cloudflare-next-intl 0.8.4 → 0.8.6

package/dist/src/db/supabase_rest.js

@@ -0,0 +1,262 @@
+import config from '../config/intl_config';
+import requireDbConfig from './require_config';
+import resolveSupabaseEndpoint from './supabase_config';
+import resolveAccessToken from './access_token';
+function describeQueryFailure(error) {
+    return `db: Supabase rejected the request — ${error.message}.`;
+}
+async function buildClient(supabase, bearerToken) {
+    const { url, anonKey } = await resolveSupabaseEndpoint(supabase);
+    const { createClient } = await import('@supabase/supabase-js');
+    return createClient(url, anonKey, { accessToken: async () => bearerToken });
+}
+function applyFilters(query, where) {
+    let result = query;
+    if (!where)
+        return result;
+    for (const [column, filter] of Object.entries(where)) {
+        if (Array.isArray(filter) && filter[0] === 'not') {
+            const [, operator, value] = filter;
+            result = result.not(column, operator, value);
+            continue;
+        }
+        const [operator, value] = Array.isArray(filter)
+            ? [filter[0], filter[1]]
+            : ['eq', filter];
+        result = result[operator](column, value);
+    }
+    return result;
+}
+function applyExtras(query, extras) {
+    let result = query;
+    if (extras.match)
+        result = result.match(extras.match);
+    if (extras.or) {
+        const or = typeof extras.or === 'string' ? { filters: extras.or, referencedTable: undefined } : extras.or;
+        result = result.or(or.filters, { referencedTable: or.referencedTable });
+    }
+    if (extras.textSearch) {
+        result = result.textSearch(extras.textSearch.column, extras.textSearch.query, {
+            type: extras.textSearch.type,
+            config: extras.textSearch.config,
+        });
+    }
+    return result;
+}
+function applyOrder(query, orderBy) {
+    if (!orderBy)
+        return query;
+    let result = query;
+    for (const clause of Array.isArray(orderBy) ? orderBy : [orderBy]) {
+        result = result.order(clause.column, { ascending: clause.ascending, nullsFirst: clause.nullsFirst });
+    }
+    return result;
+}
+async function requireSupabaseConfig() {
+    const db = config.db;
+    requireDbConfig(db);
+    if (!db.supabase) {
+        throw new Error('db: supabaseSelect/supabaseInsert/supabaseUpsert/supabaseUpdate/supabaseDelete/' +
+            'supabaseRpc need `db.supabase` (a project URL and anon key) on your RoutingConfig, ' +
+            'even in connection-string mode.');
+    }
+    return db.supabase;
+}
+async function anonClient() {
+    const supabase = await requireSupabaseConfig();
+    const { anonKey } = await resolveSupabaseEndpoint(supabase);
+    return buildClient(supabase, anonKey);
+}
+async function userClient() {
+    const supabase = await requireSupabaseConfig();
+    const token = await resolveAccessToken(config);
+    return buildClient(supabase, token);
+}
+/**
+ * Selects rows from `table` through the Supabase REST API
+ * (`@supabase/supabase-js`'s `.from(table).select()`), as the **anonymous**
+ * role — no `cfni_exec`, no raw SQL, only what PostgREST's REST API itself
+ * supports: a column list, filters (equality or a named operator), one or
+ * more `order by` clauses, `limit`/`range` pagination, `single`/`maybeSingle`,
+ * and an optional row count.
+ *
+ * Reach for this — or {@link supabaseSelectAsUser} — instead of
+ * `withPublicDb`/`withUserDb` when `db.supabase.rawSql` is `false`, or
+ * whenever a query is simple enough that avoiding `cfni_exec` entirely is
+ * preferable. Cross-table joins/aggregates spanning more than an embedded
+ * resource (`columns: '*, related(*)'`) still need `withPublicDb`/
+ * `withUserDb`, or a Postgres function called via {@link supabaseRpc}.
+ *
+ * @param table Table (or view) name.
+ * @param options Column list, filters, ordering, pagination, count.
+ * @returns The matching rows, and the total count when `options.count` is set.
+ * @throws If `db`/`db.supabase` is not set, or PostgREST rejects the request.
+ */
+export async function supabaseSelect(table, options = {}) {
+    return runSelect(await anonClient(), table, options);
+}
+/**
+ * Same as {@link supabaseSelect}, but authenticated as the **signed-in
+ * user**: the bearer token comes from `db.getAccessToken`, or the signed-in
+ * Firebase user's ID token when `firebaseAuth` is configured — see
+ * {@link resolveAccessToken}. PostgREST resolves the caller as
+ * `authenticated` and RLS applies exactly as it would for `withUserDb`.
+ */
+export async function supabaseSelectAsUser(table, options = {}) {
+    return runSelect(await userClient(), table, options);
+}
+async function runSelect(client, table, options) {
+    let query = client.from(table).select(options.columns ?? '*', options.count ? { count: options.count } : undefined);
+    query = applyFilters(query, options.where);
+    query = applyExtras(query, options);
+    query = applyOrder(query, options.orderBy);
+    if (options.limit !== undefined)
+        query = query.limit(options.limit);
+    if (options.range)
+        query = query.range(options.range[0], options.range[1]);
+    if (options.single)
+        query = query.single();
+    else if (options.maybeSingle)
+        query = query.maybeSingle();
+    const { data, error, count } = (await query);
+    if (error)
+        throw new Error(describeQueryFailure(error));
+    const rows = options.single || options.maybeSingle ? (data === null ? [] : [data]) : (data ?? []);
+    return { rows, count };
+}
+/**
+ * Inserts one or more rows into `table` through the Supabase REST API, as
+ * the **anonymous** role. See {@link supabaseSelect} for when to use this
+ * over `withPublicDb`.
+ *
+ * @param table Table name.
+ * @param values A single row, or an array of rows, to insert.
+ * @returns The inserted row(s) as returned by PostgREST.
+ */
+export async function supabaseInsert(table, values) {
+    return runInsert(await anonClient(), table, values);
+}
+/** Same as {@link supabaseInsert}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
+export async function supabaseInsertAsUser(table, values) {
+    return runInsert(await userClient(), table, values);
+}
+async function runInsert(client, table, values) {
+    const { data, error } = (await client.from(table).insert(values).select());
+    if (error)
+        throw new Error(describeQueryFailure(error));
+    return data ?? [];
+}
+/**
+ * Inserts one or more rows into `table`, or updates them on a conflict —
+ * PostgREST's `upsert`, i.e. `insert ... on conflict (...) do update`. As
+ * the **anonymous** role.
+ *
+ * @param table Table name.
+ * @param values A single row, or an array of rows, to upsert.
+ * @param options `onConflict` (defaults to the table's primary key) and
+ * `ignoreDuplicates` (skip instead of update on conflict).
+ * @returns The upserted row(s) as returned by PostgREST.
+ */
+export async function supabaseUpsert(table, values, options = {}) {
+    return runUpsert(await anonClient(), table, values, options);
+}
+/** Same as {@link supabaseUpsert}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
+export async function supabaseUpsertAsUser(table, values, options = {}) {
+    return runUpsert(await userClient(), table, values, options);
+}
+async function runUpsert(client, table, values, options) {
+    const { data, error } = (await client
+        .from(table)
+        .upsert(values, { onConflict: options.onConflict, ignoreDuplicates: options.ignoreDuplicates })
+        .select());
+    if (error)
+        throw new Error(describeQueryFailure(error));
+    return data ?? [];
+}
+/**
+ * Updates rows in `table` matching `options.where` through the Supabase
+ * REST API, as the **anonymous** role. See {@link supabaseSelect} for when
+ * to use this over `withPublicDb`.
+ *
+ * @param table Table name.
+ * @param values Columns to set.
+ * @param options `where` — filters selecting which rows to update; required,
+ * since an unfiltered update would touch every row.
+ * @returns The updated rows as returned by PostgREST.
+ */
+export async function supabaseUpdate(table, values, options) {
+    return runUpdate(await anonClient(), table, values, options);
+}
+/** Same as {@link supabaseUpdate}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
+export async function supabaseUpdateAsUser(table, values, options) {
+    return runUpdate(await userClient(), table, values, options);
+}
+async function runUpdate(client, table, values, options) {
+    requireMutationFilter(options);
+    let query = client.from(table).update(values);
+    query = applyFilters(query, options.where);
+    query = applyExtras(query, options);
+    const { data, error } = (await query.select());
+    if (error)
+        throw new Error(describeQueryFailure(error));
+    return data ?? [];
+}
+/**
+ * Deletes rows in `table` matching `options.where` through the Supabase REST
+ * API, as the **anonymous** role. See {@link supabaseSelect} for when to
+ * use this over `withPublicDb`.
+ *
+ * @param table Table name.
+ * @param options `where` — filters selecting which rows to delete; required,
+ * since an unfiltered delete would remove every row.
+ * @returns The deleted rows as returned by PostgREST.
+ */
+export async function supabaseDelete(table, options) {
+    return runDelete(await anonClient(), table, options);
+}
+/** Same as {@link supabaseDelete}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
+export async function supabaseDeleteAsUser(table, options) {
+    return runDelete(await userClient(), table, options);
+}
+async function runDelete(client, table, options) {
+    requireMutationFilter(options);
+    let query = client.from(table).delete();
+    query = applyFilters(query, options.where);
+    query = applyExtras(query, options);
+    const { data, error } = (await query.select());
+    if (error)
+        throw new Error(describeQueryFailure(error));
+    return data ?? [];
+}
+/**
+ * Calls a Postgres function through PostgREST's `.rpc()` — the same
+ * mechanism `cfni_exec` itself uses, but for a function you define yourself.
+ * This is how to run anything the `select`/`insert`/`upsert`/`update`/
+ * `delete` helpers above can't express (joins, aggregates, custom logic)
+ * without needing `cfni_exec`/raw SQL: write a regular Postgres function,
+ * `grant execute` to `anon`/`authenticated`, and call it by name.
+ *
+ * As the **anonymous** role.
+ *
+ * @param fn Function name.
+ * @param args Named arguments, matching the function's parameter names.
+ */
+export async function supabaseRpc(fn, args) {
+    return runRpc(await anonClient(), fn, args);
+}
+/** Same as {@link supabaseRpc}, authenticated as the signed-in user — see {@link supabaseSelectAsUser}. */
+export async function supabaseRpcAsUser(fn, args) {
+    return runRpc(await userClient(), fn, args);
+}
+async function runRpc(client, fn, args) {
+    const { data, error } = (await client.rpc(fn, args));
+    if (error)
+        throw new Error(describeQueryFailure(error));
+    return data;
+}
+function requireMutationFilter(options) {
+    const hasWhere = options.where && Object.keys(options.where).length > 0;
+    if (!hasWhere && !options.match && !options.or) {
+        throw new Error('db: one of `where`/`match`/`or` is required — an unfiltered update/delete would affect every row.');
+    }
+}

package/dist/src/db/supabase_transport.d.ts

@@ -5,6 +5,7 @@ import type { SupabaseDbConfig } from '../types/types';
  */
 export type SupabaseRemoteCallback = (sql: string, params: unknown[], method: 'all' | 'execute') => Promise<{
     rows: unknown[];
+    rowCount?: number | null;
 }>;
 /**
  * Builds the transport Drizzle uses in Supabase mode: every generated
@@ -21,6 +22,13 @@ export type SupabaseRemoteCallback = (sql: string, params: unknown[], method: 'a
  * Rows come back as positional arrays because `pg-proxy` maps result columns
  * by index; `cfni_exec` is what guarantees that shape.
  *
+ * Parameters are inlined into the statement as Postgres literals (see
+ * {@link inlineParams}) before it is sent, rather than passed through to
+ * `cfni_exec` for binding — `EXECUTE ... USING` can only bind a single
+ * uniformly-typed value, which breaks for anything beyond one string param.
+ * Inlining keeps every value's real type inferable by Postgres, the same way
+ * a direct `pg` connection would send it.
+ *
  * @param supabase The `db.supabase` config block.
  * @param bearerToken Token resolved as the caller's identity — the anon key,
  * or a per-request user JWT.

package/dist/src/db/supabase_transport.js

@@ -1,5 +1,28 @@
 import resolveSupabaseEndpoint from './supabase_config';
+import inlineParams from './inline_params';
+import parseComposite from './parse_composite';
 const DEFAULT_EXEC_FUNCTION = 'cfni_exec';
+/**
+ * `cfni_exec` returns each row as a Postgres composite-literal string (see
+ * {@link parseComposite}), so the JSON-decoded `data.rows` array here is a
+ * `string[]`, not already the `(string | null)[][]` `pg-proxy` expects —
+ * that positional-array shape is what this reconstructs.
+ */
+function parseExecResult(data) {
+    if (Array.isArray(data))
+        return { rows: data.map(parseRow), rowCount: null };
+    if (data && typeof data === 'object' && 'rows' in data) {
+        const { rows, rowCount } = data;
+        return {
+            rows: Array.isArray(rows) ? rows.map(parseRow) : [],
+            rowCount: typeof rowCount === 'number' ? rowCount : null,
+        };
+    }
+    return { rows: [], rowCount: null };
+}
+function parseRow(row) {
+    return typeof row === 'string' ? parseComposite(row) : row;
+}
 /**
  * Builds the transport Drizzle uses in Supabase mode: every generated
  * statement is sent through `@supabase/supabase-js`'s `.rpc()` to the
@@ -15,6 +38,13 @@ const DEFAULT_EXEC_FUNCTION = 'cfni_exec';
  * Rows come back as positional arrays because `pg-proxy` maps result columns
  * by index; `cfni_exec` is what guarantees that shape.
  *
+ * Parameters are inlined into the statement as Postgres literals (see
+ * {@link inlineParams}) before it is sent, rather than passed through to
+ * `cfni_exec` for binding — `EXECUTE ... USING` can only bind a single
+ * uniformly-typed value, which breaks for anything beyond one string param.
+ * Inlining keeps every value's real type inferable by Postgres, the same way
+ * a direct `pg` connection would send it.
+ *
  * @param supabase The `db.supabase` config block.
  * @param bearerToken Token resolved as the caller's identity — the anon key,
  * or a per-request user JWT.
@@ -33,10 +63,11 @@ export default function createSupabaseTransport(supabase, bearerToken) {
     }
     return async (sql, params) => {
         const client = await getClient();
-        const { data, error } = await client.rpc(execFunction, { statement: sql, params });
+        const statement = inlineParams(sql, params);
+        const { data, error } = await client.rpc(execFunction, { statement });
         if (error)
             throw new Error(describeFailure(error, execFunction));
-        return { rows: Array.isArray(data) ? data : [] };
+        return parseExecResult(data);
     };
 }
 function describeFailure(error, execFunction) {
@@ -45,5 +76,13 @@ function describeFailure(error, execFunction) {
     if (error.code === 'PGRST202') {
         return `db: Supabase rejected the query — ${error.message}. Install the ${execFunction} function from supabase/cfni_exec.sql in your database.`;
     }
+    // A 401 here almost always means the bearer token wasn't accepted as a
+    // valid JWT by PostgREST — the most common cause is a Firebase ID token
+    // reaching a project without Supabase third-party (Firebase) auth set up.
+    if (error.code === 'PGRST301' || error.code === '42501') {
+        return (`db: Supabase rejected the query — ${error.message}. If you are using a Firebase ` +
+            'ID token as the bearer token, make sure Supabase third-party (Firebase) auth is ' +
+            'configured for this project, or provide `db.getAccessToken` to resolve a Supabase-issued JWT.');
+    }
     return `db: Supabase rejected the query — ${error.message}.`;
 }

package/dist/src/types/types.d.ts

@@ -843,6 +843,19 @@ export interface SupabaseDbConfig {
      * `'cfni_exec'` — the function shipped in `supabase/cfni_exec.sql`.
      */
     execFunction?: string;
+    /**
+     * Whether `withPublicDb`/`withUserDb` may run arbitrary SQL through the
+     * `cfni_exec` Postgres function. Defaults to `true`.
+     *
+     * Set `false` if you don't want to (or can't) install `cfni_exec` in
+     * your database — `withPublicDb`/`withUserDb` then throw immediately in
+     * Supabase mode instead of failing later against PostgREST. Use
+     * `supabaseSelect`/`supabaseInsert`/`supabaseUpdate`/`supabaseDelete`
+     * instead, which call `@supabase/supabase-js`'s `.from(table)` API
+     * directly — no Drizzle, no raw SQL, only what PostgREST's REST API
+     * itself supports.
+     */
+    rawSql?: boolean;
 }
 export interface DbRoutingConfig {
     /**

package/llms.txt

@@ -23,7 +23,7 @@ other subpath can be used.
 - `./localeStaticParams` — `generateStaticParams` helper for locale segments.
 - `./use` — `useLocale`/`useTranslations`; resolves to the RSC or client implementation automatically via the `react-server` export condition. Both throw `"... must be used within an IntlProvider"` if called outside one.
 - `./ThemeSwitcher` — optional light/dark toggle component.
-- `./db` — `withPublicDb(fn)` / `withUserDb(fn, uid?)` server-side Postgres/Drizzle context helpers (require `db` set on your `RoutingConfig`; direct Postgres or Supabase Data API, see below).
+- `./db` — `withPublicDb(fn)` / `withUserDb(fn, uid?)` server-side Postgres/Drizzle context helpers (require `db` set on your `RoutingConfig`; direct Postgres or Supabase Data API, see below), plus `supabaseSelect`/`supabaseInsert`/`supabaseUpsert`/`supabaseUpdate`/`supabaseDelete`/`supabaseRpc` (+ `*AsUser` counterparts) — direct Supabase REST helpers, no raw SQL.
 - `./dbHelpers` — generic Drizzle SQL helper functions (`excluded`, `onConflictSet`, `ago`, `currentDate`, `windowCount`, `unnestLateral`, `ascNullsLast`, `alwaysTrue`, `lateral`, `aliasColumn`, `minOf`, `maxOf`, `roundReal`, `multiply`, `scalarFromCte`) for use with `./db`.
 
 ## `firebaseAuth*` subpaths (require `firebaseAuth` set on your `RoutingConfig`)
@@ -51,7 +51,7 @@ other subpath can be used.
 Two transports, picked by which `db` fields are set — `pg`/`drizzle-orm`/`@supabase/supabase-js` ship as dependencies and load via dynamic `import()`, so nothing bundles unless a `db` export is called.
 
 - Direct Postgres (wins if configured): `db.connectionString` — Postgres connection string, or a sync/async function returning one (resolved on each connect). The function form is the way to read a value unavailable at module scope, e.g. a Cloudflare Hyperdrive binding: `connectionString: async () => (await getCloudflareContext({ async: true })).env.HYPERDRIVE.connectionString`. There is no separate `hyperdriveBinding` option.
-- Supabase Data API (used only when neither of the above is set): `db.supabase` — `{ url?, anonKey?, execFunction? }` where `url`/`anonKey` each accept a string or a sync/async function returning one, defaulting `url`/`anonKey` to `NEXT_PUBLIC_SUPABASE_URL`/`NEXT_PUBLIC_SUPABASE_ANON_KEY`. Requires installing `supabase/cfni_exec.sql` (a `security invoker` SQL-exec function) in your database. No multi-statement transactions — each statement in a `withUserDb` callback is its own round-trip.
+- Supabase Data API (used only when neither of the above is set): `db.supabase` — `{ url?, anonKey?, execFunction?, rawSql? }` where `url`/`anonKey` each accept a string or a sync/async function returning one, defaulting `url`/`anonKey` to `NEXT_PUBLIC_SUPABASE_URL`/`NEXT_PUBLIC_SUPABASE_ANON_KEY`. Requires installing `supabase/cfni_exec.sql` (a `security invoker` SQL-exec function, `jsonb`-returning, supports SELECT/INSERT/UPDATE/DELETE incl. RETURNING and writable CTEs) in your database — `cfni-db-codegen`/`cfni-db-install-exec` can install it for you (see below). No multi-statement transactions — each statement in a `withUserDb` callback is its own round-trip; `.transaction()` throws instead of running non-atomically. `rawSql: false` disables `withPublicDb`/`withUserDb` in Supabase mode entirely (they throw) — use the `supabaseSelect`/etc. REST helpers above instead, which never touch `cfni_exec`.
 - `db.disconnectAfterRequest` — direct-Postgres mode only: closes the pooled client once the last in-flight `withPublicDb`/`withUserDb` call of the request finishes. Defaults to `true`; set `false` to keep the connection open for the isolate's lifetime (holds a Hyperdrive slot between requests).
 - `db.authenticatedRole` — direct-Postgres mode only: Postgres role assumed inside `withUserDb`'s transaction. Defaults to `'authenticated'` (Supabase RLS convention).
 - `db.getUserId` — direct-Postgres mode only: resolves the user id injected as `request.jwt.claims->>'sub'` in `withUserDb`. Omit when `firebaseAuth` is configured — the uid is then taken automatically from the signed-in Firebase user via this package's own `getAuthUser()`.
@@ -60,6 +60,7 @@ Two transports, picked by which `db` fields are set — `pg`/`drizzle-orm`/`@sup
 - `withPublicDb(fn)` — anonymous role. Direct-Postgres mode: the request's pooled connection, no transaction, no role switch. Supabase mode: the anon key as the PostgREST bearer token. Either way, no user id is attached — RLS keyed on `auth.jwt()` denies access.
 - `withUserDb(fn, uid?)` — signed-in-user role. Direct-Postgres mode: a transaction with `set_config('request.jwt.claims', ...)` + `set local role`, `uid` resolution order explicit arg → `db.getUserId()` → Firebase auth uid → throws. Supabase mode: identity rides on the JWT from `db.getAccessToken`/Firebase instead (`uid` param is ignored), no transaction wraps the call.
 - `./dbHelpers` functions are plain Drizzle `sql`-building utilities with no config dependency — usable standalone.
+- `cfni-db-codegen` binary — regenerates Drizzle models via `drizzle-kit pull`. Flags/env: `--ddl-dir`/`CFNI_DB_DDL_DIR`, `--out-dir`/`CFNI_DB_OUT_DIR`, `--out-file`/`CFNI_DB_OUT_FILE`, `--db-url`/`CODEGEN_DATABASE_URL`, `--drizzle-config`/`CFNI_DB_DRIZZLE_CONFIG`, `--rpc-dir`/`CFNI_DB_RPC_DIR`, `--tests-dir`/`CFNI_DB_TESTS_DIR`, `--force`/`CFNI_DB_FORCE_EXEC`, `--skip-exec`/`CFNI_DB_SKIP_EXEC`, `--check`. `--out-dir` is repeatable and accepts a comma-separated list, so one run generates the same schema (and `manifest.json`) into several projects; `--check` verifies every target. After a successful run it also copies `supabase/cfni_exec.sql` + its pgTAP test file into `--rpc-dir`/`--tests-dir` (siblings of `--ddl-dir` by default), gated on `db.supabase.rawSql` (read from `next.config.*`'s `@intl-config` alias; unknown → warns and assumes `true`) — skips if `rawSql: false`, skips if `--skip-exec`, skips-with-warning on a differing existing file unless `--force`. `cfni-db-install-exec` runs only this copy step, same flags, no Postgres/drizzle-kit needed.
 
 ```typescript
 // src/i18n/intl_config.ts
@@ -95,3 +96,4 @@ const rows = await withPublicDb((db) => db.select().from(bonds).limit(10));
 - `useLocale`/`useTranslations` (from `./use`) and `useAuthUser` (from `./useFirebaseAuthUser`) resolve to a Server- or Client-Component implementation automatically via the `react-server` export condition — always import from the subpath, never from an internal file path.
 - No unified `useFirebaseAuthUser` re-export inside `cloudflare-next-intl/firebaseAuth`'s barrel — that barrel can't replicate the `react-server` condition split, so import `cloudflare-next-intl/useFirebaseAuthUser` directly for the hook.
 - Missing `db` on `RoutingConfig` throws immediately from `withPublicDb`/`withUserDb`, naming the missing config field. `pg`, `drizzle-orm`, and `@supabase/supabase-js` ship as dependencies and load via dynamic `import()` — nothing to install yourself, and nothing bundles unless a `db` export is called.
+- `db.supabase.rawSql: false` makes `withPublicDb`/`withUserDb` throw in Supabase mode (they need `cfni_exec`) — reach for `supabaseSelect`/`supabaseInsert`/`supabaseUpsert`/`supabaseUpdate`/`supabaseDelete`/`supabaseRpc` instead, which only support what PostgREST's REST API itself supports (no joins beyond one embedded resource, no aggregates, no arbitrary SQL).