better-supabase 0.7.1 → 0.9.0

package/dist/shared-CBxosKK3.js

@@ -1,75 +0,0 @@
-import { pipeline, seedContext } from "@supabase/middleware";
-//#region src/bridges/shared.ts
-/** The string keys of a pipeline context: every contribution, without the seed's symbols. */
-function contributionsOf(ctx) {
-	const contributions = {};
-	for (const [key, value] of Object.entries(ctx)) contributions[key] = value;
-	return contributions;
-}
-/** The per-request value a bridge seeds under `key`. */
-function handoffOf(ctx, key) {
-	return ctx[key];
-}
-/**
-* Makes the body of `request` readable more than once, in place: the first
-* reader drains the stream into a cache and later readers are served from
-* it, so an entry and the route both see the body. For frameworks that hand
-* the route the same `Request` the middleware saw (TanStack Start,
-* SvelteKit, React Router), where `bufferRequest`'s wrapped copy can't go.
-*/
-function bufferInPlace(request) {
-	if (!request.body || request.bodyUsed) return;
-	const readOnce = request.arrayBuffer.bind(request);
-	let buffer;
-	const arrayBuffer = () => buffer ??= readOnce();
-	const text = async () => new TextDecoder().decode(await arrayBuffer());
-	const readers = {
-		arrayBuffer,
-		text,
-		json: async () => JSON.parse(await text()),
-		bytes: async () => new Uint8Array(await arrayBuffer()),
-		blob: async () => new Blob([await arrayBuffer()]),
-		formData: async () => new Response(await arrayBuffer(), { headers: request.headers }).formData(),
-		clone: () => request
-	};
-	for (const [name, value] of Object.entries(readers)) Object.defineProperty(request, name, {
-		value,
-		configurable: true
-	});
-}
-const DOWNSTREAM = Symbol("bridge.downstream");
-/**
-* The shared shape of the upstream bridges: the pipeline folds once, each
-* request seeds the framework's `next` under a symbol, and the terminal
-* hands it the contributions, so response-phase entries see the
-* framework's response. `platform` is the host's env object, if any, which
-* `getEnv` reads first.
-*/
-function around(entries) {
-	const run = pipeline(entries, (_request, ctx) => handoffOf(ctx, DOWNSTREAM)(contributionsOf(ctx)));
-	return (request, platform, downstream) => run(request, {
-		...seedContext(platform),
-		[DOWNSTREAM]: downstream
-	});
-}
-/**
-* A framework handler's value as a `Response`: responses as is, `undefined`
-* as 204, other values as JSON. `init` carries the status and headers the
-* handler set on the framework's response object.
-*/
-function toResponse(value, init = {}) {
-	if (value instanceof Response) return value;
-	const options = {
-		...init.status === void 0 ? {} : { status: init.status },
-		...init.statusText === void 0 ? {} : { statusText: init.statusText },
-		...init.headers === void 0 ? {} : { headers: init.headers }
-	};
-	if (value === void 0 || value === null) return new Response(null, {
-		status: 204,
-		...options
-	});
-	if (typeof value === "string") return new Response(value, options);
-	return Response.json(value, options);
-}
-//#endregion
-export { toResponse as i, bufferInPlace as n, handoffOf as r, around as t };

package/dist/shared-CxWmcyqB.js

@@ -1,73 +0,0 @@
-import { t as DbException } from "./db-exception-CnWcYPxL.js";
-import { n as dbError } from "./errors-B11Duf73.js";
-import { t as lookupOf } from "./lookup-BaP5bI27.js";
-//#region src/plugins/shared.ts
-/** Database column name for an app column, or `undefined` if it is unknown. */
-function dbName(table, app) {
-	return app === void 0 ? void 0 : table.columns[app]?.db;
-}
-function isNull(column) {
-	return {
-		kind: "column",
-		column,
-		op: "is",
-		value: null
-	};
-}
-function isNotNull(column) {
-	return {
-		kind: "not",
-		item: isNull(column)
-	};
-}
-function equals(column, value) {
-	return {
-		kind: "column",
-		column,
-		op: "eq",
-		value
-	};
-}
-/** Sets `column` on a row unless the caller already provided it. */
-function withDefault(row, column, value) {
-	if (column === void 0 || column in row) return row;
-	return {
-		...row,
-		[column]: value
-	};
-}
-/**
-* Refuses caller-supplied values for columns a plugin fills (timestamps,
-* actor, soft delete) unless the call passes `{ override: true }`. Returns
-* whether the caller may keep its own values.
-*/
-function guardManaged(op, columns, plugin, options) {
-	if (options["override"] === true) return true;
-	const rows = op.kind === "insert" ? op.rows : op.kind === "update" ? [op.set] : [];
-	for (const column of columns) {
-		if (column === void 0) continue;
-		if (rows.some((row) => column in row)) throw new DbException(dbError("invalid_request", `"${column}" on ${op.table.key} is filled by ${plugin}(); pass { override: true } to set it yourself`, { table: op.table.key }));
-	}
-	return false;
-}
-/** Upserts that may update existing rows must not overwrite "created" columns. */
-function insertsOnly(op) {
-	return !op.onConflict || op.onConflict.action === "ignore";
-}
-function forbidden(message) {
-	throw new DbException(dbError("forbidden", message));
-}
-/** Database-keyed row to app-keyed row. */
-function toApp(table, row) {
-	const out = {};
-	for (const [app, meta] of lookupOf(table).entries) if (meta.db in row) out[app] = row[meta.db];
-	return out;
-}
-/** App-keyed row to database-keyed row. Unknown keys are dropped. */
-function toDb(table, row) {
-	const out = {};
-	for (const [app, meta] of lookupOf(table).entries) if (app in row) out[meta.db] = row[app];
-	return out;
-}
-//#endregion
-export { insertsOnly as a, toApp as c, guardManaged as i, toDb as l, equals as n, isNotNull as o, forbidden as r, isNull as s, dbName as t, withDefault as u };

package/dist/sign-in-Cb1mwv6X.js

@@ -1,86 +0,0 @@
-import { n as ClientContext } from "./hooks-1BTCJsiw.js";
-import { useContext, useMemo, useRef, useState } from "react";
-//#region src/react/sign-in.ts
-function useAuthApi(options, hook) {
-	const context = useContext(ClientContext);
-	const auth = options.client?.auth ?? context?.client.supabase.auth;
-	if (!auth) throw new Error(`better-supabase: ${hook} needs <BetterSupabaseProvider client={bs}> or { client: supabase }`);
-	return auth;
-}
-/** Runs auth calls with `pending` and `error` state; the latest call owns the state. */
-function usePending(options) {
-	const [state, setState] = useState({
-		pending: false,
-		error: void 0
-	});
-	const latest = useRef({
-		call: 0,
-		options
-	});
-	latest.current.options = options;
-	return {
-		state,
-		run: useMemo(() => async (call) => {
-			latest.current.call += 1;
-			const id = latest.current.call;
-			setState({
-				pending: true,
-				error: void 0
-			});
-			let error;
-			try {
-				({error} = await call());
-			} catch (cause) {
-				if (id === latest.current.call) setState({
-					pending: false,
-					error: void 0
-				});
-				throw cause;
-			}
-			if (id === latest.current.call) setState({
-				pending: false,
-				error: error ?? void 0
-			});
-			if (!error) latest.current.options.onSuccess?.();
-			return error ?? void 0;
-		}, [])
-	};
-}
-/**
-* Sign-in calls with `pending` and `error` state. The session lands in the
-* client's auth store, so `useAuth()` updates on its own.
-*
-* ```tsx
-* const signIn = useSignIn({ onSuccess: () => router.push('/') });
-* <button disabled={signIn.pending} onClick={() => signIn.password({ email, password })} />
-* ```
-*/
-function useSignIn(options = {}) {
-	const auth = useAuthApi(options, "useSignIn");
-	const { state, run } = usePending(options);
-	const calls = useMemo(() => ({
-		password: (credentials) => run(() => auth.signInWithPassword({ ...credentials })),
-		otp: (credentials) => run(() => auth.signInWithOtp(credentials)),
-		verifyOtp: (params) => run(() => auth.verifyOtp(params)),
-		oauth: (provider, oauthOptions) => run(() => auth.signInWithOAuth(oauthOptions ? {
-			provider,
-			options: oauthOptions
-		} : { provider }))
-	}), [auth, run]);
-	return {
-		...state,
-		...calls
-	};
-}
-/** `auth.signOut()` with `pending` and `error` state. The provider clears cached queries. */
-function useSignOut(options = {}) {
-	const auth = useAuthApi(options, "useSignOut");
-	const { state, run } = usePending(options);
-	const signOut = useMemo(() => (signOutOptions) => run(() => auth.signOut(signOutOptions ? { ...signOutOptions } : void 0)), [auth, run]);
-	return {
-		...state,
-		signOut
-	};
-}
-//#endregion
-export { useSignIn as n, useSignOut as r, usePending as t };

package/dist/signers-4y62_VIi.d.ts

@@ -1,166 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-//#region src/blocks/webhooks/url-policy.d.ts
-/**
- * Decides whether a webhook may be sent to `url`. Throwing means the check
- * itself failed (a DNS lookup error): deliveries retry it, and `safeFetch`
- * throws `UrlCheckError`.
- */
-type AllowUrl = (url: URL) => boolean | Promise<boolean>;
-/** The addresses a host name resolves to. */
-type ResolveHost = (hostname: string) => Promise<readonly string[]>;
-interface PublicUrlOptions {
-  /**
-   * Resolves host names so each address can be checked. Defaults to
-   * `node:dns` where the runtime has it (Node, Bun, Deno); pass one on other
-   * runtimes, or `false` to check only the URL.
-   */
-  readonly resolve?: ResolveHost | false;
-  /** Allow `http:` URLs, e.g. for local development. */
-  readonly allowHttp?: boolean;
-  /** Host names that skip every check, e.g. an internal receiver you trust. */
-  readonly allowHosts?: readonly string[];
-}
-/**
- * Whether an IP address is reachable on the public internet: not loopback,
- * private, link-local (cloud metadata), carrier-grade NAT, multicast or
- * reserved. Returns `false` for anything that isn't an IP address.
- */
-declare function isPublicAddress(address: string): boolean;
-/**
- * The default `allowUrl`: HTTPS only, no credentials in the URL, no local
- * host names, and every address the host resolves to must be public. The
- * delivery transport calls it again for each redirect.
- *
- * DNS can change between this check and the connection. Route webhooks
- * through an egress proxy when that matters.
- */
-declare function publicUrl(options?: PublicUrlOptions): AllowUrl;
-//#endregion
-//#region src/blocks/webhooks/http.d.ts
-interface WebhookRequest {
-  readonly url: string;
-  readonly headers: Readonly<Record<string, string>>;
-  readonly body: string;
-  readonly signal?: AbortSignal;
-}
-interface WebhookResponse {
-  readonly status: number;
-  readonly body: string;
-  /** Seconds from the `Retry-After` header, when the receiver sent one. */
-  readonly retryAfter?: number;
-}
-/**
- * Sends one signed webhook request. Throw `WebhookPolicyError` when the
- * request must never be retried (a blocked URL); any other error retries.
- */
-interface WebhookTransport {
-  readonly apiVersion: 1;
-  readonly name: string;
-  send(request: WebhookRequest): Promise<WebhookResponse>;
-}
-/** A delivery that must not be retried, e.g. a URL `allowUrl` rejected. */
-declare class WebhookPolicyError extends Error {
-  override readonly name = "WebhookPolicyError";
-}
-interface FetchTransportOptions {
-  readonly fetch?: typeof fetch;
-  /** Checked before the first request and before each redirect. */
-  readonly allowUrl?: AllowUrl;
-  /**
-   * Defaults to 0: a redirect fails the delivery without a retry. Each hop
-   * you allow is checked with `allowUrl` first.
-   */
-  readonly maxRedirects?: number;
-  /** Per request. Defaults to 10 seconds. */
-  readonly timeoutMs?: number;
-  /** The response body bytes kept; the rest is not read. Defaults to 64 KiB. */
-  readonly maxResponseBytes?: number;
-}
-/** Sends webhooks with `fetch`, following redirects only to allowed URLs. */
-declare function fetchTransport(options?: FetchTransportOptions): WebhookTransport;
-//#endregion
-//#region src/blocks/webhooks/secrets.d.ts
-interface RotateSecretOptions {
-  /** How long older secrets keep signing, e.g. `'24 hours'` (the default). */
-  readonly overlap?: string;
-  /** Use this secret instead of a generated one, e.g. when migrating. */
-  readonly secret?: string;
-}
-/**
- * Where endpoint signing secrets live. `sqlSecretStore` (Vault or a
- * column, set in `sql.modules.webhooks-out.options.secretStorage`) is the default;
- * implement it for a KMS or a secrets manager.
- */
-interface WebhookSecretStore {
-  readonly apiVersion: 1;
-  /** The live secrets of an endpoint, newest first. */
-  secrets(endpointId: string): Promise<readonly string[]>;
-  /** Creates a new secret and returns it once. */
-  rotate?(endpointId: string, options?: RotateSecretOptions): Promise<string>;
-}
-/** The module's `webhook_secrets` and `rotate_webhook_secret` functions. */
-declare function sqlSecretStore(transport: BlockTransport, options?: {
-  readonly schema?: string;
-}): WebhookSecretStore;
-//#endregion
-//#region src/blocks/webhooks/signers.d.ts
-interface WebhookSignInput {
-  /** The delivery id, the same on every retry so receivers can deduplicate. */
-  readonly id: string;
-  readonly body: string;
-  readonly timestamp: Temporal.Instant;
-  /** The endpoint's live secrets, newest first. Sign with each while rotating. */
-  readonly secrets: readonly string[];
-}
-/**
- * Adds the signature headers to an outgoing webhook. `standardWebhooks()`
- * is the default; `hmacSigner()` covers custom header and payload formats.
- */
-interface WebhookSigner {
-  readonly apiVersion: 1;
-  readonly name: string;
-  sign(input: WebhookSignInput): Readonly<Record<string, string>> | Promise<Readonly<Record<string, string>>>;
-}
-interface StandardWebhooksOptions {
-  /** Header names, for receivers that expect a prefix such as `svix-`. */
-  readonly headers?: {
-    readonly id?: string;
-    readonly timestamp?: string;
-    readonly signature?: string;
-  };
-}
-/**
- * Signs with the [Standard Webhooks](https://www.standardwebhooks.com/)
- * scheme: `webhook-id`, `webhook-timestamp` and one `v1,` signature per
- * secret in `webhook-signature`. `verifyWebhook` checks it.
- */
-declare function standardWebhooks(options?: StandardWebhooksOptions): WebhookSigner;
-interface HmacSignerOptions {
-  readonly name?: string;
-  /** e.g. `x-acme-signature`. */
-  readonly signatureHeader: string;
-  /** Sends the epoch-seconds timestamp in this header. */
-  readonly timestampHeader?: string;
-  /** Sends the delivery id in this header. */
-  readonly idHeader?: string;
-  /** The signed text. Defaults to `${timestamp}.${body}`. */
-  readonly content?: (input: {
-    readonly id: string;
-    readonly timestamp: string;
-    readonly body: string;
-  }) => string;
-  /** Defaults to `hex`. */
-  readonly encoding?: "hex" | "base64";
-  /** Written before each signature. Defaults to `v1=`. */
-  readonly prefix?: string;
-  /** Joins the signatures of several secrets. Defaults to `,`. */
-  readonly separator?: string;
-}
-/**
- * HMAC-SHA256 with the secret's UTF-8 bytes as the key, for receivers that
- * verify an existing format, e.g. `v1=<hex>` over `timestamp.body`.
- */
-declare function hmacSigner(options: HmacSignerOptions): WebhookSigner;
-//#endregion
-export { PublicUrlOptions as _, hmacSigner as a, publicUrl as b, WebhookSecretStore as c, WebhookPolicyError as d, WebhookRequest as f, AllowUrl as g, fetchTransport as h, WebhookSigner as i, sqlSecretStore as l, WebhookTransport as m, StandardWebhooksOptions as n, standardWebhooks as o, WebhookResponse as p, WebhookSignInput as r, RotateSecretOptions as s, HmacSignerOptions as t, FetchTransportOptions as u, ResolveHost as v, isPublicAddress as y };

package/dist/spec-pins--j6mTok4.js

@@ -1,27 +0,0 @@
-//#region src/core/spec-pins.ts
-/**
-* Versions of evolving specs and conventions the code follows. Moving a pin
-* is a minor release with a changeset (see the standards docs page).
-*/
-const SPEC_PINS = {
-	otelSemconv: "1.37.0",
-	mcp: "2026-07-28",
-	openapi: "3.1.1",
-	cloudevents: "1.0.2",
-	standardWebhooks: "1.0.0",
-	sarif: "2.1.0",
-	jsonSchema: "2020-12",
-	postgrestAggregates: "12",
-	serverTiming: "WD-20260407",
-	stripeSyncEngine: "0.48.5",
-	pgvector: "0.8",
-	ocsf: "1.9.0",
-	openfeature: "0.9.0",
-	scim: "2.0",
-	supabaseSdkCapabilities: "1.14.0",
-	aiMessage: "1",
-	aiSdkUiMessageStream: "v1",
-	anthropicMemoryTool: "20250818"
-};
-//#endregion
-export { SPEC_PINS as t };

package/dist/spec-pins-C89s6DyW.d.ts

@@ -1,27 +0,0 @@
-//#region src/core/spec-pins.d.ts
-/**
- * Versions of evolving specs and conventions the code follows. Moving a pin
- * is a minor release with a changeset (see the standards docs page).
- */
-declare const SPEC_PINS: {
-  readonly otelSemconv: "1.37.0";
-  readonly mcp: "2026-07-28";
-  readonly openapi: "3.1.1";
-  readonly cloudevents: "1.0.2";
-  readonly standardWebhooks: "1.0.0";
-  readonly sarif: "2.1.0";
-  readonly jsonSchema: "2020-12";
-  readonly postgrestAggregates: "12";
-  readonly serverTiming: "WD-20260407";
-  readonly stripeSyncEngine: "0.48.5";
-  readonly pgvector: "0.8";
-  readonly ocsf: "1.9.0";
-  readonly openfeature: "0.9.0";
-  readonly scim: "2.0";
-  readonly supabaseSdkCapabilities: "1.14.0";
-  readonly aiMessage: "1";
-  readonly aiSdkUiMessageStream: "v1";
-  readonly anthropicMemoryTool: "20250818";
-};
-//#endregion
-export { SPEC_PINS as t };

package/dist/standard-BK0cqJ7y.js

@@ -1,25 +0,0 @@
-import { n as dbError } from "./errors-B11Duf73.js";
-import { a as ok, r as err } from "./result-DzUbqgdW.js";
-//#region src/core/standard.ts
-/** Validates with any Standard Schema (zod, valibot, arktype, ...). */
-async function validate(schema, value, label = "value") {
-	let outcome = schema["~standard"].validate(value);
-	if (outcome instanceof Promise) outcome = await outcome;
-	if (outcome.issues) return err(dbError("validation", `Invalid ${label}`, { issues: toIssues(outcome.issues) }));
-	return ok(outcome.value);
-}
-/** Standard Schema issues as JSON-safe `ValidationIssue`s. */
-function toIssues(issues) {
-	return issues.map((issue) => {
-		const path = issue.path?.map((segment) => {
-			const key = typeof segment === "object" ? segment.key : segment;
-			return typeof key === "symbol" ? String(key) : key;
-		});
-		return path && path.length > 0 ? {
-			message: issue.message,
-			path
-		} : { message: issue.message };
-	});
-}
-//#endregion
-export { validate as n, toIssues as t };

package/dist/standard-CYsm7xpT.d.ts

@@ -1,7 +0,0 @@
-import { f as Result } from "./result-D7y2fT87.js";
-import { StandardSchemaV1 as StandardSchemaV1$1 } from "@standard-schema/spec";
-//#region src/core/standard.d.ts
-/** Validates with any Standard Schema (zod, valibot, arktype, ...). */
-declare function validate<S extends StandardSchemaV1$1>(schema: S, value: unknown, label?: string): Promise<Result<StandardSchemaV1$1.InferOutput<S>>>;
-//#endregion
-export { validate as n, StandardSchemaV1$1 as t };