@marktiderman/genesis-supabase 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mark Tiderman
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,36 @@
-# Temporary Holding Version
+# @marktiderman/genesis-supabase
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Supabase for Genesis apps on web and React Native.
+
+```ts
+import { createGenesisSupabase, must } from "@marktiderman/genesis-supabase";
+import { keychainStorage, refreshWhileActive, wipeSessionOnReinstall } from "@marktiderman/genesis-supabase/native";
+import * as SecureStore from "expo-secure-store";
+import AsyncStorage from "@react-native-async-storage/async-storage";
+import { AppState } from "react-native";
+
+const session = keychainStorage(SecureStore);
+await wipeSessionOnReinstall({ session, sessionKey: "sb-<project-ref>-auth-token", installMarker: AsyncStorage });
+
+export const supabase = createGenesisSupabase<Database>({ url, publishableKey, storage: session, platform: "native" });
+refreshWhileActive(supabase, AppState);
+
+const rows = must(await supabase.from("tasks").select("*"));
+```
+
+- **`createGenesisSupabase`**: a client with PKCE sign-in, a persisted session that refreshes itself, and the storage you pass. `platform: "native"` turns off reading a session from the URL; exchange the OAuth redirect's code yourself.
+- **`keychainStorage(SecureStore)`**: session storage in the Keychain or Keystore. Values are split between characters into chunks under the Keychain's byte limit; a write switches to its new chunks only once they are all written, so a write cut short keeps the previous session, and its leftover chunks are swept on the next write; writes to one key run one at a time.
+- **`refreshWhileActive(client, AppState)`**: refreshes the session only while the app is in front.
+- **`wipeSessionOnReinstall`**: the iOS Keychain outlives an uninstall; this removes a leftover session (and its PKCE verifier) on the first launch after an install.
+- **`must(result)`**: the data, or a thrown `SupabaseQueryError` carrying the database's `code`, `details` and `hint`.
+
+Nothing here imports React Native or Expo: you pass those modules in.
+
+## Choices, and why
+
+- **Keychain chunks rather than encrypted AsyncStorage.** Supabase's Expo guide shows two options: an AES-encrypted value in AsyncStorage with the key in SecureStore ("LargeSecureStore"), or `expo-sqlite/localStorage`. `keychainStorage` keeps the whole session in the Keychain/Keystore instead, split into chunks under the item size limit, with an atomic switch between generations. That means one native dependency (`expo-secure-store`) rather than three, no key to manage, and a session that can't be read off the device's file system. If you prefer LargeSecureStore, pass it as `storage`; everything else here works the same.
+- **The URL polyfill.** Supabase's React Native guides still import `react-native-url-polyfill/auto` before creating the client. Keep it until your app has tested PKCE sign-in end to end without it: React Native's built-in `URL` has improved, but the docs don't yet say it's enough.
+- **`refreshWhileActive` on native only.** Supabase gates the AppState listener to native platforms; call it from native code (not on web, where the browser already refreshes in the background).
+
+
+Part of the [Genesis framework](https://github.com/marktiderman/genesis).

package/dist/index.d.ts

@@ -0,0 +1,78 @@
+import { SupabaseClientOptions, SupabaseClient } from '@supabase/supabase-js';
+
+/**
+ * Supabase for Genesis apps. Platform-neutral: web, React Native and the
+ * server import it. Native-only helpers (Keychain storage, foreground
+ * refresh, reinstall wipe) are on `@marktiderman/genesis-supabase/native`.
+ */
+
+/** The async key-value store Supabase auth keeps its session in. */
+interface SessionStorage {
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+}
+/** @stability Beta */
+interface GenesisSupabaseOptions {
+    url: string;
+    /** The publishable (anon) key. Never the secret key in an app. */
+    publishableKey: string;
+    /** Where the session lives. Native: `keychainStorage(SecureStore)`. Web: leave out for supabase-js's own default. */
+    storage?: SessionStorage;
+    /** `"native"` sets the React Native defaults (no session from the URL). Default `"web"`. */
+    platform?: "web" | "native";
+    /**
+     * Read a session from the URL after an OAuth redirect. Default: `true` on
+     * web, `false` on native, where the app hands the redirect URL to
+     * `exchangeCodeForSession` itself.
+     */
+    detectSessionInUrl?: boolean;
+    /** Anything else for supabase-js, merged last. */
+    options?: SupabaseClientOptions<"public">;
+}
+/**
+ * A Supabase client with Genesis's defaults: PKCE sign-in (the code flow, not
+ * tokens in a redirect URL), a persisted session that refreshes itself, and
+ * the session storage you pass.
+ *
+ * @stability Beta
+ */
+declare function createGenesisSupabase<Database = unknown>({ url, publishableKey, storage, platform, detectSessionInUrl, options, }: GenesisSupabaseOptions): SupabaseClient<Database>;
+/** What a Supabase or PostgREST error carries. */
+interface PostgrestErrorLike {
+    message: string;
+    code?: string;
+    details?: string | null;
+    hint?: string | null;
+}
+/**
+ * A failed query, with the database's `code` (`23505` unique violation,
+ * `42501` permission denied, `PGRST116` no rows…), `details` and `hint`, so a
+ * caller can tell an RLS refusal from a conflict. The original error is the
+ * `cause`.
+ *
+ * @stability Beta
+ */
+declare class SupabaseQueryError extends Error {
+    name: string;
+    readonly code?: string;
+    readonly details?: string | null;
+    readonly hint?: string | null;
+    constructor(error: PostgrestErrorLike);
+}
+/**
+ * The data, or a thrown {@link SupabaseQueryError}: for query results where an
+ * error should fail the caller (a TanStack Query `queryFn`). The return type
+ * keeps `null` when the query can return no row (`.maybeSingle()`).
+ *
+ * @stability Beta
+ */
+declare function must<T>(result: {
+    data: T;
+    error: null;
+} | {
+    data: null;
+    error: PostgrestErrorLike;
+}): T;
+
+export { type GenesisSupabaseOptions, type PostgrestErrorLike, type SessionStorage, SupabaseQueryError, createGenesisSupabase, must };

package/dist/index.js

@@ -0,0 +1,44 @@
+import { createClient } from '@supabase/supabase-js';
+
+// src/index.ts
+function createGenesisSupabase({
+  url,
+  publishableKey,
+  storage,
+  platform = "web",
+  detectSessionInUrl = platform === "web",
+  options = {}
+}) {
+  const client = createClient(url, publishableKey, {
+    ...options,
+    auth: {
+      flowType: "pkce",
+      persistSession: true,
+      autoRefreshToken: true,
+      detectSessionInUrl,
+      ...storage ? { storage } : {},
+      ...options.auth
+    }
+  });
+  return client;
+}
+var SupabaseQueryError = class extends Error {
+  name = "SupabaseQueryError";
+  code;
+  details;
+  hint;
+  constructor(error) {
+    super(error.message, { cause: error });
+    this.code = error.code;
+    this.details = error.details;
+    this.hint = error.hint;
+  }
+};
+function must(result) {
+  if (result.error) throw new SupabaseQueryError(result.error);
+  return result.data;
+}
+
+export { SupabaseQueryError, createGenesisSupabase, must };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAwCO,SAAS,qBAAA,CAA0C;AAAA,EACxD,GAAA;AAAA,EACA,cAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA,GAAW,KAAA;AAAA,EACX,qBAAqB,QAAA,KAAa,KAAA;AAAA,EAClC,UAAU;AACZ,CAAA,EAAqD;AAGnD,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,GAAA,EAAK,cAAA,EAAgB;AAAA,IAC/C,GAAG,OAAA;AAAA,IACH,IAAA,EAAM;AAAA,MACJ,QAAA,EAAU,MAAA;AAAA,MACV,cAAA,EAAgB,IAAA;AAAA,MAChB,gBAAA,EAAkB,IAAA;AAAA,MAClB,kBAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY,EAAC;AAAA,MAC7B,GAAG,OAAA,CAAQ;AAAA;AACb,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAkBO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,IAAA,GAAO,oBAAA;AAAA,EACP,IAAA;AAAA,EACA,OAAA;AAAA,EACA,IAAA;AAAA,EACT,YAAY,KAAA,EAA2B;AACrC,IAAA,KAAA,CAAM,KAAA,CAAM,OAAA,EAAS,EAAE,KAAA,EAAO,OAAO,CAAA;AACrC,IAAA,IAAA,CAAK,OAAO,KAAA,CAAM,IAAA;AAClB,IAAA,IAAA,CAAK,UAAU,KAAA,CAAM,OAAA;AACrB,IAAA,IAAA,CAAK,OAAO,KAAA,CAAM,IAAA;AAAA,EACpB;AACF;AASO,SAAS,KAAQ,MAAA,EAAiF;AACvG,EAAA,IAAI,OAAO,KAAA,EAAO,MAAM,IAAI,kBAAA,CAAmB,OAAO,KAAK,CAAA;AAC3D,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB","file":"index.js","sourcesContent":["/**\n * Supabase for Genesis apps. Platform-neutral: web, React Native and the\n * server import it. Native-only helpers (Keychain storage, foreground\n * refresh, reinstall wipe) are on `@marktiderman/genesis-supabase/native`.\n */\nimport { createClient, type SupabaseClient, type SupabaseClientOptions } from \"@supabase/supabase-js\";\n\n/** The async key-value store Supabase auth keeps its session in. */\nexport interface SessionStorage {\n  getItem(key: string): Promise<string | null>;\n  setItem(key: string, value: string): Promise<void>;\n  removeItem(key: string): Promise<void>;\n}\n\n/** @stability Beta */\nexport interface GenesisSupabaseOptions {\n  url: string;\n  /** The publishable (anon) key. Never the secret key in an app. */\n  publishableKey: string;\n  /** Where the session lives. Native: `keychainStorage(SecureStore)`. Web: leave out for supabase-js's own default. */\n  storage?: SessionStorage;\n  /** `\"native\"` sets the React Native defaults (no session from the URL). Default `\"web\"`. */\n  platform?: \"web\" | \"native\";\n  /**\n   * Read a session from the URL after an OAuth redirect. Default: `true` on\n   * web, `false` on native, where the app hands the redirect URL to\n   * `exchangeCodeForSession` itself.\n   */\n  detectSessionInUrl?: boolean;\n  /** Anything else for supabase-js, merged last. */\n  options?: SupabaseClientOptions<\"public\">;\n}\n\n/**\n * A Supabase client with Genesis's defaults: PKCE sign-in (the code flow, not\n * tokens in a redirect URL), a persisted session that refreshes itself, and\n * the session storage you pass.\n *\n * @stability Beta\n */\nexport function createGenesisSupabase<Database = unknown>({\n  url,\n  publishableKey,\n  storage,\n  platform = \"web\",\n  detectSessionInUrl = platform === \"web\",\n  options = {},\n}: GenesisSupabaseOptions): SupabaseClient<Database> {\n  // supabase-js's generics over the schema don't survive being forwarded, so the\n  // options are built untyped and the client is typed by the caller's Database.\n  const client = createClient(url, publishableKey, {\n    ...options,\n    auth: {\n      flowType: \"pkce\",\n      persistSession: true,\n      autoRefreshToken: true,\n      detectSessionInUrl,\n      ...(storage ? { storage } : {}),\n      ...options.auth,\n    },\n  });\n  return client as unknown as SupabaseClient<Database>;\n}\n\n/** What a Supabase or PostgREST error carries. */\nexport interface PostgrestErrorLike {\n  message: string;\n  code?: string;\n  details?: string | null;\n  hint?: string | null;\n}\n\n/**\n * A failed query, with the database's `code` (`23505` unique violation,\n * `42501` permission denied, `PGRST116` no rows…), `details` and `hint`, so a\n * caller can tell an RLS refusal from a conflict. The original error is the\n * `cause`.\n *\n * @stability Beta\n */\nexport class SupabaseQueryError extends Error {\n  override name = \"SupabaseQueryError\";\n  readonly code?: string;\n  readonly details?: string | null;\n  readonly hint?: string | null;\n  constructor(error: PostgrestErrorLike) {\n    super(error.message, { cause: error });\n    this.code = error.code;\n    this.details = error.details;\n    this.hint = error.hint;\n  }\n}\n\n/**\n * The data, or a thrown {@link SupabaseQueryError}: for query results where an\n * error should fail the caller (a TanStack Query `queryFn`). The return type\n * keeps `null` when the query can return no row (`.maybeSingle()`).\n *\n * @stability Beta\n */\nexport function must<T>(result: { data: T; error: null } | { data: null; error: PostgrestErrorLike }): T {\n  if (result.error) throw new SupabaseQueryError(result.error);\n  return result.data as T;\n}\n"]}

package/dist/native.d.ts

@@ -0,0 +1,84 @@
+import { SessionStorage } from './index.js';
+import '@supabase/supabase-js';
+
+/**
+ * React Native helpers for a Supabase session. Nothing here imports React
+ * Native or Expo: pass in `expo-secure-store`, `AppState` and a plain store,
+ * so the package stays light and the helpers are easy to test.
+ */
+
+/** The parts of `expo-secure-store` the Keychain storage uses. */
+interface SecureStoreLike {
+    getItemAsync(key: string, options?: Record<string, unknown>): Promise<string | null>;
+    setItemAsync(key: string, value: string, options?: Record<string, unknown>): Promise<void>;
+    deleteItemAsync(key: string, options?: Record<string, unknown>): Promise<void>;
+    /** `SecureStore.AFTER_FIRST_UNLOCK`, when available. */
+    AFTER_FIRST_UNLOCK?: unknown;
+}
+/** @stability Beta */
+interface KeychainStorageOptions {
+    /** UTF-8 bytes per Keychain item. A Keychain item should stay under about 2 KB; a Supabase session is larger. Default 1800. */
+    chunkSize?: number;
+    /** Extra options for every SecureStore call. Default: readable after first unlock, so a background refresh works. */
+    secureStoreOptions?: Record<string, unknown>;
+}
+/**
+ * Session storage in the Keychain (iOS) or Keystore (Android).
+ *
+ * A value is split into numbered chunks. Each write goes to a new generation of
+ * chunks, and one manifest item (`<key>.n` = `generation:count`) switches to it
+ * only once every chunk is written, so a write cut short leaves the previous
+ * session whole. Chunks split between characters (never inside one) and
+ * stay under `chunkSize` UTF-8 bytes. A pending marker (`<key>.p`) names a
+ * generation while it is being written, so chunks left by a write that was
+ * cut short or crashed are swept on the next write or remove. Writes to the
+ * same key run one at a time, so two token refreshes can't interleave.
+ *
+ * @stability Beta
+ */
+declare function keychainStorage(secureStore: SecureStoreLike, options?: KeychainStorageOptions): SessionStorage;
+/** The parts of a Supabase client's auth the refresh helper uses. */
+interface AutoRefreshAuth {
+    auth: {
+        startAutoRefresh(): Promise<void> | void;
+        stopAutoRefresh(): Promise<void> | void;
+    };
+}
+/** The parts of React Native's `AppState` the refresh helper uses. */
+interface AppStateLike {
+    currentState?: string | null;
+    addEventListener(type: "change", listener: (state: string) => void): {
+        remove(): void;
+    };
+}
+/**
+ * Refresh the session only while the app is in front, as Supabase recommends
+ * for React Native. Returns the unsubscribe.
+ *
+ * @stability Beta
+ */
+declare function refreshWhileActive(client: AutoRefreshAuth, appState: AppStateLike): () => void;
+/** @stability Beta */
+interface WipeOnReinstallOptions {
+    /** The session storage (usually `keychainStorage`). */
+    session: SessionStorage;
+    /** The session's storage key. Supabase's default is `sb-<project ref>-auth-token`. */
+    sessionKey: string;
+    /** A store that an uninstall deletes, e.g. AsyncStorage. The Keychain survives an uninstall; this is how we notice one. */
+    installMarker: SessionStorage;
+    /** The marker's key. Default `genesis.installed`. */
+    markerKey?: string;
+}
+/**
+ * On iOS the Keychain outlives an uninstall, so a reinstalled app would sign
+ * the last person back in. Call this before creating the client: on the first
+ * launch after an install it removes any session left in the Keychain, then
+ * sets a marker so later launches keep the session. Returns whether it wiped.
+ *
+ * @stability Beta
+ */
+declare function wipeSessionOnReinstall({ session, sessionKey, installMarker, markerKey }: WipeOnReinstallOptions): Promise<boolean>;
+/** Split text into pieces of at most `maxBytes` UTF-8 bytes, never inside a character. */
+declare function splitUtf8(text: string, maxBytes: number): string[];
+
+export { type AppStateLike, type AutoRefreshAuth, type KeychainStorageOptions, type SecureStoreLike, type WipeOnReinstallOptions, keychainStorage, refreshWhileActive, splitUtf8, wipeSessionOnReinstall };

package/dist/native.js

@@ -0,0 +1,111 @@
+// src/native.ts
+function keychainStorage(secureStore, options = {}) {
+  const size = options.chunkSize ?? 1800;
+  const opts = options.secureStoreOptions ?? (secureStore.AFTER_FIRST_UNLOCK !== void 0 ? { keychainAccessible: secureStore.AFTER_FIRST_UNLOCK } : {});
+  const chunkKey = (key, gen, i) => `${key}.${gen}.${i}`;
+  let counter = 0;
+  const queues = /* @__PURE__ */ new Map();
+  const serial = (key, task) => {
+    const run = (queues.get(key) ?? Promise.resolve()).catch(() => void 0).then(task);
+    queues.set(key, run);
+    return run;
+  };
+  const parse = (raw) => {
+    const [gen, count] = (raw ?? "").split(":");
+    return gen && Number(count) > 0 ? { gen, count: Number(count) } : null;
+  };
+  const manifest = async (key) => parse(await secureStore.getItemAsync(`${key}.n`, opts));
+  const pending = async (key) => parse(await secureStore.getItemAsync(`${key}.p`, opts));
+  const drop = (key, gen, count) => Promise.all(Array.from({ length: count }, (_, i) => secureStore.deleteItemAsync(chunkKey(key, gen, i), opts)));
+  const sweepPending = async (key, current) => {
+    const p = await pending(key);
+    if (!p) return;
+    if (p.gen !== current) await drop(key, p.gen, p.count);
+    await secureStore.deleteItemAsync(`${key}.p`, opts);
+  };
+  return {
+    getItem(key) {
+      return serial(key, async () => {
+        const m = await manifest(key);
+        if (!m) return null;
+        const parts = await Promise.all(Array.from({ length: m.count }, (_, i) => secureStore.getItemAsync(chunkKey(key, m.gen, i), opts)));
+        return parts.some((p) => p === null) ? null : parts.join("");
+      });
+    },
+    setItem(key, value) {
+      return serial(key, async () => {
+        const before = await manifest(key);
+        await sweepPending(key, before?.gen);
+        const gen = `${Date.now().toString(36)}${(counter++).toString(36)}`;
+        const parts = splitUtf8(value, size);
+        await secureStore.setItemAsync(`${key}.p`, `${gen}:${parts.length}`, opts);
+        const written = await Promise.allSettled(parts.map((p, i) => secureStore.setItemAsync(chunkKey(key, gen, i), p, opts)));
+        const failed = written.find((r) => r.status === "rejected");
+        if (failed) throw failed.reason;
+        await secureStore.setItemAsync(`${key}.n`, `${gen}:${parts.length}`, opts);
+        await secureStore.deleteItemAsync(`${key}.p`, opts);
+        if (before) await drop(key, before.gen, before.count);
+      });
+    },
+    removeItem(key) {
+      return serial(key, async () => {
+        const m = await manifest(key);
+        await sweepPending(key, m?.gen);
+        if (m) await drop(key, m.gen, m.count);
+        await secureStore.deleteItemAsync(`${key}.n`, opts);
+      });
+    }
+  };
+}
+function refreshWhileActive(client, appState) {
+  const apply = (state) => {
+    if (state === "active") void client.auth.startAutoRefresh();
+    else void client.auth.stopAutoRefresh();
+  };
+  apply(appState.currentState ?? "active");
+  const sub = appState.addEventListener("change", apply);
+  return () => {
+    sub.remove();
+    void client.auth.stopAutoRefresh();
+  };
+}
+async function wipeSessionOnReinstall({ session, sessionKey, installMarker, markerKey = "genesis.installed" }) {
+  if (await installMarker.getItem(markerKey) !== null) return false;
+  const indexKey = `${sessionKey}-flows-code-verifier`;
+  for (const flowId of parseFlowIndex(await session.getItem(indexKey))) await session.removeItem(`${sessionKey}-flow-${flowId}-code-verifier`);
+  for (const key of [sessionKey, `${sessionKey}-code-verifier`, indexKey, `${sessionKey}-user`]) await session.removeItem(key);
+  await installMarker.setItem(markerKey, "1");
+  return true;
+}
+var utf8Length = (codePoint) => codePoint < 128 ? 1 : codePoint < 2048 ? 2 : codePoint < 65536 ? 3 : 4;
+function splitUtf8(text, maxBytes) {
+  if (text === "") return [""];
+  const parts = [];
+  let current = "";
+  let bytes = 0;
+  for (const ch of text) {
+    const n = utf8Length(ch.codePointAt(0));
+    if (bytes + n > maxBytes && current) {
+      parts.push(current);
+      current = "";
+      bytes = 0;
+    }
+    current += ch;
+    bytes += n;
+  }
+  parts.push(current);
+  return parts;
+}
+function parseFlowIndex(raw) {
+  if (!raw) return [];
+  try {
+    const ids = JSON.parse(raw);
+    return Array.isArray(ids) ? ids.filter((id) => typeof id === "string" && /^[\w-]{1,128}$/.test(id)) : [];
+  } catch {
+    return [];
+  }
+}
+
+export { keychainStorage, refreshWhileActive, splitUtf8, wipeSessionOnReinstall };
+//# sourceMappingURL=native.js.map
+//# sourceMappingURL=native.js.map

package/dist/native.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/native.ts"],"names":[],"mappings":";AAsCO,SAAS,eAAA,CAAgB,WAAA,EAA8B,OAAA,GAAkC,EAAC,EAAmB;AAClH,EAAA,MAAM,IAAA,GAAO,QAAQ,SAAA,IAAa,IAAA;AAClC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,kBAAA,KAAuB,WAAA,CAAY,kBAAA,KAAuB,MAAA,GAAY,EAAE,kBAAA,EAAoB,WAAA,CAAY,kBAAA,EAAmB,GAAI,EAAC,CAAA;AACrJ,EAAA,MAAM,QAAA,GAAW,CAAC,GAAA,EAAa,GAAA,EAAa,CAAA,KAAc,GAAG,GAAG,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA;AAC5E,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,MAAA,uBAAa,GAAA,EAA8B;AAGjD,EAAA,MAAM,MAAA,GAAS,CAAI,GAAA,EAAa,IAAA,KAAuC;AACrE,IAAA,MAAM,GAAA,GAAA,CAAO,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,OAAA,CAAQ,OAAA,EAAQ,EAAG,KAAA,CAAM,MAAM,MAAS,CAAA,CAAE,KAAK,IAAI,CAAA;AACnF,IAAA,MAAA,CAAO,GAAA,CAAI,KAAK,GAAG,CAAA;AACnB,IAAA,OAAO,GAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAA,KAAuB;AACpC,IAAA,MAAM,CAAC,GAAA,EAAK,KAAK,KAAK,GAAA,IAAO,EAAA,EAAI,MAAM,GAAG,CAAA;AAC1C,IAAA,OAAO,GAAA,IAAO,MAAA,CAAO,KAAK,CAAA,GAAI,CAAA,GAAI,EAAE,GAAA,EAAK,KAAA,EAAO,MAAA,CAAO,KAAK,CAAA,EAAE,GAAI,IAAA;AAAA,EACpE,CAAA;AACA,EAAA,MAAM,QAAA,GAAW,OAAO,GAAA,KAAgB,KAAA,CAAM,MAAM,WAAA,CAAY,YAAA,CAAa,CAAA,EAAG,GAAG,CAAA,EAAA,CAAA,EAAM,IAAI,CAAC,CAAA;AAC9F,EAAA,MAAM,OAAA,GAAU,OAAO,GAAA,KAAgB,KAAA,CAAM,MAAM,WAAA,CAAY,YAAA,CAAa,CAAA,EAAG,GAAG,CAAA,EAAA,CAAA,EAAM,IAAI,CAAC,CAAA;AAC7F,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,GAAA,EAAa,KAAA,KACtC,QAAQ,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,IAAS,CAAC,CAAA,EAAG,CAAA,KAAM,WAAA,CAAY,eAAA,CAAgB,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,CAAC,CAAA,EAAG,IAAI,CAAC,CAAC,CAAA;AAG/G,EAAA,MAAM,YAAA,GAAe,OAAO,GAAA,EAAa,OAAA,KAAgC;AACvE,IAAA,MAAM,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,IAAI,CAAA,CAAE,QAAQ,OAAA,EAAS,MAAM,KAAK,GAAA,EAAK,CAAA,CAAE,GAAA,EAAK,CAAA,CAAE,KAAK,CAAA;AACrD,IAAA,MAAM,WAAA,CAAY,eAAA,CAAgB,CAAA,EAAG,GAAG,MAAM,IAAI,CAAA;AAAA,EACpD,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,QAAQ,GAAA,EAAK;AAGX,MAAA,OAAO,MAAA,CAAO,KAAK,YAAY;AAC7B,QAAA,MAAM,CAAA,GAAI,MAAM,QAAA,CAAS,GAAG,CAAA;AAC5B,QAAA,IAAI,CAAC,GAAG,OAAO,IAAA;AACf,QAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAK,EAAE,MAAA,EAAQ,CAAA,CAAE,KAAA,EAAM,EAAG,CAAC,GAAG,CAAA,KAAM,WAAA,CAAY,YAAA,CAAa,QAAA,CAAS,GAAA,EAAK,CAAA,CAAE,KAAK,CAAC,CAAA,EAAG,IAAI,CAAC,CAAC,CAAA;AAClI,QAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,KAAM,IAAI,CAAA,GAAI,IAAA,GAAO,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA;AAAA,MAC7D,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IACA,OAAA,CAAQ,KAAK,KAAA,EAAO;AAClB,MAAA,OAAO,MAAA,CAAO,KAAK,YAAY;AAC7B,QAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,GAAG,CAAA;AACjC,QAAA,MAAM,YAAA,CAAa,GAAA,EAAK,MAAA,EAAQ,GAAG,CAAA;AACnC,QAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,GAAA,EAAI,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA,EAAA,CAAI,OAAA,EAAA,EAAW,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AACjE,QAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AACnC,QAAA,MAAM,WAAA,CAAY,YAAA,CAAa,CAAA,EAAG,GAAG,CAAA,EAAA,CAAA,EAAM,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,KAAA,CAAM,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA;AAGzE,QAAA,MAAM,UAAU,MAAM,OAAA,CAAQ,WAAW,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,EAAG,CAAA,KAAM,YAAY,YAAA,CAAa,QAAA,CAAS,KAAK,GAAA,EAAK,CAAC,GAAG,CAAA,EAAG,IAAI,CAAC,CAAC,CAAA;AACtH,QAAA,MAAM,SAAS,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAkC,CAAA,CAAE,WAAW,UAAU,CAAA;AACtF,QAAA,IAAI,MAAA,QAAc,MAAA,CAAO,MAAA;AACzB,QAAA,MAAM,WAAA,CAAY,YAAA,CAAa,CAAA,EAAG,GAAG,CAAA,EAAA,CAAA,EAAM,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,KAAA,CAAM,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA;AACzE,QAAA,MAAM,WAAA,CAAY,eAAA,CAAgB,CAAA,EAAG,GAAG,MAAM,IAAI,CAAA;AAClD,QAAA,IAAI,QAAQ,MAAM,IAAA,CAAK,KAAK,MAAA,CAAO,GAAA,EAAK,OAAO,KAAK,CAAA;AAAA,MACtD,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IACA,WAAW,GAAA,EAAK;AACd,MAAA,OAAO,MAAA,CAAO,KAAK,YAAY;AAC7B,QAAA,MAAM,CAAA,GAAI,MAAM,QAAA,CAAS,GAAG,CAAA;AAC5B,QAAA,MAAM,YAAA,CAAa,GAAA,EAAK,CAAA,EAAG,GAAG,CAAA;AAE9B,QAAA,IAAI,GAAG,MAAM,IAAA,CAAK,KAAK,CAAA,CAAE,GAAA,EAAK,EAAE,KAAK,CAAA;AACrC,QAAA,MAAM,WAAA,CAAY,eAAA,CAAgB,CAAA,EAAG,GAAG,MAAM,IAAI,CAAA;AAAA,MACpD,CAAC,CAAA;AAAA,IACH;AAAA,GACF;AACF;AAmBO,SAAS,kBAAA,CAAmB,QAAyB,QAAA,EAAoC;AAC9F,EAAA,MAAM,KAAA,GAAQ,CAAC,KAAA,KAAqC;AAClD,IAAA,IAAI,KAAA,KAAU,QAAA,EAAU,KAAK,MAAA,CAAO,KAAK,gBAAA,EAAiB;AAAA,SACrD,KAAK,MAAA,CAAO,IAAA,CAAK,eAAA,EAAgB;AAAA,EACxC,CAAA;AACA,EAAA,KAAA,CAAM,QAAA,CAAS,gBAAgB,QAAQ,CAAA;AACvC,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,gBAAA,CAAiB,QAAA,EAAU,KAAK,CAAA;AACrD,EAAA,OAAO,MAAM;AACX,IAAA,GAAA,CAAI,MAAA,EAAO;AACX,IAAA,KAAK,MAAA,CAAO,KAAK,eAAA,EAAgB;AAAA,EACnC,CAAA;AACF;AAsBA,eAAsB,uBAAuB,EAAE,OAAA,EAAS,YAAY,aAAA,EAAe,SAAA,GAAY,qBAAoB,EAA6C;AAC9J,EAAA,IAAK,MAAM,aAAA,CAAc,OAAA,CAAQ,SAAS,CAAA,KAAO,MAAM,OAAO,KAAA;AAI9D,EAAA,MAAM,QAAA,GAAW,GAAG,UAAU,CAAA,oBAAA,CAAA;AAC9B,EAAA,KAAA,MAAW,MAAA,IAAU,cAAA,CAAe,MAAM,OAAA,CAAQ,QAAQ,QAAQ,CAAC,CAAA,EAAG,MAAM,QAAQ,UAAA,CAAW,CAAA,EAAG,UAAU,CAAA,MAAA,EAAS,MAAM,CAAA,cAAA,CAAgB,CAAA;AAC3I,EAAA,KAAA,MAAW,GAAA,IAAO,CAAC,UAAA,EAAY,CAAA,EAAG,UAAU,CAAA,cAAA,CAAA,EAAkB,QAAA,EAAU,CAAA,EAAG,UAAU,CAAA,KAAA,CAAO,CAAA,EAAG,MAAM,OAAA,CAAQ,WAAW,GAAG,CAAA;AAC3H,EAAA,MAAM,aAAA,CAAc,OAAA,CAAQ,SAAA,EAAW,GAAG,CAAA;AAC1C,EAAA,OAAO,IAAA;AACT;AAGA,IAAM,UAAA,GAAa,CAAC,SAAA,KAAuB,SAAA,GAAY,GAAA,GAAO,CAAA,GAAI,SAAA,GAAY,IAAA,GAAQ,CAAA,GAAI,SAAA,GAAY,KAAA,GAAU,CAAA,GAAI,CAAA;AAG7G,SAAS,SAAA,CAAU,MAAc,QAAA,EAA4B;AAClE,EAAA,IAAI,IAAA,KAAS,EAAA,EAAI,OAAO,CAAC,EAAE,CAAA;AAC3B,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,MAAM,IAAA,EAAM;AACrB,IAAA,MAAM,CAAA,GAAI,UAAA,CAAW,EAAA,CAAG,WAAA,CAAY,CAAC,CAAE,CAAA;AACvC,IAAA,IAAI,KAAA,GAAQ,CAAA,GAAI,QAAA,IAAY,OAAA,EAAS;AACnC,MAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAClB,MAAA,OAAA,GAAU,EAAA;AACV,MAAA,KAAA,GAAQ,CAAA;AAAA,IACV;AACA,IAAA,OAAA,IAAW,EAAA;AACX,IAAA,KAAA,IAAS,CAAA;AAAA,EACX;AACA,EAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAClB,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,eAAe,GAAA,EAA8B;AACpD,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAe,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACnC,IAAA,OAAO,MAAM,OAAA,CAAQ,GAAG,CAAA,GAAI,GAAA,CAAI,OAAO,CAAC,EAAA,KAAqB,OAAO,EAAA,KAAO,YAAY,gBAAA,CAAiB,IAAA,CAAK,EAAE,CAAC,IAAI,EAAC;AAAA,EACvH,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF","file":"native.js","sourcesContent":["/**\n * React Native helpers for a Supabase session. Nothing here imports React\n * Native or Expo: pass in `expo-secure-store`, `AppState` and a plain store,\n * so the package stays light and the helpers are easy to test.\n */\nimport type { SessionStorage } from \"./index\";\n\n/** The parts of `expo-secure-store` the Keychain storage uses. */\nexport interface SecureStoreLike {\n  getItemAsync(key: string, options?: Record<string, unknown>): Promise<string | null>;\n  setItemAsync(key: string, value: string, options?: Record<string, unknown>): Promise<void>;\n  deleteItemAsync(key: string, options?: Record<string, unknown>): Promise<void>;\n  /** `SecureStore.AFTER_FIRST_UNLOCK`, when available. */\n  AFTER_FIRST_UNLOCK?: unknown;\n}\n\n/** @stability Beta */\nexport interface KeychainStorageOptions {\n  /** UTF-8 bytes per Keychain item. A Keychain item should stay under about 2 KB; a Supabase session is larger. Default 1800. */\n  chunkSize?: number;\n  /** Extra options for every SecureStore call. Default: readable after first unlock, so a background refresh works. */\n  secureStoreOptions?: Record<string, unknown>;\n}\n\n/**\n * Session storage in the Keychain (iOS) or Keystore (Android).\n *\n * A value is split into numbered chunks. Each write goes to a new generation of\n * chunks, and one manifest item (`<key>.n` = `generation:count`) switches to it\n * only once every chunk is written, so a write cut short leaves the previous\n * session whole. Chunks split between characters (never inside one) and\n * stay under `chunkSize` UTF-8 bytes. A pending marker (`<key>.p`) names a\n * generation while it is being written, so chunks left by a write that was\n * cut short or crashed are swept on the next write or remove. Writes to the\n * same key run one at a time, so two token refreshes can't interleave.\n *\n * @stability Beta\n */\nexport function keychainStorage(secureStore: SecureStoreLike, options: KeychainStorageOptions = {}): SessionStorage {\n  const size = options.chunkSize ?? 1800;\n  const opts = options.secureStoreOptions ?? (secureStore.AFTER_FIRST_UNLOCK !== undefined ? { keychainAccessible: secureStore.AFTER_FIRST_UNLOCK } : {});\n  const chunkKey = (key: string, gen: string, i: number) => `${key}.${gen}.${i}`;\n  let counter = 0;\n  const queues = new Map<string, Promise<unknown>>();\n\n  /** Run `task` after every earlier write to `key` has settled. */\n  const serial = <T>(key: string, task: () => Promise<T>): Promise<T> => {\n    const run = (queues.get(key) ?? Promise.resolve()).catch(() => undefined).then(task);\n    queues.set(key, run);\n    return run;\n  };\n\n  const parse = (raw: string | null) => {\n    const [gen, count] = (raw ?? \"\").split(\":\");\n    return gen && Number(count) > 0 ? { gen, count: Number(count) } : null;\n  };\n  const manifest = async (key: string) => parse(await secureStore.getItemAsync(`${key}.n`, opts));\n  const pending = async (key: string) => parse(await secureStore.getItemAsync(`${key}.p`, opts));\n  const drop = (key: string, gen: string, count: number) =>\n    Promise.all(Array.from({ length: count }, (_, i) => secureStore.deleteItemAsync(chunkKey(key, gen, i), opts)));\n\n  /** Remove chunks of a write that never completed (unless they are the current generation). */\n  const sweepPending = async (key: string, current: string | undefined) => {\n    const p = await pending(key);\n    if (!p) return;\n    if (p.gen !== current) await drop(key, p.gen, p.count);\n    await secureStore.deleteItemAsync(`${key}.p`, opts);\n  };\n\n  return {\n    getItem(key) {\n      // Reads queue with writes, so a write can't swap the manifest and drop\n      // the old chunks halfway through a read.\n      return serial(key, async () => {\n        const m = await manifest(key);\n        if (!m) return null;\n        const parts = await Promise.all(Array.from({ length: m.count }, (_, i) => secureStore.getItemAsync(chunkKey(key, m.gen, i), opts)));\n        return parts.some((p) => p === null) ? null : parts.join(\"\");\n      });\n    },\n    setItem(key, value) {\n      return serial(key, async () => {\n        const before = await manifest(key);\n        await sweepPending(key, before?.gen);\n        const gen = `${Date.now().toString(36)}${(counter++).toString(36)}`;\n        const parts = splitUtf8(value, size);\n        await secureStore.setItemAsync(`${key}.p`, `${gen}:${parts.length}`, opts);\n        // Let every chunk write settle before failing, so a late write can't land\n        // after the next operation has swept this generation.\n        const written = await Promise.allSettled(parts.map((p, i) => secureStore.setItemAsync(chunkKey(key, gen, i), p, opts)));\n        const failed = written.find((r): r is PromiseRejectedResult => r.status === \"rejected\");\n        if (failed) throw failed.reason;\n        await secureStore.setItemAsync(`${key}.n`, `${gen}:${parts.length}`, opts);\n        await secureStore.deleteItemAsync(`${key}.p`, opts);\n        if (before) await drop(key, before.gen, before.count);\n      });\n    },\n    removeItem(key) {\n      return serial(key, async () => {\n        const m = await manifest(key);\n        await sweepPending(key, m?.gen);\n        // Chunks first: the manifest is what finds them, so it goes last.\n        if (m) await drop(key, m.gen, m.count);\n        await secureStore.deleteItemAsync(`${key}.n`, opts);\n      });\n    },\n  };\n}\n\n/** The parts of a Supabase client's auth the refresh helper uses. */\nexport interface AutoRefreshAuth {\n  auth: { startAutoRefresh(): Promise<void> | void; stopAutoRefresh(): Promise<void> | void };\n}\n\n/** The parts of React Native's `AppState` the refresh helper uses. */\nexport interface AppStateLike {\n  currentState?: string | null;\n  addEventListener(type: \"change\", listener: (state: string) => void): { remove(): void };\n}\n\n/**\n * Refresh the session only while the app is in front, as Supabase recommends\n * for React Native. Returns the unsubscribe.\n *\n * @stability Beta\n */\nexport function refreshWhileActive(client: AutoRefreshAuth, appState: AppStateLike): () => void {\n  const apply = (state: string | null | undefined) => {\n    if (state === \"active\") void client.auth.startAutoRefresh();\n    else void client.auth.stopAutoRefresh();\n  };\n  apply(appState.currentState ?? \"active\");\n  const sub = appState.addEventListener(\"change\", apply);\n  return () => {\n    sub.remove();\n    void client.auth.stopAutoRefresh();\n  };\n}\n\n/** @stability Beta */\nexport interface WipeOnReinstallOptions {\n  /** The session storage (usually `keychainStorage`). */\n  session: SessionStorage;\n  /** The session's storage key. Supabase's default is `sb-<project ref>-auth-token`. */\n  sessionKey: string;\n  /** A store that an uninstall deletes, e.g. AsyncStorage. The Keychain survives an uninstall; this is how we notice one. */\n  installMarker: SessionStorage;\n  /** The marker's key. Default `genesis.installed`. */\n  markerKey?: string;\n}\n\n/**\n * On iOS the Keychain outlives an uninstall, so a reinstalled app would sign\n * the last person back in. Call this before creating the client: on the first\n * launch after an install it removes any session left in the Keychain, then\n * sets a marker so later launches keep the session. Returns whether it wiped.\n *\n * @stability Beta\n */\nexport async function wipeSessionOnReinstall({ session, sessionKey, installMarker, markerKey = \"genesis.installed\" }: WipeOnReinstallOptions): Promise<boolean> {\n  if ((await installMarker.getItem(markerKey)) !== null) return false;\n  // The session, plus what supabase-js keeps beside it: the PKCE verifier (the\n  // single legacy slot, each indexed flow's slot and the index) and, with\n  // userStorage, the user.\n  const indexKey = `${sessionKey}-flows-code-verifier`;\n  for (const flowId of parseFlowIndex(await session.getItem(indexKey))) await session.removeItem(`${sessionKey}-flow-${flowId}-code-verifier`);\n  for (const key of [sessionKey, `${sessionKey}-code-verifier`, indexKey, `${sessionKey}-user`]) await session.removeItem(key);\n  await installMarker.setItem(markerKey, \"1\");\n  return true;\n}\n\n/** UTF-8 byte length of one code point. */\nconst utf8Length = (codePoint: number) => (codePoint < 0x80 ? 1 : codePoint < 0x800 ? 2 : codePoint < 0x10000 ? 3 : 4);\n\n/** Split text into pieces of at most `maxBytes` UTF-8 bytes, never inside a character. */\nexport function splitUtf8(text: string, maxBytes: number): string[] {\n  if (text === \"\") return [\"\"];\n  const parts: string[] = [];\n  let current = \"\";\n  let bytes = 0;\n  for (const ch of text) {\n    const n = utf8Length(ch.codePointAt(0)!);\n    if (bytes + n > maxBytes && current) {\n      parts.push(current);\n      current = \"\";\n      bytes = 0;\n    }\n    current += ch;\n    bytes += n;\n  }\n  parts.push(current);\n  return parts;\n}\n\n/** supabase-js's PKCE flow index: a JSON array of flow ids. Anything else is ignored. */\nfunction parseFlowIndex(raw: string | null): string[] {\n  if (!raw) return [];\n  try {\n    const ids: unknown = JSON.parse(raw);\n    return Array.isArray(ids) ? ids.filter((id): id is string => typeof id === \"string\" && /^[\\w-]{1,128}$/.test(id)) : [];\n  } catch {\n    return [];\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,51 @@
 {
   "name": "@marktiderman/genesis-supabase",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "private": false,
+  "type": "module",
+  "sideEffects": false,
+  "description": "Supabase for Genesis apps on web and React Native: a client with PKCE and safe defaults, Keychain session storage that survives interrupted writes, refresh only while the app is in front, and a result helper. Part of the Genesis framework.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/marktiderman/genesis.git",
+    "directory": "packages/supabase"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "provenance": false
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./native": {
+      "types": "./dist/native.d.ts",
+      "import": "./dist/native.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "peerDependencies": {
+    "@supabase/supabase-js": "^2.118.0"
+  },
+  "devDependencies": {
+    "@supabase/supabase-js": "^2.118.0",
+    "tsup": "^8.3.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.12"
+  },
+  "scripts": {
+    "build": "tsup && node ../../scripts/check-exports-resolve.mjs",
+    "clean": "rm -rf dist",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
 }