cloudflare-next-intl 0.8.28 → 0.8.30

package/dist/src/firebase_auth/client/auth_actions.js

@@ -127,8 +127,11 @@ export function createSendSignInLinkAction(locale, actionCodeSettings) {
         const { auth } = await getFirebaseAuthClient();
         const { sendSignInLinkToEmail } = await getFirebaseAuthModule();
         const email = (formData.get('email')?.toString() ?? '').trim();
+        const url = new URL(actionCodeSettings.url);
+        url.searchParams.set('email', email);
+        const settingsWithEmail = { ...actionCodeSettings, url: url.toString() };
         try {
-            await sendSignInLinkToEmail(auth, email, actionCodeSettings);
+            await sendSignInLinkToEmail(auth, email, settingsWithEmail);
             return { success: true, email };
         }
         catch (e) {

package/dist/src/firebase_auth/middleware/update_session.js

@@ -369,33 +369,36 @@ export default async function updateSession(request, baseResponse, locale, rebui
     }
     let unverifiedEmail = false;
     if (fa.verifyEmailPath && !isVerifyEmailPage && hasSession && decodeJwtPayload(token)?.email_verified === false) {
+        // Sending a user to `verifyEmailPath` is only safe when this claim
+        // reflects the LIVE account state, because that page resolves the
+        // same user through `getAuthUser()`/`initializeServerApp` — which
+        // reads the Auth service directly, not this frozen claim — and
+        // redirects home the moment it sees a verified user. Any disagreement
+        // between the two is therefore not a stale-data annoyance but an
+        // infinite redirect loop.
+        //
+        // The hint cookie cannot settle that: it is a client-written mirror,
+        // and after the user verifies in another tab (or the client simply
+        // never re-runs) it keeps asserting a `false` that is now wrong,
+        // while the Auth service already reports verified. Trusting a
+        // `'false'` hint as confirmation is exactly what pinned verified
+        // users in the loop. So the hint is only ever allowed to SKIP work
+        // when it agrees the user is verified — never to prove they aren't.
         const hint = request.cookies.get(emailVerifiedHintCookieName)?.value;
-        const hintConfirms = hint === 'false';
-        if (!hintConfirms && !refreshedToken) {
+        if (!refreshedToken) {
             const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
             if (refreshToken) {
                 // `skipCache`: the cached entry is what produced the very
-                // token whose claim is in question, so a normal refresh can
-                // hand back that same token and "confirm" nothing. Only a
-                // genuinely newly-minted token carries information here.
-                const previousToken = token;
+                // token whose claim is in question, so a cached refresh can
+                // hand back that same token and confirm nothing.
                 const result = await refreshIdToken(fa.apiKey, refreshToken, { skipCache: true });
                 if (result.status === 'refreshed') {
                     refreshedToken = { idToken: result.idToken, refreshToken: result.refreshToken };
                     token = refreshedToken.idToken;
-                    // Redirecting to verifyEmailPath on a claim this refresh
-                    // did not actually re-confirm is what caused an infinite
-                    // loop: the destination page resolves the same user as
-                    // VERIFIED via `getAuthUser()` (`initializeServerApp`
-                    // reads live Auth-service state, not this frozen claim)
-                    // and redirects straight back home. So only trust the
-                    // claim when this mint genuinely re-stated it — the token
-                    // changed — and never against a hint that already
-                    // observed verification live.
-                    const reconfirmed = result.idToken !== previousToken;
-                    unverifiedEmail = hint !== 'true'
-                        && reconfirmed
-                        && decodeJwtPayload(token)?.email_verified === false;
+                    // A `true` hint means the client already observed
+                    // verification live; never redirect against it, even if
+                    // this mint's claim hasn't caught up.
+                    unverifiedEmail = hint !== 'true' && decodeJwtPayload(token)?.email_verified === false;
                 }
                 else if (result.status === 'invalid') {
                     clearInvalidSession = true;
@@ -413,8 +416,7 @@ export default async function updateSession(request, baseResponse, locale, rebui
             }
         }
         else {
-            // Hint confirms unverified — no reason to refresh, trust the claim.
-            unverifiedEmail = true;
+            unverifiedEmail = hint !== 'true' && decodeJwtPayload(token)?.email_verified === false;
         }
     }
     if (refreshWasTransientFailure) {

package/llms.txt

@@ -34,7 +34,7 @@ other subpath can be used.
 - `./firebaseAuthServerProvider` — server-side equivalent provider (not used by the default auto-wiring path — see its doc comment).
 - `./useFirebaseAuthUser` — `useAuthUser()`; resolves to RSC or client implementation via the `react-server` condition. Client variant throws `"useAuthUser must be used within an AuthUserProvider"` if called outside one.
 - `./getFirebaseAuthUser` — `getAuthUser()`; unconditional server-only export of the same RSC implementation `useFirebaseAuthUser` resolves to via `react-server`. Use this when you want `await` to be visible from the type itself — TypeScript doesn't evaluate the `react-server` condition, so `useFirebaseAuthUser` always types as its client (sync) signature in editors regardless of call site.
-- `./firebaseAuthActions` — `createLoginAction`/`createSignUpAction`/`createForgotPasswordAction`: factories returning React `useActionState`-shaped form actions. `createSendSignInLinkAction`: same factory shape, for passwordless email-link sign-in — returns `{ success: true, email }` so the caller can persist the trimmed email (e.g. to `localStorage`) for the completion step. `completeSignInWithLink(locale, url, email)`: plain async function (not `useActionState`-shaped) that completes a passwordless sign-in from the emailed link's landing page — call from an effect on mount, not a form submit.
+- `./firebaseAuthActions` — `createLoginAction`/`createSignUpAction`/`createForgotPasswordAction`: factories returning React `useActionState`-shaped form actions. `createSendSignInLinkAction`: same factory shape, for passwordless email-link sign-in — appends the user's email as an `email` query parameter to `actionCodeSettings.url` and returns `{ success: true, email }` so the caller can persist the trimmed email (e.g. to `localStorage`) for the completion step. `completeSignInWithLink(locale, url, email)`: plain async function (not `useActionState`-shaped) that completes a passwordless sign-in from the emailed link's landing page — call from an effect on mount, not a form submit.
 - `./firebaseAuthMiddleware` — `updateSession`: session-cookie refresh, called automatically by `./middleware`'s default handler.
 
 ## `cookieConsent*` subpaths (require `cookieConsent` set on your `RoutingConfig`)

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cloudflare-next-intl",
-	"version": "0.8.28",
+	"version": "0.8.30",
 	"description": "Optimized Next Intl Package Special for App Router and Cloudflare",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",

package/dist/src/db/supabase_rest.d.ts

@@ -1,178 +0,0 @@
-/**
- * One filter's operator and value, e.g. `{ age: ['gt', 18] }`. The bare-value
- * form `{ id: 5 }` (see {@link SupabaseWhere}) is shorthand for `['eq', 5]`.
- * `['not', operator, value]` negates any operator (`['not', 'eq', 5]` is
- * `column <> 5` via PostgREST's `not.eq.5`).
- *
- * This is the complete operator set `@supabase/supabase-js`'s query builder
- * exposes for `.from(table)` — there's no separate "Supabase client" query
- * layer on top of `postgrest-js`; `supabase.from()` returns a `postgrest-js`
- * builder directly, so this list is also the ceiling for what `supabase-js`
- * itself can express against a single table. What's still out of reach:
- * joins/embedded resources (pass a nested `columns` string instead — that's
- * plain PostgREST syntax, not a filter), and anything needing more than one
- * table in a single round-trip. Those need `cfni_exec`/`withPublicDb`/
- * `withUserDb`, or a Postgres function called via {@link supabaseRpc}.
- */
-export type SupabaseFilterOperator = 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'like' | 'likeAllOf' | 'likeAnyOf' | 'ilike' | 'ilikeAllOf' | 'ilikeAnyOf' | 'regexMatch' | 'regexIMatch' | 'is' | 'isDistinct' | 'in' | 'contains' | 'containedBy' | 'overlaps' | 'rangeGt' | 'rangeGte' | 'rangeLt' | 'rangeLte' | 'rangeAdjacent';
-export type SupabaseFilterValue = unknown | [SupabaseFilterOperator, unknown] | ['not', SupabaseFilterOperator, unknown];
-/** Equality (or `[operator, value]`) filters, ANDed together column by column. */
-export type SupabaseWhere = Record<string, SupabaseFilterValue>;
-export interface SupabaseTextSearch {
-    column: string;
-    query: string;
-    type?: 'plain' | 'phrase' | 'websearch';
-    config?: string;
-}
-export interface SupabaseOrderBy {
-    column: string;
-    ascending?: boolean;
-    nullsFirst?: boolean;
-}
-export interface SupabaseSelectOptions {
-    /** Column list, PostgREST syntax (e.g. `'id,name'`, or `'*, related(*)'` for an embedded resource). Defaults to `'*'`. */
-    columns?: string;
-    /** Filters, ANDed together — see {@link SupabaseWhere}. */
-    where?: SupabaseWhere;
-    /** Shorthand for several `eq` filters at once — PostgREST's `.match()`. ANDed with `where`. */
-    match?: Record<string, unknown>;
-    /** A raw PostgREST `or()` filter string (e.g. `'age.gt.18,status.eq.active'`), for filters spanning multiple columns. ANDed with `where`/`match`. */
-    or?: string | {
-        filters: string;
-        referencedTable?: string;
-    };
-    /** Full-text search via PostgREST's `@@` operators. */
-    textSearch?: SupabaseTextSearch;
-    /** One or more `order by` clauses, applied in array order. */
-    orderBy?: SupabaseOrderBy | SupabaseOrderBy[];
-    /** Maximum rows to return. */
-    limit?: number;
-    /** Zero-indexed, inclusive `[from, to]` row range — PostgREST pagination. */
-    range?: [number, number];
-    /** Resolve to the single matching row instead of an array; errors if there isn't exactly one. */
-    single?: boolean;
-    /** Resolve to the single matching row, or `null` if there are none; errors if there's more than one. */
-    maybeSingle?: boolean;
-    /** Also return the total matching row count (`'exact'`, `'planned'`, or `'estimated'`). */
-    count?: 'exact' | 'planned' | 'estimated';
-}
-export interface SupabaseMutationOptions {
-    /** Filters, ANDed together — see {@link SupabaseWhere}. At least one of `where`/`match`/`or` is required for update/delete. */
-    where?: SupabaseWhere;
-    /** Shorthand for several `eq` filters at once. ANDed with `where`. */
-    match?: Record<string, unknown>;
-    /** A raw PostgREST `or()` filter string, for filters spanning multiple columns. ANDed with `where`/`match`. */
-    or?: string | {
-        filters: string;
-        referencedTable?: string;
-    };
-}
-export interface SupabaseUpsertOptions {
-    /** Column(s) forming the conflict target, comma-separated. Defaults to the table's primary key. */
-    onConflict?: string;
-    /** Skip (rather than update) rows that already exist. Defaults to `false`. */
-    ignoreDuplicates?: boolean;
-}
-export interface SupabaseResult<T> {
-    rows: T[];
-    /** Present only when `count` was requested on a select. */
-    count: number | null;
-}
-/**
- * Selects rows from `table` through the Supabase REST API
- * (`@supabase/supabase-js`'s `.from(table).select()`), as the **anonymous**
- * role — no `cfni_exec`, no raw SQL, only what PostgREST's REST API itself
- * supports: a column list, filters (equality or a named operator), one or
- * more `order by` clauses, `limit`/`range` pagination, `single`/`maybeSingle`,
- * and an optional row count.
- *
- * Reach for this — or {@link supabaseSelectAsUser} — instead of
- * `withPublicDb`/`withUserDb` when `db.supabase.rawSql` is `false`, or
- * whenever a query is simple enough that avoiding `cfni_exec` entirely is
- * preferable. Cross-table joins/aggregates spanning more than an embedded
- * resource (`columns: '*, related(*)'`) still need `withPublicDb`/
- * `withUserDb`, or a Postgres function called via {@link supabaseRpc}.
- *
- * @param table Table (or view) name.
- * @param options Column list, filters, ordering, pagination, count.
- * @returns The matching rows, and the total count when `options.count` is set.
- * @throws If `db`/`db.supabase` is not set, or PostgREST rejects the request.
- */
-export declare function supabaseSelect<T = Record<string, unknown>>(table: string, options?: SupabaseSelectOptions): Promise<SupabaseResult<T>>;
-/**
- * Same as {@link supabaseSelect}, but authenticated as the **signed-in
- * user**: the bearer token comes from `db.getAccessToken`, or the signed-in
- * Firebase user's ID token when `firebaseAuth` is configured — see
- * {@link resolveAccessToken}. PostgREST resolves the caller as
- * `authenticated` and RLS applies exactly as it would for `withUserDb`.
- */
-export declare function supabaseSelectAsUser<T = Record<string, unknown>>(table: string, options?: SupabaseSelectOptions): Promise<SupabaseResult<T>>;
-/**
- * Inserts one or more rows into `table` through the Supabase REST API, as
- * the **anonymous** role. See {@link supabaseSelect} for when to use this
- * over `withPublicDb`.
- *
- * @param table Table name.
- * @param values A single row, or an array of rows, to insert.
- * @returns The inserted row(s) as returned by PostgREST.
- */
-export declare function supabaseInsert<T = Record<string, unknown>>(table: string, values: Record<string, unknown> | Record<string, unknown>[]): Promise<T[]>;
-/** Same as {@link supabaseInsert}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
-export declare function supabaseInsertAsUser<T = Record<string, unknown>>(table: string, values: Record<string, unknown> | Record<string, unknown>[]): Promise<T[]>;
-/**
- * Inserts one or more rows into `table`, or updates them on a conflict —
- * PostgREST's `upsert`, i.e. `insert ... on conflict (...) do update`. As
- * the **anonymous** role.
- *
- * @param table Table name.
- * @param values A single row, or an array of rows, to upsert.
- * @param options `onConflict` (defaults to the table's primary key) and
- * `ignoreDuplicates` (skip instead of update on conflict).
- * @returns The upserted row(s) as returned by PostgREST.
- */
-export declare function supabaseUpsert<T = Record<string, unknown>>(table: string, values: Record<string, unknown> | Record<string, unknown>[], options?: SupabaseUpsertOptions): Promise<T[]>;
-/** Same as {@link supabaseUpsert}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
-export declare function supabaseUpsertAsUser<T = Record<string, unknown>>(table: string, values: Record<string, unknown> | Record<string, unknown>[], options?: SupabaseUpsertOptions): Promise<T[]>;
-/**
- * Updates rows in `table` matching `options.where` through the Supabase
- * REST API, as the **anonymous** role. See {@link supabaseSelect} for when
- * to use this over `withPublicDb`.
- *
- * @param table Table name.
- * @param values Columns to set.
- * @param options `where` — filters selecting which rows to update; required,
- * since an unfiltered update would touch every row.
- * @returns The updated rows as returned by PostgREST.
- */
-export declare function supabaseUpdate<T = Record<string, unknown>>(table: string, values: Record<string, unknown>, options: SupabaseMutationOptions): Promise<T[]>;
-/** Same as {@link supabaseUpdate}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
-export declare function supabaseUpdateAsUser<T = Record<string, unknown>>(table: string, values: Record<string, unknown>, options: SupabaseMutationOptions): Promise<T[]>;
-/**
- * Deletes rows in `table` matching `options.where` through the Supabase REST
- * API, as the **anonymous** role. See {@link supabaseSelect} for when to
- * use this over `withPublicDb`.
- *
- * @param table Table name.
- * @param options `where` — filters selecting which rows to delete; required,
- * since an unfiltered delete would remove every row.
- * @returns The deleted rows as returned by PostgREST.
- */
-export declare function supabaseDelete<T = Record<string, unknown>>(table: string, options: SupabaseMutationOptions): Promise<T[]>;
-/** Same as {@link supabaseDelete}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
-export declare function supabaseDeleteAsUser<T = Record<string, unknown>>(table: string, options: SupabaseMutationOptions): Promise<T[]>;
-/**
- * Calls a Postgres function through PostgREST's `.rpc()` — the same
- * mechanism `cfni_exec` itself uses, but for a function you define yourself.
- * This is how to run anything the `select`/`insert`/`upsert`/`update`/
- * `delete` helpers above can't express (joins, aggregates, custom logic)
- * without needing `cfni_exec`/raw SQL: write a regular Postgres function,
- * `grant execute` to `anon`/`authenticated`, and call it by name.
- *
- * As the **anonymous** role.
- *
- * @param fn Function name.
- * @param args Named arguments, matching the function's parameter names.
- */
-export declare function supabaseRpc<T = unknown>(fn: string, args?: Record<string, unknown>): Promise<T>;
-/** Same as {@link supabaseRpc}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
-export declare function supabaseRpcAsUser<T = unknown>(fn: string, args?: Record<string, unknown>): Promise<T>;

package/dist/src/db/supabase_rest.js

@@ -1,262 +0,0 @@
-import config from '../config/intl_config';
-import requireDbConfig from './require_config';
-import resolveSupabaseEndpoint from './supabase_config';
-import resolveAccessToken from './access_token';
-function describeQueryFailure(error) {
-    return `db: Supabase rejected the request — ${error.message}.`;
-}
-async function buildClient(supabase, bearerToken) {
-    const { url, anonKey } = await resolveSupabaseEndpoint(supabase);
-    const { createClient } = await import('@supabase/supabase-js');
-    return createClient(url, anonKey, { accessToken: async () => bearerToken });
-}
-function applyFilters(query, where) {
-    let result = query;
-    if (!where)
-        return result;
-    for (const [column, filter] of Object.entries(where)) {
-        if (Array.isArray(filter) && filter[0] === 'not') {
-            const [, operator, value] = filter;
-            result = result.not(column, operator, value);
-            continue;
-        }
-        const [operator, value] = Array.isArray(filter)
-            ? [filter[0], filter[1]]
-            : ['eq', filter];
-        result = result[operator](column, value);
-    }
-    return result;
-}
-function applyExtras(query, extras) {
-    let result = query;
-    if (extras.match)
-        result = result.match(extras.match);
-    if (extras.or) {
-        const or = typeof extras.or === 'string' ? { filters: extras.or, referencedTable: undefined } : extras.or;
-        result = result.or(or.filters, { referencedTable: or.referencedTable });
-    }
-    if (extras.textSearch) {
-        result = result.textSearch(extras.textSearch.column, extras.textSearch.query, {
-            type: extras.textSearch.type,
-            config: extras.textSearch.config,
-        });
-    }
-    return result;
-}
-function applyOrder(query, orderBy) {
-    if (!orderBy)
-        return query;
-    let result = query;
-    for (const clause of Array.isArray(orderBy) ? orderBy : [orderBy]) {
-        result = result.order(clause.column, { ascending: clause.ascending, nullsFirst: clause.nullsFirst });
-    }
-    return result;
-}
-async function requireSupabaseConfig() {
-    const db = config.db;
-    requireDbConfig(db);
-    if (!db.supabase) {
-        throw new Error('db: supabaseSelect/supabaseInsert/supabaseUpsert/supabaseUpdate/supabaseDelete/' +
-            'supabaseRpc need `db.supabase` (a project URL and anon key) on your RoutingConfig, ' +
-            'even in connection-string mode.');
-    }
-    return db.supabase;
-}
-async function anonClient() {
-    const supabase = await requireSupabaseConfig();
-    const { anonKey } = await resolveSupabaseEndpoint(supabase);
-    return buildClient(supabase, anonKey);
-}
-async function userClient() {
-    const supabase = await requireSupabaseConfig();
-    const token = await resolveAccessToken(config);
-    return buildClient(supabase, token);
-}
-/**
- * Selects rows from `table` through the Supabase REST API
- * (`@supabase/supabase-js`'s `.from(table).select()`), as the **anonymous**
- * role — no `cfni_exec`, no raw SQL, only what PostgREST's REST API itself
- * supports: a column list, filters (equality or a named operator), one or
- * more `order by` clauses, `limit`/`range` pagination, `single`/`maybeSingle`,
- * and an optional row count.
- *
- * Reach for this — or {@link supabaseSelectAsUser} — instead of
- * `withPublicDb`/`withUserDb` when `db.supabase.rawSql` is `false`, or
- * whenever a query is simple enough that avoiding `cfni_exec` entirely is
- * preferable. Cross-table joins/aggregates spanning more than an embedded
- * resource (`columns: '*, related(*)'`) still need `withPublicDb`/
- * `withUserDb`, or a Postgres function called via {@link supabaseRpc}.
- *
- * @param table Table (or view) name.
- * @param options Column list, filters, ordering, pagination, count.
- * @returns The matching rows, and the total count when `options.count` is set.
- * @throws If `db`/`db.supabase` is not set, or PostgREST rejects the request.
- */
-export async function supabaseSelect(table, options = {}) {
-    return runSelect(await anonClient(), table, options);
-}
-/**
- * Same as {@link supabaseSelect}, but authenticated as the **signed-in
- * user**: the bearer token comes from `db.getAccessToken`, or the signed-in
- * Firebase user's ID token when `firebaseAuth` is configured — see
- * {@link resolveAccessToken}. PostgREST resolves the caller as
- * `authenticated` and RLS applies exactly as it would for `withUserDb`.
- */
-export async function supabaseSelectAsUser(table, options = {}) {
-    return runSelect(await userClient(), table, options);
-}
-async function runSelect(client, table, options) {
-    let query = client.from(table).select(options.columns ?? '*', options.count ? { count: options.count } : undefined);
-    query = applyFilters(query, options.where);
-    query = applyExtras(query, options);
-    query = applyOrder(query, options.orderBy);
-    if (options.limit !== undefined)
-        query = query.limit(options.limit);
-    if (options.range)
-        query = query.range(options.range[0], options.range[1]);
-    if (options.single)
-        query = query.single();
-    else if (options.maybeSingle)
-        query = query.maybeSingle();
-    const { data, error, count } = (await query);
-    if (error)
-        throw new Error(describeQueryFailure(error));
-    const rows = options.single || options.maybeSingle ? (data === null ? [] : [data]) : (data ?? []);
-    return { rows, count };
-}
-/**
- * Inserts one or more rows into `table` through the Supabase REST API, as
- * the **anonymous** role. See {@link supabaseSelect} for when to use this
- * over `withPublicDb`.
- *
- * @param table Table name.
- * @param values A single row, or an array of rows, to insert.
- * @returns The inserted row(s) as returned by PostgREST.
- */
-export async function supabaseInsert(table, values) {
-    return runInsert(await anonClient(), table, values);
-}
-/** Same as {@link supabaseInsert}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
-export async function supabaseInsertAsUser(table, values) {
-    return runInsert(await userClient(), table, values);
-}
-async function runInsert(client, table, values) {
-    const { data, error } = (await client.from(table).insert(values).select());
-    if (error)
-        throw new Error(describeQueryFailure(error));
-    return data ?? [];
-}
-/**
- * Inserts one or more rows into `table`, or updates them on a conflict —
- * PostgREST's `upsert`, i.e. `insert ... on conflict (...) do update`. As
- * the **anonymous** role.
- *
- * @param table Table name.
- * @param values A single row, or an array of rows, to upsert.
- * @param options `onConflict` (defaults to the table's primary key) and
- * `ignoreDuplicates` (skip instead of update on conflict).
- * @returns The upserted row(s) as returned by PostgREST.
- */
-export async function supabaseUpsert(table, values, options = {}) {
-    return runUpsert(await anonClient(), table, values, options);
-}
-/** Same as {@link supabaseUpsert}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
-export async function supabaseUpsertAsUser(table, values, options = {}) {
-    return runUpsert(await userClient(), table, values, options);
-}
-async function runUpsert(client, table, values, options) {
-    const { data, error } = (await client
-        .from(table)
-        .upsert(values, { onConflict: options.onConflict, ignoreDuplicates: options.ignoreDuplicates })
-        .select());
-    if (error)
-        throw new Error(describeQueryFailure(error));
-    return data ?? [];
-}
-/**
- * Updates rows in `table` matching `options.where` through the Supabase
- * REST API, as the **anonymous** role. See {@link supabaseSelect} for when
- * to use this over `withPublicDb`.
- *
- * @param table Table name.
- * @param values Columns to set.
- * @param options `where` — filters selecting which rows to update; required,
- * since an unfiltered update would touch every row.
- * @returns The updated rows as returned by PostgREST.
- */
-export async function supabaseUpdate(table, values, options) {
-    return runUpdate(await anonClient(), table, values, options);
-}
-/** Same as {@link supabaseUpdate}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
-export async function supabaseUpdateAsUser(table, values, options) {
-    return runUpdate(await userClient(), table, values, options);
-}
-async function runUpdate(client, table, values, options) {
-    requireMutationFilter(options);
-    let query = client.from(table).update(values);
-    query = applyFilters(query, options.where);
-    query = applyExtras(query, options);
-    const { data, error } = (await query.select());
-    if (error)
-        throw new Error(describeQueryFailure(error));
-    return data ?? [];
-}
-/**
- * Deletes rows in `table` matching `options.where` through the Supabase REST
- * API, as the **anonymous** role. See {@link supabaseSelect} for when to
- * use this over `withPublicDb`.
- *
- * @param table Table name.
- * @param options `where` — filters selecting which rows to delete; required,
- * since an unfiltered delete would remove every row.
- * @returns The deleted rows as returned by PostgREST.
- */
-export async function supabaseDelete(table, options) {
-    return runDelete(await anonClient(), table, options);
-}
-/** Same as {@link supabaseDelete}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
-export async function supabaseDeleteAsUser(table, options) {
-    return runDelete(await userClient(), table, options);
-}
-async function runDelete(client, table, options) {
-    requireMutationFilter(options);
-    let query = client.from(table).delete();
-    query = applyFilters(query, options.where);
-    query = applyExtras(query, options);
-    const { data, error } = (await query.select());
-    if (error)
-        throw new Error(describeQueryFailure(error));
-    return data ?? [];
-}
-/**
- * Calls a Postgres function through PostgREST's `.rpc()` — the same
- * mechanism `cfni_exec` itself uses, but for a function you define yourself.
- * This is how to run anything the `select`/`insert`/`upsert`/`update`/
- * `delete` helpers above can't express (joins, aggregates, custom logic)
- * without needing `cfni_exec`/raw SQL: write a regular Postgres function,
- * `grant execute` to `anon`/`authenticated`, and call it by name.
- *
- * As the **anonymous** role.
- *
- * @param fn Function name.
- * @param args Named arguments, matching the function's parameter names.
- */
-export async function supabaseRpc(fn, args) {
-    return runRpc(await anonClient(), fn, args);
-}
-/** Same as {@link supabaseRpc}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
-export async function supabaseRpcAsUser(fn, args) {
-    return runRpc(await userClient(), fn, args);
-}
-async function runRpc(client, fn, args) {
-    const { data, error } = (await client.rpc(fn, args));
-    if (error)
-        throw new Error(describeQueryFailure(error));
-    return data;
-}
-function requireMutationFilter(options) {
-    const hasWhere = options.where && Object.keys(options.where).length > 0;
-    if (!hasWhere && !options.match && !options.or) {
-        throw new Error('db: one of `where`/`match`/`or` is required — an unfiltered update/delete would affect every row.');
-    }
-}