@kamod-ch/otok-supabase 1.1.0

package/dist/auth/routes.d.ts

@@ -0,0 +1,10 @@
+import type { Context, Hono } from "hono";
+import type { SupabaseAuthRoutesOptions } from "../types.js";
+export interface SupabaseAuthRoutes {
+    mount(app: Hono): void;
+    callback(c: Context): Promise<Response>;
+    confirm(c: Context): Promise<Response>;
+    signOut(c: Context): Promise<Response>;
+}
+export declare function createSupabaseAuthRoutes(options?: SupabaseAuthRoutesOptions): SupabaseAuthRoutes;
+//# sourceMappingURL=routes.d.ts.map

package/dist/auth/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAQ7D,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxC;AAmCD,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CAwFpG"}

package/dist/auth/routes.js

@@ -0,0 +1,111 @@
+import { getCookie } from "hono/cookie";
+import { isDataRequest, OTOK_CSRF_FIELD } from "@kamod-ch/otok/shared";
+import { mapSupabaseError } from "../errors.js";
+import { resolveAuthRedirect, safeRedirectPath } from "./redirects.js";
+const DEFAULT_CALLBACK = "/auth/callback";
+const DEFAULT_CONFIRM = "/auth/confirm";
+const DEFAULT_SIGNOUT = "/auth/signout";
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let mismatch = 0;
+    for (let i = 0; i < a.length; i += 1) {
+        mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return mismatch === 0;
+}
+function verifySignOutCsrf(c, formData) {
+    const cookie = getCookie(c, "otok_csrf") ?? getCookie(c, "sb-csrf");
+    const submitted = String(formData?.get(OTOK_CSRF_FIELD) ?? c.req.header("x-csrf-token") ?? "");
+    if (!cookie || !submitted || !timingSafeEqual(cookie, submitted)) {
+        return c.json({ status: 403, message: "Invalid CSRF token" }, 403);
+    }
+    return undefined;
+}
+function authFailureResponse(c, message, status = 400, errorRedirect) {
+    if (isDataRequest(c.req.raw)) {
+        return c.json({ status, message }, status);
+    }
+    const target = safeRedirectPath(errorRedirect ?? "/login", ["/"]) ?? "/login";
+    const url = new URL(target, c.req.url);
+    url.searchParams.set("error", "auth_failed");
+    return c.redirect(`${url.pathname}${url.search}`, 303);
+}
+export function createSupabaseAuthRoutes(options = {}) {
+    const successRedirect = options.successRedirect ?? "/dashboard";
+    const errorRedirect = options.errorRedirect ?? "/login";
+    const callbackPath = options.callbackPath ?? DEFAULT_CALLBACK;
+    const confirmPath = options.confirmPath ?? DEFAULT_CONFIRM;
+    const signOutPath = options.signOutPath ?? DEFAULT_SIGNOUT;
+    const allowlist = options.redirectAllowlist ?? ["/", successRedirect, errorRedirect];
+    async function callback(c) {
+        const supabase = c.var.supabase;
+        const code = c.req.query("code");
+        const next = resolveAuthRedirect(c.req.query("next") ?? c.req.query("returnTo"), successRedirect, allowlist);
+        if (!code) {
+            return authFailureResponse(c, "Missing authorization code.", 400, errorRedirect);
+        }
+        const { error } = await supabase.auth.exchangeCodeForSession(code);
+        if (error) {
+            const failure = mapSupabaseError(error, "Authentication failed.");
+            return authFailureResponse(c, failure.message ?? "Authentication failed.", failure.status, errorRedirect);
+        }
+        if (isDataRequest(c.req.raw)) {
+            return c.json({ redirect: next });
+        }
+        return c.redirect(next, 303);
+    }
+    async function confirm(c) {
+        const supabase = c.var.supabase;
+        const tokenHash = c.req.query("token_hash");
+        const type = c.req.query("type");
+        const next = resolveAuthRedirect(c.req.query("next"), successRedirect, allowlist);
+        if (!tokenHash || !type) {
+            return authFailureResponse(c, "Invalid confirmation link.", 400, errorRedirect);
+        }
+        const { error } = await supabase.auth.verifyOtp({ type, token_hash: tokenHash });
+        if (error) {
+            const failure = mapSupabaseError(error, "Email confirmation failed.");
+            return authFailureResponse(c, failure.message ?? "Email confirmation failed.", failure.status, errorRedirect);
+        }
+        if (isDataRequest(c.req.raw)) {
+            return c.json({ redirect: next });
+        }
+        return c.redirect(next, 303);
+    }
+    async function signOut(c) {
+        if (c.req.method !== "POST") {
+            return c.json({ status: 405, message: "Method not allowed" }, 405);
+        }
+        let formData;
+        const contentType = c.req.header("content-type") ?? "";
+        if (contentType.includes("multipart/form-data") || contentType.includes("application/x-www-form-urlencoded")) {
+            formData = await c.req.formData();
+        }
+        const csrfFailure = verifySignOutCsrf(c, formData);
+        if (csrfFailure)
+            return csrfFailure;
+        const supabase = c.var.supabase;
+        const { error } = await supabase.auth.signOut();
+        if (error) {
+            const failure = mapSupabaseError(error, "Sign out failed.");
+            return c.json(failure, failure.status);
+        }
+        const next = resolveAuthRedirect(c.req.query("next"), errorRedirect, allowlist);
+        if (isDataRequest(c.req.raw)) {
+            return c.json({ redirect: next });
+        }
+        return c.redirect(next, 303);
+    }
+    return {
+        mount(app) {
+            app.get(callbackPath, callback);
+            app.get(confirmPath, confirm);
+            app.post(signOutPath, signOut);
+        },
+        callback,
+        confirm,
+        signOut,
+    };
+}
+//# sourceMappingURL=routes.js.map

package/dist/auth/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,eAAe,GAAG,eAAe,CAAC;AACxC,MAAM,eAAe,GAAG,eAAe,CAAC;AASxC,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU,EAAE,QAAmB;IACxD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/F,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAC1B,CAAU,EACV,OAAe,EACf,MAAM,GAAG,GAAG,EACZ,aAAsB;IAEtB,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAa,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,IAAI,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,UAAqC,EAAE;IAC9E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,YAAY,CAAC;IAChE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC;IACxD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC;IAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;IAErF,KAAK,UAAU,QAAQ,CAAC,CAAU;QAChC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;QAE7G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,mBAAmB,CAAC,CAAC,EAAE,6BAA6B,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;YAClE,OAAO,mBAAmB,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,IAAI,wBAAwB,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC5G,CAAC;QAED,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,CAAU;QAC/B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAwB,CAAC;QACxD,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;QAElF,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC,CAAC,EAAE,4BAA4B,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QACjF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;YACtE,OAAO,mBAAmB,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,IAAI,4BAA4B,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAChH,CAAC;QAED,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,CAAU;QAC/B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,QAA8B,CAAC;QACnC,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;YAC7G,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAAa,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QAChF,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAG;YACP,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAChC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,QAAQ;QACR,OAAO;QACP,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/browser/create-browser-client.d.ts

@@ -0,0 +1,6 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { type SupabaseConfig } from "../config.js";
+export declare function createOtokSupabaseBrowserClient<Database>(config: SupabaseConfig): SupabaseClient<Database>;
+/** Reset the browser singleton — for tests only. */
+export declare function resetOtokSupabaseBrowserClientForTests(): void;
+//# sourceMappingURL=create-browser-client.d.ts.map

package/dist/browser/create-browser-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-browser-client.d.ts","sourceRoot":"","sources":["../../src/browser/create-browser-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAI3E,wBAAgB,+BAA+B,CAAC,QAAQ,EACtD,MAAM,EAAE,cAAc,GACrB,cAAc,CAAC,QAAQ,CAAC,CAuB1B;AAED,oDAAoD;AACpD,wBAAgB,sCAAsC,IAAI,IAAI,CAE7D"}

package/dist/browser/create-browser-client.js

@@ -0,0 +1,27 @@
+import { createBrowserClient } from "@supabase/ssr";
+import { validateSupabaseConfig } from "../config.js";
+let browserClient;
+export function createOtokSupabaseBrowserClient(config) {
+    const validated = validateSupabaseConfig(config);
+    if (typeof window === "undefined") {
+        throw new Error("otok-supabase: createOtokSupabaseBrowserClient() must only be called in the browser.");
+    }
+    if (!browserClient) {
+        browserClient = createBrowserClient(validated.url, validated.publishableKey, {
+            cookieOptions: validated.cookieOptions
+                ? {
+                    domain: validated.cookieOptions.domain,
+                    path: validated.cookieOptions.path,
+                    sameSite: validated.cookieOptions.sameSite,
+                    secure: validated.cookieOptions.secure,
+                }
+                : undefined,
+        });
+    }
+    return browserClient;
+}
+/** Reset the browser singleton — for tests only. */
+export function resetOtokSupabaseBrowserClientForTests() {
+    browserClient = undefined;
+}
+//# sourceMappingURL=create-browser-client.js.map

package/dist/browser/create-browser-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-browser-client.js","sourceRoot":"","sources":["../../src/browser/create-browser-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,sBAAsB,EAAuB,MAAM,cAAc,CAAC;AAE3E,IAAI,aAA8C,CAAC;AAEnD,MAAM,UAAU,+BAA+B,CAC7C,MAAsB;IAEtB,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,mBAAmB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,cAAc,EAAE;YAC3E,aAAa,EAAE,SAAS,CAAC,aAAa;gBACpC,CAAC,CAAC;oBACE,MAAM,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM;oBACtC,IAAI,EAAE,SAAS,CAAC,aAAa,CAAC,IAAI;oBAClC,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC,QAAQ;oBAC1C,MAAM,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM;iBACvC;gBACH,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO,aAAyC,CAAC;AACnD,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,sCAAsC;IACpD,aAAa,GAAG,SAAS,CAAC;AAC5B,CAAC"}

package/dist/browser/index.d.ts

@@ -0,0 +1,2 @@
+export { createOtokSupabaseBrowserClient, resetOtokSupabaseBrowserClientForTests, } from "./create-browser-client.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/browser/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/browser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,sCAAsC,GACvC,MAAM,4BAA4B,CAAC"}

package/dist/browser/index.js

@@ -0,0 +1,2 @@
+export { createOtokSupabaseBrowserClient, resetOtokSupabaseBrowserClientForTests, } from "./create-browser-client.js";
+//# sourceMappingURL=index.js.map

package/dist/browser/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/browser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,sCAAsC,GACvC,MAAM,4BAA4B,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,19 @@
+export interface SupabaseCookieOptions {
+    domain?: string;
+    path?: string;
+    sameSite?: "lax" | "strict" | "none";
+    secure?: boolean;
+}
+export interface SupabaseConfig {
+    url: string;
+    publishableKey: string;
+    cookieOptions?: SupabaseCookieOptions;
+}
+export interface SupabaseAdminConfig {
+    url: string;
+    serviceRoleKey: string;
+}
+export declare function validateSupabaseConfig(config: SupabaseConfig): SupabaseConfig;
+export declare function validateSupabaseAdminConfig(config: SupabaseAdminConfig): SupabaseAdminConfig;
+export declare function mergeCookieOptions(supabaseOptions: Record<string, unknown> | undefined, defaults: SupabaseCookieOptions | undefined): Record<string, unknown>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,qBAAqB,CAAC;CACvC;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;CACxB;AA0BD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAwB7E;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,mBAAmB,GAAG,mBAAmB,CAmB5F;AAED,wBAAgB,kBAAkB,CAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACpD,QAAQ,EAAE,qBAAqB,GAAG,SAAS,GAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB"}

package/dist/config.js

@@ -0,0 +1,77 @@
+import { SupabaseConfigurationError } from "./errors.js";
+const URL_PATTERN = /^https?:\/\/.+/;
+function decodeJwtPayload(key) {
+    const parts = key.split(".");
+    if (parts.length < 2)
+        return null;
+    try {
+        const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        const padded = payload.padEnd(payload.length + ((4 - (payload.length % 4)) % 4), "=");
+        const json = atob(padded);
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+function assertNotServiceRoleKey(key, label) {
+    const payload = decodeJwtPayload(key);
+    if (payload?.role === "service_role") {
+        throw new SupabaseConfigurationError(`${label} must not be a service role key. Use the publishable (anon) key for browser and SSR clients.`);
+    }
+}
+export function validateSupabaseConfig(config) {
+    if (!config || typeof config !== "object") {
+        throw new SupabaseConfigurationError("Supabase configuration must be an object.");
+    }
+    const url = String(config.url ?? "").trim();
+    if (!url) {
+        throw new SupabaseConfigurationError("Supabase url is required.");
+    }
+    if (!URL_PATTERN.test(url)) {
+        throw new SupabaseConfigurationError("Supabase url must be an absolute http(s) URL.");
+    }
+    const publishableKey = String(config.publishableKey ?? "").trim();
+    if (!publishableKey) {
+        throw new SupabaseConfigurationError("Supabase publishableKey is required.");
+    }
+    assertNotServiceRoleKey(publishableKey, "publishableKey");
+    return {
+        url,
+        publishableKey,
+        cookieOptions: config.cookieOptions,
+    };
+}
+export function validateSupabaseAdminConfig(config) {
+    if (!config || typeof config !== "object") {
+        throw new SupabaseConfigurationError("Supabase admin configuration must be an object.");
+    }
+    const url = String(config.url ?? "").trim();
+    if (!url) {
+        throw new SupabaseConfigurationError("Supabase url is required.");
+    }
+    if (!URL_PATTERN.test(url)) {
+        throw new SupabaseConfigurationError("Supabase url must be an absolute http(s) URL.");
+    }
+    const serviceRoleKey = String(config.serviceRoleKey ?? "").trim();
+    if (!serviceRoleKey) {
+        throw new SupabaseConfigurationError("Supabase serviceRoleKey is required.");
+    }
+    return { url, serviceRoleKey };
+}
+export function mergeCookieOptions(supabaseOptions, defaults) {
+    const merged = { ...(supabaseOptions ?? {}) };
+    if (defaults?.domain !== undefined)
+        merged.domain = defaults.domain;
+    if (defaults?.path !== undefined)
+        merged.path = defaults.path;
+    if (defaults?.secure !== undefined)
+        merged.secure = defaults.secure;
+    if (defaults?.sameSite !== undefined) {
+        merged.sameSite = defaults.sameSite;
+    }
+    if (!merged.path)
+        merged.path = "/";
+    return merged;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAoBzD,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAW,EAAE,KAAa;IACzD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,0BAA0B,CAClC,GAAG,KAAK,8FAA8F,CACvG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAsB;IAC3D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,0BAA0B,CAAC,2CAA2C,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,0BAA0B,CAAC,2BAA2B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,0BAA0B,CAAC,+CAA+C,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,CAAC,sCAAsC,CAAC,CAAC;IAC/E,CAAC;IACD,uBAAuB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAE1D,OAAO;QACL,GAAG;QACH,cAAc;QACd,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAA2B;IACrE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,0BAA0B,CAAC,iDAAiD,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,0BAA0B,CAAC,2BAA2B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,0BAA0B,CAAC,+CAA+C,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,CAAC,sCAAsC,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,eAAoD,EACpD,QAA2C;IAE3C,MAAM,MAAM,GAA4B,EAAE,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;IACvE,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IACpE,IAAI,QAAQ,EAAE,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IACpE,IAAI,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/context.d.ts

@@ -0,0 +1,6 @@
+import type { Context } from "hono";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { OtokContext } from "@kamod-ch/otok/server";
+export declare function supabaseFromHono<Database = unknown>(hono: Context | OtokContext["hono"], contextKey?: string): SupabaseClient<Database>;
+export declare function getSupabaseConfig(): import("./config.js").SupabaseConfig;
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,wBAAgB,gBAAgB,CAAC,QAAQ,GAAG,OAAO,EACjD,IAAI,EAAE,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,EACnC,UAAU,SAAa,GACtB,cAAc,CAAC,QAAQ,CAAC,CAW1B;AAED,wBAAgB,iBAAiB,yCAEhC"}

package/dist/context.js

@@ -0,0 +1,15 @@
+import { getSupabaseRuntime, tryGetSupabaseRuntime } from "./registry.js";
+export function supabaseFromHono(hono, contextKey = "supabase") {
+    const client = hono.get(contextKey);
+    if (!client) {
+        const runtime = tryGetSupabaseRuntime();
+        throw new Error(runtime
+            ? `otok-supabase: Supabase client not found on Hono context key "${contextKey}". Mount supabase() middleware first.`
+            : "otok-supabase: no runtime registered. Add supabase() to otok.config.ts plugins.");
+    }
+    return client;
+}
+export function getSupabaseConfig() {
+    return getSupabaseRuntime().config;
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE1E,MAAM,UAAU,gBAAgB,CAC9B,IAAmC,EACnC,UAAU,GAAG,UAAU;IAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAmB,CAAyC,CAAC;IACrF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,OAAO;YACL,CAAC,CAAC,iEAAiE,UAAU,uCAAuC;YACpH,CAAC,CAAC,iFAAiF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,kBAAkB,EAAE,CAAC,MAAM,CAAC;AACrC,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,27 @@
+import type { AuthError as SupabaseAuthApiError, PostgrestError } from "@supabase/supabase-js";
+import type { OtokFailure } from "@kamod-ch/otok/server";
+export type SupabaseIntegrationErrorCode = "configuration" | "auth" | "cookie" | "runtime" | "unsafe_redirect";
+export declare class OtokSupabaseError extends Error {
+    readonly code: SupabaseIntegrationErrorCode;
+    constructor(code: SupabaseIntegrationErrorCode, message: string);
+}
+export declare class SupabaseConfigurationError extends OtokSupabaseError {
+    constructor(message: string);
+}
+export declare class SupabaseAuthError extends OtokSupabaseError {
+    readonly status: number;
+    constructor(message: string, status?: number);
+}
+export declare class SupabaseCookieError extends OtokSupabaseError {
+    constructor(message: string);
+}
+type MappableError = PostgrestError | SupabaseAuthApiError | {
+    message?: string;
+    status?: number;
+    code?: string;
+};
+export declare function mapSupabaseError(error: MappableError, fallbackMessage?: string): OtokFailure;
+export declare function throwSupabaseError(error: MappableError, fallbackMessage?: string): never;
+export declare function isSupabaseIntegrationError(error: unknown): error is OtokSupabaseError;
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,IAAI,oBAAoB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,MAAM,MAAM,4BAA4B,GACpC,eAAe,GACf,MAAM,GACN,QAAQ,GACR,SAAS,GACT,iBAAiB,CAAC;AAEtB,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;gBAEhC,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,MAAM;CAKhE;AAED,qBAAa,0BAA2B,SAAQ,iBAAiB;gBACnD,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAkB,SAAQ,iBAAiB;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,OAAO,EAAE,MAAM,EAAE,MAAM,SAAM;CAK1C;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;gBAC5C,OAAO,EAAE,MAAM;CAI5B;AAED,KAAK,aAAa,GAAG,cAAc,GAAG,oBAAoB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AA6BlH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE,eAAe,SAAmB,GAAG,WAAW,CAkBtG;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,EAAE,eAAe,SAAmB,GAAG,KAAK,CAGlG;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAErF"}

package/dist/errors.js

@@ -0,0 +1,77 @@
+export class OtokSupabaseError extends Error {
+    code;
+    constructor(code, message) {
+        super(`[otok-supabase:${code}] ${message}`);
+        this.name = "OtokSupabaseError";
+        this.code = code;
+    }
+}
+export class SupabaseConfigurationError extends OtokSupabaseError {
+    constructor(message) {
+        super("configuration", message);
+        this.name = "SupabaseConfigurationError";
+    }
+}
+export class SupabaseAuthError extends OtokSupabaseError {
+    status;
+    constructor(message, status = 401) {
+        super("auth", message);
+        this.name = "SupabaseAuthError";
+        this.status = status;
+    }
+}
+export class SupabaseCookieError extends OtokSupabaseError {
+    constructor(message) {
+        super("cookie", message);
+        this.name = "SupabaseCookieError";
+    }
+}
+const PUBLIC_AUTH_MESSAGES = {
+    invalid_credentials: "Invalid email or password.",
+    email_not_confirmed: "Please confirm your email before signing in.",
+    user_already_exists: "An account with this email already exists.",
+    weak_password: "Password is too weak.",
+    over_request_rate_limit: "Too many requests. Please try again later.",
+};
+function sanitizeMessage(message, fallback) {
+    if (!message)
+        return fallback;
+    if (/key|secret|token|password|service_role/i.test(message))
+        return fallback;
+    return message;
+}
+function fieldErrorsFromAuthError(error) {
+    if (error.code === "invalid_credentials") {
+        return { password: ["Invalid email or password."] };
+    }
+    if (error.code === "weak_password") {
+        return { password: ["Password is too weak."] };
+    }
+    if (error.code === "user_already_exists") {
+        return { email: ["An account with this email already exists."] };
+    }
+    return undefined;
+}
+export function mapSupabaseError(error, fallbackMessage = "Request failed") {
+    const code = "code" in error ? error.code : undefined;
+    const status = "status" in error && typeof error.status === "number"
+        ? error.status
+        : code === "PGRST116"
+            ? 404
+            : 400;
+    const publicMessage = (code && PUBLIC_AUTH_MESSAGES[code]) ||
+        sanitizeMessage(error.message, fallbackMessage);
+    return {
+        status,
+        message: publicMessage,
+        fieldErrors: "name" in error && error.name === "AuthApiError" ? fieldErrorsFromAuthError(error) : undefined,
+    };
+}
+export function throwSupabaseError(error, fallbackMessage = "Request failed") {
+    const failure = mapSupabaseError(error, fallbackMessage);
+    throw Object.assign(new Error(failure.message), { failure, otokFailure: failure });
+}
+export function isSupabaseIntegrationError(error) {
+    return error instanceof OtokSupabaseError;
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAUA,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAA+B;IAE5C,YAAY,IAAkC,EAAE,OAAe;QAC7D,KAAK,CAAC,kBAAkB,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,iBAAiB;IAC/D,YAAY,OAAe;QACzB,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,iBAAiB;IAC7C,MAAM,CAAS;IAExB,YAAY,OAAe,EAAE,MAAM,GAAG,GAAG;QACvC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,iBAAiB;IACxD,YAAY,OAAe;QACzB,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAID,MAAM,oBAAoB,GAA2B;IACnD,mBAAmB,EAAE,4BAA4B;IACjD,mBAAmB,EAAE,8CAA8C;IACnE,mBAAmB,EAAE,4CAA4C;IACjE,aAAa,EAAE,uBAAuB;IACtC,uBAAuB,EAAE,4CAA4C;CACtE,CAAC;AAEF,SAAS,eAAe,CAAC,OAA2B,EAAE,QAAgB;IACpE,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,yCAAyC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAA2B;IAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,CAAC,4CAA4C,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAoB,EAAE,eAAe,GAAG,gBAAgB;IACvF,MAAM,IAAI,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,MAAM,MAAM,GACV,QAAQ,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QACnD,CAAC,CAAC,KAAK,CAAC,MAAM;QACd,CAAC,CAAC,IAAI,KAAK,UAAU;YACnB,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,GAAG,CAAC;IAEZ,MAAM,aAAa,GACjB,CAAC,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpC,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAElD,OAAO;QACL,MAAM;QACN,OAAO,EAAE,aAAa;QACtB,WAAW,EAAE,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAA6B,CAAC,CAAC,CAAC,CAAC,SAAS;KACpI,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAoB,EAAE,eAAe,GAAG,gBAAgB;IACzF,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACzD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,OAAO,KAAK,YAAY,iBAAiB,CAAC;AAC5C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { default, configureSupabaseApp } from "./plugin.js";
+export type { SupabaseConfig, SupabaseAdminConfig, SupabaseCookieOptions } from "./config.js";
+export type { SupabasePluginOptions } from "./types.js";
+export { validateSupabaseConfig, validateSupabaseAdminConfig } from "./config.js";
+export { mapSupabaseError, throwSupabaseError, isSupabaseIntegrationError, OtokSupabaseError, SupabaseConfigurationError, SupabaseAuthError, SupabaseCookieError, } from "./errors.js";
+export type { SupabaseClient, User, JwtPayload, SupabaseVariables, SupabaseClaimsVariables, SupabaseUserVariables, SupabaseEnv, SupabaseAuthClaimsEnv, SupabaseAuthUserEnv, SupabaseAuthFullEnv, SupabaseAuthRoutesOptions, RequireSupabaseAuthOptions, RequireSupabaseUserOptions, SupabaseActionResult, SupabaseRuntime, } from "./types.js";
+export { registerSupabaseRuntime, getSupabaseRuntime, tryGetSupabaseRuntime, resetSupabaseRuntimeForTests, } from "./registry.js";
+export { supabaseFromHono, getSupabaseConfig } from "./context.js";
+export { createOtokSupabaseBrowserClient } from "./browser/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC5D,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC9F,YAAY,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,EAC1B,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,cAAc,EACd,IAAI,EACJ,UAAU,EACV,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,WAAW,EACX,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+export { default, configureSupabaseApp } from "./plugin.js";
+export { validateSupabaseConfig, validateSupabaseAdminConfig } from "./config.js";
+export { mapSupabaseError, throwSupabaseError, isSupabaseIntegrationError, OtokSupabaseError, SupabaseConfigurationError, SupabaseAuthError, SupabaseCookieError, } from "./errors.js";
+export { registerSupabaseRuntime, getSupabaseRuntime, tryGetSupabaseRuntime, resetSupabaseRuntimeForTests, } from "./registry.js";
+export { supabaseFromHono, getSupabaseConfig } from "./context.js";
+export { createOtokSupabaseBrowserClient } from "./browser/index.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAG5D,OAAO,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,EAC1B,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAkBrB,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/loader.d.ts

@@ -0,0 +1,23 @@
+import type { LoaderResult, OtokActionContext, OtokContext, OtokLoader } from "@kamod-ch/otok/server";
+import type { SupabaseClient } from "@supabase/supabase-js";
+type LoaderSupabaseContext<Database> = {
+    supabase: SupabaseClient<Database>;
+};
+type ActionSupabaseContext<Database> = LoaderSupabaseContext<Database>;
+/**
+ * Wrap a loader with typed `supabase` from the registered middleware.
+ *
+ * ```ts
+ * export const loader = defineLoader<Database>(async ({ supabase }) => {
+ *   const { data } = await supabase.from("projects").select("*");
+ *   return { projects: data ?? [] };
+ * });
+ * ```
+ */
+export declare function defineLoader<Data extends LoaderResult, Database = unknown>(handler: (ctx: OtokContext & LoaderSupabaseContext<Database>) => Data | Promise<Data>, contextKey?: string): OtokLoader<Data>;
+/**
+ * Wrap an action with typed `supabase` from the registered middleware.
+ */
+export declare function defineAction<Result, Database = unknown>(handler: (ctx: OtokActionContext & ActionSupabaseContext<Database>) => Result | Promise<Result>, contextKey?: string): (context: OtokActionContext) => Result | Promise<Result>;
+export {};
+//# sourceMappingURL=loader.d.ts.map

package/dist/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACtG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,KAAK,qBAAqB,CAAC,QAAQ,IAAI;IACrC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;CACpC,CAAC;AAEF,KAAK,qBAAqB,CAAC,QAAQ,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AAEvE;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,YAAY,EAAE,QAAQ,GAAG,OAAO,EACxE,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EACrF,UAAU,SAAa,GACtB,UAAU,CAAC,IAAI,CAAC,CAMlB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,EACrD,OAAO,EAAE,CAAC,GAAG,EAAE,iBAAiB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,EAC/F,UAAU,SAAa,GACtB,CAAC,OAAO,EAAE,iBAAiB,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM1D"}

package/dist/loader.js

@@ -0,0 +1,27 @@
+import { supabaseFromHono } from "./context.js";
+/**
+ * Wrap a loader with typed `supabase` from the registered middleware.
+ *
+ * ```ts
+ * export const loader = defineLoader<Database>(async ({ supabase }) => {
+ *   const { data } = await supabase.from("projects").select("*");
+ *   return { projects: data ?? [] };
+ * });
+ * ```
+ */
+export function defineLoader(handler, contextKey = "supabase") {
+    return (context) => handler({
+        ...context,
+        supabase: supabaseFromHono(context.hono, contextKey),
+    });
+}
+/**
+ * Wrap an action with typed `supabase` from the registered middleware.
+ */
+export function defineAction(handler, contextKey = "supabase") {
+    return (context) => handler({
+        ...context,
+        supabase: supabaseFromHono(context.hono, contextKey),
+    });
+}
+//# sourceMappingURL=loader.js.map

package/dist/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQhD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAqF,EACrF,UAAU,GAAG,UAAU;IAEvB,OAAO,CAAC,OAAO,EAAE,EAAE,CACjB,OAAO,CAAC;QACN,GAAG,OAAO;QACV,QAAQ,EAAE,gBAAgB,CAAW,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;KAC/D,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA+F,EAC/F,UAAU,GAAG,UAAU;IAEvB,OAAO,CAAC,OAAO,EAAE,EAAE,CACjB,OAAO,CAAC;QACN,GAAG,OAAO;QACV,QAAQ,EAAE,gBAAgB,CAAW,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;KAC/D,CAAC,CAAC;AACP,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,6 @@
+import type { Hono } from "hono";
+import type { SupabasePluginOptions, SupabaseRuntime } from "./types.js";
+export declare function configureSupabaseApp(app: Hono, options: SupabasePluginOptions): SupabaseRuntime;
+/** Otok plugin factory — register in otok.config.ts plugins array. */
+export default function supabasePlugin(options: SupabasePluginOptions): import("@kamod-ch/otok-config").OtokPlugin<unknown>;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAMjC,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAQzE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,GAAG,eAAe,CAuB/F;AA6BD,sEAAsE;AACtE,MAAM,CAAC,OAAO,UAAU,cAAc,CAAC,OAAO,EAAE,qBAAqB,uDAMpE"}

package/dist/plugin.js

@@ -0,0 +1,65 @@
+import { definePlugin } from "@kamod-ch/otok";
+import { validateSupabaseConfig } from "./config.js";
+import { SupabaseConfigurationError } from "./errors.js";
+import { createSupabaseAuthRoutes } from "./auth/routes.js";
+import { registerSupabaseRuntime } from "./registry.js";
+import { supabase } from "./server/middleware.js";
+const DEFAULT_AUTH_ROUTES = {
+    successRedirect: "/dashboard",
+    errorRedirect: "/login",
+    redirectAllowlist: ["/"],
+};
+export function configureSupabaseApp(app, options) {
+    const config = validateSupabaseConfig(options);
+    const mountAuthRoutes = options.mountAuthRoutes !== false;
+    const authRoutes = {
+        ...DEFAULT_AUTH_ROUTES,
+        ...options.authRoutes,
+    };
+    const runtime = {
+        config,
+        authRoutes,
+        mountAuthRoutes,
+    };
+    registerSupabaseRuntime(runtime);
+    app.use("*", supabase(config));
+    if (mountAuthRoutes) {
+        createSupabaseAuthRoutes(authRoutes).mount(app);
+    }
+    return runtime;
+}
+const supabasePluginFactory = definePlugin({
+    name: "@kamod-ch/otok-supabase",
+    version: "1.0.0",
+    schema: {
+        parse(input) {
+            if (!input || typeof input !== "object") {
+                throw new SupabaseConfigurationError("supabase() options must be an object.");
+            }
+            validateSupabaseConfig(input);
+            return input;
+        },
+    },
+    envSchema: {
+        parse(input) {
+            const url = input.SUPABASE_URL?.trim();
+            const publishableKey = input.SUPABASE_PUBLISHABLE_KEY?.trim();
+            if (url !== undefined && !url) {
+                throw new SupabaseConfigurationError("SUPABASE_URL must not be empty when set.");
+            }
+            if (publishableKey !== undefined && !publishableKey) {
+                throw new SupabaseConfigurationError("SUPABASE_PUBLISHABLE_KEY must not be empty when set.");
+            }
+            return { supabaseUrl: url, supabasePublishableKey: publishableKey };
+        },
+    },
+});
+/** Otok plugin factory — register in otok.config.ts plugins array. */
+export default function supabasePlugin(options) {
+    const plugin = supabasePluginFactory(options);
+    plugin.configureApp = ({ app }) => {
+        configureSupabaseApp(app, options);
+    };
+    return plugin;
+}
+//# sourceMappingURL=plugin.js.map