cloudflare-next-intl 0.8.30 → 0.8.32

package/README.md

@@ -467,8 +467,11 @@ export default setIntlConfig({
   server-side connection.
 - `authenticatedRole` — Postgres role `withUserDb` switches its
   call-scoped session to for the duration of your callback (`set role`, no
-  transaction involved; the session is closed when the call ends). Defaults
-  to `'authenticated'` (the Supabase RLS convention).
+  transaction involved; the session is closed when the call ends). May be a string or
+  a sync/async function returning a string. Defaults to `'authenticated'` (the Supabase RLS convention).
+- `authenticatedRoleClaim` — Firebase custom claims field (default `'role'`) read
+  to determine the Postgres role inside `withUserDb` when `firebaseAuth` is enabled.
+  Set `false` to disable custom claim inspection and rely on `authenticatedRole`.
 - `getUserId` — resolves the user id injected as
   `request.jwt.claims->>'sub'` inside `withUserDb`. Omit when
   `firebaseAuth` is configured — the uid then comes from this package's own

package/dist/src/db/context.js

@@ -31,6 +31,30 @@ async function resolveUserId(uid) {
     throw new Error('db: withUserDb could not resolve a user id. Pass one explicitly, set ' +
         '`db.getUserId`, or configure `firebaseAuth` so the signed-in Firebase uid is used.');
 }
+/**
+ * Resolves the Postgres role for `withUserDb`'s session. When `firebaseAuth`
+ * is configured and `db.authenticatedRoleClaim` isn't `false`, the signed-in
+ * user's Firebase ID token claim (default field `'role'`) wins when present;
+ * otherwise falls back to `db.authenticatedRole` (string or sync/async
+ * function), then `DEFAULT_ROLE`.
+ */
+async function resolveAuthenticatedRole(db) {
+    const claimField = db.authenticatedRoleClaim;
+    if (config.firebaseAuth && claimField !== false) {
+        const { getAuthUser } = await import('../firebase_auth/server/use_auth_user_server');
+        const { user } = await getAuthUser();
+        if (user && typeof user.getIdTokenResult === 'function') {
+            const { claims } = await user.getIdTokenResult();
+            const claimValue = claims[claimField ?? 'role'];
+            if (typeof claimValue === 'string' && claimValue)
+                return claimValue;
+        }
+    }
+    if (db.authenticatedRole) {
+        return typeof db.authenticatedRole === 'function' ? await db.authenticatedRole() : db.authenticatedRole;
+    }
+    return DEFAULT_ROLE;
+}
 /**
  * Builds a Drizzle handle backed by PostgREST. `bearerToken` decides the role
  * Postgres sees: the anon key for public access, a user JWT for `withUserDb`.
@@ -134,6 +158,21 @@ export async function withPublicDb(fn) {
         return await fn(await postgresDb(drizzleHandle, client));
     });
 }
+function injectUidComment(sql, userId) {
+    if (typeof sql === 'string') {
+        if (/^(select|with)\b/i.test(sql.trimStart())) {
+            return `/* uid:${userId} */ ${sql}`;
+        }
+        return sql;
+    }
+    if (sql && typeof sql === 'object' && typeof sql.text === 'string') {
+        const obj = sql;
+        if (/^(select|with)\b/i.test(obj.text.trimStart())) {
+            return { ...obj, text: `/* uid:${userId} */ ${obj.text}` };
+        }
+    }
+    return sql;
+}
 /**
  * Runs a query as the **signed-in user**, with `request.jwt.claims` and the
  * authenticated role set on the session so RLS policies apply to their id.
@@ -153,14 +192,101 @@ export async function withUserDb(fn, uid) {
         return fn(await supabaseDb(resolved.supabase, token));
     }
     const userId = await resolveUserId(uid);
-    const role = db.authenticatedRole ?? DEFAULT_ROLE;
+    const role = await resolveAuthenticatedRole(db);
     return await withDbClient(config, async (client) => {
         const rawClient = client;
-        await rawClient.query(`select set_config('request.jwt.claims', $1, false)`, [JSON.stringify({ sub: userId })]);
-        await rawClient.query(`set role "${role}"`);
+        const setSessionState = async () => {
+            await rawClient.query(`select set_config('request.jwt.claims', $1, false)`, [JSON.stringify({ sub: userId })]);
+            await rawClient.query(`set role "${role.replace(/"/g, '""')}"`);
+        };
+        const isSelectOnly = (sql) => {
+            const text = typeof sql === 'string' ? sql : sql?.text;
+            return typeof text === 'string' && /^(select|with)\b/i.test(text.trimStart());
+        };
+        let inTransaction = false;
+        let sessionStateSet = false;
+        let gate = Promise.resolve();
+        const serialize = (op) => {
+            const run = gate.then(op, op);
+            gate = run.catch(() => undefined);
+            return run;
+        };
+        const interceptingClient = new Proxy(client, {
+            get(target, prop) {
+                if (prop === 'query') {
+                    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                    return async (sql, ...args) => {
+                        const text = typeof sql === 'string' ? sql : (typeof sql?.text === 'string' ? sql.text : '');
+                        const isBegin = /^begin\b/i.test(text.trimStart());
+                        const isCommitOrRollback = /^(commit|rollback)\b/i.test(text.trimStart());
+                        if (isBegin) {
+                            return await serialize(async () => {
+                                if (!sessionStateSet) {
+                                    await rawClient.query('begin');
+                                    inTransaction = true;
+                                    await setSessionState();
+                                    sessionStateSet = true;
+                                }
+                                else if (!inTransaction) {
+                                    await rawClient.query('begin');
+                                    inTransaction = true;
+                                }
+                                return { rows: [], rowCount: 0 };
+                            });
+                        }
+                        if (isCommitOrRollback) {
+                            return await serialize(async () => {
+                                if (inTransaction) {
+                                    const res = await rawClient.query(text);
+                                    inTransaction = false;
+                                    return res;
+                                }
+                                return { rows: [], rowCount: 0 };
+                            });
+                        }
+                        await serialize(async () => {
+                            if (!sessionStateSet) {
+                                if (isSelectOnly(sql)) {
+                                    await rawClient.query('begin');
+                                    inTransaction = true;
+                                    await setSessionState();
+                                    await rawClient.query('commit');
+                                    inTransaction = false;
+                                }
+                                else {
+                                    await rawClient.query('begin');
+                                    inTransaction = true;
+                                    await setSessionState();
+                                }
+                                sessionStateSet = true;
+                            }
+                            else if (!inTransaction && !isSelectOnly(sql)) {
+                                await rawClient.query('begin');
+                                inTransaction = true;
+                            }
+                        });
+                        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                        return target.query(injectUidComment(sql, userId), ...args);
+                    };
+                }
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                const value = target[prop];
+                return typeof value === 'function' ? value.bind(target) : value;
+            }
+        });
         const { drizzle } = await import('drizzle-orm/node-postgres');
-        const drizzleHandle = drizzle(client);
-        return await fn(await postgresDb(drizzleHandle, rawClient));
+        const drizzleHandle = drizzle(interceptingClient);
+        try {
+            const result = await fn(await postgresDb(drizzleHandle, interceptingClient));
+            if (inTransaction)
+                await rawClient.query('commit');
+            return result;
+        }
+        catch (err) {
+            if (inTransaction)
+                await rawClient.query('rollback').catch(() => undefined);
+            throw err;
+        }
     });
 }
 /**

package/dist/src/db/db_performance.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/db/db_performance.bench.js

@@ -0,0 +1,116 @@
+import { bench, describe } from 'vitest';
+import tokenizeSql from './sql_tokens';
+import parseStatement from './parse_statement';
+import inlineParams from './inline_params';
+import encodeParam from './encode_param';
+import parseWhere from './parse_where';
+import parseComposite from './parse_composite';
+import buildRestFilters from './rest_filters';
+import resolveRawSql from './resolve_raw_sql';
+import { parseExecResult } from './supabase_transport';
+import { excluded, onConflictSet } from './helpers';
+import { pgTable, text, integer, timestamp } from 'drizzle-orm/pg-core';
+describe('DB Module Branch Benchmarks', () => {
+    const complexSql = 'SELECT id, name, email, created_at FROM users WHERE status = $1 AND age >= $2 AND role IN ($3, $4) ORDER BY created_at DESC LIMIT $5 OFFSET $6';
+    const insertSql = 'INSERT INTO users ("name", "email", "age", "status") VALUES ($1, $2, $3, $4), ($5, $6, $7, $8) ON CONFLICT ("email") DO UPDATE SET "name" = excluded."name", "status" = $9 RETURNING "id", "name"';
+    const updateSql = 'UPDATE users SET name = $1, status = $2 WHERE id = $3 AND active = $4 RETURNING id';
+    const deleteSql = 'DELETE FROM users WHERE tenant_id = $1 AND status = $2 AND created_at < $3 RETURNING id';
+    const sampleParams = ['active', 21, 'admin', 'user', 50, 10, 'John Doe', 'john@example.com', 30, 'pending'];
+    // Schema for helpers benchmarks
+    const usersTable = pgTable('users', {
+        id: integer('id').primaryKey(),
+        name: text('name').notNull(),
+        email: text('email').notNull(),
+        updatedAt: timestamp('updated_at'),
+    });
+    const mockTarget = {
+        eq: () => mockTarget,
+        gte: () => mockTarget,
+        in: () => mockTarget,
+        or: () => mockTarget,
+    };
+    const sampleWhereTree = {
+        kind: 'and',
+        children: [
+            { kind: 'compare', column: 'status', operator: 'eq', value: { kind: 'param', index: 1 } },
+            { kind: 'compare', column: 'age', operator: 'gte', value: { kind: 'param', index: 2 } },
+            { kind: 'in', column: 'role', values: [{ kind: 'param', index: 3 }, { kind: 'param', index: 4 }], negated: false }
+        ]
+    };
+    // 1. Tokenizer benchmarks
+    describe('tokenizeSql', () => {
+        bench('Select statement', () => { tokenizeSql(complexSql); });
+        bench('Insert statement', () => { tokenizeSql(insertSql); });
+        bench('Update statement', () => { tokenizeSql(updateSql); });
+        bench('Delete statement', () => { tokenizeSql(deleteSql); });
+    });
+    // 2. Parser benchmarks
+    describe('parseStatement', () => {
+        bench('Select statement', () => { parseStatement(complexSql); });
+        bench('Insert statement', () => { parseStatement(insertSql); });
+        bench('Update statement', () => { parseStatement(updateSql); });
+        bench('Delete statement', () => { parseStatement(deleteSql); });
+    });
+    // 3. Where Clause parser
+    describe('parseWhere', () => {
+        const tokens = tokenizeSql(complexSql);
+        // "WHERE status = $1 AND age >= $2 AND role IN ($3, $4)" starts after WHERE token (index 8)
+        bench('Where clause parsing', () => {
+            parseWhere(tokens, 9);
+        });
+    });
+    // 4. Parameter inlining
+    describe('inlineParams', () => {
+        bench('Select with 6 params', () => { inlineParams(complexSql, sampleParams); });
+        bench('Insert with 9 params', () => { inlineParams(insertSql, sampleParams); });
+    });
+    // 5. Parameter encoding
+    describe('encodeParam', () => {
+        bench('String encoding', () => { encodeParam('test string with \'quotes\' and \\ backslashes'); });
+        bench('Number encoding', () => { encodeParam(12345.678); });
+        bench('Boolean encoding', () => { encodeParam(true); });
+        bench('Date encoding', () => { encodeParam(new Date('2026-01-01T12:00:00Z')); });
+        bench('JSON Object encoding', () => { encodeParam({ a: 1, b: 'hello', c: [true, false] }); });
+        bench('Array encoding', () => { encodeParam(['foo', 'bar', 'baz']); });
+        bench('Uint8Array encoding', () => { encodeParam(new Uint8Array([1, 2, 3, 4, 255])); });
+    });
+    // 6. Composite type parsing
+    describe('parseComposite', () => {
+        bench('Simple composite row', () => { parseComposite('(123,"hello",t,"2026-01-01")'); });
+        bench('Escaped quoted composite row', () => { parseComposite('(123,"hello ""world""",t,"2026-01-01")'); });
+    });
+    // 7. REST Filters builder
+    describe('buildRestFilters', () => {
+        bench('Where tree translation', () => {
+            buildRestFilters(mockTarget, sampleWhereTree, sampleParams);
+        });
+    });
+    // 8. Result Decoder
+    describe('parseExecResult', () => {
+        const sampleResult = [
+            '(1,"John Doe","john@example.com","2026-01-01")',
+            '(2,"Jane Doe","jane@example.com","2026-01-02")',
+            '(3,"Bob Smith","bob@example.com","2026-01-03")',
+        ];
+        bench('Parse RPC array result', () => {
+            parseExecResult(sampleResult);
+        });
+    });
+    // 9. Drizzle Helpers
+    describe('helpers', () => {
+        const exUsers = excluded(usersTable);
+        bench('excluded column lookup', () => {
+            const _a = exUsers.name;
+            const _b = exUsers.email;
+        });
+        bench('onConflictSet generation', () => {
+            onConflictSet(usersTable, ['name', 'email']);
+        });
+    });
+    // 10. Raw SQL Resolution
+    describe('resolveRawSql', () => {
+        bench('Next.config lookup', () => {
+            resolveRawSql('/Volumes/External/own_projects/cloudflare-next-intl');
+        });
+    });
+});

package/dist/src/db/encode_param.js

@@ -34,11 +34,19 @@ export default function encodeParam(value) {
     // Plain objects (jsonb columns) — pg sends these JSON-stringified.
     return quoteLiteral(JSON.stringify(value));
 }
+const HEX_TABLE = Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));
 function quoteLiteral(text) {
+    if (text.indexOf("'") === -1)
+        return `'${text}'`;
     return `'${text.replace(/'/g, "''")}'`;
 }
 function bytesToHex(bytes) {
-    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+    let hex = '';
+    const len = bytes.length;
+    for (let i = 0; i < len; i++) {
+        hex += HEX_TABLE[bytes[i]];
+    }
+    return hex;
 }
 /** Encodes a JS array as a Postgres array literal body, e.g. `{1,2,"a,b"}`. */
 function encodeArray(value) {
@@ -56,5 +64,7 @@ function encodeArray(value) {
     return `{${items.join(',')}}`;
 }
 function quoteArrayElement(text) {
+    if (text.indexOf('\\') === -1 && text.indexOf('"') === -1)
+        return `"${text}"`;
     return `"${text.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
 }

package/dist/src/db/helpers.js

@@ -23,7 +23,7 @@ export function excluded(table) {
     const cols = getTableColumns(table);
     const tableName = getTableName(table);
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    return new Proxy({}, {
+    return new Proxy(cols, {
         get(_, prop) {
             const col = cols[prop];
             if (!col) {

package/dist/src/db/inline_params.js

@@ -19,57 +19,65 @@ import encodeParam from './encode_param';
 export default function inlineParams(statement, params) {
     let result = '';
     let i = 0;
+    let lastIndex = 0;
     const len = statement.length;
     while (i < len) {
-        const ch = statement[i];
-        if (ch === '-' && statement[i + 1] === '-') {
+        const code = statement.charCodeAt(i);
+        if (code === 45 && statement.charCodeAt(i + 1) === 45) { // --
             const end = statement.indexOf('\n', i);
             const stop = end === -1 ? len : end + 1;
-            result += statement.slice(i, stop);
             i = stop;
             continue;
         }
-        if (ch === '/' && statement[i + 1] === '*') {
+        if (code === 47 && statement.charCodeAt(i + 1) === 42) { // /*
             const end = statement.indexOf('*/', i + 2);
             const stop = end === -1 ? len : end + 2;
-            result += statement.slice(i, stop);
             i = stop;
             continue;
         }
-        if (ch === "'" || (ch === 'E' && statement[i + 1] === "'")) {
-            const start = ch === 'E' ? i + 1 : i;
+        if (code === 39 || (code === 69 && statement.charCodeAt(i + 1) === 39)) { // ' or E'
+            const start = code === 69 ? i + 1 : i;
             const end = findStringEnd(statement, start + 1);
-            result += statement.slice(i, end);
             i = end;
             continue;
         }
-        if (ch === '"') {
+        if (code === 34) { // "
             const end = findQuotedIdentifierEnd(statement, i + 1);
-            result += statement.slice(i, end);
             i = end;
             continue;
         }
-        if (ch === '$' && /[0-9]/.test(statement[i + 1] ?? '')) {
-            let j = i + 1;
-            while (j < len && /[0-9]/.test(statement[j]))
-                j++;
-            const index = Number(statement.slice(i + 1, j));
-            if (index < 1 || index > params.length) {
-                throw new Error(`db: statement references $${index} but only ${params.length} param(s) were provided.`);
+        if (code === 36) { // $
+            const nextCode = statement.charCodeAt(i + 1);
+            if (nextCode >= 48 && nextCode <= 57) {
+                let j = i + 2;
+                while (j < len) {
+                    const c = statement.charCodeAt(j);
+                    if (c >= 48 && c <= 57)
+                        j++;
+                    else
+                        break;
+                }
+                const index = Number(statement.slice(i + 1, j));
+                if (index < 1 || index > params.length) {
+                    throw new Error(`db: statement references $${index} but only ${params.length} param(s) were provided.`);
+                }
+                if (i > lastIndex)
+                    result += statement.slice(lastIndex, i);
+                result += encodeParam(params[index - 1]);
+                i = j;
+                lastIndex = j;
+                continue;
             }
-            result += encodeParam(params[index - 1]);
-            i = j;
-            continue;
-        }
-        if (ch === '$') {
             const tagEnd = findDollarQuoteEnd(statement, i);
-            result += statement.slice(i, tagEnd);
             i = tagEnd;
             continue;
         }
-        result += ch;
         i++;
     }
+    if (lastIndex === 0)
+        return statement;
+    if (lastIndex < len)
+        result += statement.slice(lastIndex);
     return result;
 }
 function findStringEnd(statement, from) {

package/dist/src/db/parse_composite.js

@@ -24,33 +24,51 @@ export default function parseComposite(literal) {
     if (len === i)
         return fields;
     while (true) {
-        if (literal[i] === '"') {
-            let value = '';
+        if (literal.charCodeAt(i) === 34) { // '"'
             i++;
+            const start = i;
+            let hasEscaped = false;
             while (i < len) {
-                if (literal[i] === '"') {
-                    if (literal[i + 1] === '"') {
-                        value += '"';
-                        i += 2;
-                        continue;
+                if (literal.charCodeAt(i) === 34) {
+                    if (literal.charCodeAt(i + 1) === 34) {
+                        hasEscaped = true;
+                        break;
                     }
                     break;
                 }
-                value += literal[i];
                 i++;
             }
-            i++; // closing quote
-            fields.push(value);
+            if (!hasEscaped) {
+                fields.push(literal.slice(start, i));
+                i++; // skip closing quote
+            }
+            else {
+                let value = literal.slice(start, i);
+                while (i < len) {
+                    if (literal.charCodeAt(i) === 34) {
+                        if (literal.charCodeAt(i + 1) === 34) {
+                            value += '"';
+                            i += 2;
+                            continue;
+                        }
+                        break;
+                    }
+                    value += literal[i];
+                    i++;
+                }
+                i++; // skip closing quote
+                fields.push(value);
+            }
         }
         else {
-            let value = '';
-            while (i < len && literal[i] !== ',') {
-                value += literal[i];
+            const start = i;
+            while (i < len && literal.charCodeAt(i) !== 44) {
                 i++;
             }
+            const value = literal.slice(start, i);
             fields.push(value === '' ? null : value);
         }
-        if (literal[i] === ',') {
+        if (literal.charCodeAt(i) === 44) { // ','
             i++;
             continue;
         }

package/dist/src/db/parse_statement.d.ts

@@ -60,17 +60,4 @@ export interface ParsedDelete {
 }
 /** Any statement the REST executor knows how to run. */
 export type ParsedStatement = ParsedSelect | ParsedInsert | ParsedUpdate | ParsedDelete;
-/**
- * Parses a generated statement into the smallest description the REST
- * executor needs, rejecting anything PostgREST's single-table API cannot do.
- *
- * The parser is deliberately strict: a statement it does not fully understand
- * must raise rather than translate approximately, because the transport reads
- * a raise as "send this to `cfni_exec` instead" and a wrong translation would
- * silently return wrong rows.
- *
- * @param sql The generated statement text, `$n` placeholders included.
- * @returns The parsed statement.
- * @throws {UnsupportedSqlError} If the statement is outside the supported subset.
- */
 export default function parseStatement(sql: string): ParsedStatement;

package/dist/src/db/parse_statement.js

@@ -14,20 +14,31 @@ import UnsupportedSqlError from './unsupported_sql';
  * @returns The parsed statement.
  * @throws {UnsupportedSqlError} If the statement is outside the supported subset.
  */
+const STATEMENT_CACHE = new Map();
+const MAX_STATEMENT_CACHE = 500;
 export default function parseStatement(sql) {
+    const cached = STATEMENT_CACHE.get(sql);
+    if (cached)
+        return cached;
     const tokens = tokenizeSql(sql);
     const first = tokens[0];
     if (!first || first.kind !== 'word')
         throw new UnsupportedSqlError('empty statement');
+    let parsed;
     if (first.value === 'select')
-        return parseSelect(tokens);
-    if (first.value === 'insert')
-        return parseInsert(tokens);
-    if (first.value === 'update')
-        return parseUpdate(tokens);
-    if (first.value === 'delete')
-        return parseDelete(tokens);
-    throw new UnsupportedSqlError(`statement type "${first.value}"`);
+        parsed = parseSelect(tokens);
+    else if (first.value === 'insert')
+        parsed = parseInsert(tokens);
+    else if (first.value === 'update')
+        parsed = parseUpdate(tokens);
+    else if (first.value === 'delete')
+        parsed = parseDelete(tokens);
+    else
+        throw new UnsupportedSqlError(`statement type "${first.value}"`);
+    if (STATEMENT_CACHE.size >= MAX_STATEMENT_CACHE)
+        STATEMENT_CACHE.clear();
+    STATEMENT_CACHE.set(sql, parsed);
+    return parsed;
 }
 function parseSelect(tokens) {
     let index = 1;

package/dist/src/db/sql_tokens.js

@@ -1,4 +1,5 @@
-const MULTI_CHAR_OPERATORS = ['-|-', '<>', '!=', '>=', '<=', '~*', '@>', '<@', '&&', '>>', '<<', '&>', '&<', '@@'];
+const TOKEN_CACHE = new Map();
+const MAX_CACHE_SIZE = 500;
 /**
  * Splits a statement generated by `drizzle-orm/pg-proxy` into tokens the
  * statement parser can walk.
@@ -12,77 +13,194 @@ const MULTI_CHAR_OPERATORS = ['-|-', '<>', '!=', '>=', '<=', '~*', '@>', '<@', '
  * @returns The token list, in source order.
  */
 export default function tokenizeSql(sql) {
+    const cached = TOKEN_CACHE.get(sql);
+    if (cached)
+        return cached.slice();
     const tokens = [];
     let i = 0;
-    while (i < sql.length) {
-        const char = sql[i];
-        if (/\s/.test(char)) {
+    const len = sql.length;
+    while (i < len) {
+        const code = sql.charCodeAt(i);
+        // Whitespace: space (32), tab (9), LF (10), VT (11), FF (12), CR (13)
+        if (code === 32 || (code >= 9 && code <= 13)) {
             i++;
             continue;
         }
-        if (char === '-' && sql[i + 1] === '-') {
+        // Line comment --
+        if (code === 45 && sql.charCodeAt(i + 1) === 45) {
             const end = sql.indexOf('\n', i);
-            i = end === -1 ? sql.length : end + 1;
+            i = end === -1 ? len : end + 1;
             continue;
         }
-        if (char === '/' && sql[i + 1] === '*') {
+        // Block comment /* ... */
+        if (code === 47 && sql.charCodeAt(i + 1) === 42) {
             const end = sql.indexOf('*/', i + 2);
-            i = end === -1 ? sql.length : end + 2;
+            i = end === -1 ? len : end + 2;
             continue;
         }
-        if (char === '"') {
+        // Quoted identifier "..."
+        if (code === 34) {
             const [value, next] = readDelimited(sql, i + 1, '"');
             tokens.push({ kind: 'quoted', value });
             i = next;
             continue;
         }
-        if (char === "'") {
+        // String literal '...'
+        if (code === 39) {
             const [value, next] = readDelimited(sql, i + 1, "'");
             tokens.push({ kind: 'string', value });
             i = next;
             continue;
         }
-        if (char === '$' && /[0-9]/.test(sql[i + 1] ?? '')) {
-            let end = i + 1;
-            while (end < sql.length && /[0-9]/.test(sql[end]))
-                end++;
-            tokens.push({ kind: 'param', index: Number(sql.slice(i + 1, end)) });
-            i = end;
-            continue;
+        // Parameter $1, $2, ...
+        if (code === 36) {
+            const nextCode = sql.charCodeAt(i + 1);
+            if (nextCode >= 48 && nextCode <= 57) {
+                let end = i + 2;
+                while (end < len) {
+                    const c = sql.charCodeAt(end);
+                    if (c >= 48 && c <= 57)
+                        end++;
+                    else
+                        break;
+                }
+                tokens.push({ kind: 'param', index: Number(sql.slice(i + 1, end)) });
+                i = end;
+                continue;
+            }
         }
-        if (/[0-9]/.test(char)) {
-            let end = i;
-            while (end < sql.length && /[0-9.]/.test(sql[end]))
-                end++;
+        // Numbers 0-9
+        if (code >= 48 && code <= 57) {
+            let end = i + 1;
+            while (end < len) {
+                const c = sql.charCodeAt(end);
+                if ((c >= 48 && c <= 57) || c === 46)
+                    end++; // 0-9 or .
+                else
+                    break;
+            }
             tokens.push({ kind: 'number', value: sql.slice(i, end) });
             i = end;
             continue;
         }
-        if (/[A-Za-z_]/.test(char)) {
-            let end = i;
-            while (end < sql.length && /[A-Za-z0-9_]/.test(sql[end]))
-                end++;
+        // Words A-Z, a-z, _
+        if ((code >= 65 && code <= 90) || (code >= 97 && code <= 122) || code === 95) {
+            let end = i + 1;
+            while (end < len) {
+                const c = sql.charCodeAt(end);
+                if ((c >= 65 && c <= 90) || (c >= 97 && c <= 122) || (c >= 48 && c <= 57) || c === 95)
+                    end++;
+                else
+                    break;
+            }
             tokens.push({ kind: 'word', value: sql.slice(i, end).toLowerCase() });
             i = end;
             continue;
         }
-        const operator = MULTI_CHAR_OPERATORS.find((candidate) => sql.startsWith(candidate, i));
-        if (operator) {
-            tokens.push({ kind: 'punct', value: operator });
-            i += operator.length;
-            continue;
+        // Multi-char operators check
+        const nextCode = sql.charCodeAt(i + 1);
+        if (nextCode) {
+            if (code === 45 && nextCode === 124 && sql.charCodeAt(i + 2) === 45) { // -|-
+                tokens.push({ kind: 'punct', value: '-|-' });
+                i += 3;
+                continue;
+            }
+            if (code === 60 && nextCode === 62) {
+                tokens.push({ kind: 'punct', value: '<>' });
+                i += 2;
+                continue;
+            } // <>
+            if (code === 33 && nextCode === 61) {
+                tokens.push({ kind: 'punct', value: '!=' });
+                i += 2;
+                continue;
+            } // !=
+            if (code === 62 && nextCode === 61) {
+                tokens.push({ kind: 'punct', value: '>=' });
+                i += 2;
+                continue;
+            } // >=
+            if (code === 60 && nextCode === 61) {
+                tokens.push({ kind: 'punct', value: '<=' });
+                i += 2;
+                continue;
+            } // <=
+            if (code === 126 && nextCode === 42) {
+                tokens.push({ kind: 'punct', value: '~*' });
+                i += 2;
+                continue;
+            } // ~*
+            if (code === 64 && nextCode === 62) {
+                tokens.push({ kind: 'punct', value: '@>' });
+                i += 2;
+                continue;
+            } // @>
+            if (code === 60 && nextCode === 64) {
+                tokens.push({ kind: 'punct', value: '<@' });
+                i += 2;
+                continue;
+            } // <@
+            if (code === 38 && nextCode === 38) {
+                tokens.push({ kind: 'punct', value: '&&' });
+                i += 2;
+                continue;
+            } // &&
+            if (code === 62 && nextCode === 62) {
+                tokens.push({ kind: 'punct', value: '>>' });
+                i += 2;
+                continue;
+            } // >>
+            if (code === 60 && nextCode === 60) {
+                tokens.push({ kind: 'punct', value: '<<' });
+                i += 2;
+                continue;
+            } // <<
+            if (code === 38 && nextCode === 62) {
+                tokens.push({ kind: 'punct', value: '&>' });
+                i += 2;
+                continue;
+            } // &>
+            if (code === 38 && nextCode === 60) {
+                tokens.push({ kind: 'punct', value: '&<' });
+                i += 2;
+                continue;
+            } // &<
+            if (code === 64 && nextCode === 64) {
+                tokens.push({ kind: 'punct', value: '@@' });
+                i += 2;
+                continue;
+            } // @@
         }
-        tokens.push({ kind: 'punct', value: char });
+        tokens.push({ kind: 'punct', value: sql[i] });
         i++;
     }
-    return tokens;
+    if (TOKEN_CACHE.size >= MAX_CACHE_SIZE)
+        TOKEN_CACHE.clear();
+    TOKEN_CACHE.set(sql, tokens);
+    return tokens.slice();
 }
 function readDelimited(sql, from, delimiter) {
-    let value = '';
+    const delimCode = delimiter.charCodeAt(0);
     let i = from;
-    while (i < sql.length) {
-        if (sql[i] === delimiter) {
-            if (sql[i + 1] === delimiter) {
+    const len = sql.length;
+    let hasEscaped = false;
+    // Fast check for quotes without escaping
+    while (i < len) {
+        if (sql.charCodeAt(i) === delimCode) {
+            if (sql.charCodeAt(i + 1) === delimCode) {
+                hasEscaped = true;
+                break;
+            }
+            return [sql.slice(from, i), i + 1];
+        }
+        i++;
+    }
+    if (!hasEscaped)
+        return [sql.slice(from, i), len];
+    let value = sql.slice(from, i);
+    while (i < len) {
+        if (sql.charCodeAt(i) === delimCode) {
+            if (sql.charCodeAt(i + 1) === delimCode) {
                 value += delimiter;
                 i += 2;
                 continue;
@@ -92,5 +210,5 @@ function readDelimited(sql, from, delimiter) {
         value += sql[i];
         i++;
     }
-    return [value, sql.length];
+    return [value, len];
 }

package/dist/src/firebase_auth/client/firebase_client.js

@@ -62,7 +62,7 @@ export async function getFirebaseAuthClient() {
                 measurementId: fa.measurementId,
             };
             const app = getApps().length ? getApp() : initializeApp(firebaseConfig);
-            if (fa.appCheck) {
+            if (fa.appCheck && typeof window !== 'undefined') {
                 cachedAppCheck = await initializeFirebaseAppCheck(app, fa.appCheck);
             }
             if (perfModule) {

package/dist/src/firebase_auth/middleware/update_session.js

@@ -243,7 +243,11 @@ export default async function updateSession(request, baseResponse, locale, rebui
         const mode = request.nextUrl.searchParams.get('mode');
         if (mode) {
             let target = resolveActionModePaths(fa)[mode];
-            if (fa.followSameOriginContinueUrl !== false) {
+            // Already on the page this mode routes to: the link has arrived.
+            // Following `continueUrl` from here would send it back to the
+            // action URL, which forwards to this same target again — an
+            // endless 307 ping-pong.
+            if (fa.followSameOriginContinueUrl !== false && target !== path) {
                 const continueUrl = request.nextUrl.searchParams.get('continueUrl');
                 if (continueUrl) {
                     try {
@@ -291,6 +295,15 @@ export default async function updateSession(request, baseResponse, locale, rebui
             if (target && target !== path) {
                 const url = localeUrl(target);
                 url.search = request.nextUrl.search;
+                // Staying on this origin: only `oobCode` (plus anything the app
+                // put there itself) is still needed. Dropping Firebase's own
+                // routing params keeps the landed URL clean and makes a second
+                // forwarding pass impossible.
+                if (fa.stripActionLinkQuery !== false) {
+                    for (const key of ['mode', 'apiKey', 'lang', 'continueUrl']) {
+                        url.searchParams.delete(key);
+                    }
+                }
                 return buildRedirect(baseResponse, url);
             }
         }

package/dist/src/types/types.d.ts

@@ -546,14 +546,24 @@ export interface FirebaseAuthRoutingConfig {
      * auto-corrects a missing leading slash with a warning.
      */
     actionLinkPath?: string;
+    /**
+     * Whether a same-origin emailed-action-link forward strips Firebase's own
+     * `mode`/`apiKey`/`lang`/`continueUrl` params, landing the user on a clean
+     * `?oobCode=` URL. Defaults to `true`. Set `false` to keep the full query
+     * when the destination page reads those params itself. Cross-origin
+     * redirects always keep the full query.
+     */
+    stripActionLinkQuery?: boolean;
     /**
      * Whether the middleware's own redirects (`redirectAuthPath`, `homePath`,
      * `verifyEmailPath`) carry over the original request's query string —
      * e.g. `/login?ref=abc` stays `/login?ref=abc` after redirecting to
      * `homePath` for a signed-in user, instead of dropping to `/`. Defaults
      * to `true`. The emailed-action-link forward (see
-     * {@link resetPasswordPath}) always preserves its query string
-     * regardless of this setting, since `oobCode` must survive that hop.
+     * {@link resetPasswordPath}) always preserves `oobCode` regardless of
+     * this setting, since it must survive that hop; when the forward stays on
+     * this origin it drops Firebase's own `mode`/`apiKey`/`lang`/`continueUrl`
+     * params, which the destination page no longer needs.
      */
     preserveRedirectQuery?: boolean;
     /** Returns true if the given (locale-stripped) path is an auth page (login/signup/etc). */
@@ -900,10 +910,21 @@ export interface DbRoutingConfig {
      */
     disconnectAfterRequest?: boolean;
     /**
-     * Postgres role assumed inside `withUserDb`'s transaction. Defaults
-     * to `'authenticated'` (the Supabase RLS convention).
+     * Postgres role assumed inside `withUserDb`'s transaction, used when
+     * {@link authenticatedRoleClaim} doesn't resolve one (e.g. `firebaseAuth`
+     * isn't configured, or the claim is absent). May be a string or a
+     * sync/async function resolved on each call. Defaults to `'authenticated'`
+     * (the Supabase RLS convention).
+     */
+    authenticatedRole?: string | (() => string | Promise<string>);
+    /**
+     * Name of the Firebase custom-claims field read for the Postgres role
+     * inside `withUserDb`, taking priority over {@link authenticatedRole}
+     * when present on the signed-in user's ID token. Defaults to `'role'`.
+     * Only consulted when `firebaseAuth` is configured; set `false` to skip
+     * reading claims entirely and always use `authenticatedRole`.
      */
-    authenticatedRole?: string;
+    authenticatedRoleClaim?: string | false;
     /**
      * Resolves the user id injected as `request.jwt.claims->>'sub'` inside
      * `withUserDb`. Omit when `firebaseAuth` is configured — the uid then

package/llms.txt

@@ -54,7 +54,8 @@ Two transports, picked by which `db` fields are set — `pg`/`drizzle-orm`/`@sup
 - Direct Postgres (wins if configured): `db.connectionString` — Postgres connection string, or a sync/async function returning one (resolved on each connect). The function form is the way to read a value unavailable at module scope, e.g. a Cloudflare Hyperdrive binding: `connectionString: async () => (await getCloudflareContext({ async: true })).env.HYPERDRIVE.connectionString`. There is no separate `hyperdriveBinding` option.
 - Supabase Data API (used only when neither of the above is set): `db.supabase` — `{ url?, anonKey?, execFunction?, rawSql? }` where `url`/`anonKey` each accept a string or a sync/async function returning one, defaulting `url`/`anonKey` to `NEXT_PUBLIC_SUPABASE_URL`/`NEXT_PUBLIC_SUPABASE_ANON_KEY`. Statements are translated to PostgREST REST calls first; unsupported statements fall back to `supabase/cfni_exec.sql` (a `security invoker` SQL-exec function) in your database — `cfni-db-codegen`/`cfni-db-install-exec` can install it for you (see below). No multi-statement transactions — each statement in a `withUserDb` callback is its own round-trip; `.transaction()` throws instead of running non-atomically. `rawSql: false` disables `cfni_exec` fallback, throwing an informative error when a query cannot be served over REST.
 - `db.disconnectAfterRequest` — deprecated, ignored since 0.8.23. Each `withPublicDb`/`withUserDb` call opens and closes its own client; Hyperdrive pools the server-side connection.
-- `db.authenticatedRole` — direct-Postgres mode only: Postgres role assumed inside `withUserDb`'s transaction. Defaults to `'authenticated'` (Supabase RLS convention).
+- `db.authenticatedRole` — direct-Postgres mode only: Postgres role assumed inside `withUserDb`'s transaction. Accepts a string or a sync/async function returning one. Defaults to `'authenticated'` (Supabase RLS convention).
+- `db.authenticatedRoleClaim` — direct-Postgres mode only: Firebase custom claim field (default `'role'`) read to determine the Postgres role in `withUserDb` when `firebaseAuth` is enabled. Set `false` to disable.
 - `db.getUserId` — direct-Postgres mode only: resolves the user id injected as `request.jwt.claims->>'sub'` in `withUserDb`. Omit when `firebaseAuth` is configured — the uid is then taken automatically from the signed-in Firebase user via this package's own `getAuthUser()`.
 - `db.getAccessToken` — Supabase mode only: resolves the JWT sent as `Authorization: Bearer` in `withUserDb`, which is what makes PostgREST resolve `authenticated` and apply RLS. Omit when `firebaseAuth` is configured — the signed-in user's Firebase ID token is used automatically.
 - `db.disconnectTimeoutMs` — deprecated, ignored since 0.8.23. Teardown is awaited or deferred to `ctx.waitUntil` without a timeout.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cloudflare-next-intl",
-	"version": "0.8.30",
+	"version": "0.8.32",
 	"description": "Optimized Next Intl Package Special for App Router and Cloudflare",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",