cloudflare-next-intl 0.8.2 → 0.8.3

package/README.md

@@ -411,10 +411,12 @@ export default setIntlConfig({
 
 `db` fields (all optional):
 
-- `connectionString` — a Postgres connection string. Omit to resolve it from
-  the Hyperdrive binding named by `hyperdriveBinding` instead (the normal
-  production setup); a value here always wins over the binding, which is
-  what makes local dev / build-time evaluation work.
+- `connectionString` — a Postgres connection string, or a sync/async function
+  returning one (resolved on each connect, so the value can come from a secret
+  store). Omit to resolve it from the Hyperdrive binding named by
+  `hyperdriveBinding` instead (the normal production setup); a value here
+  always wins over the binding, which is what makes local dev / build-time
+  evaluation work.
 - `hyperdriveBinding` — name of the Hyperdrive binding on `env` to read a
   connection string from when `connectionString` is not set. Defaults to
   `'HYPERDRIVE'`. Requires `generate.getCloudflareContext` to be configured.
@@ -472,11 +474,35 @@ bundles any of them.
 
 `db.supabase` fields (all optional):
 
-- `url` — project URL. Defaults to `NEXT_PUBLIC_SUPABASE_URL`.
-- `anonKey` — anon/publishable key. Defaults to `NEXT_PUBLIC_SUPABASE_ANON_KEY`.
-  Never put a service-role key here.
+- `url` — project URL, or a sync/async function returning one. Defaults to
+  `NEXT_PUBLIC_SUPABASE_URL`.
+- `anonKey` — anon/publishable key, or a sync/async function returning one.
+  Defaults to `NEXT_PUBLIC_SUPABASE_ANON_KEY`. Never put a service-role key
+  here.
 - `execFunction` — name of the exec function. Defaults to `'cfni_exec'`.
 
+Any of `connectionString`, `supabase.url`, and `supabase.anonKey` may be a
+function instead of a string, resolved (and awaited) at use time rather than
+when the config object is built — useful when the value lives in a secret
+store or a Cloudflare binding rather than an environment variable:
+
+```typescript
+export default setIntlConfig({
+    locales: ["en", "uk"] as const,
+    defaultLocale: "en",
+    generate: { getCloudflareContext },
+    db: {
+        supabase: {
+            url: "https://abc.supabase.co",
+            anonKey: async () => {
+                const { env } = await getCloudflareContext({ async: true });
+                return env.SUPABASE_ANON_KEY.get();
+            },
+        },
+    },
+});
+```
+
 `db.getAccessToken` resolves the JWT `withUserDb` sends as
 `Authorization: Bearer`, which is what makes PostgREST resolve the caller as
 `authenticated`. Omit it when `firebaseAuth` is configured — the signed-in

package/dist/src/db/connection.js

@@ -1,5 +1,6 @@
 import reportError from '../error_handling/report_error';
 import requireDbConfig from './require_config';
+import resolveConfigValue from './resolve_config_value';
 const DEFAULT_BINDING = 'HYPERDRIVE';
 const DEFAULT_DISCONNECT_TIMEOUT_MS = 2000;
 let connectionString = null;
@@ -30,8 +31,9 @@ export function resetConnectionState() {
  * Cloudflare Hyperdrive binding named by `db.hyperdriveBinding`.
  */
 async function resolveConnectionString(config, db) {
-    if (db.connectionString)
-        return db.connectionString;
+    const configured = await resolveConfigValue(db.connectionString);
+    if (configured)
+        return configured;
     const getContext = config.generate?.getCloudflareContext;
     if (getContext) {
         const context = await getContext({ async: true });

package/dist/src/db/context.js

@@ -60,7 +60,7 @@ export async function withPublicDb(fn) {
     requireDbConfig(db);
     if (resolveDbMode(db) === 'supabase') {
         const supabase = db.supabase;
-        const { anonKey } = resolveSupabaseEndpoint(supabase);
+        const { anonKey } = await resolveSupabaseEndpoint(supabase);
         return fn(await supabaseDb(supabase, anonKey));
     }
     const client = await connectToPostgres(config);

package/dist/src/db/resolve_config_value.d.ts

@@ -0,0 +1,9 @@
+import type { ConfigValue } from '../types/types';
+/**
+ * Resolves a config value that may have been supplied directly or as a
+ * sync/async function.
+ *
+ * @param value The configured value or resolver.
+ * @returns The resolved value, or `undefined` when nothing was configured.
+ */
+export default function resolveConfigValue<T>(value: ConfigValue<T | undefined> | undefined): Promise<T | undefined>;

package/dist/src/db/resolve_config_value.js

@@ -0,0 +1,10 @@
+/**
+ * Resolves a config value that may have been supplied directly or as a
+ * sync/async function.
+ *
+ * @param value The configured value or resolver.
+ * @returns The resolved value, or `undefined` when nothing was configured.
+ */
+export default async function resolveConfigValue(value) {
+    return typeof value === 'function' ? value() : value;
+}

package/dist/src/db/supabase_config.d.ts

@@ -13,6 +13,7 @@ export interface ResolvedSupabaseEndpoint {
  *
  * @param supabase The `db.supabase` config block.
  * @returns The project URL and anon key to build a Supabase client from.
+ * Values given as functions are resolved here.
  * @throws If neither config nor environment supplies a URL or an anon key.
  */
-export default function resolveSupabaseEndpoint(supabase: SupabaseDbConfig): ResolvedSupabaseEndpoint;
+export default function resolveSupabaseEndpoint(supabase: SupabaseDbConfig): Promise<ResolvedSupabaseEndpoint>;

package/dist/src/db/supabase_config.js

@@ -1,3 +1,4 @@
+import resolveConfigValue from './resolve_config_value';
 /**
  * Resolves the Supabase project URL and anon key, preferring explicit config
  * over the `NEXT_PUBLIC_SUPABASE_URL`/`NEXT_PUBLIC_SUPABASE_ANON_KEY`
@@ -5,15 +6,16 @@
  *
  * @param supabase The `db.supabase` config block.
  * @returns The project URL and anon key to build a Supabase client from.
+ * Values given as functions are resolved here.
  * @throws If neither config nor environment supplies a URL or an anon key.
  */
-export default function resolveSupabaseEndpoint(supabase) {
-    const url = supabase.url ?? process.env.NEXT_PUBLIC_SUPABASE_URL;
+export default async function resolveSupabaseEndpoint(supabase) {
+    const url = (await resolveConfigValue(supabase.url)) ?? process.env.NEXT_PUBLIC_SUPABASE_URL;
     if (!url) {
         throw new Error('db: could not resolve a Supabase project URL. Set `db.supabase.url` ' +
             'or the NEXT_PUBLIC_SUPABASE_URL environment variable.');
     }
-    const anonKey = supabase.anonKey ?? process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+    const anonKey = (await resolveConfigValue(supabase.anonKey)) ?? process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
     if (!anonKey) {
         throw new Error('db: could not resolve a Supabase anon key. Set `db.supabase.anonKey` ' +
             'or the NEXT_PUBLIC_SUPABASE_ANON_KEY environment variable.');

package/dist/src/db/supabase_transport.js

@@ -21,11 +21,11 @@ const DEFAULT_EXEC_FUNCTION = 'cfni_exec';
  * @returns A callback suitable for `drizzle-orm/pg-proxy`'s `drizzle()`.
  */
 export default function createSupabaseTransport(supabase, bearerToken) {
-    const { url, anonKey } = resolveSupabaseEndpoint(supabase);
     const execFunction = supabase.execFunction ?? DEFAULT_EXEC_FUNCTION;
     let clientPromise = null;
     async function getClient() {
         clientPromise ?? (clientPromise = (async () => {
+            const { url, anonKey } = await resolveSupabaseEndpoint(supabase);
             const { createClient } = await import('@supabase/supabase-js');
             return createClient(url, anonKey, { accessToken: async () => bearerToken });
         })());

package/dist/src/types/index.d.ts

@@ -1 +1 @@
-export type { CookieAttributes, LocalePrefixMode, Locales, ReturnType, RoutingConfig, TranslationEntry, TranslationObject, TranslatorReturnType, Alternates, changeFrequency, IntlSitemap, CookieConsentRoutingConfig, CookieConsentAnalyticsConfig, CookieConsentCloudflareContext, CookieConsentGetCloudflareContext, DbRoutingConfig, SupabaseDbConfig, } from './types';
+export type { CookieAttributes, LocalePrefixMode, Locales, ReturnType, RoutingConfig, TranslationEntry, TranslationObject, TranslatorReturnType, Alternates, changeFrequency, IntlSitemap, CookieConsentRoutingConfig, CookieConsentAnalyticsConfig, CookieConsentCloudflareContext, CookieConsentGetCloudflareContext, DbRoutingConfig, SupabaseDbConfig, ConfigValue, } from './types';

package/dist/src/types/types.d.ts

@@ -817,18 +817,27 @@ export interface IntlSitemap {
     lastModified: Date | string | undefined;
     videos?: Videos[] | undefined;
 }
+/**
+ * A config value that may be given directly, or as a sync/async function
+ * resolved at use time. The function form lets a value come from a secret
+ * store, a Cloudflare binding, or any other source that isn't available when
+ * the config object is first created.
+ */
+export type ConfigValue<T> = T | (() => T | Promise<T>);
 export interface SupabaseDbConfig {
     /**
      * Supabase project URL, e.g. `https://abc.supabase.co`. Defaults to
-     * `process.env.NEXT_PUBLIC_SUPABASE_URL`.
+     * `process.env.NEXT_PUBLIC_SUPABASE_URL`. May be a function (sync or
+     * async) resolved on each use.
      */
-    url?: string;
+    url?: ConfigValue<string | undefined>;
     /**
      * Supabase anon (publishable) key. Defaults to
      * `process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY`. This is the only key the
-     * `db` module ever needs — never put a service-role key here.
+     * `db` module ever needs — never put a service-role key here. May be a
+     * function (sync or async) resolved on each use.
      */
-    anonKey?: string;
+    anonKey?: ConfigValue<string | undefined>;
     /**
      * Name of the Postgres function that runs the generated SQL. Defaults to
      * `'cfni_exec'` — the function shipped in `supabase/cfni_exec.sql`.
@@ -840,9 +849,10 @@ export interface DbRoutingConfig {
      * Postgres connection string. Omit to resolve it from the Cloudflare
      * Hyperdrive binding named by `hyperdriveBinding` instead (the normal
      * production setup); a value here always wins over the binding, which is
-     * what makes local dev / build-time evaluation work.
+     * what makes local dev / build-time evaluation work. May be a function
+     * (sync or async) resolved on each connect.
      */
-    connectionString?: string;
+    connectionString?: ConfigValue<string | undefined>;
     /**
      * Name of the Hyperdrive binding on `env` whose `connectionString` is used
      * when `connectionString` is not set. Defaults to `'HYPERDRIVE'`. Requires

package/llms.txt

@@ -50,8 +50,8 @@ other subpath can be used.
 
 Two transports, picked by which `db` fields are set — `pg`/`drizzle-orm`/`@supabase/supabase-js` ship as dependencies and load via dynamic `import()`, so nothing bundles unless a `db` export is called.
 
-- Direct Postgres (wins if configured): `db.connectionString` — Postgres connection string; when omitted, resolved from the Hyperdrive binding named by `db.hyperdriveBinding` (default `'HYPERDRIVE'`) via `generate.getCloudflareContext`. An explicit `connectionString` always wins (enables local dev / build-time evaluation).
-- Supabase Data API (used only when neither of the above is set): `db.supabase` — `{ url?, anonKey?, execFunction? }`, defaulting `url`/`anonKey` to `NEXT_PUBLIC_SUPABASE_URL`/`NEXT_PUBLIC_SUPABASE_ANON_KEY`. Requires installing `supabase/cfni_exec.sql` (a `security invoker` SQL-exec function) in your database. No multi-statement transactions — each statement in a `withUserDb` callback is its own round-trip.
+- Direct Postgres (wins if configured): `db.connectionString` — Postgres connection string or a sync/async function returning one (resolved on each connect); when omitted, resolved from the Hyperdrive binding named by `db.hyperdriveBinding` (default `'HYPERDRIVE'`) via `generate.getCloudflareContext`. An explicit `connectionString` always wins (enables local dev / build-time evaluation).
+- Supabase Data API (used only when neither of the above is set): `db.supabase` — `{ url?, anonKey?, execFunction? }` where `url`/`anonKey` each accept a string or a sync/async function returning one, defaulting `url`/`anonKey` to `NEXT_PUBLIC_SUPABASE_URL`/`NEXT_PUBLIC_SUPABASE_ANON_KEY`. Requires installing `supabase/cfni_exec.sql` (a `security invoker` SQL-exec function) in your database. No multi-statement transactions — each statement in a `withUserDb` callback is its own round-trip.
 - `db.disconnectAfterRequest` — direct-Postgres mode only: closes the pooled client once the last in-flight `withPublicDb`/`withUserDb` call of the request finishes. Defaults to `true`; set `false` to keep the connection open for the isolate's lifetime (holds a Hyperdrive slot between requests).
 - `db.authenticatedRole` — direct-Postgres mode only: Postgres role assumed inside `withUserDb`'s transaction. Defaults to `'authenticated'` (Supabase RLS convention).
 - `db.getUserId` — direct-Postgres mode only: resolves the user id injected as `request.jwt.claims->>'sub'` in `withUserDb`. Omit when `firebaseAuth` is configured — the uid is then taken automatically from the signed-in Firebase user via this package's own `getAuthUser()`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",