better-supabase 0.8.0 → 0.10.0

package/dist/cli/version-B4k0aUxS.js

@@ -1,4 +0,0 @@
-//#region src/cli/version.ts
-const VERSION = "0.8.0";
-//#endregion
-export { VERSION as t };

package/dist/client-wxeTQFtB.js

@@ -1,310 +0,0 @@
-import { n as dbError } from "./errors-2M6CKMP4.js";
-import { n as decodeJwtPayload } from "./base64-D2gsioCY.js";
-import { a as tenantClaimPaths, i as claimsOf, n as claimAt } from "./claims-PqzCxaTD.js";
-import { r as invalidateTables } from "./user-change-XzvgafU4.js";
-import { n as liveQuery, t as liveCount } from "./live-CTAZQkwl.js";
-//#region src/bindings/keys.ts
-/**
-* The session's user id. With `tokens-only` cookies and no stored user,
-* auth-js puts a placeholder in `session.user` whose getters throw, so the
-* id falls back to the token's `sub`.
-*/
-function sessionUserId(session) {
-	try {
-		if (typeof session.user.id === "string") return session.user.id;
-	} catch {}
-	const sub = decodeJwtPayload(session.access_token)?.["sub"];
-	return typeof sub === "string" ? sub : null;
-}
-/** The tenant claim `config.claims.tenant` names, for a signed-in caller. */
-function claimedTenant(auth, meta) {
-	if (auth.status !== "signed-in") return void 0;
-	for (const path of tenantClaimPaths(claimsOf(meta).tenant)) {
-		const value = claimAt(auth.claims, path);
-		if (value !== void 0) return value;
-	}
-}
-const specKeys = /* @__PURE__ */ new WeakMap();
-/** Specs are immutable, so a memoized or module-level spec is serialized once. */
-function specKey(spec) {
-	let key = specKeys.get(spec);
-	if (key === void 0) {
-		key = JSON.stringify(spec, (_key, value) => typeof value === "bigint" ? { $bigint: value.toString() } : value);
-		specKeys.set(spec, key);
-	}
-	return key;
-}
-//#endregion
-//#region src/bindings/client.ts
-/** The caller of the client's auth store. */
-function callerOf(auth) {
-	return {
-		status: auth.status,
-		userId: auth.user?.id ?? null
-	};
-}
-/**
-* The caller of a plain supabase-js client, for subscriptions made without
-* the provider. `loading` until auth-js reports the first state.
-*/
-function plainCaller(supabase) {
-	let caller = {
-		status: "loading",
-		userId: null
-	};
-	return {
-		current: () => caller,
-		subscribe: (listener) => {
-			const { data } = supabase.auth.onAuthStateChange((_event, session) => {
-				caller = {
-					status: session ? "signed-in" : "signed-out",
-					userId: session ? sessionUserId(session) : null
-				};
-				listener();
-			});
-			return () => {
-				data.subscription.unsubscribe();
-			};
-		}
-	};
-}
-/** Throws when `invalidate` has no query client to refetch with. */
-function assertInvalidateClient(hook, options, queryClient) {
-	if (options?.invalidate && !queryClient) throw new Error(`better-supabase: ${hook}({ invalidate }) needs a queryClient on the provider or in the options`);
-}
-/**
-* Subscribes to a topic by its rendered name. Returns the function that
-* leaves, or `undefined` when the name does not match the topic.
-*/
-function startBroadcast(run) {
-	const matched = run.topic.match(run.name);
-	if (!matched) return void 0;
-	const { queryClient } = run;
-	const forward = (payload, message) => {
-		const current = run.latest();
-		const table = current.handlers;
-		(table?.[message.event] ?? table?.["*"])?.(payload, message);
-		const invalidate = current.options?.invalidate;
-		if (!invalidate || !queryClient) return;
-		if (typeof invalidate !== "function") {
-			invalidateTables(queryClient, invalidate);
-			return;
-		}
-		for (const queryKey of invalidate(message)) queryClient.invalidateQueries({ queryKey });
-	};
-	const self = run.latest().options?.self;
-	const subscription = run.topic.subscribe(run.supabase, matched, { "*": forward }, {
-		...self === void 0 ? {} : { self },
-		onStatus: run.onStatus,
-		onInvalid: (message, issues) => run.latest().options?.onInvalid?.(message, issues)
-	});
-	return () => {
-		subscription.unsubscribe();
-		run.onStatus("closed");
-	};
-}
-/** The key a live subscription restarts on: spec, tenant and caller. */
-function liveKey(client, spec, auth, options) {
-	if (!spec || auth.status === "loading") return null;
-	const tenant = options.tenant ?? claimedTenant(auth, client.betterSupabase.meta);
-	return JSON.stringify([
-		specKey(spec),
-		tenant ?? null,
-		auth.user?.id ?? null,
-		options.debounceMs ?? null
-	]);
-}
-/** Invalidates the cached queries that read a table whenever one changes. */
-function startLiveQuery(run) {
-	const { client, queryClient, options } = run;
-	const tenant = options.tenant ?? claimedTenant(run.auth, client.betterSupabase.meta);
-	const userId = run.auth.user?.id ?? null;
-	const live = liveQuery(client.betterSupabase, client.supabase, run.spec, {
-		onChange: (tables) => void invalidateTables(queryClient, tables),
-		onStatus: run.onStatus,
-		...tenant === void 0 ? {} : { tenant },
-		...userId === null ? {} : { user: userId },
-		...options.debounceMs === void 0 ? {} : { debounceMs: options.debounceMs }
-	});
-	if (run.resumed) live.ready.then(() => void invalidateTables(queryClient, live.tables), () => void 0);
-	return () => {
-		live.unsubscribe();
-	};
-}
-/** Splits a count source into its spec and the seed's count and time. */
-function countSource(source, options) {
-	const seed = source && "spec" in source ? source : void 0;
-	return {
-		spec: (seed ? seed.spec : source) ?? null,
-		initial: seed?.count ?? options.initial,
-		seedAt: seed?.at,
-		seeded: seed !== void 0 && seed.count !== null
-	};
-}
-const NO_COUNT = {
-	key: null,
-	count: void 0,
-	at: 0,
-	error: void 0
-};
-/** Refetches the count after each debounced change to a table it reads. */
-function startLiveCount(run) {
-	const { client, key, options } = run;
-	const tenant = options.tenant ?? claimedTenant(run.auth, client.betterSupabase.meta);
-	const userId = run.auth.user?.id ?? null;
-	const live = liveCount(client.betterSupabase, client.supabase, client.db, run.spec, {
-		immediate: run.immediate,
-		...run.since === void 0 ? {} : { since: run.since },
-		onCount: (count) => {
-			const at = Date.now();
-			run.onState(() => ({
-				key,
-				count,
-				at,
-				error: void 0
-			}));
-		},
-		onError: (error) => {
-			run.onState((last) => ({
-				key,
-				count: last.key === key ? last.count : void 0,
-				at: last.key === key ? last.at : 0,
-				error
-			}));
-		},
-		onStatus: run.onStatus,
-		...tenant === void 0 ? {} : { tenant },
-		...userId === null ? {} : { user: userId },
-		...options.debounceMs === void 0 ? {} : { debounceMs: options.debounceMs }
-	});
-	return () => {
-		live.unsubscribe();
-	};
-}
-/** The count to show: the client's, unless a newer server seed arrived. */
-function shownCount(state, key, source) {
-	const fresh = state.key === key;
-	const seedNewer = source.seedAt !== void 0 && source.seeded && source.seedAt > state.at;
-	return {
-		count: fresh && state.count !== void 0 && !seedNewer ? state.count : source.initial,
-		error: fresh ? state.error : void 0
-	};
-}
-const NO_HANDLERS = {};
-/** Joins a presence topic by its rendered name, or `undefined` when it does not match. */
-function joinPresence(supabase, topic, name, handlers) {
-	const matched = topic.match(name);
-	if (!matched) return void 0;
-	const joined = topic.subscribe(supabase, matched, NO_HANDLERS, handlers);
-	let tracked;
-	return {
-		track: async (state) => {
-			const result = await joined.track(state);
-			return result.ok ? void 0 : result.error;
-		},
-		untrack: async () => {
-			const result = await joined.untrack();
-			return result.ok ? void 0 : result.error;
-		},
-		sync(state) {
-			const key = state === void 0 ? void 0 : JSON.stringify(state);
-			if (key === void 0 || key === tracked) return;
-			tracked = key;
-			if (state === null || state === void 0) joined.untrack();
-			else joined.track(state);
-		},
-		leave() {
-			joined.unsubscribe();
-		}
-	};
-}
-/** The error `track` and `untrack` return before the join. */
-const notJoined = () => Promise.resolve(dbError("invalid_request", "better-supabase: the presence topic is not joined"));
-/**
-* Tracks the runs of an action outside React: the inputs in flight, the
-* last data and the last error. `latest` is read on each run, so the action
-* and the callbacks can change between runs.
-*/
-function createActionRunner(latest) {
-	const listeners = /* @__PURE__ */ new Set();
-	let inFlight = [];
-	let data;
-	let error;
-	let state = snapshot();
-	function snapshot() {
-		const pendingInputs = inFlight.map((item) => item.input);
-		return {
-			pending: inFlight.length > 0,
-			pendingInputs,
-			pendingInput: pendingInputs.at(-1),
-			data,
-			error
-		};
-	}
-	const emit = () => {
-		state = snapshot();
-		for (const listener of listeners) listener();
-	};
-	return {
-		current: () => state,
-		subscribe: (listener) => {
-			listeners.add(listener);
-			return () => {
-				listeners.delete(listener);
-			};
-		},
-		run: async (input) => {
-			const entry = { input };
-			inFlight = [...inFlight, entry];
-			error = void 0;
-			emit();
-			const done = () => {
-				inFlight = inFlight.filter((item) => item !== entry);
-			};
-			const { action, options } = latest();
-			let result;
-			try {
-				result = await action(input);
-			} catch (cause) {
-				done();
-				emit();
-				throw cause;
-			}
-			done();
-			if (result.ok) data = result.data;
-			else error = result.error;
-			emit();
-			if (result.ok) options.onSuccess?.(result.data, input);
-			else options.onError?.(result.error, input);
-			return result;
-		},
-		reset: () => {
-			data = void 0;
-			error = void 0;
-			emit();
-		}
-	};
-}
-/**
-* One run per key: `update` restarts `start` when the key changes and stops
-* the run when the key is `null`.
-*/
-function keyed() {
-	let current;
-	return {
-		update: (key, start) => {
-			if (current?.key === key) return;
-			current?.stop?.();
-			current = key === null ? void 0 : {
-				key,
-				stop: start()
-			};
-		},
-		stop: () => {
-			current?.stop?.();
-			current = void 0;
-		}
-	};
-}
-//#endregion
-export { createActionRunner as a, liveKey as c, shownCount as d, startBroadcast as f, specKey as g, sessionUserId as h, countSource as i, notJoined as l, startLiveQuery as m, assertInvalidateClient as n, joinPresence as o, startLiveCount as p, callerOf as r, keyed as s, NO_COUNT as t, plainCaller as u };

package/dist/cloud-event-Dune0KI7.d.ts

@@ -1,64 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { S as BlockEvent, T as BlockEventPattern, a as EventHub } from "./events-D1BOCll8.js";
-//#region src/events/cloud-event.d.ts
-/** A CloudEvents 1.0 event. Extension attributes are lowercase alphanumerics. */
-interface CloudEvent<T = unknown> {
-  readonly specversion: "1.0";
-  readonly id: string;
-  readonly source: string;
-  readonly type: string;
-  readonly subject?: string;
-  readonly time?: string;
-  readonly datacontenttype?: string;
-  readonly dataschema?: string;
-  readonly data?: T;
-  readonly [extension: string]: unknown;
-}
-interface CloudEventOptions {
-  /** URI-reference of the producer, e.g. `https://crm.example.com` or `/crm`. */
-  readonly source: string;
-  /** Replaces the `dev.better-supabase` type prefix. */
-  readonly typePrefix?: string;
-  readonly id?: () => string;
-  readonly now?: () => Temporal.Instant;
-  /**
-   * The `dataschema` attribute: the URI (or `$id`) of the JSON Schema the
-   * event's `data` conforms to, e.g. a schema emitted next to an AsyncAPI
-   * document. A function picks one per event type and leaves it out by
-   * returning `undefined`. Defaults to none.
-   */
-  readonly dataschema?: string | ((event: DataschemaContext) => string | undefined);
-}
-/** What a `dataschema` function sees of an event. */
-interface DataschemaContext {
-  /** The CloudEvents `type`, with the configured prefix. */
-  readonly type: string;
-  /** App key of the mutated table, for row events. */
-  readonly table?: string;
-}
-/** Sends events somewhere: a queue, a bus, an outbox table, an HTTP endpoint. */
-interface EventSink {
-  send(events: readonly CloudEvent[]): void | Promise<void>;
-}
-/**
- * A block event as a CloudEvent: `dev.better-supabase.support.started` with
- * the event data and the actor (`actorId`) as `data` and the tenant as
- * `partitionkey`.
- */
-declare function blockCloudEvent(event: BlockEvent, options: CloudEventOptions): CloudEvent;
-interface ForwardBlockOptions extends CloudEventOptions {
-  /** Only forward events that match, e.g. `support.*`. Defaults to all. */
-  readonly types?: readonly BlockEventPattern[];
-  /** Sink failures never fail the block call. Defaults to the `Logger`. */
-  readonly onError?: (error: unknown, events: readonly CloudEvent[]) => void;
-}
-/**
- * Sends a CloudEvent for every block event (`support.*`, `organization.*`, ...) to
- * `sink`. Returns a function that stops forwarding. Like
- * `forwardMutations`, sends are tracked on `betterSupabase.events`.
- */
-declare function forwardBlockEvents(betterSupabase: {
-  readonly events: EventHub;
-}, sink: EventSink, options: ForwardBlockOptions): () => void;
-//#endregion
-export { ForwardBlockOptions as a, EventSink as i, CloudEventOptions as n, blockCloudEvent as o, DataschemaContext as r, forwardBlockEvents as s, CloudEvent as t };

package/dist/compiler-V1qvcST1.d.ts

@@ -1,14 +0,0 @@
-import { v as Operation } from "./executor-Drzu3dBK.js";
-import { a as PostgrestPlan } from "./postgrest-BUqLag2Q.js";
-//#region src/core/compiler.d.ts
-/**
- * Turns an IR operation into something a backend runs. An `Executor` for a
- * new backend usually pairs with a `Compiler` for it.
- */
-interface Compiler<TTarget> {
-  readonly target: string;
-  compile(op: Operation): TTarget;
-}
-declare const postgrestCompiler: Compiler<PostgrestPlan>;
-//#endregion
-export { postgrestCompiler as n, Compiler as t };

package/dist/compose-BHej1acw.js

@@ -1,53 +0,0 @@
-import { n as dbError } from "./errors-2M6CKMP4.js";
-import { t as AsyncResult } from "./result-DEqHCMKP.js";
-import { n as credentialRefInTenant, t as credentialProviderOf } from "./provider-DxRTex4x.js";
-//#region src/credentials/compose.ts
-const NO_CAPABILITIES = {
-	userSubjects: false,
-	authorization: false,
-	revoke: false,
-	inbound: false
-};
-const unsupported = (provider, what) => dbError("unsupported", `The credential provider "${provider}" ${what}`, { hint: "CREDENTIAL_UNSUPPORTED" });
-/**
-* One provider over several: each call goes to the provider whose `name`
-* is the ref's `provider`. A ref no provider handles fails with
-* `invalid_input` (`CREDENTIAL_PROVIDER_UNKNOWN`), and an optional method
-* the chosen provider lacks with `unsupported`.
-*/
-function credentialRouter(providers, options = {}) {
-	const byName = /* @__PURE__ */ new Map();
-	for (const provider of providers) {
-		if (byName.has(provider.name)) throw new TypeError(`credentialRouter got two providers named "${provider.name}"`);
-		byName.set(provider.name, credentialProviderOf(provider));
-	}
-	const unknown = (ref) => dbError("invalid_input", `No credential provider named "${ref.provider}" is configured`, { hint: "CREDENTIAL_PROVIDER_UNKNOWN" });
-	const route = (ref, then) => {
-		const provider = byName.get(ref.provider);
-		return provider === void 0 ? AsyncResult.err(unknown(ref)) : then(provider);
-	};
-	return {
-		apiVersion: 1,
-		name: options.name ?? "router",
-		getToken: (ref, tokenOptions) => route(ref, (provider) => provider.getToken(ref, tokenOptions)),
-		capabilities: (ref) => byName.get(ref.provider)?.capabilities(ref) ?? NO_CAPABILITIES,
-		startAuthorization: (ref, startOptions) => route(ref, (provider) => provider.startAuthorization === void 0 ? AsyncResult.err(unsupported(provider.name, "doesn't authorize accounts")) : provider.startAuthorization(ref, startOptions)),
-		completeAuthorization: (ref, completeOptions) => route(ref, (provider) => provider.completeAuthorization === void 0 ? AsyncResult.err(unsupported(provider.name, "doesn't authorize accounts")) : provider.completeAuthorization(ref, completeOptions)),
-		revoke: (ref, revokeOptions) => route(ref, (provider) => provider.revoke(ref, revokeOptions)),
-		verifyInbound: (request, ref) => route(ref, (provider) => provider.verifyInbound === void 0 ? AsyncResult.err(unsupported(provider.name, "doesn't verify inbound requests")) : provider.verifyInbound(request, ref)),
-		set: (ref, value, setOptions) => route(ref, (provider) => provider.set === void 0 ? AsyncResult.err(unsupported(provider.name, "can't store secrets")) : provider.set(ref, value, setOptions))
-	};
-}
-/**
-* Revokes the credential a ref names when a provider is configured and can
-* revoke it. Resolves `false` without a provider, for a provider without
-* revocation, or for a ref outside `options.tenant`.
-*/
-function revokeIfConfigured(provider, ref, options) {
-	if (provider === void 0) return AsyncResult.ok(false);
-	if ("tenant" in options && !credentialRefInTenant(ref, options.tenant)) return AsyncResult.ok(false);
-	if (!provider.capabilities(ref).revoke) return AsyncResult.ok(false);
-	return provider.revoke(ref, { subject: options.subject });
-}
-//#endregion
-export { revokeIfConfigured as n, credentialRouter as t };

package/dist/composite-CWAJTRBF.d.ts

@@ -1,146 +0,0 @@
-import { a as AnyModels, i as AnyFunctions } from "./types-CoE5Zwy4.js";
-import { a as EventHub } from "./events-D1BOCll8.js";
-import { i as CookieScope, s as SessionEncoding } from "./session-ChiXDZdZ.js";
-import { r as AuthState, t as AuthResolution } from "./resolve-MxXVWyhd.js";
-import { _ as Db, t as BetterSupabase } from "./define-DmcfoNXB.js";
-import { _ as ReplicaState, i as ServerContext, n as ContextOptions, s as ServerOptions, t as BetterServer, x as ActiveSupport } from "./server-types-CrAmZ8jv.js";
-import { d as RefreshPolicy, r as GuardOptions } from "./respond-Cw-zanCm.js";
-import { SupabaseClient } from "@supabase/supabase-js";
-import { Entry, SingleKeyEntry } from "@supabase/middleware";
-import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
-//#region src/server/entries/core.d.ts
-/**
- * What the entries need from a `createServer` server: its resolver, its
- * request-scoped context builder and the settings behind them. The server
- * registers it once; entries read it with `serverCore(server)`.
- */
-interface ServerCore<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
-  readonly events: EventHub;
-  /** How long reads stay on the primary after a write. */
-  readonly pinMs: number;
-  resolve(request: Request, options: {
-    readonly refresh?: boolean;
-    readonly cookies?: boolean;
-    readonly encode?: SessionEncoding;
-    readonly checkSession?: boolean;
-  }): Promise<AuthResolution<C, P>>;
-  /** The session cookie's name (`auth.cookie.name`, else `sb-<ref>-auth-token`). */
-  sessionCookie(): string;
-  /** `ServerOptions.tenant`, or `undefined` without one. */
-  tenant(request: Request, auth: AuthState<C, P>): string | undefined | PromiseLike<string | undefined>;
-  support(request: Request, auth: AuthState<C, P>): Promise<ActiveSupport | undefined>;
-  context(resolution: AuthResolution<C, P>, request: Request, options: ContextOptions, tenant: string | undefined): ServerContext<M, F, E, C, P>;
-}
-/** The core of a server built by `createServer` or one of the adapter factories. */
-declare function serverCore<M extends AnyModels, F extends AnyFunctions, E, C, P>(server: {
-  readonly events: EventHub;
-  context(request: Request): Promise<ServerContext<M, F, E, C, P>>;
-}): ServerCore<M, F, E, C, P>;
-//#endregion
-//#region src/server/entries/guard.d.ts
-interface GuardEntryConfig extends GuardOptions {
-  /** Include error messages in problem responses. Defaults to `NODE_ENV === 'development'`. */
-  readonly expose?: boolean;
-}
-/**
- * Entry that answers callers `allow`, `aal` or `scopes` refuse with a 401 or
- * 403 Problem Details response, before the handler runs. It contributes
- * `ctx.guard`, the options the caller passed.
- */
-declare function withGuard<C, P>(config?: GuardEntryConfig): SingleKeyEntry<"guard", {
-  readonly auth: AuthState<C, P>;
-}, GuardOptions>;
-//#endregion
-//#region src/server/entries/session.d.ts
-interface SessionEntryConfig {
-  /**
-   * Refresh an expired cookie session and send the new cookies on the
-   * response. Only where cookies can be written once per request (a proxy, a
-   * framework middleware); never in Server Components. `'navigation'`
-   * refreshes page loads, navigations and form posts (`shouldRefresh`), so
-   * parallel `fetch` calls never race on the refresh token. Defaults to false.
-   */
-  readonly refresh?: RefreshPolicy;
-  /**
-   * Ask the Auth server whether the session still exists, so a session
-   * ended elsewhere (sign-out on another device, an admin revoke) is anon
-   * here too. One Auth call per matching request: `true` checks every
-   * request, `'navigation'` full page loads (`shouldCheckSession`). Off by
-   * default, because a valid token otherwise never calls the Auth server.
-   */
-  readonly checkSession?: boolean | "navigation" | ((request: Request) => boolean);
-  /** Read the session cookie. Defaults to true; `false` resolves bearer tokens only. */
-  readonly cookies?: boolean;
-  /**
-   * Keeps the invocation alive for event sink sends the handler started:
-   * `EdgeRuntime.waitUntil`, the Workers `ctx.waitUntil` or Next's `after`.
-   */
-  readonly waitUntil?: (promise: Promise<unknown>) => void;
-  /**
-   * The shape refreshed sessions are written in, `cookies.encode` in
-   * `@supabase/ssr`. Use the browser client's value. Defaults to the
-   * server's `auth.cookie.encode`, then `user-and-tokens`.
-   */
-  readonly encode?: SessionEncoding;
-  /**
-   * Cookie scopes (`domain`, `path`) earlier deploys wrote the session at.
-   * Each response to a request that carries the session cookie expires it
-   * at these scopes, like `clearAuthCookiesAtScopes` in `@supabase/ssr`, so
-   * moving the cookie to a new domain or path is one config change. Never
-   * list the current scope: that clears the live session.
-   */
-  readonly cookieScopes?: readonly CookieScope[];
-}
-/**
- * Entry contributing `ctx.session`, the request's `AuthResolution`: a bearer
- * token first, the session cookie second. It is the only entry with a
- * response seam for cookies: on the way out it adds the refreshed session
- * cookies and the no-store headers, and hands pending event sends to
- * `waitUntil`.
- */
-declare function withSession<M extends AnyModels, F extends AnyFunctions, E, C, P>(core: ServerCore<M, F, E, C, P>, config?: SessionEntryConfig): SingleKeyEntry<"session", Record<never, never>, AuthResolution<C, P>>;
-//#endregion
-//#region src/server/composite.d.ts
-/** What `withBetterSupabase` takes besides the definition or server. */
-interface BetterSupabaseConfig extends SessionEntryConfig, GuardEntryConfig {}
-/** The keys `withBetterSupabase` puts on `ctx`. */
-interface BetterSupabaseContributions<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
-  /** The full request context: `auth`, `supabase`, `stats()`, `apply()` and the rest. */
-  bs: ServerContext<M, F, E, C, P>;
-  /** The verified token's payload, or `null`; the key `withSupabase` uses. */
-  jwtClaims: (JWTClaims & C) | null;
-  userClaims: UserClaims | null;
-  authMode: AuthMode;
-  /** Repositories over PostgREST as the caller. */
-  db: Db<M, F, E, SupabaseClient>;
-  /** Repositories over direct Postgres as the caller, when Postgres is configured or upstream. */
-  sql: Db<M, F, E, undefined> | undefined;
-  tenant: string | undefined;
-  support: ActiveSupport | undefined;
-  replica: ReplicaState | undefined;
-}
-/** The entry `withBetterSupabase` returns, for `pipeline` and the framework bridges. */
-type BetterSupabaseEntry<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> = Entry<BetterSupabaseContributions<M, F, E, C, P>>;
-/**
- * The whole better-supabase server as one `@supabase/middleware` entry: it
- * verifies the caller (bearer token or session cookie), refuses callers the
- * guard rejects with Problem Details, and contributes `ctx.db`, `ctx.sql`,
- * `ctx.bs` and the `withSupabase` keys (`jwtClaims`, `userClaims`,
- * `authMode`), so `withPostgresClient` and `withOpenFeature` compose after
- * it. Refreshed cookies and `bs-primary-until` go out on the response.
- *
- * ```ts
- * export default {
- *   fetch: pipeline([withBetterSupabase(betterSupabase)], async (req, ctx) =>
- *     Response.json(await ctx.db.notes.findMany().orThrow())),
- * }
- * ```
- *
- * Pass a server from `createServer` to share its clients and JWKS cache
- * with the rest of the app; pass the definition to build one with
- * `config`'s server options.
- */
-declare function withBetterSupabase<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, config?: BetterSupabaseConfig & ServerOptions): BetterSupabaseEntry<M, F, E, C, P>;
-declare function withBetterSupabase<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown>(server: BetterServer<M, F, E, C, P>, config?: BetterSupabaseConfig): BetterSupabaseEntry<M, F, E, C, P>;
-//#endregion
-export { SessionEntryConfig as a, withGuard as c, withBetterSupabase as i, ServerCore as l, BetterSupabaseContributions as n, withSession as o, BetterSupabaseEntry as r, GuardEntryConfig as s, BetterSupabaseConfig as t, serverCore as u };