cloudflare-next-intl 0.7.7 → 0.8.0

package/dist/src/firebase_auth/server/mint_server_app_check_token.js

@@ -1,5 +1,6 @@
 import config from '@intl-config';
 import reportError from '../../error_handling/report_error';
+import signCustomTokenRemote from './sign_custom_token_remote';
 // Matches `firebase-admin`'s own `AppCheckTokenGenerator.createCustomToken`
 // exactly (`token-generator.js`) — this specific audience (the App Check
 // TOKEN EXCHANGE service, not the App Check API resource name itself) is
@@ -21,36 +22,63 @@ const CUSTOM_TOKEN_LIFETIME = '5m';
  * Mints a fresh App Check token server-side via a service account, for use
  * when the client-written App Check cookie (see `appCheckTokenCookieName`)
  * is absent — e.g. a cold navigation before `AuthUserProvider` has run and
- * had a chance to write it. Requires `clientEmail`/`privateKey`/`appId` on
- * `firebaseAuth.appCheck`; returns `undefined` (never throws) if the
- * exchange fails, so a caller can always fall back to "no App Check token"
- * exactly as before this existed.
+ * had a chance to write it. Requires `clientEmail`/`appId` on
+ * `firebaseAuth.appCheck`, plus either `privateKey` or the
+ * `oauthClientId`/`oauthClientSecret`/`oauthRefreshToken` triple; returns
+ * `undefined` (never throws) if the exchange fails, so a caller can always
+ * fall back to "no App Check token" exactly as before this existed.
  *
- * Signs a short-lived custom JWT with the service account's private key
- * (`jose`, Edge/WebCrypto-compatible — no `firebase-admin`), then exchanges
- * it for an App Check token via `exchangeCustomToken`, authenticated with
- * the project's Web API key (`?key=`) — `exchangeCustomToken` otherwise
- * rejects the call outright as an unregistered/unidentified caller
- * (403 `PERMISSION_DENIED`), before the custom token itself is even
- * evaluated. Not cached beyond the caller's own request-scoped `cache()`
- * wrapper — a fresh mint costs one signing operation plus one network
- * round-trip, acceptable per-request but not worth doing more than once per
- * request.
+ * Signs a short-lived custom JWT, then exchanges it for an App Check token
+ * via `exchangeCustomToken`, authenticated with the project's Web API key
+ * (`?key=`) — `exchangeCustomToken` otherwise rejects the call outright as
+ * an unregistered/unidentified caller (403 `PERMISSION_DENIED`), before the
+ * custom token itself is even evaluated. Not cached beyond the caller's own
+ * request-scoped `cache()` wrapper — a fresh mint costs one signing
+ * operation plus one network round-trip, acceptable per-request but not
+ * worth doing more than once per request.
+ *
+ * The custom token is signed one of two ways, `privateKey` taking priority
+ * when both are set:
+ * - `privateKey` set: signed locally (`jose`, Edge/WebCrypto-compatible —
+ *   no `firebase-admin`).
+ * - OAuth triple set instead: signed remotely via
+ *   `sign_custom_token_remote.ts` (IAM Credentials `signJwt`) — the way to
+ *   mint tokens when a GCP org policy blocks creating the service-account
+ *   key `privateKey` would otherwise require.
  */
 export default async function mintServerAppCheckToken(projectId, apiKey, appCheck) {
-    if (!appCheck?.clientEmail || !appCheck.privateKey || !appCheck.appId)
+    if (!appCheck?.clientEmail || !appCheck.appId)
+        return undefined;
+    const hasOauthTriple = appCheck.oauthClientId && appCheck.oauthClientSecret && appCheck.oauthRefreshToken;
+    if (!appCheck.privateKey && !hasOauthTriple)
         return undefined;
     try {
-        const { SignJWT, importPKCS8 } = await import('jose');
-        const privateKey = await importPKCS8(appCheck.privateKey.replace(/\\n/g, '\n'), 'RS256');
-        const customToken = await new SignJWT({ app_id: appCheck.appId })
-            .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
-            .setIssuer(appCheck.clientEmail)
-            .setSubject(appCheck.clientEmail)
-            .setAudience(APP_CHECK_CUSTOM_TOKEN_AUDIENCE)
-            .setIssuedAt()
-            .setExpirationTime(CUSTOM_TOKEN_LIFETIME)
-            .sign(privateKey);
+        const claims = {
+            iss: appCheck.clientEmail,
+            sub: appCheck.clientEmail,
+            aud: APP_CHECK_CUSTOM_TOKEN_AUDIENCE,
+            iat: Math.floor(Date.now() / 1000),
+            exp: Math.floor(Date.now() / 1000) + 300,
+            app_id: appCheck.appId,
+        };
+        const customToken = appCheck.privateKey
+            ? await (async () => {
+                const { SignJWT, importPKCS8 } = await import('jose');
+                const privateKey = await importPKCS8(appCheck.privateKey.replace(/\\n/g, '\n'), 'RS256');
+                return new SignJWT({ app_id: appCheck.appId })
+                    .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
+                    .setIssuer(appCheck.clientEmail)
+                    .setSubject(appCheck.clientEmail)
+                    .setAudience(APP_CHECK_CUSTOM_TOKEN_AUDIENCE)
+                    .setIssuedAt()
+                    .setExpirationTime(CUSTOM_TOKEN_LIFETIME)
+                    .sign(privateKey);
+            })()
+            : await signCustomTokenRemote(appCheck.clientEmail, claims, {
+                clientId: appCheck.oauthClientId,
+                clientSecret: appCheck.oauthClientSecret,
+                refreshToken: appCheck.oauthRefreshToken,
+            });
         const url = `https://firebaseappcheck.googleapis.com/v1/projects/${projectId}/apps/${appCheck.appId}:exchangeCustomToken?key=${apiKey}`;
         const res = await fetch(url, {
             method: 'POST',

package/dist/src/firebase_auth/server/sign_custom_token_remote.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Signs the App Check custom token claims remotely via IAM Credentials'
+ * `signJwt`, instead of locally with a service-account private key. Lets
+ * `mintServerAppCheckToken` work under an org policy that enforces
+ * `iam.disableServiceAccountKeyCreation` — that constraint blocks
+ * `serviceAccounts.keys.create` only; it does not affect `signJwt`, which
+ * signs using a key Google holds and never exports.
+ *
+ * The caller's OAuth identity (the refresh token) must carry
+ * `roles/iam.serviceAccountTokenCreator` on `clientEmail` — grant it with:
+ * `gcloud iam service-accounts add-iam-policy-binding <clientEmail>
+ *   --member="user:<you>" --role="roles/iam.serviceAccountTokenCreator"`.
+ */
+export default function signCustomTokenRemote(clientEmail: string, claims: Record<string, unknown>, oauth: {
+    clientId: string;
+    clientSecret: string;
+    refreshToken: string;
+}): Promise<string>;

package/dist/src/firebase_auth/server/sign_custom_token_remote.js

@@ -0,0 +1,39 @@
+/**
+ * Signs the App Check custom token claims remotely via IAM Credentials'
+ * `signJwt`, instead of locally with a service-account private key. Lets
+ * `mintServerAppCheckToken` work under an org policy that enforces
+ * `iam.disableServiceAccountKeyCreation` — that constraint blocks
+ * `serviceAccounts.keys.create` only; it does not affect `signJwt`, which
+ * signs using a key Google holds and never exports.
+ *
+ * The caller's OAuth identity (the refresh token) must carry
+ * `roles/iam.serviceAccountTokenCreator` on `clientEmail` — grant it with:
+ * `gcloud iam service-accounts add-iam-policy-binding <clientEmail>
+ *   --member="user:<you>" --role="roles/iam.serviceAccountTokenCreator"`.
+ */
+export default async function signCustomTokenRemote(clientEmail, claims, oauth) {
+    const tokenRes = await fetch('https://oauth2.googleapis.com/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            client_id: oauth.clientId,
+            client_secret: oauth.clientSecret,
+            refresh_token: oauth.refreshToken,
+            grant_type: 'refresh_token',
+        }),
+    });
+    if (!tokenRes.ok) {
+        throw new Error(`oauth2 refresh_token exchange failed: ${tokenRes.status} ${await tokenRes.text()}`);
+    }
+    const { access_token: accessToken } = await tokenRes.json();
+    const signRes = await fetch(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${clientEmail}:signJwt`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ payload: JSON.stringify(claims) }),
+    });
+    if (!signRes.ok) {
+        throw new Error(`iamcredentials.signJwt failed: ${signRes.status} ${await signRes.text()}`);
+    }
+    const { signedJwt } = await signRes.json();
+    return signedJwt;
+}

package/dist/src/index.d.ts

@@ -4,3 +4,4 @@ export * from './server';
 export * from './client';
 export * from './theme_switcher';
 export * from './types';
+export * from './db';

package/dist/src/index.js

@@ -4,3 +4,4 @@ export * from './server';
 export * from './client';
 export * from './theme_switcher';
 export * from './types';
+export * from './db';

package/dist/src/types/types.d.ts

@@ -85,6 +85,14 @@ export interface RoutingConfig<AppLocales extends Locales, AppLocalePrefixMode e
      * if this field is missing at call time rather than silently no-op'ing.
      */
     firebaseAuth?: FirebaseAuthRoutingConfig;
+    /**
+     * Configures the optional `db` submodule (Postgres/Drizzle access over a
+     * Cloudflare Hyperdrive or plain connection string). Omit entirely to keep
+     * it fully disabled — no file in this package imports `pg`/`drizzle-orm`
+     * unless a `db` export is actually called, and every such export throws a
+     * clear error if this field is missing at call time.
+     */
+    db?: DbRoutingConfig;
     /**
      * Configures the optional `cookie_consent` submodule (cookie-consent +
      * privacy-policy-update banners). Omit entirely to keep it disabled —
@@ -621,9 +629,10 @@ export interface FirebaseAppCheckConfig {
      * Service account client email, used ONLY server-side to mint an App
      * Check token when the client-written App Check cookie is absent (e.g.
      * a cold navigation before `AuthUserProvider` has run — see
-     * `appCheckTokenCookieName`). Required alongside `privateKey` and
-     * `appId` for server-side minting. Never sent to the client — read only
-     * by `firebase_server.ts`.
+     * `appCheckTokenCookieName`). Required alongside `appId`, plus either
+     * `privateKey` or the `oauthClientId`/`oauthClientSecret`/
+     * `oauthRefreshToken` triple, for server-side minting. Never sent to the
+     * client — read only by `firebase_server.ts`.
      */
     clientEmail: string;
     /**
@@ -633,13 +642,35 @@ export interface FirebaseAppCheckConfig {
      * (e.g. `process.env.FIREBASE_PRIVATE_KEY`), never exposed to the
      * browser. Escaped `\n` sequences (common when stored in a single-line
      * env var) are unescaped automatically before use.
-     */
-    privateKey: string;
+     *
+     * Omit this and set the `oauthClientId`/`oauthClientSecret`/
+     * `oauthRefreshToken` triple instead when your GCP org enforces
+     * `iam.disableServiceAccountKeyCreation`, which blocks issuing this key
+     * in the first place. When both are set, `privateKey` takes priority.
+     */
+    privateKey?: string;
+    /**
+     * Application Default Credentials OAuth client ID — the `client_id`
+     * field from `application_default_credentials.json` (see
+     * `gcloud auth application-default login`). Paired with
+     * `oauthClientSecret` and `oauthRefreshToken` as an alternative to
+     * `privateKey`: instead of signing the App Check custom token locally,
+     * it's signed remotely via IAM Credentials `signJwt`, authenticated as
+     * this OAuth identity. That identity needs
+     * `roles/iam.serviceAccountTokenCreator` on `clientEmail`. Use this when
+     * a service-account key can't be created (see `privateKey`). Ignored
+     * when `privateKey` is set.
+     */
+    oauthClientId?: string;
+    /** OAuth client secret paired with `oauthClientId`. Same ADC-JSON `client_secret` field, same secret-handling rules as `privateKey`. */
+    oauthClientSecret?: string;
+    /** OAuth refresh token paired with `oauthClientId`. Same ADC-JSON `refresh_token` field, same secret-handling rules as `privateKey`. */
+    oauthRefreshToken?: string;
     /**
      * Firebase App Check app ID (e.g. `"1:1234567890:web:abcdef123456"`),
-     * required alongside `clientEmail`/`privateKey` for server-side minting.
-     * Distinct from the Firebase Auth `appId` on `FirebaseAuthRoutingConfig`
-     * itself — App Check registers apps separately.
+     * required alongside `clientEmail` for server-side minting. Distinct
+     * from the Firebase Auth `appId` on `FirebaseAuthRoutingConfig` itself —
+     * App Check registers apps separately.
      */
     appId: string;
 }
@@ -786,3 +817,86 @@ export interface IntlSitemap {
     lastModified: Date | string | undefined;
     videos?: Videos[] | undefined;
 }
+export interface SupabaseDbConfig {
+    /**
+     * Supabase project URL, e.g. `https://abc.supabase.co`. Defaults to
+     * `process.env.NEXT_PUBLIC_SUPABASE_URL`.
+     */
+    url?: string;
+    /**
+     * Supabase anon (publishable) key. Defaults to
+     * `process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY`. This is the only key the
+     * `db` module ever needs — never put a service-role key here.
+     */
+    anonKey?: string;
+    /**
+     * Name of the Postgres function that runs the generated SQL. Defaults to
+     * `'cfni_exec'` — the function shipped in `supabase/cfni_exec.sql`.
+     */
+    execFunction?: string;
+}
+export interface DbRoutingConfig {
+    /**
+     * Postgres connection string. Omit to resolve it from the Cloudflare
+     * Hyperdrive binding named by `hyperdriveBinding` instead (the normal
+     * production setup); a value here always wins over the binding, which is
+     * what makes local dev / build-time evaluation work.
+     */
+    connectionString?: string;
+    /**
+     * Name of the Hyperdrive binding on `env` whose `connectionString` is used
+     * when `connectionString` is not set. Defaults to `'HYPERDRIVE'`. Requires
+     * `generate.getCloudflareContext` to be configured.
+     */
+    hyperdriveBinding?: string;
+    /**
+     * Whether the pooled client is closed once the last in-flight
+     * `withPublicDb`/`withUserDb` call of the request finishes.
+     * Defaults to `true` (one connection per request, released to Hyperdrive
+     * immediately). Set `false` to keep the connection open for the lifetime
+     * of the isolate — faster for a long-lived server, but it holds a
+     * Hyperdrive connection slot between requests.
+     */
+    disconnectAfterRequest?: boolean;
+    /**
+     * Postgres role assumed inside `withUserDb`'s transaction. Defaults
+     * to `'authenticated'` (the Supabase RLS convention).
+     */
+    authenticatedRole?: string;
+    /**
+     * Resolves the user id injected as `request.jwt.claims->>'sub'` inside
+     * `withUserDb`. Omit when `firebaseAuth` is configured — the uid then
+     * comes from this package's own `getAuthUser()` automatically. Provide it
+     * to use a different auth source (or when `firebaseAuth` is absent).
+     */
+    getUserId?: () => Promise<string | null> | string | null;
+    /** Milliseconds `disconnectPostgres` waits for `client.end()` before giving up. Defaults to `2000`. */
+    disconnectTimeoutMs?: number;
+    /**
+     * Reaches Postgres through the Supabase Data API instead of a direct
+     * connection, using only your project URL and anon key. Set this when you
+     * have no Postgres password to give the package — `withPublicDb` and
+     * `withUserDb` behave the same either way, so switching is a config change
+     * with no app-code change.
+     *
+     * Ignored when `connectionString` or `hyperdriveBinding` is set: a direct
+     * connection always wins, so adding this block cannot silently reroute
+     * live traffic. Requires the `cfni_exec` function from
+     * `supabase/cfni_exec.sql` to be installed in your database.
+     *
+     * No multi-statement transactions: unlike connection-string mode, each
+     * statement inside a `withUserDb` callback is its own round-trip. Do not
+     * rely on multi-statement atomicity in this mode.
+     */
+    supabase?: SupabaseDbConfig;
+    /**
+     * Resolves the JWT sent as `Authorization: Bearer` for `withUserDb` in
+     * Supabase mode, which is what makes PostgREST resolve the caller as
+     * `authenticated` and apply RLS. Omit when `firebaseAuth` is configured —
+     * the signed-in user's Firebase ID token is then used automatically.
+     *
+     * Unused in connection-string mode, which identifies the user with
+     * `getUserId` and `set_config` instead.
+     */
+    getAccessToken?: () => Promise<string | null> | string | null;
+}

package/llms.txt

@@ -23,6 +23,8 @@ other subpath can be used.
 - `./localeStaticParams` — `generateStaticParams` helper for locale segments.
 - `./use` — `useLocale`/`useTranslations`; resolves to the RSC or client implementation automatically via the `react-server` export condition. Both throw `"... must be used within an IntlProvider"` if called outside one.
 - `./ThemeSwitcher` — optional light/dark toggle component.
+- `./db` — `withPublicDb(fn)` / `withUserDb(fn, uid?)` server-side Postgres/Drizzle context helpers (require `db` set on your `RoutingConfig`; direct Postgres or Supabase Data API, see below).
+- `./dbHelpers` — generic Drizzle SQL helper functions (`excluded`, `onConflictSet`, `ago`, `currentDate`, `windowCount`, `unnestLateral`, `ascNullsLast`, `alwaysTrue`, `lateral`, `aliasColumn`, `minOf`, `maxOf`, `roundReal`, `multiply`, `scalarFromCte`) for use with `./db`.
 
 ## `firebaseAuth*` subpaths (require `firebaseAuth` set on your `RoutingConfig`)
 
@@ -44,6 +46,38 @@ other subpath can be used.
 - `./cookieConsentAnalytics` — `CookieConsentAnalytics`: gates Cloudflare Web Analytics / Google Ads / Google Analytics / AdSense / Microsoft Clarity behind consent; rendered automatically by `IntlProvider` when `cookieConsent.secrets` or `getSecrets` is set (and `autoWireAnalytics !== false`). Never renders in local dev (`NODE_ENV === 'development'`) unless `cookieConsent.enableAnalyticsInDevMode` is `true`.
 - Country-based gating (`cookieConsent.getCountryCode` / `getCloudflareContext` + `gdprCountries`): resolved server-side by `IntlProvider` into a `requiresConsent` boolean passed to `CookieConsentProvider`. Neither getter set → gating off, consent always implicitly granted. `getCountryCode` (direct country resolver) takes precedence over `getCloudflareContext` (reads `cf.country`) when both are set. `getCloudflareContext` accepts `@opennextjs/cloudflare`'s `getCloudflareContext` function directly (its exact overloaded signature — `CookieConsentGetCloudflareContext`), called internally with `{ async: true }`. Unresolved country (or a `null` context) always requires consent (fail-safe). `./cookieConsent` also exports `defaultGdprCountries` (EU/EEA + UK + Switzerland).
 
+## `db*` subpaths (require `db` set on your `RoutingConfig`)
+
+Two transports, picked by which `db` fields are set — `pg`/`drizzle-orm`/`@supabase/supabase-js` ship as dependencies and load via dynamic `import()`, so nothing bundles unless a `db` export is called.
+
+- Direct Postgres (wins if configured): `db.connectionString` — Postgres connection string; when omitted, resolved from the Hyperdrive binding named by `db.hyperdriveBinding` (default `'HYPERDRIVE'`) via `generate.getCloudflareContext`. An explicit `connectionString` always wins (enables local dev / build-time evaluation).
+- Supabase Data API (used only when neither of the above is set): `db.supabase` — `{ url?, anonKey?, execFunction? }`, defaulting `url`/`anonKey` to `NEXT_PUBLIC_SUPABASE_URL`/`NEXT_PUBLIC_SUPABASE_ANON_KEY`. Requires installing `supabase/cfni_exec.sql` (a `security invoker` SQL-exec function) in your database. No multi-statement transactions — each statement in a `withUserDb` callback is its own round-trip.
+- `db.disconnectAfterRequest` — direct-Postgres mode only: closes the pooled client once the last in-flight `withPublicDb`/`withUserDb` call of the request finishes. Defaults to `true`; set `false` to keep the connection open for the isolate's lifetime (holds a Hyperdrive slot between requests).
+- `db.authenticatedRole` — direct-Postgres mode only: Postgres role assumed inside `withUserDb`'s transaction. Defaults to `'authenticated'` (Supabase RLS convention).
+- `db.getUserId` — direct-Postgres mode only: resolves the user id injected as `request.jwt.claims->>'sub'` in `withUserDb`. Omit when `firebaseAuth` is configured — the uid is then taken automatically from the signed-in Firebase user via this package's own `getAuthUser()`.
+- `db.getAccessToken` — Supabase mode only: resolves the JWT sent as `Authorization: Bearer` in `withUserDb`, which is what makes PostgREST resolve `authenticated` and apply RLS. Omit when `firebaseAuth` is configured — the signed-in user's Firebase ID token is used automatically.
+- `db.disconnectTimeoutMs` — direct-Postgres mode only: ms `disconnectPostgres` waits for `client.end()` before giving up. Defaults to `2000`.
+- `withPublicDb(fn)` — anonymous role. Direct-Postgres mode: the request's pooled connection, no transaction, no role switch. Supabase mode: the anon key as the PostgREST bearer token. Either way, no user id is attached — RLS keyed on `auth.jwt()` denies access.
+- `withUserDb(fn, uid?)` — signed-in-user role. Direct-Postgres mode: a transaction with `set_config('request.jwt.claims', ...)` + `set local role`, `uid` resolution order explicit arg → `db.getUserId()` → Firebase auth uid → throws. Supabase mode: identity rides on the JWT from `db.getAccessToken`/Firebase instead (`uid` param is ignored), no transaction wraps the call.
+- `./dbHelpers` functions are plain Drizzle `sql`-building utilities with no config dependency — usable standalone.
+
+```typescript
+// src/i18n/intl_config.ts
+import { getCloudflareContext } from "@opennextjs/cloudflare";
+
+export default setIntlConfig({
+    locales: ["en", "uk"] as const,
+    defaultLocale: "en",
+    generate: { getCloudflareContext },
+    db: { hyperdriveBinding: "HYPERDRIVE" },
+});
+
+// anywhere on the server
+import { withPublicDb } from "cloudflare-next-intl/db";
+
+const rows = await withPublicDb((db) => db.select().from(bonds).limit(10));
+```
+
 ## Conventions
 
 - Every exported function/component has a JSDoc comment with an `@example` where usage isn't obvious from the signature alone.
@@ -56,3 +90,4 @@ other subpath can be used.
 - Missing `firebaseAuth` on `RoutingConfig` throws immediately from any `firebaseAuth*` export, naming the missing config field.
 - `useLocale`/`useTranslations` (from `./use`) and `useAuthUser` (from `./useFirebaseAuthUser`) resolve to a Server- or Client-Component implementation automatically via the `react-server` export condition — always import from the subpath, never from an internal file path.
 - No unified `useFirebaseAuthUser` re-export inside `cloudflare-next-intl/firebaseAuth`'s barrel — that barrel can't replicate the `react-server` condition split, so import `cloudflare-next-intl/useFirebaseAuthUser` directly for the hook.
+- Missing `db` on `RoutingConfig` throws immediately from `withPublicDb`/`withUserDb`, naming the missing config field. `pg`, `drizzle-orm`, and `@supabase/supabase-js` ship as dependencies and load via dynamic `import()` — nothing to install yourself, and nothing bundles unless a `db` export is called.

package/package.json

@@ -1,13 +1,17 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.7.7",
+  "version": "0.8.0",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
-
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "sideEffects": false,
+  "bin": {
+    "cfni-db-codegen": "bin/db_codegen.mjs"
+  },
   "files": [
     "dist",
+    "bin",
+    "supabase",
     "LICENSE",
     "README.md",
     "llms.txt"
@@ -172,6 +176,14 @@
     "./createServerErrorAction": {
       "types": "./dist/src/error_handling/create_server_error_action.d.ts",
       "import": "./dist/src/error_handling/create_server_error_action.js"
+    },
+    "./db": {
+      "types": "./dist/src/db/index.d.ts",
+      "import": "./dist/src/db/index.js"
+    },
+    "./dbHelpers": {
+      "types": "./dist/src/db/helpers.d.ts",
+      "import": "./dist/src/db/helpers.js"
     }
   },
   "scripts": {
@@ -216,8 +228,11 @@
   "homepage": "https://github.com/demian-ilnytskyi/cloudflare-next-intl#readme",
   "dependencies": {
     "@microsoft/clarity": "^1.0.2",
+    "@supabase/supabase-js": "^2.112.3",
+    "drizzle-orm": "^0.45.2",
     "firebase": "^12.17.0",
-    "jose": "^6.2.8"
+    "jose": "^6.2.8",
+    "pg": "^8.23.0"
   },
   "peerDependencies": {
     "next": ">=12.0.0",
@@ -236,16 +251,18 @@
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^20.14.5",
+    "@types/pg": "^8.23.1",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitest/coverage-v8": "^3.2.7",
+    "drizzle-kit": "^0.31.10",
     "eslint": "^9.28.0",
     "eslint-config-next": "15.3.3",
     "eslint-config-prettier": "^10.1.2",
     "jsdom": "^29.1.1",
     "next": "^15.3.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "react": "19.2.0",
+    "react-dom": "19.2.0",
     "tsup": "^8.5.1",
     "typescript": "^5.5.3",
     "typescript-eslint": "^8.33.1",

package/supabase/cfni_exec.sql

@@ -0,0 +1,34 @@
+-- Executes a statement generated by cloudflare-next-intl's `db` module and
+-- returns its rows as positional JSON arrays, which is the shape
+-- drizzle-orm/pg-proxy maps result columns from.
+--
+-- SECURITY INVOKER is load-bearing: the statement runs with the privileges of
+-- the caller (anon or authenticated, per the request's JWT), so row-level
+-- security still applies exactly as it does over the REST API. Do not change
+-- this to SECURITY DEFINER, and do not add a role parameter — either would
+-- turn this into a privilege-escalation primitive.
+create or replace function public.cfni_exec(statement text, params jsonb default '[]'::jsonb)
+returns json
+language plpgsql
+security invoker
+as $$
+declare
+    result json;
+    args text[];
+begin
+    select coalesce(array_agg(value #>> '{}' order by ordinality), '{}')
+      into args
+      from jsonb_array_elements(params) with ordinality as t(value, ordinality);
+
+    execute format('select coalesce(json_agg(json_build_array(r.*)), ''[]''::json) from (%s) r', statement)
+       into result
+      using args;
+
+    return result;
+end;
+$$;
+
+revoke all on function public.cfni_exec(text, jsonb) from public;
+grant execute on function public.cfni_exec(text, jsonb) to authenticated;
+-- Grant to anon only if your app calls withPublicDb:
+grant execute on function public.cfni_exec(text, jsonb) to anon;