cloudflare-next-intl 0.7.8 → 0.8.1

package/dist/src/db/testing.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Test double for {@link DrizzleDb} — the handle `withPublicDb`/`withUserDb`
+ * pass to your callback. Use it in repository/unit tests to avoid a real
+ * Postgres connection: build one with {@link makeFakeDb}, queue canned
+ * results with {@link rowsResult}/{@link executeResult}, then pass it
+ * directly wherever your code expects a `DrizzleDb`.
+ *
+ * Real repositories call chains like `db.select({...}).from(t).where(w)...`
+ * where every intermediate call returns `this` and the final awaited value
+ * resolves to a canned row array — plus `db.execute(sql...)` resolving to
+ * `{ rows: [...] }`, and `db.$with(name).as(builder)` / `db.with(...).select(...)`
+ * for CTE-based queries.
+ *
+ * Each fake db instance is given an ordered queue of results (`resultQueue`)
+ * consumed one-per-terminal-call in the exact sequence your code issues
+ * them — select/insert/update/delete/execute all share one queue, so call
+ * order in your source is what determines which fixture a call gets.
+ *
+ * Every intermediate chain call (`.where(...)`, `.values(...)`, `.set(...)`,
+ * `.orderBy(...)`, etc.) is also recorded with its exact arguments on the
+ * chain object returned from `select`/`insert`/`update`/`delete`, and that
+ * chain object is attached to the matching entry in `db.calls` — so a test
+ * can assert not just "select was called twice" but "the second select's
+ * `.where(...)` argument was X", closing the gap where a fake that only
+ * echoes canned rows back can't detect a broken predicate/sort/value.
+ */
+type Row = Record<string, unknown>;
+interface QueuedResult {
+    kind: 'rows' | 'execute';
+    rows: Row[];
+}
+/** Queues a result for a `select`/`insert`/`update`/`delete` chain. */
+declare function rowsResult(rows: Row[]): QueuedResult;
+/** Queues a result for an `execute(...)` call. */
+declare function executeResult(rows: Row[]): QueuedResult;
+interface ChainCall {
+    method: string;
+    args: unknown[];
+}
+/**
+ * Lazy like real drizzle query builders: intermediate calls just record
+ * themselves and return `this`; the queue is only consumed when the chain
+ * is actually awaited (`.then()`), which is also when a CTE built via
+ * `db.$with(name).as(builder)` is skipped — a CTE definition is never
+ * itself awaited standalone, only the final `db.with(...).select(...)`
+ * chain that references it is.
+ */
+declare class ChainableQuery implements PromiseLike<Row[]> {
+    private readonly takeRows;
+    /** Every intermediate call this chain received, in call order, with its exact arguments. */
+    readonly chainCalls: ChainCall[];
+    constructor(takeRows: () => Row[]);
+    private record;
+    /** Returns the arguments of this chain's first call to `method` (e.g. `"where"`, `"values"`). */
+    argsOf(method: string): unknown[] | undefined;
+    from(...args: unknown[]): this;
+    leftJoin(...args: unknown[]): this;
+    innerJoin(...args: unknown[]): this;
+    where(...args: unknown[]): this;
+    orderBy(...args: unknown[]): this;
+    groupBy(...args: unknown[]): this;
+    limit(...args: unknown[]): this;
+    offset(...args: unknown[]): this;
+    values(...args: unknown[]): this;
+    set(...args: unknown[]): this;
+    returning(...args: unknown[]): this;
+    as(...args: unknown[]): this;
+    then<TResult1 = Row[], TResult2 = never>(onfulfilled?: ((value: Row[]) => TResult1 | PromiseLike<TResult1>) | null, onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null): Promise<TResult1 | TResult2>;
+}
+/**
+ * Fake {@link DrizzleDb} backed by a queue of canned results. Build one with
+ * {@link makeFakeDb} rather than calling this constructor directly.
+ */
+declare class FakeDrizzleDb {
+    private readonly queue;
+    /** Top-level calls captured for assertions — each entry's `chain` is the same `ChainableQuery` returned to the caller, so its recorded `.where()`/`.values()`/etc. arguments are inspectable via `chain.argsOf(...)`. */
+    readonly calls: {
+        method: string;
+        args: unknown[];
+        chain?: ChainableQuery;
+    }[];
+    constructor(queue: QueuedResult[]);
+    private takeRows;
+    private makeChain;
+    select(...args: unknown[]): ChainableQuery;
+    insert(...args: unknown[]): ChainableQuery;
+    update(...args: unknown[]): ChainableQuery;
+    delete(...args: unknown[]): ChainableQuery;
+    execute(...args: unknown[]): Promise<{
+        rows: Row[];
+    }>;
+    /** CTE definition — never awaited on its own, so it must not touch the queue. */
+    $with(_name: string): {
+        as: (builder: unknown) => unknown;
+    };
+    with(..._ctes: unknown[]): {
+        select: (...args: unknown[]) => ChainableQuery;
+    };
+}
+/**
+ * Builds a fake {@link DrizzleDb} that resolves each terminal call
+ * (`select`/`insert`/`update`/`delete`/`execute`) to the next entry in
+ * `results`, in the exact order your code under test calls them.
+ *
+ * @param results Queued results, one per terminal call, built with
+ * {@link rowsResult}/{@link executeResult}.
+ * @returns A fake db to pass wherever your code expects a `DrizzleDb`.
+ *
+ * @example
+ * const db = makeFakeDb([rowsResult([{ id: 1 }])]);
+ * const rows = await db.select().from(bonds);
+ */
+export declare function makeFakeDb(results: QueuedResult[]): FakeDrizzleDb;
+export { rowsResult, executeResult };
+export type { Row, ChainableQuery, FakeDrizzleDb };

package/dist/src/db/testing.js

@@ -0,0 +1,137 @@
+/**
+ * Test double for {@link DrizzleDb} — the handle `withPublicDb`/`withUserDb`
+ * pass to your callback. Use it in repository/unit tests to avoid a real
+ * Postgres connection: build one with {@link makeFakeDb}, queue canned
+ * results with {@link rowsResult}/{@link executeResult}, then pass it
+ * directly wherever your code expects a `DrizzleDb`.
+ *
+ * Real repositories call chains like `db.select({...}).from(t).where(w)...`
+ * where every intermediate call returns `this` and the final awaited value
+ * resolves to a canned row array — plus `db.execute(sql...)` resolving to
+ * `{ rows: [...] }`, and `db.$with(name).as(builder)` / `db.with(...).select(...)`
+ * for CTE-based queries.
+ *
+ * Each fake db instance is given an ordered queue of results (`resultQueue`)
+ * consumed one-per-terminal-call in the exact sequence your code issues
+ * them — select/insert/update/delete/execute all share one queue, so call
+ * order in your source is what determines which fixture a call gets.
+ *
+ * Every intermediate chain call (`.where(...)`, `.values(...)`, `.set(...)`,
+ * `.orderBy(...)`, etc.) is also recorded with its exact arguments on the
+ * chain object returned from `select`/`insert`/`update`/`delete`, and that
+ * chain object is attached to the matching entry in `db.calls` — so a test
+ * can assert not just "select was called twice" but "the second select's
+ * `.where(...)` argument was X", closing the gap where a fake that only
+ * echoes canned rows back can't detect a broken predicate/sort/value.
+ */
+/** Queues a result for a `select`/`insert`/`update`/`delete` chain. */
+function rowsResult(rows) {
+    return { kind: 'rows', rows };
+}
+/** Queues a result for an `execute(...)` call. */
+function executeResult(rows) {
+    return { kind: 'execute', rows };
+}
+/**
+ * Lazy like real drizzle query builders: intermediate calls just record
+ * themselves and return `this`; the queue is only consumed when the chain
+ * is actually awaited (`.then()`), which is also when a CTE built via
+ * `db.$with(name).as(builder)` is skipped — a CTE definition is never
+ * itself awaited standalone, only the final `db.with(...).select(...)`
+ * chain that references it is.
+ */
+class ChainableQuery {
+    constructor(takeRows) {
+        this.takeRows = takeRows;
+        /** Every intermediate call this chain received, in call order, with its exact arguments. */
+        this.chainCalls = [];
+    }
+    record(method, args) {
+        this.chainCalls.push({ method, args });
+        return this;
+    }
+    /** Returns the arguments of this chain's first call to `method` (e.g. `"where"`, `"values"`). */
+    argsOf(method) {
+        return this.chainCalls.find((c) => c.method === method)?.args;
+    }
+    from(...args) { return this.record('from', args); }
+    leftJoin(...args) { return this.record('leftJoin', args); }
+    innerJoin(...args) { return this.record('innerJoin', args); }
+    where(...args) { return this.record('where', args); }
+    orderBy(...args) { return this.record('orderBy', args); }
+    groupBy(...args) { return this.record('groupBy', args); }
+    limit(...args) { return this.record('limit', args); }
+    offset(...args) { return this.record('offset', args); }
+    values(...args) { return this.record('values', args); }
+    set(...args) { return this.record('set', args); }
+    returning(...args) { return this.record('returning', args); }
+    as(...args) { return this.record('as', args); }
+    then(onfulfilled, onrejected) {
+        return Promise.resolve().then(() => this.takeRows()).then(onfulfilled, onrejected);
+    }
+}
+/**
+ * Fake {@link DrizzleDb} backed by a queue of canned results. Build one with
+ * {@link makeFakeDb} rather than calling this constructor directly.
+ */
+class FakeDrizzleDb {
+    constructor(queue) {
+        /** Top-level calls captured for assertions — each entry's `chain` is the same `ChainableQuery` returned to the caller, so its recorded `.where()`/`.values()`/etc. arguments are inspectable via `chain.argsOf(...)`. */
+        this.calls = [];
+        this.queue = [...queue];
+    }
+    takeRows(method) {
+        const next = this.queue.shift();
+        if (!next)
+            throw new Error(`FakeDrizzleDb: no queued result left for ${method}()`);
+        return next.rows;
+    }
+    makeChain(method, args) {
+        const chain = new ChainableQuery(() => this.takeRows(method));
+        this.calls.push({ method, args, chain });
+        return chain;
+    }
+    select(...args) {
+        return this.makeChain('select', args);
+    }
+    insert(...args) {
+        return this.makeChain('insert', args);
+    }
+    update(...args) {
+        return this.makeChain('update', args);
+    }
+    delete(...args) {
+        return this.makeChain('delete', args);
+    }
+    async execute(...args) {
+        this.calls.push({ method: 'execute', args });
+        const next = this.queue.shift();
+        if (!next)
+            throw new Error('FakeDrizzleDb: no queued result left for execute()');
+        return { rows: next.rows };
+    }
+    /** CTE definition — never awaited on its own, so it must not touch the queue. */
+    $with(_name) {
+        return { as: (builder) => builder };
+    }
+    with(..._ctes) {
+        return { select: (...args) => this.select(...args) };
+    }
+}
+/**
+ * Builds a fake {@link DrizzleDb} that resolves each terminal call
+ * (`select`/`insert`/`update`/`delete`/`execute`) to the next entry in
+ * `results`, in the exact order your code under test calls them.
+ *
+ * @param results Queued results, one per terminal call, built with
+ * {@link rowsResult}/{@link executeResult}.
+ * @returns A fake db to pass wherever your code expects a `DrizzleDb`.
+ *
+ * @example
+ * const db = makeFakeDb([rowsResult([{ id: 1 }])]);
+ * const rows = await db.select().from(bonds);
+ */
+export function makeFakeDb(results) {
+    return new FakeDrizzleDb(results);
+}
+export { rowsResult, executeResult };

package/dist/src/index.d.ts

@@ -4,3 +4,4 @@ export * from './server';
 export * from './client';
 export * from './theme_switcher';
 export * from './types';
+export * from './db';

package/dist/src/index.js

@@ -4,3 +4,4 @@ export * from './server';
 export * from './client';
 export * from './theme_switcher';
 export * from './types';
+export * from './db';

package/dist/src/types/types.d.ts

@@ -85,6 +85,14 @@ export interface RoutingConfig<AppLocales extends Locales, AppLocalePrefixMode e
      * if this field is missing at call time rather than silently no-op'ing.
      */
     firebaseAuth?: FirebaseAuthRoutingConfig;
+    /**
+     * Configures the optional `db` submodule (Postgres/Drizzle access over a
+     * Cloudflare Hyperdrive or plain connection string). Omit entirely to keep
+     * it fully disabled — no file in this package imports `pg`/`drizzle-orm`
+     * unless a `db` export is actually called, and every such export throws a
+     * clear error if this field is missing at call time.
+     */
+    db?: DbRoutingConfig;
     /**
      * Configures the optional `cookie_consent` submodule (cookie-consent +
      * privacy-policy-update banners). Omit entirely to keep it disabled —
@@ -809,3 +817,86 @@ export interface IntlSitemap {
     lastModified: Date | string | undefined;
     videos?: Videos[] | undefined;
 }
+export interface SupabaseDbConfig {
+    /**
+     * Supabase project URL, e.g. `https://abc.supabase.co`. Defaults to
+     * `process.env.NEXT_PUBLIC_SUPABASE_URL`.
+     */
+    url?: string;
+    /**
+     * Supabase anon (publishable) key. Defaults to
+     * `process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY`. This is the only key the
+     * `db` module ever needs — never put a service-role key here.
+     */
+    anonKey?: string;
+    /**
+     * Name of the Postgres function that runs the generated SQL. Defaults to
+     * `'cfni_exec'` — the function shipped in `supabase/cfni_exec.sql`.
+     */
+    execFunction?: string;
+}
+export interface DbRoutingConfig {
+    /**
+     * Postgres connection string. Omit to resolve it from the Cloudflare
+     * Hyperdrive binding named by `hyperdriveBinding` instead (the normal
+     * production setup); a value here always wins over the binding, which is
+     * what makes local dev / build-time evaluation work.
+     */
+    connectionString?: string;
+    /**
+     * Name of the Hyperdrive binding on `env` whose `connectionString` is used
+     * when `connectionString` is not set. Defaults to `'HYPERDRIVE'`. Requires
+     * `generate.getCloudflareContext` to be configured.
+     */
+    hyperdriveBinding?: string;
+    /**
+     * Whether the pooled client is closed once the last in-flight
+     * `withPublicDb`/`withUserDb` call of the request finishes.
+     * Defaults to `true` (one connection per request, released to Hyperdrive
+     * immediately). Set `false` to keep the connection open for the lifetime
+     * of the isolate — faster for a long-lived server, but it holds a
+     * Hyperdrive connection slot between requests.
+     */
+    disconnectAfterRequest?: boolean;
+    /**
+     * Postgres role assumed inside `withUserDb`'s transaction. Defaults
+     * to `'authenticated'` (the Supabase RLS convention).
+     */
+    authenticatedRole?: string;
+    /**
+     * Resolves the user id injected as `request.jwt.claims->>'sub'` inside
+     * `withUserDb`. Omit when `firebaseAuth` is configured — the uid then
+     * comes from this package's own `getAuthUser()` automatically. Provide it
+     * to use a different auth source (or when `firebaseAuth` is absent).
+     */
+    getUserId?: () => Promise<string | null> | string | null;
+    /** Milliseconds `disconnectPostgres` waits for `client.end()` before giving up. Defaults to `2000`. */
+    disconnectTimeoutMs?: number;
+    /**
+     * Reaches Postgres through the Supabase Data API instead of a direct
+     * connection, using only your project URL and anon key. Set this when you
+     * have no Postgres password to give the package — `withPublicDb` and
+     * `withUserDb` behave the same either way, so switching is a config change
+     * with no app-code change.
+     *
+     * Ignored when `connectionString` or `hyperdriveBinding` is set: a direct
+     * connection always wins, so adding this block cannot silently reroute
+     * live traffic. Requires the `cfni_exec` function from
+     * `supabase/cfni_exec.sql` to be installed in your database.
+     *
+     * No multi-statement transactions: unlike connection-string mode, each
+     * statement inside a `withUserDb` callback is its own round-trip. Do not
+     * rely on multi-statement atomicity in this mode.
+     */
+    supabase?: SupabaseDbConfig;
+    /**
+     * Resolves the JWT sent as `Authorization: Bearer` for `withUserDb` in
+     * Supabase mode, which is what makes PostgREST resolve the caller as
+     * `authenticated` and apply RLS. Omit when `firebaseAuth` is configured —
+     * the signed-in user's Firebase ID token is then used automatically.
+     *
+     * Unused in connection-string mode, which identifies the user with
+     * `getUserId` and `set_config` instead.
+     */
+    getAccessToken?: () => Promise<string | null> | string | null;
+}

package/llms.txt

@@ -23,6 +23,8 @@ other subpath can be used.
 - `./localeStaticParams` — `generateStaticParams` helper for locale segments.
 - `./use` — `useLocale`/`useTranslations`; resolves to the RSC or client implementation automatically via the `react-server` export condition. Both throw `"... must be used within an IntlProvider"` if called outside one.
 - `./ThemeSwitcher` — optional light/dark toggle component.
+- `./db` — `withPublicDb(fn)` / `withUserDb(fn, uid?)` server-side Postgres/Drizzle context helpers (require `db` set on your `RoutingConfig`; direct Postgres or Supabase Data API, see below).
+- `./dbHelpers` — generic Drizzle SQL helper functions (`excluded`, `onConflictSet`, `ago`, `currentDate`, `windowCount`, `unnestLateral`, `ascNullsLast`, `alwaysTrue`, `lateral`, `aliasColumn`, `minOf`, `maxOf`, `roundReal`, `multiply`, `scalarFromCte`) for use with `./db`.
 
 ## `firebaseAuth*` subpaths (require `firebaseAuth` set on your `RoutingConfig`)
 
@@ -44,6 +46,38 @@ other subpath can be used.
 - `./cookieConsentAnalytics` — `CookieConsentAnalytics`: gates Cloudflare Web Analytics / Google Ads / Google Analytics / AdSense / Microsoft Clarity behind consent; rendered automatically by `IntlProvider` when `cookieConsent.secrets` or `getSecrets` is set (and `autoWireAnalytics !== false`). Never renders in local dev (`NODE_ENV === 'development'`) unless `cookieConsent.enableAnalyticsInDevMode` is `true`.
 - Country-based gating (`cookieConsent.getCountryCode` / `getCloudflareContext` + `gdprCountries`): resolved server-side by `IntlProvider` into a `requiresConsent` boolean passed to `CookieConsentProvider`. Neither getter set → gating off, consent always implicitly granted. `getCountryCode` (direct country resolver) takes precedence over `getCloudflareContext` (reads `cf.country`) when both are set. `getCloudflareContext` accepts `@opennextjs/cloudflare`'s `getCloudflareContext` function directly (its exact overloaded signature — `CookieConsentGetCloudflareContext`), called internally with `{ async: true }`. Unresolved country (or a `null` context) always requires consent (fail-safe). `./cookieConsent` also exports `defaultGdprCountries` (EU/EEA + UK + Switzerland).
 
+## `db*` subpaths (require `db` set on your `RoutingConfig`)
+
+Two transports, picked by which `db` fields are set — `pg`/`drizzle-orm`/`@supabase/supabase-js` ship as dependencies and load via dynamic `import()`, so nothing bundles unless a `db` export is called.
+
+- Direct Postgres (wins if configured): `db.connectionString` — Postgres connection string; when omitted, resolved from the Hyperdrive binding named by `db.hyperdriveBinding` (default `'HYPERDRIVE'`) via `generate.getCloudflareContext`. An explicit `connectionString` always wins (enables local dev / build-time evaluation).
+- Supabase Data API (used only when neither of the above is set): `db.supabase` — `{ url?, anonKey?, execFunction? }`, defaulting `url`/`anonKey` to `NEXT_PUBLIC_SUPABASE_URL`/`NEXT_PUBLIC_SUPABASE_ANON_KEY`. Requires installing `supabase/cfni_exec.sql` (a `security invoker` SQL-exec function) in your database. No multi-statement transactions — each statement in a `withUserDb` callback is its own round-trip.
+- `db.disconnectAfterRequest` — direct-Postgres mode only: closes the pooled client once the last in-flight `withPublicDb`/`withUserDb` call of the request finishes. Defaults to `true`; set `false` to keep the connection open for the isolate's lifetime (holds a Hyperdrive slot between requests).
+- `db.authenticatedRole` — direct-Postgres mode only: Postgres role assumed inside `withUserDb`'s transaction. Defaults to `'authenticated'` (Supabase RLS convention).
+- `db.getUserId` — direct-Postgres mode only: resolves the user id injected as `request.jwt.claims->>'sub'` in `withUserDb`. Omit when `firebaseAuth` is configured — the uid is then taken automatically from the signed-in Firebase user via this package's own `getAuthUser()`.
+- `db.getAccessToken` — Supabase mode only: resolves the JWT sent as `Authorization: Bearer` in `withUserDb`, which is what makes PostgREST resolve `authenticated` and apply RLS. Omit when `firebaseAuth` is configured — the signed-in user's Firebase ID token is used automatically.
+- `db.disconnectTimeoutMs` — direct-Postgres mode only: ms `disconnectPostgres` waits for `client.end()` before giving up. Defaults to `2000`.
+- `withPublicDb(fn)` — anonymous role. Direct-Postgres mode: the request's pooled connection, no transaction, no role switch. Supabase mode: the anon key as the PostgREST bearer token. Either way, no user id is attached — RLS keyed on `auth.jwt()` denies access.
+- `withUserDb(fn, uid?)` — signed-in-user role. Direct-Postgres mode: a transaction with `set_config('request.jwt.claims', ...)` + `set local role`, `uid` resolution order explicit arg → `db.getUserId()` → Firebase auth uid → throws. Supabase mode: identity rides on the JWT from `db.getAccessToken`/Firebase instead (`uid` param is ignored), no transaction wraps the call.
+- `./dbHelpers` functions are plain Drizzle `sql`-building utilities with no config dependency — usable standalone.
+
+```typescript
+// src/i18n/intl_config.ts
+import { getCloudflareContext } from "@opennextjs/cloudflare";
+
+export default setIntlConfig({
+    locales: ["en", "uk"] as const,
+    defaultLocale: "en",
+    generate: { getCloudflareContext },
+    db: { hyperdriveBinding: "HYPERDRIVE" },
+});
+
+// anywhere on the server
+import { withPublicDb } from "cloudflare-next-intl/db";
+
+const rows = await withPublicDb((db) => db.select().from(bonds).limit(10));
+```
+
 ## Conventions
 
 - Every exported function/component has a JSDoc comment with an `@example` where usage isn't obvious from the signature alone.
@@ -56,3 +90,4 @@ other subpath can be used.
 - Missing `firebaseAuth` on `RoutingConfig` throws immediately from any `firebaseAuth*` export, naming the missing config field.
 - `useLocale`/`useTranslations` (from `./use`) and `useAuthUser` (from `./useFirebaseAuthUser`) resolve to a Server- or Client-Component implementation automatically via the `react-server` export condition — always import from the subpath, never from an internal file path.
 - No unified `useFirebaseAuthUser` re-export inside `cloudflare-next-intl/firebaseAuth`'s barrel — that barrel can't replicate the `react-server` condition split, so import `cloudflare-next-intl/useFirebaseAuthUser` directly for the hook.
+- Missing `db` on `RoutingConfig` throws immediately from `withPublicDb`/`withUserDb`, naming the missing config field. `pg`, `drizzle-orm`, and `@supabase/supabase-js` ship as dependencies and load via dynamic `import()` — nothing to install yourself, and nothing bundles unless a `db` export is called.

package/package.json

@@ -1,13 +1,17 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.7.8",
+  "version": "0.8.1",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
-
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "sideEffects": false,
+  "bin": {
+    "cfni-db-codegen": "bin/db_codegen.mjs"
+  },
   "files": [
     "dist",
+    "bin",
+    "supabase",
     "LICENSE",
     "README.md",
     "llms.txt"
@@ -172,6 +176,18 @@
     "./createServerErrorAction": {
       "types": "./dist/src/error_handling/create_server_error_action.d.ts",
       "import": "./dist/src/error_handling/create_server_error_action.js"
+    },
+    "./db": {
+      "types": "./dist/src/db/index.d.ts",
+      "import": "./dist/src/db/index.js"
+    },
+    "./dbHelpers": {
+      "types": "./dist/src/db/helpers.d.ts",
+      "import": "./dist/src/db/helpers.js"
+    },
+    "./dbTesting": {
+      "types": "./dist/src/db/testing.d.ts",
+      "import": "./dist/src/db/testing.js"
     }
   },
   "scripts": {
@@ -216,8 +232,11 @@
   "homepage": "https://github.com/demian-ilnytskyi/cloudflare-next-intl#readme",
   "dependencies": {
     "@microsoft/clarity": "^1.0.2",
+    "@supabase/supabase-js": "^2.112.3",
+    "drizzle-orm": "^0.45.2",
     "firebase": "^12.17.0",
-    "jose": "^6.2.8"
+    "jose": "^6.2.8",
+    "pg": "^8.23.0"
   },
   "peerDependencies": {
     "next": ">=12.0.0",
@@ -236,16 +255,18 @@
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^20.14.5",
+    "@types/pg": "^8.23.1",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitest/coverage-v8": "^3.2.7",
+    "drizzle-kit": "^0.31.10",
     "eslint": "^9.28.0",
     "eslint-config-next": "15.3.3",
     "eslint-config-prettier": "^10.1.2",
     "jsdom": "^29.1.1",
     "next": "^15.3.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "react": "19.2.0",
+    "react-dom": "19.2.0",
     "tsup": "^8.5.1",
     "typescript": "^5.5.3",
     "typescript-eslint": "^8.33.1",

package/supabase/cfni_exec.sql

@@ -0,0 +1,34 @@
+-- Executes a statement generated by cloudflare-next-intl's `db` module and
+-- returns its rows as positional JSON arrays, which is the shape
+-- drizzle-orm/pg-proxy maps result columns from.
+--
+-- SECURITY INVOKER is load-bearing: the statement runs with the privileges of
+-- the caller (anon or authenticated, per the request's JWT), so row-level
+-- security still applies exactly as it does over the REST API. Do not change
+-- this to SECURITY DEFINER, and do not add a role parameter — either would
+-- turn this into a privilege-escalation primitive.
+create or replace function public.cfni_exec(statement text, params jsonb default '[]'::jsonb)
+returns json
+language plpgsql
+security invoker
+as $$
+declare
+    result json;
+    args text[];
+begin
+    select coalesce(array_agg(value #>> '{}' order by ordinality), '{}')
+      into args
+      from jsonb_array_elements(params) with ordinality as t(value, ordinality);
+
+    execute format('select coalesce(json_agg(json_build_array(r.*)), ''[]''::json) from (%s) r', statement)
+       into result
+      using args;
+
+    return result;
+end;
+$$;
+
+revoke all on function public.cfni_exec(text, jsonb) from public;
+grant execute on function public.cfni_exec(text, jsonb) to authenticated;
+-- Grant to anon only if your app calls withPublicDb:
+grant execute on function public.cfni_exec(text, jsonb) to anon;