ?? await current() : await current(tenant);
-				const caller = await authorizeCaller(ctx, actionOptions, parsed);
+				const caller = await authorizeCaller$1(ctx, actionOptions, parsed);
 				if ("kind" in caller) return {
 					ok: false,
 					data: null,
@@ -608,7 +663,7 @@ function createNext(betterSupabase, options = {}) {
 		},
 		require: async (requireOptions = {}) => {
 			const ctx = await current(requireOptions.tenant);
-			const caller = guard(ctx.auth, requireOptions.allow, requireOptions.aal, requireOptions.scopes) ?? await authorizeCaller(ctx, requireOptions, void 0);
+			const caller = await requireCaller(ctx.auth, requireOptions, tenantFor(ctx, toSession(ctx.auth)), options.authorizer);
 			if ("kind" in caller) interrupt(caller);
 			return withExtra(ctx, caller);
 		},
@@ -679,25 +734,5 @@ function createNext(betterSupabase, options = {}) {
 		}
 	});
 }
-const NEXT_DIGESTS = /* @__PURE__ */ new Set([
-	"NEXT_REDIRECT",
-	"NEXT_HTTP_ERROR_FALLBACK",
-	"DYNAMIC_SERVER_USAGE",
-	"BAILOUT_TO_CLIENT_SIDE_RENDERING",
-	"HANGING_PROMISE_REJECTION",
-	"NEXT_PRERENDER_INTERRUPTED"
-]);
-const REACT_POSTPONE = Symbol.for("react.postpone");
-/**
-* `unstable_rethrow` without `next/navigation`: that entry loads the client
-* router context, which Turbopack can't resolve inside route handlers. The
-* digests are the ones Next 16 checks.
-*/
-function rethrowNextControlFlow(error) {
-	if (typeof error !== "object" || error === null) return;
-	const digest = "digest" in error ? error.digest : void 0;
-	if (typeof digest === "string" && NEXT_DIGESTS.has(digest.split(";", 1)[0] ?? "") || "$$typeof" in error && error.$$typeof === REACT_POSTPONE || error instanceof Error && error.message.includes("needs to bail out of prerendering")) throw error;
-	if ("cause" in error) rethrowNextControlFlow(error.cause);
-}
 //#endregion
-export { REQUEST_ID_HEADER, STATS_URL_HEADER, createNext, nextCache, requireAal, sessionStale, sessionTag, shouldCheckSession, shouldRefresh, supportOf, supportSessions, supportTag, tagFor, tenantOf, toSession };
+export { REQUEST_ID_HEADER, STATS_URL_HEADER, createNext, defineAction, nextCache, requireAal, sessionStale, sessionTag, shouldCheckSession, shouldRefresh, supportOf, supportSessions, supportTag, tagFor, tenantOf, toSession };

package/dist/node/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../refusal-DhSU2Vvr.js";
+import { n as RouteGuardOptions } from "../refusal-oD3ISM9h.js";
 import { i as toWebHeaders, r as applyWebHeaders, t as NodeHeaderTarget } from "../node-headers-AO06VhqH.js";
-import { _ as toNodeHandler, a as FastifyReplyLike, b as toWebRequest, c as KoaMiddleware, d as guard, f as koaGuard, g as toKoa, h as toFastify, i as FastifyHook, l as ToNodeOptions, m as toExpress, n as ExpressMiddleware, o as FastifyRequestLike, p as problemErrorHandler, r as ExpressResponse, s as KoaContextLike, t as ExpressErrorHandler, u as fastifyGuard, v as WebRequestOptions, y as sendWebResponse } from "../index-CdZKQF98.js";
+import { _ as toNodeHandler, a as FastifyReplyLike, b as toWebRequest, c as KoaMiddleware, d as guard, f as koaGuard, g as toKoa, h as toFastify, i as FastifyHook, l as ToNodeOptions, m as toExpress, n as ExpressMiddleware, o as FastifyRequestLike, p as problemErrorHandler, r as ExpressResponse, s as KoaContextLike, t as ExpressErrorHandler, u as fastifyGuard, v as WebRequestOptions, y as sendWebResponse } from "../index-Brhm22eL.js";
 export { ExpressErrorHandler, ExpressMiddleware, ExpressResponse, FastifyHook, FastifyReplyLike, FastifyRequestLike, KoaContextLike, KoaMiddleware, type NodeHeaderTarget, type RouteGuardOptions, ToNodeOptions, type WebRequestOptions, applyWebHeaders, fastifyGuard, guard, koaGuard, problemErrorHandler, sendWebResponse, toExpress, toFastify, toKoa, toNodeHandler, toWebHeaders, toWebRequest };

package/dist/node/index.js

@@ -1,6 +1,6 @@
-import { i as toResponse, t as around } from "../shared-CBxosKK3.js";
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-CeJWxmkH.js";
-import { t as beforeRoute } from "../before-route-CnR0C0Jr.js";
+import { a as toResponse, t as around } from "../shared-BmMcMoW9.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-br4Ma9Cf.js";
+import { t as beforeRoute } from "../before-route-B98js9m_.js";
 import { i as toWebHeaders, t as applyWebHeaders } from "../node-headers-C71zNQHe.js";
 import { n as toWebRequest, t as sendWebResponse } from "../http-Cv4T29xh.js";
 //#region src/node/index.ts

package/dist/nuxt/index.d.ts

@@ -26,8 +26,8 @@ export interface NuxtLike {
   readonly options: {
     readonly betterSupabase?: NuxtModuleOptions | undefined;
     nitro: {
-      virtual?: Record<string, string | (() => string)>;
-      handlers?: NitroHandlerLike[];
+      virtual?: Record<string, unknown>;
+      handlers?: unknown[];
     };
   };
   hook(name: "imports:extend", fn: (imports: NuxtImportLike[]) => void): void;

package/dist/nuxt/index.js

@@ -33,10 +33,11 @@ function setup(inline, nuxt) {
 			...nitro.virtual,
 			[MIDDLEWARE_ID]: middlewareSource(options.server)
 		};
-		nitro.handlers = [...nitro.handlers ?? [], {
+		const middleware = {
 			handler: MIDDLEWARE_ID,
 			middleware: true
-		}];
+		};
+		nitro.handlers = [...nitro.handlers ?? [], middleware];
 	}
 	if (options.composables ?? true) nuxt.hook("imports:extend", (imports) => {
 		for (const name of VUE_COMPOSABLES) imports.push({

package/dist/onboarding-BZvLLPaY.js

@@ -0,0 +1,68 @@
+import { C as optionalText, I as textOf, S as optionalInstant, k as recordsOf, n as applyTemporal, o as blockCall } from "./block-helpers-CfG_MvDR.js";
+import { r as withBlockHooks } from "./block-hooks-BsXncUlZ.js";
+//#region src/blocks/onboarding/onboarding.ts
+const ID = /^[a-z][a-z0-9_.-]{0,63}$/;
+/**
+* Declares an onboarding checklist. Pass the result to
+* `blocks.onboarding.options.checklists` so the database knows its
+* steps, and to the methods of `createOnboarding` to read and complete them.
+*/
+function defineChecklist(spec) {
+	if (!ID.test(spec.id)) throw new TypeError(`defineChecklist: "${spec.id}" is not a checklist id`);
+	const seen = /* @__PURE__ */ new Set();
+	for (const step of spec.steps) {
+		if (!ID.test(step.id) || seen.has(step.id)) throw new TypeError(`defineChecklist(${spec.id}): step "${step.id}" is not a unique step id`);
+		seen.add(step.id);
+	}
+	return spec;
+}
+/**
+* The onboarding block: reads and completes the steps of the checklists in
+* `blocks.onboarding.options.checklists`, for the caller or an organization.
+*/
+function createOnboarding(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const tenantOf = (subject) => ({ tenant: subject[0] ?? null });
+	return withBlockHooks({
+		progress: (checklist, ...subject) => call("onboarding_progress", {
+			checklist: checklist.id,
+			...tenantOf(subject)
+		}, (value) => progressOf(checklist.steps, value)),
+		complete: (checklist, step, ...subject) => call("complete_onboarding_step", {
+			checklist: checklist.id,
+			step,
+			...tenantOf(subject)
+		}, (value) => value === true),
+		reset: (checklist, step, ...subject) => call("reset_onboarding_step", {
+			checklist: checklist.id,
+			step,
+			...tenantOf(subject)
+		}, (value) => value === true)
+	}, options.hooks, {
+		block: "onboarding",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+function progressOf(steps, value) {
+	const rows = new Map(recordsOf(value, "onboarding_progress").map((row) => [textOf(row["step"]), row]));
+	const list = steps.map((step) => {
+		const row = rows.get(step.id);
+		return {
+			...step,
+			completed: row !== void 0,
+			completedAt: optionalInstant(row?.["completedAt"]),
+			completedBy: optionalText(row?.["completedBy"])
+		};
+	});
+	const completed = list.filter((step) => step.completed).length;
+	return {
+		steps: list,
+		completed,
+		total: list.length,
+		done: completed === list.length,
+		next: list.find((step) => !step.completed)
+	};
+}
+//#endregion
+export { defineChecklist as n, createOnboarding as t };

package/dist/openapi/index.d.ts

@@ -1,2 +1,4 @@
-import { a as ResourceOptions, i as ResourceOperation, n as OpenApiOptions, o as createOpenApi, r as PROBLEM_SCHEMA, t as OpenApiDocument } from "../index-Bxih3l0u.js";
-export { OpenApiDocument, OpenApiOptions, PROBLEM_SCHEMA, ResourceOperation, ResourceOptions, createOpenApi };
+import { D as ResourceOperation } from "../model-lUafmeBQ.js";
+import { V as PROBLEM_SCHEMA, _ as OpenApiDocuments, b as OpenApiVersion, d as OpenApi30Document, f as OpenApi31Document, g as OpenApiDocument, h as OpenApiComponents, l as AnyOpenApiDocument, m as OpenApi33PreviewDocument, p as OpenApi32Document, u as OPENAPI_33_PREVIEW_VERSION, v as OpenApiInfo, x as RenderedOpenApi, y as OpenApiSecurityRequirement } from "../api-TG3jE5aO.js";
+import { a as openapiFormat, i as toOpenApi30Schema, n as ResourceOptions, r as createOpenApi, t as OpenApiOptions } from "../index-Ej8XQ9w9.js";
+export { type AnyOpenApiDocument, OPENAPI_33_PREVIEW_VERSION, type OpenApi30Document, type OpenApi31Document, type OpenApi32Document, type OpenApi33PreviewDocument, type OpenApiComponents, type OpenApiDocument, type OpenApiDocuments, type OpenApiInfo, OpenApiOptions, type OpenApiSecurityRequirement, type OpenApiVersion, PROBLEM_SCHEMA, type RenderedOpenApi, type ResourceOperation, ResourceOptions, createOpenApi, openapiFormat, toOpenApi30Schema };