better-supabase 0.9.0 → 0.11.0

package/dist/mcp/index.js

@@ -1,21 +1,21 @@
-import { n as dbError } from "../errors-8i6tSICm.js";
-import { a as ok } from "../result-BlgnMB0H.js";
-import { t as base64ToText } from "../base64-BmeCBgGo.js";
-import { n as validate } from "../standard-B5fe2gnW.js";
-import { a as methodNotAllowed, c as toProblem, o as problemResponse } from "../problem-pIiL3WbE.js";
+import { n as dbError } from "../errors-BV1SKTVs.js";
+import { a as ok } from "../result-DIeYscA3.js";
+import { t as base64ToText } from "../base64-D4aqdnDR.js";
+import { n as validate } from "../standard-B1BigegP.js";
+import { a as methodNotAllowed, c as toProblem, o as problemResponse } from "../problem-JRCohp1j.js";
 import { t as SPEC_PINS } from "../spec-pins-S4PymRxp.js";
 import { t as buildJsonSchema, v as toDraft07 } from "../json-schema-CpYINXG8.js";
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CEjmtazZ.js";
+import { r as operationPermission, t as OPERATION_PREFIXES } from "../operations-CsIfMED7.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-B2WRsRIg.js";
 import { n as jsonResponse, t as jsonReplacer } from "../json-CEnpTHlZ.js";
-import { o as settle, r as guard, t as defaultExpose } from "../respond-DdhZ9Wbn.js";
+import { o as settle, r as guard, t as defaultExpose } from "../respond-Bhp3G__q.js";
 import { t as boundedTtlCache } from "../ttl-cache-XzZ-Q2eX.js";
-import { n as checkPermission, t as checkEach } from "../authorizer-DH7DjkL3.js";
-import { t as defineResource } from "../resource-C8r5xGqY.js";
-import { r as hasRole } from "../kit-MUK34-ZG.js";
+import { n as checkPermission, t as checkEach } from "../authorizer-B3yyCVUF.js";
+import { t as defineResource } from "../resource-Bdkqi8jo.js";
+import { r as hasRole } from "../kit-LTbHrWWD.js";
 import { t as withExtra } from "../extra-CGQ2_q3S.js";
 import { r as pageSchema, t as pageInputSchema } from "../resource-schemas-BJ518zFH.js";
 import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../http-DdYadv-o.js";
-import { r as operationPermission, t as OPERATION_PREFIXES } from "../operations-CsIfMED7.js";
 import { resourceMetadataResponse, unauthorizedResponse } from "@supabase/server/oauth-protected-resource";
 //#region src/mcp/dialect.ts
 /**
@@ -57,9 +57,9 @@ const UNSUPPORTED_PROTOCOL_VERSION = -32022;
 const META_VERSION = "io.modelcontextprotocol/protocolVersion";
 const META_CAPABILITIES = "io.modelcontextprotocol/clientCapabilities";
 const META_SERVER_INFO = "io.modelcontextprotocol/serverInfo";
-/** A JSON-RPC error response. */
-function rpcError(id, code, message, status = 200, data) {
-	return Response.json({
+/** A JSON-RPC error message. */
+function rpcErrorBody(id, code, message, data) {
+	return {
 		jsonrpc: "2.0",
 		id: id ?? null,
 		error: {
@@ -67,7 +67,11 @@ function rpcError(id, code, message, status = 200, data) {
 			message,
 			...data ? { data } : {}
 		}
-	}, { status });
+	};
+}
+/** A JSON-RPC error response. */
+function rpcError(id, code, message, status = 200, data) {
+	return Response.json(rpcErrorBody(id, code, message, data), { status });
 }
 /** A non-array object. */
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -162,7 +166,13 @@ async function permittedTools(authorizer, tools, context) {
 	return shown;
 }
 //#endregion
-//#region src/mcp/mcp.ts
+//#region src/mcp/protocol.ts
+/**
+* The transport-free part of MCP: protocol versions, tool and result shapes,
+* the handshake results and a dispatcher for one JSON-RPC message. The
+* Streamable HTTP server in `mcp.ts` and the CLI's stdio server share it, so
+* it imports nothing from Node.
+*/
 const MCP_PROTOCOL_VERSION = SPEC_PINS.mcp;
 /** Revisions before 2026-07-28 open with an `initialize` handshake. */
 const LEGACY_VERSIONS = [
@@ -171,6 +181,99 @@ const LEGACY_VERSIONS = [
 	"2025-03-26"
 ];
 const SUPPORTED_VERSIONS = [MCP_PROTOCOL_VERSION, ...LEGACY_VERSIONS];
+/** How long clients may cache `tools/list` and `server/discover`. */
+const LIST_TTL_MS = 3e5;
+const CAPABILITIES = { tools: { listChanged: false } };
+/** A tool result: the value as text, and as `structuredContent` when it is an object. */
+function textResult(value, isError = false) {
+	const structured = isObject(value) ? value : void 0;
+	return {
+		content: [{
+			type: "text",
+			text: typeof value === "string" ? value : JSON.stringify(value ?? null, jsonReplacer)
+		}],
+		...structured ? { structuredContent: structured } : {},
+		...isError ? { isError: true } : {}
+	};
+}
+/** A message on 2026-07-28 or later, which carries its version in `_meta`. */
+function isModernMessage(message) {
+	const meta = message.params?.["_meta"];
+	return isObject(meta) && meta["io.modelcontextprotocol/protocolVersion"] !== void 0;
+}
+/** The `initialize` result for a pre-2026-07-28 client. */
+function initializeResult(requested, server) {
+	return {
+		protocolVersion: typeof requested === "string" && LEGACY_VERSIONS.includes(requested) ? requested : LEGACY_VERSIONS[0],
+		capabilities: CAPABILITIES,
+		serverInfo: server.info,
+		...server.instructions ? { instructions: server.instructions } : {}
+	};
+}
+/** The `server/discover` result for a 2026-07-28 client. */
+function discoverResult(server) {
+	return {
+		supportedVersions: [...SUPPORTED_VERSIONS],
+		capabilities: CAPABILITIES,
+		...server.instructions ? { instructions: server.instructions } : {},
+		ttlMs: LIST_TTL_MS,
+		cacheScope: "private"
+	};
+}
+/** A result as a 2026-07-28 response marks it: complete, with the server's info. */
+function modernResult(result, server) {
+	return {
+		...result,
+		resultType: "complete",
+		_meta: { [META_SERVER_INFO]: server.info }
+	};
+}
+const response = (id, result) => ({
+	jsonrpc: "2.0",
+	id: id ?? null,
+	result
+});
+/**
+* The JSON-RPC response to one message, or `undefined` for a notification.
+* It answers `initialize`, `server/discover`, `ping`, `tools/list` and
+* `tools/call`, for message-based transports such as stdio.
+*/
+async function answerMessage(message, server) {
+	if (!isRpcRequest(message)) return rpcErrorBody(null, INVALID_REQUEST, "Expected a JSON-RPC 2.0 message");
+	if (message.id === void 0) return;
+	const modern = isModernMessage(message);
+	const reply = (result) => response(message.id, modern ? modernResult(result, server) : { ...result });
+	switch (message.method) {
+		case "initialize": return modern ? rpcErrorBody(message.id, METHOD_NOT_FOUND, "Method not found: initialize") : reply(initializeResult(message.params?.["protocolVersion"], server));
+		case "server/discover": return reply(discoverResult(server));
+		case "ping": return reply({});
+		case "tools/list": return reply({
+			tools: await server.listTools(),
+			...modern ? {
+				ttlMs: LIST_TTL_MS,
+				cacheScope: "private"
+			} : {}
+		});
+		case "tools/call": {
+			const name = message.params?.["name"];
+			const result = typeof name === "string" ? await server.callTool(name, message.params?.["arguments"]) : void 0;
+			return result === void 0 ? rpcErrorBody(message.id, INVALID_PARAMS, `Unknown tool ${JSON.stringify(name)}`) : reply(result);
+		}
+		default: return rpcErrorBody(message.id, METHOD_NOT_FOUND, `Method not found: ${message.method}`);
+	}
+}
+/** The response to one line of a newline-delimited JSON-RPC stream. */
+function answerLine(line, server) {
+	let message;
+	try {
+		message = JSON.parse(line);
+	} catch {
+		return Promise.resolve(rpcErrorBody(null, PARSE_ERROR, "Parse error"));
+	}
+	return answerMessage(message, server);
+}
+//#endregion
+//#region src/mcp/mcp.ts
 /** The host's hostname is in the list; a missing or malformed host is not. */
 function hostAllowed(host, allowed) {
 	if (!host) return false;
@@ -293,21 +396,8 @@ function tableTools(resource, defs) {
 	}
 	return tools;
 }
-/** How long clients may cache `tools/list` and `server/discover` (per token). */
-const LIST_TTL_MS = 3e5;
 /** Callers whose visible tool lists are kept; the oldest goes first. */
 const VISIBLE_LISTS_MAX = 1e3;
-function textResult(value, isError = false) {
-	const structured = typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
-	return {
-		content: [{
-			type: "text",
-			text: typeof value === "string" ? value : JSON.stringify(value ?? null, jsonReplacer)
-		}],
-		...structured ? { structuredContent: structured } : {},
-		...isError ? { isError: true } : {}
-	};
-}
 /**
 * An MCP server (Streamable HTTP, stateless) whose tools run as the caller:
 * the Bearer token from the MCP client is verified and every query goes
@@ -419,11 +509,22 @@ function createMcp(betterSupabase, options) {
 	* (`ttlMs`). `tools/call` still checks `visible` on every call.
 	*/
 	const visibleLists = boundedTtlCache({ max: VISIBLE_LISTS_MAX });
+	let warned = false;
+	/** A tool with a permission and no authorizer to check it is never listed, which is easy to miss. */
+	const warnHidden = (all) => {
+		if (warned || options.authorizer) return;
+		const hidden = all.filter((entry) => entry.permission !== void 0).map((entry) => entry.info.name);
+		if (hidden.length > 0) {
+			warned = true;
+			console.warn(`createMcp: ${hidden.join(", ")} ${hidden.length === 1 ? "has" : "have"} a permission but no authorizer is set, so tools/list hides ${hidden.length === 1 ? "it" : "them"}. Pass authorizer to createMcp, or drop the permission.`);
+		}
+	};
 	/** Without a `visible` hook or permissions every caller sees the same list, built once. */
 	const visibleTools = async (context, target) => {
 		const all = [...registry.values()];
 		const gated = all.some((entry) => entry.permission !== void 0);
 		if (!options.visible && !gated) return listFor(target);
+		warnHidden(all);
 		const ctx = context();
 		const token = ctx.auth.kind === "user" ? ctx.auth.token : void 0;
 		const cached = token === void 0 ? void 0 : visibleLists.get(token);
@@ -456,12 +557,14 @@ function createMcp(betterSupabase, options) {
 		return isRefusal(outcome) ? failure(dbError("forbidden", outcome.refusal)) : outcome;
 	};
 	const scopes = (options.advertisedScopes ?? []).filter((scope) => scope !== "offline_access");
-	const serverInfo = {
-		name: options.name,
-		version: options.version,
-		...options.title ? { title: options.title } : {}
+	const description = {
+		info: {
+			name: options.name,
+			version: options.version,
+			...options.title ? { title: options.title } : {}
+		},
+		...options.instructions ? { instructions: options.instructions } : {}
 	};
-	const capabilities = { tools: { listChanged: false } };
 	const unauthorized = (request) => {
 		const response = unauthorizedResponse(request, { resourceMetadataUrl: metadataUrl(request) });
 		if (scopes.length > 0) response.headers.set("www-authenticate", `${response.headers.get("www-authenticate") ?? "Bearer"}, scope=${quoted(scopes.join(" "))}`);
@@ -530,8 +633,7 @@ function createMcp(betterSupabase, options) {
 			return rpcError(null, PARSE_ERROR, "Parse error", 400);
 		}
 		if (!isRpcRequest(message)) return rpcError(null, INVALID_REQUEST, "Expected one JSON-RPC 2.0 message", 400);
-		const meta = message.params?.["_meta"];
-		const modern = isObject(meta) && meta["io.modelcontextprotocol/protocolVersion"] !== void 0 || header === MCP_PROTOCOL_VERSION;
+		const modern = isModernMessage(message) || header === MCP_PROTOCOL_VERSION;
 		if (modern) {
 			const invalid = checkModern(message, header, request.headers);
 			if (invalid) return invalid;
@@ -544,31 +646,12 @@ function createMcp(betterSupabase, options) {
 		const reply = (result) => jsonResponse({
 			jsonrpc: "2.0",
 			id: message.id,
-			result: modern ? {
-				...result,
-				resultType: "complete",
-				_meta: { [META_SERVER_INFO]: serverInfo }
-			} : result
+			result: modern ? modernResult(result, description) : result
 		});
 		const notFound = () => rpcError(message.id, METHOD_NOT_FOUND, `Method not found: ${message.method}`, modern ? 404 : 200);
 		switch (message.method) {
-			case "server/discover": return reply({
-				supportedVersions: [...SUPPORTED_VERSIONS],
-				capabilities,
-				...options.instructions ? { instructions: options.instructions } : {},
-				ttlMs: LIST_TTL_MS,
-				cacheScope: "private"
-			});
-			case "initialize": {
-				if (modern) return notFound();
-				const requested = message.params?.["protocolVersion"];
-				return reply({
-					protocolVersion: typeof requested === "string" && LEGACY_VERSIONS.includes(requested) ? requested : LEGACY_VERSIONS[0],
-					capabilities,
-					serverInfo,
-					...options.instructions ? { instructions: options.instructions } : {}
-				});
-			}
+			case "server/discover": return reply(discoverResult(description));
+			case "initialize": return modern ? notFound() : reply(initializeResult(message.params?.["protocolVersion"], description));
 			case "ping": return modern ? notFound() : reply({});
 			case "tools/list": return reply({
 				tools: await visibleTools(toolContext, schemaTargetFor(modern ? MCP_PROTOCOL_VERSION : header ?? "2025-03-26")),
@@ -624,4 +707,4 @@ function createMcp(betterSupabase, options) {
 	return mcp;
 }
 //#endregion
-export { MCP_PROTOCOL_VERSION, createMcp, defineTool };
+export { MCP_PROTOCOL_VERSION, answerLine, answerMessage, createMcp, defineTool };

package/dist/mcp/sdk/index.d.ts

@@ -1,10 +1,10 @@
-import { a as AnyModels, i as AnyFunctions } from "../../types-YfwpIE-d.js";
-import { r as AuthState } from "../../resolve-w9EpHzuM.js";
-import { i as CredentialRef, r as CredentialProvider } from "../../provider-9gBq9W6k.js";
+import { a as AnyModels, i as AnyFunctions } from "../../types-BrpW5ixT.js";
+import { r as AuthState } from "../../resolve-Bqb8TMTt.js";
+import { i as CredentialRef, r as CredentialProvider } from "../../provider-CNs0Jx0I.js";
 import { i as SupabaseMcpScope, n as SupabaseMcpModule, r as SupabaseMcpPlatformModule, t as SupabaseMcpFeature } from "../../supabase-mcp-C6tMoEjn.js";
-import { t as BetterSupabase } from "../../define-DxHHbNEb.js";
-import { i as ServerContext$1, s as ServerOptions, t as BetterServer } from "../../server-types-OohhIQb2.js";
-import { r as GuardOptions, t as AllowedCaller } from "../../respond-C7I8kLK_.js";
+import { t as BetterSupabase } from "../../define-M_r1d2AT.js";
+import { a as ServerContext$1, c as ServerOptions, n as BetterServer } from "../../server-types-BKN_R4Ws.js";
+import { r as GuardOptions, t as AllowedCaller } from "../../respond-CEBC6KUX.js";
 import { AuthInfo, CallToolResult, Icon, InputRequiredResult, OAuthTokenVerifier, RegisteredTool, ScopeChallengeHandler, ServerContext, StandardSchemaWithJSON, ToolAnnotations } from "@modelcontextprotocol/server";
 //#region src/mcp/sdk/sdk.d.ts
 interface McpAuthOptions extends ServerOptions, Omit<GuardOptions, "scopes"> {
@@ -43,7 +43,7 @@ interface McpFetchHandler {
     readonly authInfo?: AuthInfo;
   }): Promise<Response>;
 }
-interface BetterMcpAuth<M extends AnyModels = AnyModels, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
+interface BetterMcpAuth<M extends AnyModels = AnyModels, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown, P = unknown, B = unknown> extends BetterServer<M, F, E, C, P, B> {
   /** An `OAuthTokenVerifier` for the SDK's bearer helpers; it verifies the token locally. */
   readonly verifier: OAuthTokenVerifier;
   /** The RFC 9728 Protected Resource Metadata document. */
@@ -57,17 +57,17 @@ interface BetterMcpAuth<M extends AnyModels = AnyModels, F extends AnyFunctions
    */
   serve(handler: McpFetchHandler): (request: Request) => Promise<Response>;
   /** The caller's context for a tool call, from `ctx.http.authInfo`. */
-  contextOf(ctx: ServerContext): Promise<ServerContext$1<M, F, E, C, P>>;
+  contextOf(ctx: ServerContext): Promise<ServerContext$1<M, F, E, C, P, B>>;
 }
 /** What `withBetterSupabaseMcp` adds to the SDK's tool context. */
-interface BetterToolExtra<M extends AnyModels = AnyModels, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown, P = unknown> {
+interface BetterToolExtra<M extends AnyModels = AnyModels, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown, P = unknown, B = unknown> {
   /** Repositories bound to the verified caller, with RLS. */
-  readonly db: ServerContext$1<M, F, E, C, P>["db"];
+  readonly db: ServerContext$1<M, F, E, C, P, B>["db"];
   readonly auth: AuthState<C, P>;
   /** The full server context: `db`, `auth`, `supabase` and the rest. */
-  readonly bs: ServerContext$1<M, F, E, C, P>;
+  readonly bs: ServerContext$1<M, F, E, C, P, B>;
 }
-type BetterToolContext<M extends AnyModels = AnyModels, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown, P = unknown> = ServerContext & BetterToolExtra<M, F, E, C, P>;
+type BetterToolContext<M extends AnyModels = AnyModels, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown, P = unknown, B = unknown> = ServerContext & BetterToolExtra<M, F, E, C, P, B>;
 interface BetterToolConfig<InputArgs extends StandardSchemaWithJSON | undefined, OutputArgs extends StandardSchemaWithJSON | undefined> {
   readonly title?: string;
   readonly description?: string;
@@ -83,8 +83,8 @@ interface BetterToolConfig<InputArgs extends StandardSchemaWithJSON | undefined,
 type ToolReturn = CallToolResult | InputRequiredResult | Promise<CallToolResult | InputRequiredResult>;
 type BetterToolCallback<InputArgs extends StandardSchemaWithJSON | undefined, Ctx> = InputArgs extends StandardSchemaWithJSON ? (args: StandardSchemaWithJSON.InferOutput<InputArgs>, ctx: Ctx) => ToolReturn : (ctx: Ctx) => ToolReturn;
 /** An SDK server whose tool callbacks also get `db`, `auth` and `bs`. */
-type BetterMcpServer<S, M extends AnyModels = AnyModels, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown, P = unknown> = Omit<S, "registerTool"> & {
-  registerTool<OutputArgs extends StandardSchemaWithJSON | undefined = undefined, InputArgs extends StandardSchemaWithJSON | undefined = undefined>(name: string, config: BetterToolConfig<InputArgs, OutputArgs>, cb: BetterToolCallback<InputArgs, BetterToolContext<M, F, E, C, P>>): RegisteredTool;
+type BetterMcpServer<S, M extends AnyModels = AnyModels, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown, P = unknown, B = unknown> = Omit<S, "registerTool"> & {
+  registerTool<OutputArgs extends StandardSchemaWithJSON | undefined = undefined, InputArgs extends StandardSchemaWithJSON | undefined = undefined>(name: string, config: BetterToolConfig<InputArgs, OutputArgs>, cb: BetterToolCallback<InputArgs, BetterToolContext<M, F, E, C, P, B>>): RegisteredTool;
 };
 /** The structural part of `McpServer` (or a wrapper of it) that `withBetterSupabaseMcp` needs. */
 interface ToolRegistrar {
@@ -96,13 +96,13 @@ interface ToolRegistrar {
  * tokens locally, serves the RFC 9728 metadata, and binds repositories to
  * the caller. Pair it with `withBetterSupabaseMcp` and `createMcpHandler`.
  */
-export declare function createMcpAuth<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: McpAuthOptions): BetterMcpAuth<M, F, E, C, P>;
+export declare function createMcpAuth<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P, B>, options?: McpAuthOptions): BetterMcpAuth<M, F, E, C, P, B>;
 /**
  * Wraps `server.registerTool` so every tool callback gets `db`, `auth` and
  * `bs` for the caller on its context. Wrap after an authorization wrapper
  * so permissions are checked before the context is built.
  */
-export declare function withBetterSupabaseMcp<S extends ToolRegistrar, M extends AnyModels, F extends AnyFunctions, E, C, P>(server: S, auth: Pick<BetterMcpAuth<M, F, E, C, P>, "contextOf">): BetterMcpServer<S, M, F, E, C, P>;
+export declare function withBetterSupabaseMcp<S extends ToolRegistrar, M extends AnyModels, F extends AnyFunctions, E, C, P, B>(server: S, auth: Pick<BetterMcpAuth<M, F, E, C, P, B>, "contextOf">): BetterMcpServer<S, M, F, E, C, P>;
 //#endregion
 //#region src/mcp/sdk/supabase.d.ts
 type UserAuth<C, P> = Extract<AuthState<C, P>, {
@@ -132,6 +132,6 @@ interface SupabaseMcpLoaders {
  * `authorize`, then a server built for the request with the Management API
  * token from `credentials`. The server closes when its response ends.
  */
-export declare function supabaseMcpHandler<M extends AnyModels, F extends AnyFunctions, E, C, P>(auth: Pick<BetterMcpAuth<M, F, E, C, P>, "serve">, options: SupabaseMcpHandlerOptions<C, P>, loaders?: SupabaseMcpLoaders): (request: Request) => Promise<Response>;
+export declare function supabaseMcpHandler<M extends AnyModels, F extends AnyFunctions, E, C, P, B>(auth: Pick<BetterMcpAuth<M, F, E, C, P, B>, "serve">, options: SupabaseMcpHandlerOptions<C, P>, loaders?: SupabaseMcpLoaders): (request: Request) => Promise<Response>;
 //#endregion
 export type { AllowedCaller, BetterMcpAuth, BetterMcpServer, BetterToolCallback, BetterToolConfig, BetterToolContext, BetterToolExtra, GuardOptions, McpAuthOptions, McpFetchHandler, SupabaseMcpFeature, SupabaseMcpHandlerOptions, SupabaseMcpLoaders, SupabaseMcpModule, SupabaseMcpPlatformModule, SupabaseMcpScope, ToolRegistrar };

package/dist/mcp/sdk/index.js

@@ -1,8 +1,8 @@
-import { n as dbError } from "../../errors-8i6tSICm.js";
-import { o as problemResponse } from "../../problem-pIiL3WbE.js";
-import { i as delegationOf } from "../../actor-KHDOKGb1.js";
-import { c as extendServer, i as resolveToken, n as flushEvents, s as createServer } from "../../adapter-CEjmtazZ.js";
-import { r as guard } from "../../respond-DdhZ9Wbn.js";
+import { n as dbError } from "../../errors-BV1SKTVs.js";
+import { o as problemResponse } from "../../problem-JRCohp1j.js";
+import { i as delegationOf } from "../../actor-CAL8mMih.js";
+import { c as extendServer, i as resolveToken, n as flushEvents, s as createServer } from "../../adapter-B2WRsRIg.js";
+import { r as guard } from "../../respond-Bhp3G__q.js";
 import { t as withExtra } from "../../extra-CGQ2_q3S.js";
 import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../../http-DdYadv-o.js";
 import { n as loadSupabaseMcp, r as loadSupabaseMcpPlatform, t as isRecord } from "../../supabase-mcp-DomZ-amK.js";

package/dist/{messages-Cx4ttLJJ.js → messages-D5nIfCCf.js}

@@ -1,7 +1,7 @@
-import { n as dbError } from "./errors-8i6tSICm.js";
+import { n as dbError } from "./errors-BV1SKTVs.js";
 import { s as nowInstant } from "./temporal-CB5Fpo5d.js";
 import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { o as problemResponse } from "./problem-pIiL3WbE.js";
+import { o as problemResponse } from "./problem-JRCohp1j.js";
 //#region src/ai-sdk/gateway.ts
 const count = (value) => typeof value === "number" && Number.isFinite(value) ? value : 0;
 /** Parses a USD amount (`"0.00042"` or a number) into micro-USD. */

package/dist/{options-BQ07tTYr.js → methods-7u6vSgz_.js}

@@ -1,11 +1,11 @@
 import { n as blockOptions, r as option } from "./options-BMjcVuaI.js";
+//#region src/blocks/shared-signals/options.ts
+const sharedSignalsSqlOptions = blockOptions({ retention: option.string({ default: "7 days" }) });
+//#endregion
 //#region src/blocks/shared-signals/methods.ts
 /** RFC 8935 push delivery, as SSF names it in `delivery.method`. */
 const SSF_PUSH = "urn:ietf:rfc:8935";
 /** RFC 8936 poll delivery. */
 const SSF_POLL = "urn:ietf:rfc:8936";
 //#endregion
-//#region src/blocks/shared-signals/options.ts
-const sharedSignalsSqlOptions = blockOptions({ retention: option.string({ default: "7 days" }) });
-//#endregion
-export { SSF_POLL as n, SSF_PUSH as r, sharedSignalsSqlOptions as t };
+export { SSF_PUSH as n, sharedSignalsSqlOptions as r, SSF_POLL as t };

package/dist/{mfa-DtflCXEt.d.ts → mfa-YzkRjNad.d.ts}

@@ -1,4 +1,4 @@
-import { b as DbError } from "./result-Cj3yWhjH.js";
+import { b as DbError } from "./result-BREt7qOh.js";
 //#region src/auth/mfa.d.ts
 /** Authenticator assurance level: `aal2` once a second factor is verified in this session. */
 type Aal = "aal1" | "aal2";

package/dist/{model-messages-CTu-6kBu.js → model-messages-CIdqdUtk.js}

@@ -1,5 +1,5 @@
 import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { a as meta } from "./messages-Cx4ttLJJ.js";
+import { a as meta } from "./messages-D5nIfCCf.js";
 //#region src/ai-sdk/model-messages.ts
 const FETCHABLE_URL = /^(?:https?|data):/u;
 function fileUrl(data) {

package/dist/{money-codec-C_-K5ZUU.js → money-codec-C21MWw50.js}

@@ -1,5 +1,5 @@
-import { n as dbError } from "./errors-8i6tSICm.js";
-import { a as bigintOf, x as optionalBigintOf } from "./block-helpers-CfG_MvDR.js";
+import { n as dbError } from "./errors-BV1SKTVs.js";
+import { a as bigintOf, x as optionalBigintOf } from "./block-helpers-DkVZNDrj.js";
 import { d as money, s as isCurrency } from "./money-95Rff2vT.js";
 //#region src/blocks/money-codec.ts
 /**

package/dist/nestjs/index.d.ts

@@ -1,6 +1,6 @@
-import { n as RouteGuardOptions } from "../refusal-oD3ISM9h.js";
+import { n as RouteGuardOptions } from "../refusal-CufncwaN.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
-import { l as ToNodeOptions } from "../index-Brhm22eL.js";
+import { l as ToNodeOptions } from "../index-Bq409YZn.js";
 import { AnyEntry } from "@supabase/middleware";
 import { IncomingMessage, ServerResponse } from "node:http";
 //#region src/nestjs/index.d.ts

package/dist/nestjs/index.js

@@ -1,4 +1,4 @@
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-br4Ma9Cf.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-CFpfmjcS.js";
 import { t as beforeRoute } from "../before-route-B98js9m_.js";
 import { t as applyWebHeaders } from "../node-headers-C71zNQHe.js";
 import { n as toWebRequest, t as sendWebResponse } from "../http-Cv4T29xh.js";

package/dist/next/index.d.ts

@@ -1,22 +1,22 @@
-import { a as AnyModels, i as AnyFunctions } from "../types-YfwpIE-d.js";
-import { r as AuthState } from "../resolve-w9EpHzuM.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
+import { r as AuthState } from "../resolve-Bqb8TMTt.js";
 import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
-import { Wt as DbStats, at as QuerySpec, q as ReadSet, s as CacheAdapter, t as BetterSupabase } from "../define-DxHHbNEb.js";
+import { Wt as DbStats, at as QuerySpec, q as ReadSet, s as CacheAdapter, t as BetterSupabase } from "../define-M_r1d2AT.js";
 import { n as Impersonator } from "../impersonation-D5chOkrO.js";
-import { C as supportSessions, S as SupportStartRequest, b as SupportPolicy, g as ActiveSupport, i as ServerContext, n as ContextOptions, s as ServerOptions, t as BetterServer, x as SupportSessions, y as SupportOptions } from "../server-types-OohhIQb2.js";
-import { n as AmrEntry, t as Aal } from "../mfa-DtflCXEt.js";
-import { t as tenantOf } from "../tenant-DdmVhsff.js";
-import { n as toSession, t as AuthSession } from "../view-Dv0A949a.js";
-import { t as AuthOutageHook } from "../session-DiWHtYrO.js";
-import { n as AuthKind, r as GuardOptions } from "../respond-C7I8kLK_.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-D5S7KNFe.js";
-import { r as LiveCountSeed, t as CountRunner } from "../index-BIi8i6BO.js";
-import { r as MembershipClaim } from "../entitlements-CbzCKalR.js";
-import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-D2vEQVXI.js";
-import { t as ResourceMap } from "../resources-BklF-rjz.js";
-import { t as defineAction } from "../resource-execute-D0yQ-8WR.js";
-import { i as tagFor, t as TagOptions } from "../tags-Dw8vKkcI.js";
-import { n as supportOf, t as SupportView } from "../support-view-BbcZR7Io.js";
+import { C as SupportSessions, S as SupportPolicy, T as supportSessions, a as ServerContext, c as ServerOptions, l as SharedServer, n as BetterServer, r as ContextOptions, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions } from "../server-types-BKN_R4Ws.js";
+import { n as AmrEntry, t as Aal } from "../mfa-YzkRjNad.js";
+import { t as tenantOf } from "../tenant-BNp3kBAG.js";
+import { n as toSession, t as AuthSession } from "../view-Bf7e07rQ.js";
+import { t as AuthOutageHook } from "../session-CwpfitmI.js";
+import { n as AuthKind, r as GuardOptions } from "../respond-CEBC6KUX.js";
+import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-BeZX2pR_.js";
+import { r as LiveCountSeed, t as CountRunner } from "../index-qCG78-Rf.js";
+import { r as MembershipClaim } from "../entitlements-DgkeStXd.js";
+import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-CGr0BbL-.js";
+import { t as ResourceMap } from "../resources-BiQpsM6O.js";
+import { t as defineAction } from "../resource-execute-ruP2L1op.js";
+import { i as tagFor, t as TagOptions } from "../tags-AUpl4Ob9.js";
+import { n as supportOf, t as SupportView } from "../support-view-IRnDLuGN.js";
 import { NextRequest } from "next/server.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/collector.d.ts
@@ -53,6 +53,11 @@ interface NextResourceRoutes {
 //#endregion
 //#region src/next/types.d.ts
 interface NextOptions extends ServerOptions {
+  /**
+   * An existing server, such as the one `createHono` returned, so both
+   * frameworks share one `createServer`. The server options are then ignored.
+   */
+  readonly server?: SharedServer;
   /** Invalidate `tagFor(table)` cache tags after mutations. Defaults to true. */
   readonly cacheTags?: boolean;
   /** Include internal error messages in Problem Details. Defaults to development only. */
@@ -152,7 +157,7 @@ interface ScopeOptions {
    */
   readonly tenant?: string;
 }
-interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Ref = string> extends BetterServer<M, F, E, C, P> {
+interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Ref = string, B = unknown> extends BetterServer<M, F, E, C, P, B> {
   /** `proxy.ts`: refreshes sessions for page loads and server actions. */
   proxy(request: NextRequest, options?: ProxyOptions<C, P>): Promise<Response>;
   /**
@@ -163,8 +168,8 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * const { db } = await bs.context({ tenant: organizationId });
    * ```
    */
-  context(options?: ScopeOptions): Promise<ServerContext<M, F, E, C, P>>;
-  context(request: Request | undefined, options?: ContextOptions): Promise<ServerContext<M, F, E, C, P>>;
+  context(options?: ScopeOptions): Promise<ServerContext<M, F, E, C, P, B>>;
+  context(request: Request | undefined, options?: ContextOptions): Promise<ServerContext<M, F, E, C, P, B>>;
   /**
    * The verified caller as serializable data (no token, no clients), memoized
    * per request. Wrap it in a `'use cache: private'` function with Cache
@@ -178,7 +183,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    */
   contextForSession(session: AuthSession<C, P>, options: {
     readonly token: string | null;
-  }): Promise<ServerContext<M, F, E, C, P>>;
+  }): Promise<ServerContext<M, F, E, C, P, B>>;
   /**
    * First statement of an app-authored `'use cache: private'` function: sets
    * `cacheLife` from the session's expiry (`sessionStale`, capped by
@@ -193,7 +198,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * }
    * ```
    */
-  cached(options?: CachedOptions<Extract<keyof M, string>>): Promise<CachedContext<M, F, E, C, P>>;
+  cached(options?: CachedOptions<Extract<keyof M, string>>): Promise<CachedContext<M, F, E, C, P, B>>;
   /**
    * Drops every `bs.cached()` entry of a user, e.g. after a role change,
    * and the entries tagged with `tags` (such as a permission snapshot's tag).
@@ -214,7 +219,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    */
   liveCount<T extends Extract<keyof M, string>>(spec: QuerySpec<T, "count", number>, db?: CountRunner): Promise<LiveCountSeed<T>>;
   /** Route handler with auth, Result unwrapping and Problem Details errors. */
-  route<Params = Record<string, string | string[]>, R extends boolean = false>(handler: (request: NextRequest, ctx: ServerContext<M, F, E, C, P> & AuthorizedContext<C, P, R> & {
+  route<Params = Record<string, string | string[]>, R extends boolean = false>(handler: (request: NextRequest, ctx: ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R> & {
     readonly params: Params;
   }) => unknown, options?: RouteOptions<C, P, R, Ref>): (request: NextRequest, segment: {
     readonly params: Promise<Params>;
@@ -229,7 +234,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * );
    * ```
    */
-  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: ActionOptions<S, C, P, R, Ref>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C, P> & AuthorizedContext<C, P, R>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: ActionOptions<S, C, P, R, Ref>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
   /**
    * For Server Components: the caller's context, or the Next.js interrupt
    * for a refused caller. `unauthorized` calls `unauthorized()`, `forbidden`
@@ -240,7 +245,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * const { db, tenant } = await bs.require({ requireTenant: true, roles: ['admin'] });
    * ```
    */
-  require<R extends boolean = false>(options?: RequireOptions<C, P, R, Ref>): Promise<ServerContext<M, F, E, C, P> & AuthorizedContext<C, P, R>>;
+  require<R extends boolean = false>(options?: RequireOptions<C, P, R, Ref>): Promise<ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>;
   /**
    * REST resources for a catch-all route, matching the API model:
    * collections, items and actions, as the caller (RLS), behind the guard in
@@ -254,7 +259,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * );
    * ```
    */
-  resources(map: ResourceMap<M, Ref, ServerContext<M, F, E, C, P>["db"]>, options?: NextResourcesOptions): NextResourceRoutes;
+  resources(map: ResourceMap<M, Ref, ServerContext<M, F, E, C, P, B>["db"]>, options?: NextResourcesOptions): NextResourceRoutes;
   /**
    * Tags the current `"use cache"` scope with a table (and row) tag. With a
    * `tenant`, mutations in other tenants leave the entry cached.
@@ -329,7 +334,7 @@ interface CachedOptions<T extends string = string> extends ScopeOptions {
   /** With `tables`, also tags the row `bs:<first table>:<id>`. */
   readonly id?: string | number;
 }
-type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> = ServerContext<M, F, E, C, P> & {
+type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> = ServerContext<M, F, E, C, P, B> & {
   readonly session: AuthSession<C, P>;
 };
 interface NextCacheOptions {
@@ -363,9 +368,9 @@ interface RequireAalOptions {
  * export const bs = createNext(betterSupabase);
  * ```
  */
-export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, A extends AnyAuthorizer | undefined = undefined>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: NextOptions & {
+export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, A extends AnyAuthorizer | undefined = undefined, B = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P, B>, options?: NextOptions & {
   readonly authorizer?: A;
-}): BetterNext<M, F, E, C, P, PermissionRef<A>>;
+}): BetterNext<M, F, E, C, P, PermissionRef<A>, B>;
 //#endregion
 //#region src/next/cache.d.ts
 /** The tag `bs.cached()` adds to entries rendered in a support session. */