better-supabase 0.8.0 → 0.9.0

package/dist/signers-CXt_wA9S.d.ts

@@ -0,0 +1,385 @@
+/// <reference lib="esnext.temporal" />
+import { f as Result, t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { n as SqlClient } from "./executor-BBHgjUJu.js";
+import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
+import { r as BlockTemporalOptions } from "./block-helpers-C86hPEjI.js";
+import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
+import { t as BlockProblemOptions } from "./problem-CEjyhV5T.js";
+//#region src/blocks/webhooks/incoming-types.d.ts
+/** How a delivery proves it came from the sender. */
+type IncomingVerify = "none" | "standard-webhooks" | "hmac-sha256" | "shared-secret";
+interface IncomingWebhooksOptions extends BlockProblemOptions, BlockTemporalOptions {
+  /**
+   * A service SQL connection (`postgres.admin`): `receive` looks endpoints
+   * up by token, counts the rate limit and stores deliveries with it.
+   */
+  readonly sql: SqlClient;
+  /**
+   * The caller's transport for `create`, `list`, `update` and the other
+   * management calls, so `webhooks.manage` is checked for them. Defaults
+   * to `sqlTransport(sql)`.
+   */
+  readonly transport?: BlockTransport;
+  readonly mappers?: readonly ErrorMapper[];
+  /** `withBlockHooks` hooks around the management methods. */
+  readonly hooks?: BlockHooks<IncomingWebhooks>;
+  /** Receives the errors `after` hooks throw. */
+  readonly logger?: Logger;
+  /** The schema of the `webhooks-in` module. Defaults to `better_supabase`. */
+  readonly schema?: string;
+  /** The webhook inbox source deliveries are stored under. Defaults to `webhook-in`. */
+  readonly source?: string;
+  /**
+   * Deliveries per endpoint and period, counted with the `rate-limit`
+   * module's `hit_rate_limit`. Unset: no limit.
+   */
+  readonly rateLimit?: {
+    readonly max: number;
+    /** Seconds, or a Postgres interval such as `1 minute`. */
+    readonly period: number | string;
+  };
+  /** Request headers stored with each delivery. Defaults to none. */
+  readonly keepHeaders?: readonly string[];
+  /**
+   * Where verified deliveries go. Defaults to `inboxDestination(sql, {
+   * source })`, the webhook inbox; `jobsDestination(jobs, { queue })` sends
+   * them to a jobs queue. A destination can route on the endpoint's
+   * metadata.
+   */
+  readonly destination?: IncomingDestination;
+}
+/** A verified delivery, handed to the destination. */
+interface IncomingDelivery {
+  readonly endpoint: {
+    readonly id: string;
+    readonly tenant: string;
+    readonly metadata: Readonly<Record<string, unknown>>;
+  };
+  /** `options.source`. */
+  readonly source: string;
+  /**
+   * Unique per endpoint and delivery: the signed `webhook-id`, the HMAC, the
+   * `webhook-id` header or a random id. A repeated delivery repeats it.
+   */
+  readonly messageId: string;
+  /** The payload's `type` when it is a string. */
+  readonly type: string | null;
+  /** The parsed JSON body, or `{ body }` when it isn't JSON. */
+  readonly payload: unknown;
+  /** `options.keepHeaders` and the endpoint id header, lowercased. */
+  readonly headers: Readonly<Record<string, string>>;
+}
+interface IncomingDestinationResult {
+  readonly id: string | number;
+  /** True when the destination had the delivery already; `receive` answers 200. */
+  readonly duplicate: boolean;
+}
+/**
+ * Stores or forwards verified deliveries. It must detect a repeated
+ * `endpoint.id` and `messageId` and report it as a duplicate. Versioned:
+ * `apiVersion: 1`.
+ */
+interface IncomingDestination {
+  readonly apiVersion: 1;
+  readonly name: string;
+  deliver(delivery: IncomingDelivery): Promise<IncomingDestinationResult>;
+}
+interface CreateIncomingWebhookInput {
+  readonly tenant: string;
+  readonly name: string;
+  /** Defaults to `none`: the token in the URL is the only credential. */
+  readonly verify?: IncomingVerify;
+  readonly metadata?: Readonly<Record<string, unknown>>;
+  /** The header that carries the HMAC for `hmac-sha256`. Defaults to `x-signature`. */
+  readonly signatureHeader?: string;
+  /** The record the endpoint belongs to, a type from `options.subjects`. */
+  readonly subject?: {
+    readonly type: string;
+    readonly id: string;
+  };
+}
+/** An endpoint as members see it: everything but the token and secret. */
+interface IncomingWebhook {
+  readonly id: string;
+  readonly tenant: string;
+  readonly name: string;
+  readonly verify: IncomingVerify;
+  readonly signatureHeader: string | null;
+  readonly enabled: boolean;
+  readonly maxBodyBytes: number;
+  readonly receiveCount: number;
+  readonly lastReceivedAt: string | null;
+  readonly lastStatus: number | null;
+  readonly metadata: Readonly<Record<string, unknown>>;
+  readonly subject: {
+    readonly type: string;
+    readonly id: string;
+  } | null;
+  readonly createdBy: string | null;
+  readonly createdAt: string;
+}
+/** A new endpoint: its token (for the URL) and secret are shown once. */
+interface CreatedIncomingWebhook {
+  readonly id: string;
+  readonly tenant: string;
+  readonly name: string;
+  readonly verify: IncomingVerify;
+  readonly token: string;
+  readonly secret: string | null;
+  readonly signatureHeader: string | null;
+  readonly subject: {
+    readonly type: string;
+    readonly id: string;
+  } | null;
+}
+interface UpdateIncomingWebhookInput {
+  readonly name?: string;
+  readonly metadata?: Readonly<Record<string, unknown>>;
+  readonly verify?: IncomingVerify;
+  readonly signatureHeader?: string;
+}
+interface UpdatedIncomingWebhook {
+  readonly id: string;
+  readonly tenant: string;
+  readonly name: string;
+  readonly verify: IncomingVerify;
+  readonly secret: string | null;
+  readonly signatureHeader: string | null;
+  readonly metadata: Readonly<Record<string, unknown>>;
+}
+interface RotatedIncomingSecret {
+  readonly secret: string;
+  readonly previousSecretExpiresAt: Temporal.Instant | null;
+}
+interface IncomingWebhooks {
+  /**
+   * The route for `/hooks/<token>`: finds the endpoint, checks the body
+   * size, the rate limit and the signature, stores the delivery in the
+   * webhook inbox with the endpoint's tenant and answers 202 (200 for a
+   * repeated delivery). A delivery repeats when its signed `webhook-id`
+   * does (`standard-webhooks`), when its body does (`hmac-sha256`, whose
+   * signature covers only the body), or when its `webhook-id` header does
+   * (`none`). Needs a service connection.
+   */
+  receive(request: Request, token: string): Promise<Response>;
+  /** Creates an endpoint for a tenant; the caller needs `webhooks.manage`. */
+  create(input: CreateIncomingWebhookInput): AsyncResult<CreatedIncomingWebhook>;
+  /** A new token, and with `rotateSecret` a new secret. */
+  rotate(id: string, options?: {
+    readonly rotateSecret?: boolean;
+  }): AsyncResult<{
+    readonly token: string;
+    readonly secret: string | null;
+  }>;
+  rotateSecret(id: string, options?: {
+    readonly grace?: Temporal.Duration | string;
+  }): AsyncResult<RotatedIncomingSecret>;
+  update(id: string, input: UpdateIncomingWebhookInput): AsyncResult<UpdatedIncomingWebhook>;
+  setEnabled(id: string, enabled: boolean): AsyncResult<boolean>;
+  remove(id: string): AsyncResult<boolean>;
+  /**
+   * A tenant's endpoints, or one subject's, as the caller sees them (the
+   * read policy hides endpoints whose subject they can't read).
+   */
+  list(tenant: string, subject?: {
+    readonly type: string;
+    readonly id?: string;
+  }): AsyncResult<readonly IncomingWebhook[]>;
+}
+//#endregion
+//#region src/blocks/webhooks/url-policy.d.ts
+/**
+ * Decides whether a webhook may be sent to `url`. Throwing means the check
+ * itself failed (a DNS lookup error): deliveries retry it, and `safeFetch`
+ * throws `UrlCheckError`.
+ */
+type AllowUrl = (url: URL) => boolean | Promise<boolean>;
+/** The addresses a host name resolves to. */
+type ResolveHost = (hostname: string) => Promise<readonly string[]>;
+interface PublicUrlOptions {
+  /**
+   * Resolves host names so each address can be checked. Defaults to
+   * `node:dns` where the runtime has it (Node, Bun, Deno); pass one on other
+   * runtimes, or `false` to check only the URL.
+   */
+  readonly resolve?: ResolveHost | false;
+  /** Allow `http:` URLs, e.g. for local development. */
+  readonly allowHttp?: boolean;
+  /** Host names that skip every check, e.g. an internal receiver you trust. */
+  readonly allowHosts?: readonly string[];
+}
+/**
+ * Whether an IP address is reachable on the public internet: not loopback,
+ * private, link-local (cloud metadata), carrier-grade NAT, multicast or
+ * reserved. Returns `false` for anything that isn't an IP address.
+ */
+declare function isPublicAddress(address: string): boolean;
+/**
+ * The default `allowUrl`: HTTPS only, no credentials in the URL, no local
+ * host names, and every address the host resolves to must be public. The
+ * delivery transport calls it again for each redirect.
+ *
+ * DNS can change between this check and the connection. Route webhooks
+ * through an egress proxy when that matters.
+ */
+declare function publicUrl(options?: PublicUrlOptions): AllowUrl;
+//#endregion
+//#region src/blocks/webhooks/http.d.ts
+interface WebhookRequest {
+  readonly url: string;
+  readonly headers: Readonly<Record<string, string>>;
+  readonly body: string;
+  readonly signal?: AbortSignal;
+}
+interface WebhookResponse {
+  readonly status: number;
+  readonly body: string;
+  /** Seconds from the `Retry-After` header, when the receiver sent one. */
+  readonly retryAfter?: number;
+}
+/**
+ * Sends one signed webhook request. Throw `WebhookPolicyError` when the
+ * request must never be retried (a blocked URL); any other error retries.
+ */
+interface WebhookTransport {
+  readonly apiVersion: 1;
+  readonly name: string;
+  send(request: WebhookRequest): Promise<WebhookResponse>;
+}
+/** A delivery that must not be retried, e.g. a URL `allowUrl` rejected. */
+declare class WebhookPolicyError extends Error {
+  override readonly name = "WebhookPolicyError";
+}
+interface FetchTransportOptions {
+  readonly fetch?: typeof fetch;
+  /** Checked before the first request and before each redirect. */
+  readonly allowUrl?: AllowUrl;
+  /**
+   * Defaults to 0: a redirect fails the delivery without a retry. Each hop
+   * you allow is checked with `allowUrl` first.
+   */
+  readonly maxRedirects?: number;
+  /** Per request. Defaults to 10 seconds. */
+  readonly timeoutMs?: number;
+  /** The response body bytes kept; the rest is not read. Defaults to 64 KiB. */
+  readonly maxResponseBytes?: number;
+}
+/** Sends webhooks with `fetch`, following redirects only to allowed URLs. */
+declare function fetchTransport(options?: FetchTransportOptions): WebhookTransport;
+//#endregion
+//#region src/blocks/webhooks/secrets.d.ts
+interface RotateSecretOptions {
+  /** How long older secrets keep signing, e.g. `'24 hours'` (the default). */
+  readonly overlap?: string;
+  /** Use this secret instead of a generated one, e.g. when migrating. */
+  readonly secret?: string;
+}
+/**
+ * Where endpoint signing secrets live. `sqlSecretStore` (Vault or a
+ * column, set in `blocks.webhooks-out.options.secretStorage`) is the default;
+ * implement it for a KMS or a secrets manager.
+ */
+interface WebhookSecretStore {
+  readonly apiVersion: 1;
+  /** The live secrets of an endpoint, newest first. */
+  secrets(endpointId: string): Promise<readonly string[]>;
+  /** Creates a new secret and returns it once. */
+  rotate?(endpointId: string, options?: RotateSecretOptions): Promise<string>;
+}
+/** The module's `webhook_secrets` and `rotate_webhook_secret` functions. */
+declare function sqlSecretStore(transport: BlockTransport, options?: {
+  readonly schema?: string;
+}): WebhookSecretStore;
+//#endregion
+//#region src/blocks/webhooks/signers.d.ts
+interface WebhookSignInput {
+  /** The delivery id, the same on every retry so receivers can deduplicate. */
+  readonly id: string;
+  readonly body: string;
+  readonly timestamp: Temporal.Instant;
+  /** The endpoint's live secrets, newest first. Sign with each while rotating. */
+  readonly secrets: readonly string[];
+}
+/**
+ * Adds the signature headers to an outgoing webhook. `standardWebhooks()`
+ * is the default; `hmacSigner()` covers custom header and payload formats.
+ */
+interface WebhookSigner {
+  readonly apiVersion: 1;
+  readonly name: string;
+  sign(input: WebhookSignInput): Readonly<Record<string, string>> | Promise<Readonly<Record<string, string>>>;
+}
+interface StandardWebhooksOptions {
+  /** Header names, for receivers that expect a prefix such as `svix-`. */
+  readonly headers?: {
+    readonly id?: string;
+    readonly timestamp?: string;
+    readonly signature?: string;
+  };
+}
+/**
+ * Signs with the [Standard Webhooks](https://www.standardwebhooks.com/)
+ * scheme: `webhook-id`, `webhook-timestamp` and one `v1,` signature per
+ * secret in `webhook-signature`. `verifyWebhook` checks it.
+ */
+declare function standardWebhooks(options?: StandardWebhooksOptions): WebhookSigner;
+/**
+ * Signs raw bytes with an Ed25519 key, such as
+ * `createSigningKeys(options).signer(owner)` from `better-supabase/blocks/signing-keys`.
+ */
+interface RawSigner {
+  sign(data: Uint8Array): PromiseLike<Result<{
+    readonly alg: string;
+    readonly signature: Uint8Array;
+  }>>;
+}
+interface AsymmetricWebhooksOptions extends StandardWebhooksOptions {
+  readonly signer: RawSigner;
+  /**
+   * Also sends a `v1,` HMAC signature per endpoint secret, for receivers
+   * that move from secrets to the public key. Default: false.
+   */
+  readonly hmac?: boolean;
+}
+/**
+ * Signs with the Standard Webhooks asymmetric scheme: one `v1a,` Ed25519
+ * signature over `id.timestamp.body` in `webhook-signature`. Receivers
+ * verify it with the `whpk_` key `webhookPublicKey` returns, through
+ * `verifyWebhook`. Endpoints opt in with `signing = 'v1a'`.
+ */
+declare function standardWebhooksAsymmetric(options: AsymmetricWebhooksOptions): WebhookSigner;
+/** The `whpk_` public key of an Ed25519 JWK, for receivers of `v1a` signatures. */
+declare function webhookPublicKey(jwk: {
+  readonly kty: string;
+  readonly crv?: string;
+  readonly x?: string;
+}): string;
+interface HmacSignerOptions {
+  readonly name?: string;
+  /** e.g. `x-acme-signature`. */
+  readonly signatureHeader: string;
+  /** Sends the epoch-seconds timestamp in this header. */
+  readonly timestampHeader?: string;
+  /** Sends the delivery id in this header. */
+  readonly idHeader?: string;
+  /** The signed text. Defaults to `${timestamp}.${body}`. */
+  readonly content?: (input: {
+    readonly id: string;
+    readonly timestamp: string;
+    readonly body: string;
+  }) => string;
+  /** Defaults to `hex`. */
+  readonly encoding?: "hex" | "base64";
+  /** Written before each signature. Defaults to `v1=`. */
+  readonly prefix?: string;
+  /** Joins the signatures of several secrets. Defaults to `,`. */
+  readonly separator?: string;
+}
+/**
+ * HMAC-SHA256 with the secret's UTF-8 bytes as the key, for receivers that
+ * verify an existing format, e.g. `v1=<hex>` over `timestamp.body`.
+ */
+declare function hmacSigner(options: HmacSignerOptions): WebhookSigner;
+//#endregion
+export { IncomingVerify as A, isPublicAddress as C, IncomingDelivery as D, CreatedIncomingWebhook as E, UpdateIncomingWebhookInput as F, UpdatedIncomingWebhook as I, IncomingWebhooks as M, IncomingWebhooksOptions as N, IncomingDestination as O, RotatedIncomingSecret as P, ResolveHost as S, CreateIncomingWebhookInput as T, WebhookResponse as _, WebhookSignInput as a, AllowUrl as b, standardWebhooks as c, RotateSecretOptions as d, WebhookSecretStore as f, WebhookRequest as g, WebhookPolicyError as h, StandardWebhooksOptions as i, IncomingWebhook as j, IncomingDestinationResult as k, standardWebhooksAsymmetric as l, FetchTransportOptions as m, HmacSignerOptions as n, WebhookSigner as o, sqlSecretStore as p, RawSigner as r, hmacSigner as s, AsymmetricWebhooksOptions as t, webhookPublicKey as u, WebhookTransport as v, publicUrl as w, PublicUrlOptions as x, fetchTransport as y };

package/dist/signing-keys-Bq9mMCTh.d.ts

@@ -0,0 +1,90 @@
+/// <reference lib="esnext.temporal" />
+import { t as AsyncResult } from "./result-Cj3yWhjH.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { n as BlockOptions } from "./block-helpers-C86hPEjI.js";
+import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
+import { i as JwsAlgorithm, n as Jwks, o as SigningAlgorithm, t as Jwk } from "./jws-35a8VhFV.js";
+//#region src/blocks/signing-keys/signing-keys.d.ts
+interface SigningKeysOptions extends BlockOptions {
+  /**
+   * The JWS `alg` an Ed25519 key signs with: `EdDSA` (RFC 8037), which most
+   * verifiers read, or the fully specified `Ed25519` (RFC 9864). Default: `EdDSA`.
+   */
+  readonly ed25519Alg?: "EdDSA" | "Ed25519";
+  /** How long a signer keeps the imported private key, in seconds. Default: 300. */
+  readonly cacheSeconds?: number;
+  /** `withBlockHooks` hooks around the client's methods. */
+  readonly hooks?: NoInfer<BlockHooks<SigningKeys>>;
+  /** Receives the errors `after` hooks throw. Default: `console`. */
+  readonly logger?: Logger;
+}
+/** Who a key belongs to: an organization, an app, a stream. */
+interface SigningKeyOwner {
+  /** Lowercase letters, digits, `-` and `_`, such as `organization`. */
+  readonly type: string;
+  readonly id: string;
+}
+/** What `create` and `rotate` return. The private key never leaves Vault again. */
+interface CreatedSigningKey {
+  readonly kid: string;
+  readonly alg: SigningAlgorithm;
+  readonly publicKey: Jwk;
+  /** The kid the new key replaced, which stays in the JWKS until its tokens expire. */
+  readonly retired: string | null;
+}
+/** What `sign` returns. */
+interface Signature {
+  readonly kid: string;
+  readonly alg: JwsAlgorithm;
+  readonly signature: Uint8Array;
+}
+/** Signs with an owner's active key. */
+interface Signer {
+  readonly owner: SigningKeyOwner;
+  /** The raw signature of `data` with the active key. */
+  sign(data: Uint8Array): AsyncResult<Signature>;
+  /**
+   * A compact JWS over `claims`, with `alg`, `kid` and `typ: "JWT"` in the
+   * header unless `header` sets them. A numeric `exp` keeps the key in the
+   * JWKS until then (`note_signing_key_exp`), so a rotation can't strand the token.
+   */
+  signJwt(claims: Readonly<Record<string, unknown>>, header?: Readonly<Record<string, unknown>>): AsyncResult<string>;
+}
+interface JwksOptions {
+  /** How long a retired key stays published past its last `exp`. Default: `blocks.signing-keys.options.jwksGrace`. */
+  readonly grace?: Temporal.Duration;
+}
+interface JwksResponseOptions extends JwksOptions {
+  /** The `Cache-Control` max-age, in seconds. Default: 300. */
+  readonly maxAge?: number;
+}
+interface SignerOptions {
+  /** Creates a key of this type when the owner has none, instead of failing with `SIGNING_KEY_MISSING`. */
+  readonly create?: SigningAlgorithm;
+}
+interface SigningKeys {
+  /** Generates a key for the owner and makes it active; the previous key is retired. */
+  create(owner: SigningKeyOwner, alg?: SigningAlgorithm): AsyncResult<CreatedSigningKey>;
+  /** `create` with the active key's type, or `alg` when given. */
+  rotate(owner: SigningKeyOwner, alg?: SigningAlgorithm): AsyncResult<CreatedSigningKey>;
+  /** Retires a key without a replacement. `false` when it was not active. */
+  retire(kid: string): AsyncResult<boolean>;
+  /** Keeps a key published until at least `exp`. `false` for an unknown kid. */
+  noteExp(kid: string, exp: Temporal.Instant): AsyncResult<boolean>;
+  /** The owner's public keys still in use, as a JWK Set. */
+  jwks(owner: SigningKeyOwner, options?: JwksOptions): AsyncResult<Jwks>;
+  /** `jwks` as an `application/jwk-set+json` response with `Cache-Control`. */
+  jwksResponse(owner: SigningKeyOwner, options?: JwksResponseOptions): Promise<Response>;
+  /** Deletes every key of the owner. */
+  remove(owner: SigningKeyOwner): AsyncResult<number>;
+  /** Deletes retired keys no token can still need. */
+  purge(options?: JwksOptions): AsyncResult<number>;
+  signer(owner: SigningKeyOwner, options?: SignerOptions): Signer;
+}
+/**
+ * The `signing-keys` SQL module as typed calls: keys are generated and used
+ * with WebCrypto here, kept in Supabase Vault there. Service role only.
+ */
+declare function createSigningKeys(options: SigningKeysOptions): SigningKeys;
+//#endregion
+export { Signer as a, SigningKeys as c, Signature as i, SigningKeysOptions as l, JwksOptions as n, SignerOptions as o, JwksResponseOptions as r, SigningKeyOwner as s, CreatedSigningKey as t, createSigningKeys as u };

package/dist/solid/index.d.ts

@@ -1,11 +1,11 @@
-import { b as DbError } from "../result-BchM1XZn.js";
-import { J as TemplateValues } from "../storage-api-CB7Zl1Ci.js";
-import { at as QuerySpec } from "../define-DmcfoNXB.js";
-import { t as AuthSnapshot } from "../bind-CQ5mPyX1.js";
-import { t as AuthSession } from "../view-TpXEUcVN.js";
-import { S as Topic, f as PresenceMember, u as EventSchemas, w as TopicHandlers, x as SubscriptionStatus } from "../index-BCHR4Ucl.js";
-import { t as SupportView } from "../support-view-scqMgtOo.js";
-import { a as BroadcastOptions, c as LiveCountHookOptions, d as PresenceHookOptions, f as PresenceTopic, i as ActionState, l as LiveCountSource, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-DIe9XYWL.js";
+import { b as DbError } from "../result-Cj3yWhjH.js";
+import { J as TemplateValues } from "../storage-api-Cx-1iWBd.js";
+import { at as QuerySpec } from "../define-DxHHbNEb.js";
+import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-cMS7UtM1.js";
+import { t as AuthSnapshot } from "../bind-a7sUgvf4.js";
+import { t as AuthSession } from "../view-Dv0A949a.js";
+import { a as BroadcastOptions, c as LiveCountHookOptions, d as PresenceHookOptions, f as PresenceTopic, i as ActionState, l as LiveCountSource, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-CWXN_h_E.js";
+import { t as SupportView } from "../support-view-BbcZR7Io.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Accessor, JSX } from "solid-js";
 import { QueryClient } from "@tanstack/query-core";

package/dist/solid/index.js

@@ -1,13 +1,13 @@
 import { t as clearOnUserChange } from "../user-change-XzvgafU4.js";
-import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-wxeTQFtB.js";
+import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-CvITjt-9.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
 import { t as fieldErrorsOf } from "../field-errors-DZVRWRkf.js";
-import { createComponent, createContext, createEffect, createMemo, createSignal, onCleanup, onMount, untrack, useContext } from "solid-js";
+import { n as useContext$1, t as ClientContext } from "../context-B8_p3MXo.js";
+import { createComponent, createEffect, createMemo, createSignal, onCleanup, onMount, untrack, useContext } from "solid-js";
 //#region src/solid/index.ts
 function read(value) {
 	return typeof value === "function" ? value() : value;
 }
-const ClientContext = createContext();
 /** Provides the better-supabase client to the primitives. */
 function BetterSupabaseProvider(props) {
 	const { client, queryClient } = props;
@@ -32,11 +32,6 @@ function BetterSupabaseProvider(props) {
 		}
 	});
 }
-function useContext$1() {
-	const context = useContext(ClientContext);
-	if (!context) throw new Error("better-supabase: wrap your app in <BetterSupabaseProvider client={bs}>");
-	return context;
-}
 /** The session state for UI: `loading`, `signed-out` or `signed-in` with the user and claims. */
 function useAuth() {
 	return useContext$1().auth;

package/dist/solid-controller-DLsmrczT.js

@@ -0,0 +1,33 @@
+import { n as useContext$1 } from "./context-B8_p3MXo.js";
+import { n as withEnv, t as blockEnv } from "./block-env-CBd_SoL5.js";
+import { from, onCleanup, onMount } from "solid-js";
+//#region src/blocks/solid-controller.ts
+/**
+* Makes a controller once and reads it through `from`. Its work starts on
+* mount (never during server rendering), and the controller is disposed
+* with the owner.
+*/
+function useBlockController(create, options, usesEnv = true) {
+	const controller = create(withEnv(options, usesEnv ? () => blockEnv(useContext$1().client) : void 0));
+	const state = from({ subscribe: (next) => {
+		next(controller.getSnapshot());
+		let stop;
+		onMount(() => {
+			stop = controller.subscribe(() => {
+				next(controller.getSnapshot());
+			});
+			next(controller.getSnapshot());
+		});
+		return () => stop?.();
+	} }, controller.getSnapshot());
+	onCleanup(() => {
+		controller.dispose();
+	});
+	return {
+		state,
+		actions: controller.actions,
+		controller
+	};
+}
+//#endregion
+export { useBlockController as t };

package/dist/solid-controller-DqlvYFZa.d.ts

@@ -0,0 +1,11 @@
+import { n as Controller } from "./controller-D845qKh2.js";
+import { Accessor } from "solid-js";
+//#region src/blocks/solid-controller.d.ts
+/** A block controller in a Solid component: `state` follows the controller. */
+interface SolidController<S, A> {
+  readonly state: Accessor<S>;
+  readonly actions: A;
+  readonly controller: Controller<S, A>;
+}
+//#endregion
+export { SolidController as t };

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
-import { a as AnyModels, i as AnyFunctions } from "../types-CoE5Zwy4.js";
-import { t as BetterSupabase } from "../define-DmcfoNXB.js";
-import { t as BetterServer } from "../server-types-CrAmZ8jv.js";
-import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-W99LCPBS.js";
-import { t as RefusalRedirects } from "../refusal-CFI8-5nf.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-148t1m3C.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-YfwpIE-d.js";
+import { t as BetterSupabase } from "../define-DxHHbNEb.js";
+import { t as BetterServer } from "../server-types-OohhIQb2.js";
+import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-D5S7KNFe.js";
+import { t as RefusalRedirects } from "../refusal-oD3ISM9h.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-DG5Bv39u.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/solid-start/index.d.ts
 /** The part of a SolidStart `FetchEvent` the integration reads and writes. */
@@ -13,13 +13,9 @@ export interface SolidFetchEvent {
     readonly headers: Headers;
   };
   readonly locals: Record<string, unknown>;
-  /** The H3 event; Nitro's Cloudflare presets put the bindings on its context. */
+  /** The H3 2 event; Nitro 3's Cloudflare preset puts the bindings on its request. */
   readonly nativeEvent?: {
-    readonly context?: {
-      readonly cloudflare?: {
-        readonly env?: unknown;
-      } | undefined;
-    } | undefined;
+    readonly req: Request;
   } | undefined;
 }
 export interface SolidStartOptions extends FrameworkOptions {

package/dist/solid-start/index.js

@@ -1,9 +1,10 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CN45ibbV.js";
-import { t as defaultExpose } from "../respond-volM3ByS.js";
-import { i as requireCaller, o as runAction } from "../kit-BhHr9T9v.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-3ey3QmrO.js";
-import { r as refusalResponse } from "../refusal-K78A1Vmq.js";
-import { t as beforeRoute } from "../before-route-CnR0C0Jr.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CEjmtazZ.js";
+import { t as defaultExpose } from "../respond-DdhZ9Wbn.js";
+import { i as requireCaller, o as runAction } from "../kit-MUK34-ZG.js";
+import { i as nitroCloudflareEnv } from "../shared-BmMcMoW9.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-INbjMZX1.js";
+import { r as refusalResponse } from "../refusal-br4Ma9Cf.js";
+import { t as beforeRoute } from "../before-route-B98js9m_.js";
 //#region src/solid-start/index.ts
 /** SolidStart integration: middleware, guards and server function actions. */
 function createSolidStart(betterSupabase, options) {
@@ -21,7 +22,7 @@ function createSolidStart(betterSupabase, options) {
 	return extendServer(server, {
 		middleware: {
 			onRequest: async (event) => {
-				const env = options.platformEnv ? options.platformEnv(event) : event.nativeEvent?.context?.cloudflare?.env;
+				const env = options.platformEnv ? options.platformEnv(event) : event.nativeEvent && nitroCloudflareEnv(event.nativeEvent.req);
 				const outcome = await run(event.request, env);
 				if (!outcome.reached) return outcome.response;
 				for (const cookie of outcome.headers.getSetCookie()) event.response.headers.append("set-cookie", cookie);