@marktiderman/genesis-supabase 0.1.1 → 0.2.0

package/README.md

@@ -23,9 +23,187 @@ const rows = must(await supabase.from("tasks").select("*"));
 - **`refreshWhileActive(client, AppState)`**: refreshes the session only while the app is in front.
 - **`wipeSessionOnReinstall`**: the iOS Keychain outlives an uninstall; this removes a leftover session (and its PKCE verifier) on the first launch after an install.
 - **`must(result)`**: the data, or a thrown `SupabaseQueryError` carrying the database's `code`, `details` and `hint`.
+- **`signInWithApple`, `completeOAuthRedirect`, `deleteMyAccount`**: see [Account](#account-sign-in-and-deletion) below.
+- **`app_release_policy`**: the table the native updates block reads; see [Release policy](#release-policy-the-updates-block).
 
 Nothing here imports React Native or Expo: you pass those modules in.
 
+## Account: sign-in and deletion
+
+What the App Store asks of an app with accounts: an equivalent privacy-preserving login beside any
+other third-party sign-in (Guideline 4.8; Sign in with Apple satisfies it), Apple's own button, and
+deleting the account from inside the app (5.1.1(v)), including revoking the person's Apple tokens.
+Everything below is covered except that last server step; see [Not covered yet](#not-covered-yet).
+
+### Sign in with Apple
+
+```ts
+import * as AppleAuthentication from "expo-apple-authentication";
+import * as Crypto from "expo-crypto";
+import { signInWithApple } from "@marktiderman/genesis-supabase/native";
+
+const digest = (s: string) => Crypto.digestStringAsync(Crypto.CryptoDigestAlgorithm.SHA256, s);
+
+async function onApple() {
+  const result = await signInWithApple(supabase, AppleAuthentication, { digest, randomNonce: Crypto.randomUUID });
+  if (result.canceled) return; // they closed Apple's sheet: not an error
+  if (result.error) return showError(result.error.message); // result.error.code says why
+  // Apple shares the name on the first sign-in only, so save it now.
+  if (result.fullName) await supabase.auth.updateUser({ data: { full_name: result.fullName } });
+  // For revoking on deletion: hand the single-use code to your server now (see below).
+  if (result.authorizationCode) await supabase.functions.invoke("apple-store-token", { body: { code: result.authorizationCode } });
+}
+```
+
+- **`signInWithApple(client, AppleAuthentication, { digest, randomNonce? })`**: checks
+  `isAvailableAsync()`, asks for name and email with the SHA-256 (lowercase hex; anything else is
+  `bad_digest`) of a fresh nonce, and signs in with `signInWithIdToken({ provider: "apple", token, nonce })`
+  (Supabase gets the raw nonce and checks the token against it). Returns
+  `{ session, user, fullName, email, authorizationCode }`, `{ canceled: true }` or `{ error }` (a
+  `GenesisAuthError` with a `code`, plus `fullName` when Apple shared one, so a retry can still
+  save it); it never throws.
+- Draw it with `appleProvider({ apple: AppleAuthentication, onPress: onApple })` from
+  `@marktiderman/genesis-ui-native` in `AuthScreen`'s `providers`: Apple's own button on iOS,
+  nothing elsewhere.
+- Setup is yours: enable the Apple provider in Supabase Auth with your bundle id as a client id,
+  turn on the Sign in with Apple capability (`ios.usesAppleSignIn: true` in `app.json`), and add
+  `expo-apple-authentication` and `expo-crypto`.
+
+### Other OAuth providers (Google…): the redirect
+
+```ts
+import * as WebBrowser from "expo-web-browser";
+import { completeOAuthRedirect } from "@marktiderman/genesis-supabase/native";
+
+const redirectTo = "myapp://auth/callback";
+const { data } = await supabase.auth.signInWithOAuth({ provider: "google", options: { redirectTo, skipBrowserRedirect: true } });
+const res = await WebBrowser.openAuthSessionAsync(data.url!, redirectTo);
+if (res.type === "success") {
+  const result = await completeOAuthRedirect(supabase, res.url);
+  if (result.error) showError(result.error.message); // never result.error.providerMessage
+  else if (result.redirectType === "recovery") router.push("/set-password");
+}
+```
+
+- **`completeOAuthRedirect(client, url)`**: reads the redirect's query and fragment. A `code` is
+  exchanged with `exchangeCodeForSession`, with the redirect's `sb_flow_id` when it has one so the
+  right flow's verifier is used. An `error` comes back as `{ error }` with no request. Returns
+  `{ session, redirectType }` (`"recovery"` after a password-reset link) or `{ error }`; it never throws.
+- **Pass only the URL `openAuthSessionAsync` resolved with**, for the sign-in the app just started.
+  A code is single-use and the exchange spends the stored verifier whatever happens, so feeding it a
+  stray `?code=` from some other link burns the sign-in in progress.
+- **Handle each redirect once.** If the app also listens with `Linking.addEventListener("url", …)`,
+  the same redirect arrives twice and the second exchange fails just after the first signed them
+  in. Pick one path (the auth-session result), or remember the last code you handled and skip it.
+- **The error text is fixed copy.** `error.message` is chosen from the `code`; the redirect's own
+  `error_description` is only on `error.providerMessage`, which is **untrusted**: any web page or
+  app can open your callback link with any text in it. Log it, don't show it.
+- **Native needs `flowType: "pkce"`**, which `createGenesisSupabase` sets. With the implicit flow
+  the redirect carries tokens instead of a code, and this returns `missing_code`.
+- **Redirect URLs:** add the exact deep link (`myapp://auth/callback`) to Supabase Auth's Redirect
+  URLs, not a wildcard such as `myapp://**`.
+- **Why the deep link is safe:** another app can claim your custom scheme, and any page can open
+  it. That's harmless because of PKCE: a code is useless without the verifier, which never leaves
+  this device. The implicit flow would hand tokens to whoever owns the scheme.
+
+### Deleting the account
+
+The database half is a migration this package ships:
+[`migrations/0001_genesis_account_deletion.sql`](./migrations/0001_genesis_account_deletion.sql)
+(also at `node_modules/@marktiderman/genesis-supabase/migrations/`). Copy it into your app's
+`supabase/migrations/` under a new timestamped name. It defines `public.delete_my_account()`, a
+`security definer` function with `search_path = ''` that deletes the caller's `auth.users` row,
+executable by `authenticated` only (granted and revoked by name; a later blanket
+`grant … on all functions` would hand it back to `anon`, so such a grant must exclude it). Its pgTAP
+test is `migrations/tests/0001_genesis_account_deletion.test.sql`: copy it to
+`supabase/tests/database/` and run `supabase test db`.
+
+It refuses, by error code (`SupabaseQueryError.code` on the client):
+
+| Code | When |
+|---|---|
+| `42501` | Nobody is signed in, or the person has a verified MFA factor and the session isn't `aal2`: verify the second factor, then retry. |
+| `GA001` | The app's hook refused (below). |
+| `GA002` | The app requires a recent sign-in and this one isn't: sign in again, then retry. |
+| `23503` | A row still references the login: a foreign key without `on delete cascade`, or files in Storage. |
+
+- **Your data:** deleting the login removes the rows whose foreign keys to `auth.users(id)` are
+  `on delete cascade`, and is refused (`23503`) while any other row still points at it, so the
+  person never ends up half-deleted. Give every user-owned table such a foreign key: a table keyed
+  on `auth.uid()` without one keeps orphans.
+- **Storage:** Supabase documents that a user who owns objects in Storage can't be deleted, so the
+  call fails (`23503`) while they have files. Remove their files through the Storage API first.
+  (Documented by Supabase; not verified against a full stack in this package's tests.)
+- **The app hook:** create `private.genesis_before_account_delete(uuid)` and it runs first, in the
+  same transaction, with the person's id, to scrub data, set flags, or refuse (e.g. the sole owner
+  of a team). Any error it raises cancels the delete and reaches the client as `GA001` (or as the
+  hook's own code when that starts with `GA`). The migration's header has an example.
+- **Recent sign-in (optional):** call `perform private.genesis_require_recent_sign_in(interval '10 minutes')`
+  from the hook to require that the person authenticated within that time (`GA002` otherwise). It
+  reads the newest `amr` timestamp in the JWT, which records the actual sign-in and survives a token
+  refresh, and falls back to `iat`. On `GA002`, have them sign in again (or `reauthenticate()`),
+  then retry.
+
+```ts
+import { Alert } from "react-native";
+import { deleteMyAccount } from "@marktiderman/genesis-supabase";
+
+<SettingsPage
+  sections={sections}
+  dangerousActions={[
+    {
+      label: "Delete account",
+      testID: "delete-account",
+      onPress: () =>
+        Alert.alert("Delete your account?", "This removes your account and its data for good. It can't be undone.", [
+          { text: "Cancel", style: "cancel" },
+          { text: "Delete", style: "destructive", onPress: () => void deleteMyAccount(supabase).catch(showError) },
+        ]),
+    },
+  ]}
+/>;
+```
+
+- **`deleteMyAccount(client)`**: calls the `delete_my_account` RPC through `must`, then signs this
+  device out (`scope: "local"`; the login's refresh tokens went with it). A refusal throws a
+  `SupabaseQueryError` and keeps the session. An access token already issued stays valid until it
+  expires.
+
+### Not covered yet
+
+- **Revoking Sign in with Apple tokens on deletion.** Apple requires an app that offers Sign in
+  with Apple to revoke the person's tokens through its REST API when they delete their account, and
+  App Review rejects apps that don't. Supabase doesn't do it, and the native id-token sign-in never
+  gives Supabase an Apple refresh token, so it takes a server step this package doesn't ship yet:
+  1. At sign-in, the app sends `result.authorizationCode` to an Edge Function. It is single-use and
+     valid for about five minutes.
+  2. The function exchanges it at `https://appleid.apple.com/auth/token`
+     (`grant_type=authorization_code`, with your client id and a client secret JWT signed with your
+     Sign in with Apple key) and stores the returned `refresh_token` against the user, somewhere
+     only the service role reads.
+  3. Before deletion, a function calls `https://appleid.apple.com/auth/revoke` with that refresh
+     token (`token_type_hint=refresh_token`), then calls `delete_my_account` (or the app does).
+
+## Release policy (the updates block)
+
+[`migrations/0002_genesis_app_release_policy.sql`](./migrations/0002_genesis_app_release_policy.sql)
+defines `public.app_release_policy`, one row per app: the oldest store version each platform may
+run (`min_version_ios`, `min_version_android`), store links, a maintenance switch with a message,
+and release notes (`notes`, an array of `{ version, title?, body }`). Copy it into your app's
+`supabase/migrations/` under a new timestamped name, and its pgTAP test
+(`migrations/tests/0002_genesis_app_release_policy.test.sql`) into `supabase/tests/database/`.
+
+- **Who can do what:** row level security is on; anon and authenticated may only `select` (the app
+  reads it before sign-in), and only the service role writes. Supabase's default privileges give
+  anon and authenticated everything on a new public table, so the migration revokes them by name
+  and grants back `select` alone.
+- **Malformed values stay out:** check constraints require plain dotted versions (`1.4.0`), https
+  (or `itms-apps://` / `market://`) store links, a store link beside each minimum version (the
+  force-upgrade screen's only way out), and notes that are objects with a string `version` and
+  `body` (and a string `title`, if any).
+- **Read it** with `supabasePolicySource(supabase)` from `@marktiderman/genesis-native/updates`,
+  which fails open: no row, a failed read or a malformed value never blocks anyone.
+
 ## Choices, and why
 
 - **Keychain chunks rather than encrypted AsyncStorage.** Supabase's Expo guide shows two options: an AES-encrypted value in AsyncStorage with the key in SecureStore ("LargeSecureStore"), or `expo-sqlite/localStorage`. `keychainStorage` keeps the whole session in the Keychain/Keystore instead, split into chunks under the item size limit, with an atomic switch between generations. That means one native dependency (`expo-secure-store`) rather than three, no key to manage, and a session that can't be read off the device's file system. If you prefer LargeSecureStore, pass it as `storage`; everything else here works the same.

package/dist/index.d.ts

@@ -74,5 +74,30 @@ declare function must<T>(result: {
     data: null;
     error: PostgrestErrorLike;
 }): T;
+/** The parts of a Supabase client {@link deleteMyAccount} uses. A `SupabaseClient` fits. */
+interface DeleteAccountClient {
+    rpc: (fn: any, ...rest: any[]) => PromiseLike<{
+        data: unknown;
+        error: PostgrestErrorLike | null;
+    }>;
+    auth: {
+        signOut(options?: {
+            scope?: "global" | "local" | "others";
+        }): Promise<unknown>;
+    };
+}
+/**
+ * In-app account deletion (App Store Review Guideline 5.1.1(v)), on web and
+ * native: calls the `delete_my_account` RPC (this package's
+ * `migrations/0001_genesis_account_deletion.sql`), which deletes the login
+ * and, through the app's `on delete cascade` foreign keys, its data; then
+ * clears the session on this device. Throws a {@link SupabaseQueryError} when
+ * the database refuses (`42501`: not signed in) and keeps the session then.
+ *
+ * Put it behind a confirmation; see the README.
+ *
+ * @stability Beta
+ */
+declare function deleteMyAccount(client: DeleteAccountClient): Promise<void>;
 
-export { type GenesisSupabaseOptions, type PostgrestErrorLike, type SessionStorage, SupabaseQueryError, createGenesisSupabase, must };
+export { type DeleteAccountClient, type GenesisSupabaseOptions, type PostgrestErrorLike, type SessionStorage, SupabaseQueryError, createGenesisSupabase, deleteMyAccount, must };

package/dist/index.js

@@ -38,7 +38,11 @@ function must(result) {
   if (result.error) throw new SupabaseQueryError(result.error);
   return result.data;
 }
+async function deleteMyAccount(client) {
+  must(await client.rpc("delete_my_account"));
+  await client.auth.signOut({ scope: "local" });
+}
 
-export { SupabaseQueryError, createGenesisSupabase, must };
+export { SupabaseQueryError, createGenesisSupabase, deleteMyAccount, must };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAwCO,SAAS,qBAAA,CAA0C;AAAA,EACxD,GAAA;AAAA,EACA,cAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA,GAAW,KAAA;AAAA,EACX,qBAAqB,QAAA,KAAa,KAAA;AAAA,EAClC,UAAU;AACZ,CAAA,EAAqD;AAGnD,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,GAAA,EAAK,cAAA,EAAgB;AAAA,IAC/C,GAAG,OAAA;AAAA,IACH,IAAA,EAAM;AAAA,MACJ,QAAA,EAAU,MAAA;AAAA,MACV,cAAA,EAAgB,IAAA;AAAA,MAChB,gBAAA,EAAkB,IAAA;AAAA,MAClB,kBAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY,EAAC;AAAA,MAC7B,GAAG,OAAA,CAAQ;AAAA;AACb,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAkBO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,IAAA,GAAO,oBAAA;AAAA,EACP,IAAA;AAAA,EACA,OAAA;AAAA,EACA,IAAA;AAAA,EACT,YAAY,KAAA,EAA2B;AACrC,IAAA,KAAA,CAAM,KAAA,CAAM,OAAA,EAAS,EAAE,KAAA,EAAO,OAAO,CAAA;AACrC,IAAA,IAAA,CAAK,OAAO,KAAA,CAAM,IAAA;AAClB,IAAA,IAAA,CAAK,UAAU,KAAA,CAAM,OAAA;AACrB,IAAA,IAAA,CAAK,OAAO,KAAA,CAAM,IAAA;AAAA,EACpB;AACF;AASO,SAAS,KAAQ,MAAA,EAAiF;AACvG,EAAA,IAAI,OAAO,KAAA,EAAO,MAAM,IAAI,kBAAA,CAAmB,OAAO,KAAK,CAAA;AAC3D,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB","file":"index.js","sourcesContent":["/**\n * Supabase for Genesis apps. Platform-neutral: web, React Native and the\n * server import it. Native-only helpers (Keychain storage, foreground\n * refresh, reinstall wipe) are on `@marktiderman/genesis-supabase/native`.\n */\nimport { createClient, type SupabaseClient, type SupabaseClientOptions } from \"@supabase/supabase-js\";\n\n/** The async key-value store Supabase auth keeps its session in. */\nexport interface SessionStorage {\n  getItem(key: string): Promise<string | null>;\n  setItem(key: string, value: string): Promise<void>;\n  removeItem(key: string): Promise<void>;\n}\n\n/** @stability Beta */\nexport interface GenesisSupabaseOptions {\n  url: string;\n  /** The publishable (anon) key. Never the secret key in an app. */\n  publishableKey: string;\n  /** Where the session lives. Native: `keychainStorage(SecureStore)`. Web: leave out for supabase-js's own default. */\n  storage?: SessionStorage;\n  /** `\"native\"` sets the React Native defaults (no session from the URL). Default `\"web\"`. */\n  platform?: \"web\" | \"native\";\n  /**\n   * Read a session from the URL after an OAuth redirect. Default: `true` on\n   * web, `false` on native, where the app hands the redirect URL to\n   * `exchangeCodeForSession` itself.\n   */\n  detectSessionInUrl?: boolean;\n  /** Anything else for supabase-js, merged last. */\n  options?: SupabaseClientOptions<\"public\">;\n}\n\n/**\n * A Supabase client with Genesis's defaults: PKCE sign-in (the code flow, not\n * tokens in a redirect URL), a persisted session that refreshes itself, and\n * the session storage you pass.\n *\n * @stability Beta\n */\nexport function createGenesisSupabase<Database = unknown>({\n  url,\n  publishableKey,\n  storage,\n  platform = \"web\",\n  detectSessionInUrl = platform === \"web\",\n  options = {},\n}: GenesisSupabaseOptions): SupabaseClient<Database> {\n  // supabase-js's generics over the schema don't survive being forwarded, so the\n  // options are built untyped and the client is typed by the caller's Database.\n  const client = createClient(url, publishableKey, {\n    ...options,\n    auth: {\n      flowType: \"pkce\",\n      persistSession: true,\n      autoRefreshToken: true,\n      detectSessionInUrl,\n      ...(storage ? { storage } : {}),\n      ...options.auth,\n    },\n  });\n  return client as unknown as SupabaseClient<Database>;\n}\n\n/** What a Supabase or PostgREST error carries. */\nexport interface PostgrestErrorLike {\n  message: string;\n  code?: string;\n  details?: string | null;\n  hint?: string | null;\n}\n\n/**\n * A failed query, with the database's `code` (`23505` unique violation,\n * `42501` permission denied, `PGRST116` no rows…), `details` and `hint`, so a\n * caller can tell an RLS refusal from a conflict. The original error is the\n * `cause`.\n *\n * @stability Beta\n */\nexport class SupabaseQueryError extends Error {\n  override name = \"SupabaseQueryError\";\n  readonly code?: string;\n  readonly details?: string | null;\n  readonly hint?: string | null;\n  constructor(error: PostgrestErrorLike) {\n    super(error.message, { cause: error });\n    this.code = error.code;\n    this.details = error.details;\n    this.hint = error.hint;\n  }\n}\n\n/**\n * The data, or a thrown {@link SupabaseQueryError}: for query results where an\n * error should fail the caller (a TanStack Query `queryFn`). The return type\n * keeps `null` when the query can return no row (`.maybeSingle()`).\n *\n * @stability Beta\n */\nexport function must<T>(result: { data: T; error: null } | { data: null; error: PostgrestErrorLike }): T {\n  if (result.error) throw new SupabaseQueryError(result.error);\n  return result.data as T;\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAwCO,SAAS,qBAAA,CAA0C;AAAA,EACxD,GAAA;AAAA,EACA,cAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA,GAAW,KAAA;AAAA,EACX,qBAAqB,QAAA,KAAa,KAAA;AAAA,EAClC,UAAU;AACZ,CAAA,EAAqD;AAGnD,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,GAAA,EAAK,cAAA,EAAgB;AAAA,IAC/C,GAAG,OAAA;AAAA,IACH,IAAA,EAAM;AAAA,MACJ,QAAA,EAAU,MAAA;AAAA,MACV,cAAA,EAAgB,IAAA;AAAA,MAChB,gBAAA,EAAkB,IAAA;AAAA,MAClB,kBAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY,EAAC;AAAA,MAC7B,GAAG,OAAA,CAAQ;AAAA;AACb,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAkBO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,IAAA,GAAO,oBAAA;AAAA,EACP,IAAA;AAAA,EACA,OAAA;AAAA,EACA,IAAA;AAAA,EACT,YAAY,KAAA,EAA2B;AACrC,IAAA,KAAA,CAAM,KAAA,CAAM,OAAA,EAAS,EAAE,KAAA,EAAO,OAAO,CAAA;AACrC,IAAA,IAAA,CAAK,OAAO,KAAA,CAAM,IAAA;AAClB,IAAA,IAAA,CAAK,UAAU,KAAA,CAAM,OAAA;AACrB,IAAA,IAAA,CAAK,OAAO,KAAA,CAAM,IAAA;AAAA,EACpB;AACF;AASO,SAAS,KAAQ,MAAA,EAAiF;AACvG,EAAA,IAAI,OAAO,KAAA,EAAO,MAAM,IAAI,kBAAA,CAAmB,OAAO,KAAK,CAAA;AAC3D,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAuBA,eAAsB,gBAAgB,MAAA,EAA4C;AAChF,EAAA,IAAA,CAAM,MAAM,MAAA,CAAO,GAAA,CAAI,mBAAmB,CAAgF,CAAA;AAE1H,EAAA,MAAM,OAAO,IAAA,CAAK,OAAA,CAAQ,EAAE,KAAA,EAAO,SAAS,CAAA;AAC9C","file":"index.js","sourcesContent":["/**\n * Supabase for Genesis apps. Platform-neutral: web, React Native and the\n * server import it. Native-only helpers (Keychain storage, foreground\n * refresh, reinstall wipe) are on `@marktiderman/genesis-supabase/native`.\n */\nimport { createClient, type SupabaseClient, type SupabaseClientOptions } from \"@supabase/supabase-js\";\n\n/** The async key-value store Supabase auth keeps its session in. */\nexport interface SessionStorage {\n  getItem(key: string): Promise<string | null>;\n  setItem(key: string, value: string): Promise<void>;\n  removeItem(key: string): Promise<void>;\n}\n\n/** @stability Beta */\nexport interface GenesisSupabaseOptions {\n  url: string;\n  /** The publishable (anon) key. Never the secret key in an app. */\n  publishableKey: string;\n  /** Where the session lives. Native: `keychainStorage(SecureStore)`. Web: leave out for supabase-js's own default. */\n  storage?: SessionStorage;\n  /** `\"native\"` sets the React Native defaults (no session from the URL). Default `\"web\"`. */\n  platform?: \"web\" | \"native\";\n  /**\n   * Read a session from the URL after an OAuth redirect. Default: `true` on\n   * web, `false` on native, where the app hands the redirect URL to\n   * `exchangeCodeForSession` itself.\n   */\n  detectSessionInUrl?: boolean;\n  /** Anything else for supabase-js, merged last. */\n  options?: SupabaseClientOptions<\"public\">;\n}\n\n/**\n * A Supabase client with Genesis's defaults: PKCE sign-in (the code flow, not\n * tokens in a redirect URL), a persisted session that refreshes itself, and\n * the session storage you pass.\n *\n * @stability Beta\n */\nexport function createGenesisSupabase<Database = unknown>({\n  url,\n  publishableKey,\n  storage,\n  platform = \"web\",\n  detectSessionInUrl = platform === \"web\",\n  options = {},\n}: GenesisSupabaseOptions): SupabaseClient<Database> {\n  // supabase-js's generics over the schema don't survive being forwarded, so the\n  // options are built untyped and the client is typed by the caller's Database.\n  const client = createClient(url, publishableKey, {\n    ...options,\n    auth: {\n      flowType: \"pkce\",\n      persistSession: true,\n      autoRefreshToken: true,\n      detectSessionInUrl,\n      ...(storage ? { storage } : {}),\n      ...options.auth,\n    },\n  });\n  return client as unknown as SupabaseClient<Database>;\n}\n\n/** What a Supabase or PostgREST error carries. */\nexport interface PostgrestErrorLike {\n  message: string;\n  code?: string;\n  details?: string | null;\n  hint?: string | null;\n}\n\n/**\n * A failed query, with the database's `code` (`23505` unique violation,\n * `42501` permission denied, `PGRST116` no rows…), `details` and `hint`, so a\n * caller can tell an RLS refusal from a conflict. The original error is the\n * `cause`.\n *\n * @stability Beta\n */\nexport class SupabaseQueryError extends Error {\n  override name = \"SupabaseQueryError\";\n  readonly code?: string;\n  readonly details?: string | null;\n  readonly hint?: string | null;\n  constructor(error: PostgrestErrorLike) {\n    super(error.message, { cause: error });\n    this.code = error.code;\n    this.details = error.details;\n    this.hint = error.hint;\n  }\n}\n\n/**\n * The data, or a thrown {@link SupabaseQueryError}: for query results where an\n * error should fail the caller (a TanStack Query `queryFn`). The return type\n * keeps `null` when the query can return no row (`.maybeSingle()`).\n *\n * @stability Beta\n */\nexport function must<T>(result: { data: T; error: null } | { data: null; error: PostgrestErrorLike }): T {\n  if (result.error) throw new SupabaseQueryError(result.error);\n  return result.data as T;\n}\n\n/** The parts of a Supabase client {@link deleteMyAccount} uses. A `SupabaseClient` fits. */\nexport interface DeleteAccountClient {\n  // Loose on purpose: a client typed by an app's Database narrows `rpc`'s\n  // function names, and the app's generated types may not list this one yet.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  rpc: (fn: any, ...rest: any[]) => PromiseLike<{ data: unknown; error: PostgrestErrorLike | null }>;\n  auth: { signOut(options?: { scope?: \"global\" | \"local\" | \"others\" }): Promise<unknown> };\n}\n\n/**\n * In-app account deletion (App Store Review Guideline 5.1.1(v)), on web and\n * native: calls the `delete_my_account` RPC (this package's\n * `migrations/0001_genesis_account_deletion.sql`), which deletes the login\n * and, through the app's `on delete cascade` foreign keys, its data; then\n * clears the session on this device. Throws a {@link SupabaseQueryError} when\n * the database refuses (`42501`: not signed in) and keeps the session then.\n *\n * Put it behind a confirmation; see the README.\n *\n * @stability Beta\n */\nexport async function deleteMyAccount(client: DeleteAccountClient): Promise<void> {\n  must((await client.rpc(\"delete_my_account\")) as { data: unknown; error: null } | { data: null; error: PostgrestErrorLike });\n  // The login is gone and its refresh tokens with it: only this device's copy is left to clear.\n  await client.auth.signOut({ scope: \"local\" });\n}\n"]}

package/dist/native.d.ts

@@ -1,10 +1,154 @@
 import { SessionStorage } from './index.js';
-import '@supabase/supabase-js';
+import { Session, SupabaseClient, User } from '@supabase/supabase-js';
+
+/**
+ * Native sign-in onto a Supabase session: finishing an OAuth redirect (PKCE)
+ * and Sign in with Apple. Nothing here imports Expo: pass the modules in.
+ * Exported from `@marktiderman/genesis-supabase/native`.
+ */
+
+/**
+ * Why a sign-in didn't produce a session. `code` is the provider's error
+ * (`access_denied`…), Supabase Auth's error code, or one of Genesis's own:
+ * `missing_code` (the redirect carried neither a code nor an error),
+ * `oauth_error`, `exchange_failed`, `apple_unavailable`, `apple_failed`,
+ * `apple_no_token`, `bad_digest`, `sign_in_failed`, `no_session`.
+ *
+ * @stability Beta
+ */
+declare class GenesisAuthError extends Error {
+    name: string;
+    readonly code: string;
+    /**
+     * The provider's own `error_description`, as it came in the redirect.
+     * UNTRUSTED: any app or web page can open your callback link with any text
+     * here, so never show it as an official message. Log it; show `message`.
+     */
+    readonly providerMessage?: string;
+    constructor(code: string, message: string, options?: {
+        cause?: unknown;
+        providerMessage?: string;
+    });
+}
+/** The parts of a Supabase client the sign-in helpers use. A `SupabaseClient` fits. */
+interface SignInClient {
+    auth: Pick<SupabaseClient["auth"], "exchangeCodeForSession" | "signInWithIdToken">;
+}
+/** @stability Beta */
+type OAuthRedirectResult = {
+    session: Session;
+    /** `"recovery"` after a password-reset link (send them to set a new password), otherwise `null`. */
+    redirectType: string | null;
+    error?: undefined;
+} | {
+    session?: undefined;
+    redirectType?: undefined;
+    error: GenesisAuthError;
+};
+/**
+ * The query and fragment parameters of a URL (the query wins for a key in
+ * both). Hand-parsed: React Native's `URL` has no reliable `searchParams`.
+ */
+declare function redirectParams(url: string): Record<string, string>;
+/**
+ * Finish an OAuth sign-in from the URL the browser came back to. With a `code`
+ * it exchanges it for a session (PKCE: the verifier is already in the client's
+ * storage), passing the redirect's `sb_flow_id` so the right flow's verifier
+ * is used; with an `error` it returns that error and makes no request.
+ * Nothing is thrown; every failure is `{ error }`.
+ *
+ * Pass only the URL `WebBrowser.openAuthSessionAsync` resolved with, for the
+ * sign-in this app just started. A code is single-use and the exchange uses
+ * up the stored verifier whatever happens, so a stray `?code=` from another
+ * link spends the sign-in in progress, and handling the same redirect twice
+ * (the auth-session result and a `Linking` listener) fails the second time.
+ * Handle each redirect once.
+ *
+ * The error `message` is fixed copy chosen by `code`; the redirect's own text
+ * is only in `providerMessage`, which is untrusted.
+ *
+ * @stability Beta
+ */
+declare function completeOAuthRedirect(client: SignInClient, url: string): Promise<OAuthRedirectResult>;
+/** A person's name as `expo-apple-authentication` returns it. */
+interface AppleFullNameLike {
+    givenName?: string | null;
+    middleName?: string | null;
+    familyName?: string | null;
+}
+/** The parts of `expo-apple-authentication` that {@link signInWithApple} uses. Pass the module itself. */
+interface AppleAuthenticationLike {
+    isAvailableAsync(): Promise<boolean>;
+    signInAsync(options: {
+        requestedScopes?: number[];
+        nonce?: string;
+    }): Promise<{
+        identityToken: string | null;
+        /** Single-use, valid about five minutes: what a server exchanges for the Apple refresh token it revokes on deletion. */
+        authorizationCode: string | null;
+        fullName: AppleFullNameLike | null;
+        email: string | null;
+    }>;
+    AppleAuthenticationScope: {
+        FULL_NAME: number;
+        EMAIL: number;
+    };
+}
+/** @stability Beta */
+interface SignInWithAppleOptions {
+    /**
+     * SHA-256 of a string as lowercase hex, e.g.
+     * `(s) => Crypto.digestStringAsync(Crypto.CryptoDigestAlgorithm.SHA256, s)` from `expo-crypto`.
+     * Apple gets the hash; Supabase gets the raw nonce and checks the token against it.
+     */
+    digest(value: string): Promise<string>;
+    /** A fresh random nonce. Default: 32 bytes from `crypto.getRandomValues`, as hex (pass one, e.g. `Crypto.randomUUID`, where that's missing). */
+    randomNonce?: () => string;
+}
+/** @stability Beta */
+type SignInWithAppleResult = {
+    session: Session;
+    user: User;
+    /** The name Apple shared. Apple sends it on the first sign-in only: save it then. */
+    fullName: string | null;
+    /** The email Apple shared (possibly a private relay address), on the first sign-in only. */
+    email: string | null;
+    /**
+     * Apple's single-use authorization code (valid about five minutes). Send it
+     * to your server straight away: it exchanges it for the Apple refresh token
+     * that account deletion must revoke. See the README.
+     */
+    authorizationCode: string | null;
+    canceled?: undefined;
+    error?: undefined;
+} | {
+    canceled: true;
+    session?: undefined;
+    error?: undefined;
+} | {
+    error: GenesisAuthError;
+    /** When Apple shared a name but Supabase then refused: Apple won't send it again, so keep it for the retry. */
+    fullName?: string | null;
+    session?: undefined;
+    canceled?: undefined;
+};
+/**
+ * Native Sign in with Apple straight into a Supabase session: checks the
+ * device supports it, asks for name and email with a SHA-256 hashed nonce, and
+ * signs in with the identity token. Closing Apple's sheet is `{ canceled: true }`,
+ * not an error. Nothing is thrown; every failure is `{ error }`.
+ *
+ * @stability Beta
+ */
+declare function signInWithApple(client: SignInClient, apple: AppleAuthenticationLike, { digest, randomNonce }: SignInWithAppleOptions): Promise<SignInWithAppleResult>;
+/** "Given Middle Family", or null when Apple shared no name. */
+declare function formatFullName(name: AppleFullNameLike | null | undefined): string | null;
 
 /**
  * React Native helpers for a Supabase session. Nothing here imports React
- * Native or Expo: pass in `expo-secure-store`, `AppState` and a plain store,
- * so the package stays light and the helpers are easy to test.
+ * Native or Expo: pass in `expo-secure-store`, `AppState`,
+ * `expo-apple-authentication` and a plain store, so the package stays light
+ * and the helpers are easy to test.
  */
 
 /** The parts of `expo-secure-store` the Keychain storage uses. */
@@ -81,4 +225,4 @@ declare function wipeSessionOnReinstall({ session, sessionKey, installMarker, ma
 /** Split text into pieces of at most `maxBytes` UTF-8 bytes, never inside a character. */
 declare function splitUtf8(text: string, maxBytes: number): string[];
 
-export { type AppStateLike, type AutoRefreshAuth, type KeychainStorageOptions, type SecureStoreLike, type WipeOnReinstallOptions, keychainStorage, refreshWhileActive, splitUtf8, wipeSessionOnReinstall };
+export { type AppStateLike, type AppleAuthenticationLike, type AppleFullNameLike, type AutoRefreshAuth, GenesisAuthError, type KeychainStorageOptions, type OAuthRedirectResult, type SecureStoreLike, type SignInClient, type SignInWithAppleOptions, type SignInWithAppleResult, type WipeOnReinstallOptions, completeOAuthRedirect, formatFullName, keychainStorage, redirectParams, refreshWhileActive, signInWithApple, splitUtf8, wipeSessionOnReinstall };

package/dist/native.js

@@ -1,3 +1,130 @@
+// src/sign-in.ts
+var GenesisAuthError = class extends Error {
+  name = "GenesisAuthError";
+  code;
+  /**
+   * The provider's own `error_description`, as it came in the redirect.
+   * UNTRUSTED: any app or web page can open your callback link with any text
+   * here, so never show it as an official message. Log it; show `message`.
+   */
+  providerMessage;
+  constructor(code, message, options = {}) {
+    super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
+    this.code = code;
+    if (options.providerMessage !== void 0) this.providerMessage = options.providerMessage;
+  }
+};
+var REDIRECT_MESSAGES = {
+  access_denied: "Sign-in was canceled or not allowed.",
+  otp_expired: "That sign-in link has expired. Ask for a new one.",
+  flow_state_expired: "That sign-in took too long. Try again.",
+  flow_state_not_found: "That sign-in has already been used or has expired. Try again.",
+  bad_oauth_state: "That sign-in couldn't be checked. Try again.",
+  bad_oauth_callback: "That sign-in couldn't be checked. Try again.",
+  provider_email_needs_verification: "Verify your email with the provider, then try again.",
+  server_error: "The sign-in service had a problem. Try again.",
+  temporarily_unavailable: "The sign-in service is busy. Try again in a moment."
+};
+var REDIRECT_FALLBACK = "Sign-in didn't complete. Try again.";
+var hasOwn = (o, key) => Object.prototype.hasOwnProperty.call(o, key);
+function redirectParams(url) {
+  const params = /* @__PURE__ */ Object.create(null);
+  const hash = url.indexOf("#");
+  const query = url.indexOf("?");
+  const parts = [
+    query >= 0 && (hash < 0 || query < hash) ? url.slice(query + 1, hash >= 0 ? hash : void 0) : "",
+    hash >= 0 ? url.slice(hash + 1) : ""
+  ];
+  for (const part of parts) {
+    for (const pair of part.split("&")) {
+      if (!pair) continue;
+      const eq = pair.indexOf("=");
+      const key = decode(eq >= 0 ? pair.slice(0, eq) : pair);
+      if (!hasOwn(params, key)) params[key] = decode(eq >= 0 ? pair.slice(eq + 1) : "");
+    }
+  }
+  return params;
+}
+function decode(s) {
+  try {
+    return decodeURIComponent(s.replace(/\+/g, " "));
+  } catch {
+    return s;
+  }
+}
+async function completeOAuthRedirect(client, url) {
+  const params = redirectParams(url);
+  if (params.error || params.error_description || params.error_code) {
+    const code = params.error_code || params.error || "oauth_error";
+    const message = REDIRECT_MESSAGES[code] ?? (params.error ? REDIRECT_MESSAGES[params.error] : void 0) ?? REDIRECT_FALLBACK;
+    return { error: new GenesisAuthError(code, message, { providerMessage: params.error_description || void 0 }) };
+  }
+  if (!params.code) return { error: new GenesisAuthError("missing_code", "The sign-in redirect carried no code") };
+  try {
+    const { data, error } = await client.auth.exchangeCodeForSession(
+      params.code,
+      params.sb_flow_id ? { flowId: params.sb_flow_id } : void 0
+    );
+    if (error) return { error: new GenesisAuthError(error.code ?? "exchange_failed", error.message, { cause: error }) };
+    if (!data.session) return { error: new GenesisAuthError("no_session", "The code exchange returned no session") };
+    const redirectType = data.redirectType ?? null;
+    return { session: data.session, redirectType };
+  } catch (e) {
+    return { error: new GenesisAuthError("exchange_failed", e instanceof Error ? e.message : "The code exchange failed", { cause: e }) };
+  }
+}
+async function signInWithApple(client, apple, { digest, randomNonce = defaultNonce }) {
+  const unavailable = (cause) => ({
+    error: new GenesisAuthError("apple_unavailable", "Sign in with Apple isn't available on this device", { cause })
+  });
+  try {
+    if (!await apple.isAvailableAsync()) return unavailable();
+  } catch (e) {
+    return unavailable(e);
+  }
+  let credential;
+  let nonce;
+  try {
+    nonce = randomNonce();
+    const hashed = await digest(nonce);
+    if (!/^[0-9a-f]{64}$/.test(hashed)) {
+      return { error: new GenesisAuthError("bad_digest", "signInWithApple: digest must return SHA-256 as 64 lowercase hex characters") };
+    }
+    credential = await apple.signInAsync({
+      requestedScopes: [apple.AppleAuthenticationScope.FULL_NAME, apple.AppleAuthenticationScope.EMAIL],
+      nonce: hashed
+    });
+  } catch (e) {
+    if (e?.code === "ERR_REQUEST_CANCELED") return { canceled: true };
+    return { error: new GenesisAuthError("apple_failed", e instanceof Error ? e.message : "Sign in with Apple failed", { cause: e }) };
+  }
+  const fullName = formatFullName(credential.fullName);
+  if (!credential.identityToken) return { error: new GenesisAuthError("apple_no_token", "Apple returned no identity token"), fullName };
+  try {
+    const { data, error } = await client.auth.signInWithIdToken({ provider: "apple", token: credential.identityToken, nonce });
+    if (error) return { error: new GenesisAuthError(error.code ?? "sign_in_failed", error.message, { cause: error }), fullName };
+    if (!data.session || !data.user) return { error: new GenesisAuthError("no_session", "Sign-in returned no session"), fullName };
+    return {
+      session: data.session,
+      user: data.user,
+      fullName,
+      email: credential.email ?? null,
+      authorizationCode: credential.authorizationCode ?? null
+    };
+  } catch (e) {
+    return { error: new GenesisAuthError("sign_in_failed", e instanceof Error ? e.message : "Sign-in failed", { cause: e }), fullName };
+  }
+}
+function formatFullName(name) {
+  if (!name) return null;
+  return [name.givenName, name.middleName, name.familyName].map((p) => p?.trim()).filter(Boolean).join(" ") || null;
+}
+function defaultNonce() {
+  const c = globalThis.crypto;
+  if (!c?.getRandomValues) throw new Error("[genesis] signInWithApple: no crypto.getRandomValues here; pass randomNonce (e.g. expo-crypto's randomUUID)");
+  return Array.from(c.getRandomValues(new Uint8Array(32)), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
 // src/native.ts
 function keychainStorage(secureStore, options = {}) {
   const size = options.chunkSize ?? 1800;
@@ -106,6 +233,6 @@ function parseFlowIndex(raw) {
   }
 }
 
-export { keychainStorage, refreshWhileActive, splitUtf8, wipeSessionOnReinstall };
+export { GenesisAuthError, completeOAuthRedirect, formatFullName, keychainStorage, redirectParams, refreshWhileActive, signInWithApple, splitUtf8, wipeSessionOnReinstall };
 //# sourceMappingURL=native.js.map
 //# sourceMappingURL=native.js.map

package/dist/native.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/native.ts"],"names":[],"mappings":";AAsCO,SAAS,eAAA,CAAgB,WAAA,EAA8B,OAAA,GAAkC,EAAC,EAAmB;AAClH,EAAA,MAAM,IAAA,GAAO,QAAQ,SAAA,IAAa,IAAA;AAClC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,kBAAA,KAAuB,WAAA,CAAY,kBAAA,KAAuB,MAAA,GAAY,EAAE,kBAAA,EAAoB,WAAA,CAAY,kBAAA,EAAmB,GAAI,EAAC,CAAA;AACrJ,EAAA,MAAM,QAAA,GAAW,CAAC,GAAA,EAAa,GAAA,EAAa,CAAA,KAAc,GAAG,GAAG,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA;AAC5E,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,MAAA,uBAAa,GAAA,EAA8B;AAGjD,EAAA,MAAM,MAAA,GAAS,CAAI,GAAA,EAAa,IAAA,KAAuC;AACrE,IAAA,MAAM,GAAA,GAAA,CAAO,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,OAAA,CAAQ,OAAA,EAAQ,EAAG,KAAA,CAAM,MAAM,MAAS,CAAA,CAAE,KAAK,IAAI,CAAA;AACnF,IAAA,MAAA,CAAO,GAAA,CAAI,KAAK,GAAG,CAAA;AACnB,IAAA,OAAO,GAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAA,KAAuB;AACpC,IAAA,MAAM,CAAC,GAAA,EAAK,KAAK,KAAK,GAAA,IAAO,EAAA,EAAI,MAAM,GAAG,CAAA;AAC1C,IAAA,OAAO,GAAA,IAAO,MAAA,CAAO,KAAK,CAAA,GAAI,CAAA,GAAI,EAAE,GAAA,EAAK,KAAA,EAAO,MAAA,CAAO,KAAK,CAAA,EAAE,GAAI,IAAA;AAAA,EACpE,CAAA;AACA,EAAA,MAAM,QAAA,GAAW,OAAO,GAAA,KAAgB,KAAA,CAAM,MAAM,WAAA,CAAY,YAAA,CAAa,CAAA,EAAG,GAAG,CAAA,EAAA,CAAA,EAAM,IAAI,CAAC,CAAA;AAC9F,EAAA,MAAM,OAAA,GAAU,OAAO,GAAA,KAAgB,KAAA,CAAM,MAAM,WAAA,CAAY,YAAA,CAAa,CAAA,EAAG,GAAG,CAAA,EAAA,CAAA,EAAM,IAAI,CAAC,CAAA;AAC7F,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,GAAA,EAAa,KAAA,KACtC,QAAQ,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,IAAS,CAAC,CAAA,EAAG,CAAA,KAAM,WAAA,CAAY,eAAA,CAAgB,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,CAAC,CAAA,EAAG,IAAI,CAAC,CAAC,CAAA;AAG/G,EAAA,MAAM,YAAA,GAAe,OAAO,GAAA,EAAa,OAAA,KAAgC;AACvE,IAAA,MAAM,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,IAAI,CAAA,CAAE,QAAQ,OAAA,EAAS,MAAM,KAAK,GAAA,EAAK,CAAA,CAAE,GAAA,EAAK,CAAA,CAAE,KAAK,CAAA;AACrD,IAAA,MAAM,WAAA,CAAY,eAAA,CAAgB,CAAA,EAAG,GAAG,MAAM,IAAI,CAAA;AAAA,EACpD,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,QAAQ,GAAA,EAAK;AAGX,MAAA,OAAO,MAAA,CAAO,KAAK,YAAY;AAC7B,QAAA,MAAM,CAAA,GAAI,MAAM,QAAA,CAAS,GAAG,CAAA;AAC5B,QAAA,IAAI,CAAC,GAAG,OAAO,IAAA;AACf,QAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAK,EAAE,MAAA,EAAQ,CAAA,CAAE,KAAA,EAAM,EAAG,CAAC,GAAG,CAAA,KAAM,WAAA,CAAY,YAAA,CAAa,QAAA,CAAS,GAAA,EAAK,CAAA,CAAE,KAAK,CAAC,CAAA,EAAG,IAAI,CAAC,CAAC,CAAA;AAClI,QAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,KAAM,IAAI,CAAA,GAAI,IAAA,GAAO,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA;AAAA,MAC7D,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IACA,OAAA,CAAQ,KAAK,KAAA,EAAO;AAClB,MAAA,OAAO,MAAA,CAAO,KAAK,YAAY;AAC7B,QAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,GAAG,CAAA;AACjC,QAAA,MAAM,YAAA,CAAa,GAAA,EAAK,MAAA,EAAQ,GAAG,CAAA;AACnC,QAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,GAAA,EAAI,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA,EAAA,CAAI,OAAA,EAAA,EAAW,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AACjE,QAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AACnC,QAAA,MAAM,WAAA,CAAY,YAAA,CAAa,CAAA,EAAG,GAAG,CAAA,EAAA,CAAA,EAAM,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,KAAA,CAAM,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA;AAGzE,QAAA,MAAM,UAAU,MAAM,OAAA,CAAQ,WAAW,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,EAAG,CAAA,KAAM,YAAY,YAAA,CAAa,QAAA,CAAS,KAAK,GAAA,EAAK,CAAC,GAAG,CAAA,EAAG,IAAI,CAAC,CAAC,CAAA;AACtH,QAAA,MAAM,SAAS,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAkC,CAAA,CAAE,WAAW,UAAU,CAAA;AACtF,QAAA,IAAI,MAAA,QAAc,MAAA,CAAO,MAAA;AACzB,QAAA,MAAM,WAAA,CAAY,YAAA,CAAa,CAAA,EAAG,GAAG,CAAA,EAAA,CAAA,EAAM,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,KAAA,CAAM,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA;AACzE,QAAA,MAAM,WAAA,CAAY,eAAA,CAAgB,CAAA,EAAG,GAAG,MAAM,IAAI,CAAA;AAClD,QAAA,IAAI,QAAQ,MAAM,IAAA,CAAK,KAAK,MAAA,CAAO,GAAA,EAAK,OAAO,KAAK,CAAA;AAAA,MACtD,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IACA,WAAW,GAAA,EAAK;AACd,MAAA,OAAO,MAAA,CAAO,KAAK,YAAY;AAC7B,QAAA,MAAM,CAAA,GAAI,MAAM,QAAA,CAAS,GAAG,CAAA;AAC5B,QAAA,MAAM,YAAA,CAAa,GAAA,EAAK,CAAA,EAAG,GAAG,CAAA;AAE9B,QAAA,IAAI,GAAG,MAAM,IAAA,CAAK,KAAK,CAAA,CAAE,GAAA,EAAK,EAAE,KAAK,CAAA;AACrC,QAAA,MAAM,WAAA,CAAY,eAAA,CAAgB,CAAA,EAAG,GAAG,MAAM,IAAI,CAAA;AAAA,MACpD,CAAC,CAAA;AAAA,IACH;AAAA,GACF;AACF;AAmBO,SAAS,kBAAA,CAAmB,QAAyB,QAAA,EAAoC;AAC9F,EAAA,MAAM,KAAA,GAAQ,CAAC,KAAA,KAAqC;AAClD,IAAA,IAAI,KAAA,KAAU,QAAA,EAAU,KAAK,MAAA,CAAO,KAAK,gBAAA,EAAiB;AAAA,SACrD,KAAK,MAAA,CAAO,IAAA,CAAK,eAAA,EAAgB;AAAA,EACxC,CAAA;AACA,EAAA,KAAA,CAAM,QAAA,CAAS,gBAAgB,QAAQ,CAAA;AACvC,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,gBAAA,CAAiB,QAAA,EAAU,KAAK,CAAA;AACrD,EAAA,OAAO,MAAM;AACX,IAAA,GAAA,CAAI,MAAA,EAAO;AACX,IAAA,KAAK,MAAA,CAAO,KAAK,eAAA,EAAgB;AAAA,EACnC,CAAA;AACF;AAsBA,eAAsB,uBAAuB,EAAE,OAAA,EAAS,YAAY,aAAA,EAAe,SAAA,GAAY,qBAAoB,EAA6C;AAC9J,EAAA,IAAK,MAAM,aAAA,CAAc,OAAA,CAAQ,SAAS,CAAA,KAAO,MAAM,OAAO,KAAA;AAI9D,EAAA,MAAM,QAAA,GAAW,GAAG,UAAU,CAAA,oBAAA,CAAA;AAC9B,EAAA,KAAA,MAAW,MAAA,IAAU,cAAA,CAAe,MAAM,OAAA,CAAQ,QAAQ,QAAQ,CAAC,CAAA,EAAG,MAAM,QAAQ,UAAA,CAAW,CAAA,EAAG,UAAU,CAAA,MAAA,EAAS,MAAM,CAAA,cAAA,CAAgB,CAAA;AAC3I,EAAA,KAAA,MAAW,GAAA,IAAO,CAAC,UAAA,EAAY,CAAA,EAAG,UAAU,CAAA,cAAA,CAAA,EAAkB,QAAA,EAAU,CAAA,EAAG,UAAU,CAAA,KAAA,CAAO,CAAA,EAAG,MAAM,OAAA,CAAQ,WAAW,GAAG,CAAA;AAC3H,EAAA,MAAM,aAAA,CAAc,OAAA,CAAQ,SAAA,EAAW,GAAG,CAAA;AAC1C,EAAA,OAAO,IAAA;AACT;AAGA,IAAM,UAAA,GAAa,CAAC,SAAA,KAAuB,SAAA,GAAY,GAAA,GAAO,CAAA,GAAI,SAAA,GAAY,IAAA,GAAQ,CAAA,GAAI,SAAA,GAAY,KAAA,GAAU,CAAA,GAAI,CAAA;AAG7G,SAAS,SAAA,CAAU,MAAc,QAAA,EAA4B;AAClE,EAAA,IAAI,IAAA,KAAS,EAAA,EAAI,OAAO,CAAC,EAAE,CAAA;AAC3B,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,MAAM,IAAA,EAAM;AACrB,IAAA,MAAM,CAAA,GAAI,UAAA,CAAW,EAAA,CAAG,WAAA,CAAY,CAAC,CAAE,CAAA;AACvC,IAAA,IAAI,KAAA,GAAQ,CAAA,GAAI,QAAA,IAAY,OAAA,EAAS;AACnC,MAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAClB,MAAA,OAAA,GAAU,EAAA;AACV,MAAA,KAAA,GAAQ,CAAA;AAAA,IACV;AACA,IAAA,OAAA,IAAW,EAAA;AACX,IAAA,KAAA,IAAS,CAAA;AAAA,EACX;AACA,EAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAClB,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,eAAe,GAAA,EAA8B;AACpD,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAe,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACnC,IAAA,OAAO,MAAM,OAAA,CAAQ,GAAG,CAAA,GAAI,GAAA,CAAI,OAAO,CAAC,EAAA,KAAqB,OAAO,EAAA,KAAO,YAAY,gBAAA,CAAiB,IAAA,CAAK,EAAE,CAAC,IAAI,EAAC;AAAA,EACvH,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF","file":"native.js","sourcesContent":["/**\n * React Native helpers for a Supabase session. Nothing here imports React\n * Native or Expo: pass in `expo-secure-store`, `AppState` and a plain store,\n * so the package stays light and the helpers are easy to test.\n */\nimport type { SessionStorage } from \"./index\";\n\n/** The parts of `expo-secure-store` the Keychain storage uses. */\nexport interface SecureStoreLike {\n  getItemAsync(key: string, options?: Record<string, unknown>): Promise<string | null>;\n  setItemAsync(key: string, value: string, options?: Record<string, unknown>): Promise<void>;\n  deleteItemAsync(key: string, options?: Record<string, unknown>): Promise<void>;\n  /** `SecureStore.AFTER_FIRST_UNLOCK`, when available. */\n  AFTER_FIRST_UNLOCK?: unknown;\n}\n\n/** @stability Beta */\nexport interface KeychainStorageOptions {\n  /** UTF-8 bytes per Keychain item. A Keychain item should stay under about 2 KB; a Supabase session is larger. Default 1800. */\n  chunkSize?: number;\n  /** Extra options for every SecureStore call. Default: readable after first unlock, so a background refresh works. */\n  secureStoreOptions?: Record<string, unknown>;\n}\n\n/**\n * Session storage in the Keychain (iOS) or Keystore (Android).\n *\n * A value is split into numbered chunks. Each write goes to a new generation of\n * chunks, and one manifest item (`<key>.n` = `generation:count`) switches to it\n * only once every chunk is written, so a write cut short leaves the previous\n * session whole. Chunks split between characters (never inside one) and\n * stay under `chunkSize` UTF-8 bytes. A pending marker (`<key>.p`) names a\n * generation while it is being written, so chunks left by a write that was\n * cut short or crashed are swept on the next write or remove. Writes to the\n * same key run one at a time, so two token refreshes can't interleave.\n *\n * @stability Beta\n */\nexport function keychainStorage(secureStore: SecureStoreLike, options: KeychainStorageOptions = {}): SessionStorage {\n  const size = options.chunkSize ?? 1800;\n  const opts = options.secureStoreOptions ?? (secureStore.AFTER_FIRST_UNLOCK !== undefined ? { keychainAccessible: secureStore.AFTER_FIRST_UNLOCK } : {});\n  const chunkKey = (key: string, gen: string, i: number) => `${key}.${gen}.${i}`;\n  let counter = 0;\n  const queues = new Map<string, Promise<unknown>>();\n\n  /** Run `task` after every earlier write to `key` has settled. */\n  const serial = <T>(key: string, task: () => Promise<T>): Promise<T> => {\n    const run = (queues.get(key) ?? Promise.resolve()).catch(() => undefined).then(task);\n    queues.set(key, run);\n    return run;\n  };\n\n  const parse = (raw: string | null) => {\n    const [gen, count] = (raw ?? \"\").split(\":\");\n    return gen && Number(count) > 0 ? { gen, count: Number(count) } : null;\n  };\n  const manifest = async (key: string) => parse(await secureStore.getItemAsync(`${key}.n`, opts));\n  const pending = async (key: string) => parse(await secureStore.getItemAsync(`${key}.p`, opts));\n  const drop = (key: string, gen: string, count: number) =>\n    Promise.all(Array.from({ length: count }, (_, i) => secureStore.deleteItemAsync(chunkKey(key, gen, i), opts)));\n\n  /** Remove chunks of a write that never completed (unless they are the current generation). */\n  const sweepPending = async (key: string, current: string | undefined) => {\n    const p = await pending(key);\n    if (!p) return;\n    if (p.gen !== current) await drop(key, p.gen, p.count);\n    await secureStore.deleteItemAsync(`${key}.p`, opts);\n  };\n\n  return {\n    getItem(key) {\n      // Reads queue with writes, so a write can't swap the manifest and drop\n      // the old chunks halfway through a read.\n      return serial(key, async () => {\n        const m = await manifest(key);\n        if (!m) return null;\n        const parts = await Promise.all(Array.from({ length: m.count }, (_, i) => secureStore.getItemAsync(chunkKey(key, m.gen, i), opts)));\n        return parts.some((p) => p === null) ? null : parts.join(\"\");\n      });\n    },\n    setItem(key, value) {\n      return serial(key, async () => {\n        const before = await manifest(key);\n        await sweepPending(key, before?.gen);\n        const gen = `${Date.now().toString(36)}${(counter++).toString(36)}`;\n        const parts = splitUtf8(value, size);\n        await secureStore.setItemAsync(`${key}.p`, `${gen}:${parts.length}`, opts);\n        // Let every chunk write settle before failing, so a late write can't land\n        // after the next operation has swept this generation.\n        const written = await Promise.allSettled(parts.map((p, i) => secureStore.setItemAsync(chunkKey(key, gen, i), p, opts)));\n        const failed = written.find((r): r is PromiseRejectedResult => r.status === \"rejected\");\n        if (failed) throw failed.reason;\n        await secureStore.setItemAsync(`${key}.n`, `${gen}:${parts.length}`, opts);\n        await secureStore.deleteItemAsync(`${key}.p`, opts);\n        if (before) await drop(key, before.gen, before.count);\n      });\n    },\n    removeItem(key) {\n      return serial(key, async () => {\n        const m = await manifest(key);\n        await sweepPending(key, m?.gen);\n        // Chunks first: the manifest is what finds them, so it goes last.\n        if (m) await drop(key, m.gen, m.count);\n        await secureStore.deleteItemAsync(`${key}.n`, opts);\n      });\n    },\n  };\n}\n\n/** The parts of a Supabase client's auth the refresh helper uses. */\nexport interface AutoRefreshAuth {\n  auth: { startAutoRefresh(): Promise<void> | void; stopAutoRefresh(): Promise<void> | void };\n}\n\n/** The parts of React Native's `AppState` the refresh helper uses. */\nexport interface AppStateLike {\n  currentState?: string | null;\n  addEventListener(type: \"change\", listener: (state: string) => void): { remove(): void };\n}\n\n/**\n * Refresh the session only while the app is in front, as Supabase recommends\n * for React Native. Returns the unsubscribe.\n *\n * @stability Beta\n */\nexport function refreshWhileActive(client: AutoRefreshAuth, appState: AppStateLike): () => void {\n  const apply = (state: string | null | undefined) => {\n    if (state === \"active\") void client.auth.startAutoRefresh();\n    else void client.auth.stopAutoRefresh();\n  };\n  apply(appState.currentState ?? \"active\");\n  const sub = appState.addEventListener(\"change\", apply);\n  return () => {\n    sub.remove();\n    void client.auth.stopAutoRefresh();\n  };\n}\n\n/** @stability Beta */\nexport interface WipeOnReinstallOptions {\n  /** The session storage (usually `keychainStorage`). */\n  session: SessionStorage;\n  /** The session's storage key. Supabase's default is `sb-<project ref>-auth-token`. */\n  sessionKey: string;\n  /** A store that an uninstall deletes, e.g. AsyncStorage. The Keychain survives an uninstall; this is how we notice one. */\n  installMarker: SessionStorage;\n  /** The marker's key. Default `genesis.installed`. */\n  markerKey?: string;\n}\n\n/**\n * On iOS the Keychain outlives an uninstall, so a reinstalled app would sign\n * the last person back in. Call this before creating the client: on the first\n * launch after an install it removes any session left in the Keychain, then\n * sets a marker so later launches keep the session. Returns whether it wiped.\n *\n * @stability Beta\n */\nexport async function wipeSessionOnReinstall({ session, sessionKey, installMarker, markerKey = \"genesis.installed\" }: WipeOnReinstallOptions): Promise<boolean> {\n  if ((await installMarker.getItem(markerKey)) !== null) return false;\n  // The session, plus what supabase-js keeps beside it: the PKCE verifier (the\n  // single legacy slot, each indexed flow's slot and the index) and, with\n  // userStorage, the user.\n  const indexKey = `${sessionKey}-flows-code-verifier`;\n  for (const flowId of parseFlowIndex(await session.getItem(indexKey))) await session.removeItem(`${sessionKey}-flow-${flowId}-code-verifier`);\n  for (const key of [sessionKey, `${sessionKey}-code-verifier`, indexKey, `${sessionKey}-user`]) await session.removeItem(key);\n  await installMarker.setItem(markerKey, \"1\");\n  return true;\n}\n\n/** UTF-8 byte length of one code point. */\nconst utf8Length = (codePoint: number) => (codePoint < 0x80 ? 1 : codePoint < 0x800 ? 2 : codePoint < 0x10000 ? 3 : 4);\n\n/** Split text into pieces of at most `maxBytes` UTF-8 bytes, never inside a character. */\nexport function splitUtf8(text: string, maxBytes: number): string[] {\n  if (text === \"\") return [\"\"];\n  const parts: string[] = [];\n  let current = \"\";\n  let bytes = 0;\n  for (const ch of text) {\n    const n = utf8Length(ch.codePointAt(0)!);\n    if (bytes + n > maxBytes && current) {\n      parts.push(current);\n      current = \"\";\n      bytes = 0;\n    }\n    current += ch;\n    bytes += n;\n  }\n  parts.push(current);\n  return parts;\n}\n\n/** supabase-js's PKCE flow index: a JSON array of flow ids. Anything else is ignored. */\nfunction parseFlowIndex(raw: string | null): string[] {\n  if (!raw) return [];\n  try {\n    const ids: unknown = JSON.parse(raw);\n    return Array.isArray(ids) ? ids.filter((id): id is string => typeof id === \"string\" && /^[\\w-]{1,128}$/.test(id)) : [];\n  } catch {\n    return [];\n  }\n}\n"]}
+{"version":3,"sources":["../src/sign-in.ts","../src/native.ts"],"names":[],"mappings":";AAgBO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EACjC,IAAA,GAAO,kBAAA;AAAA,EACP,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAA;AAAA,EACT,WAAA,CAAY,IAAA,EAAc,OAAA,EAAiB,OAAA,GAAyD,EAAC,EAAG;AACtG,IAAA,KAAA,CAAM,OAAA,EAAS,QAAQ,KAAA,KAAU,MAAA,GAAY,SAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAO,CAAA;AACjF,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAI,OAAA,CAAQ,eAAA,KAAoB,MAAA,EAAW,IAAA,CAAK,kBAAkB,OAAA,CAAQ,eAAA;AAAA,EAC5E;AACF;AAGA,IAAM,iBAAA,GAA4C;AAAA,EAChD,aAAA,EAAe,sCAAA;AAAA,EACf,WAAA,EAAa,mDAAA;AAAA,EACb,kBAAA,EAAoB,wCAAA;AAAA,EACpB,oBAAA,EAAsB,+DAAA;AAAA,EACtB,eAAA,EAAiB,8CAAA;AAAA,EACjB,kBAAA,EAAoB,8CAAA;AAAA,EACpB,iCAAA,EAAmC,sDAAA;AAAA,EACnC,YAAA,EAAc,+CAAA;AAAA,EACd,uBAAA,EAAyB;AAC3B,CAAA;AACA,IAAM,iBAAA,GAAoB,qCAAA;AAiB1B,IAAM,MAAA,GAAS,CAAC,CAAA,EAAW,GAAA,KAAgB,OAAO,SAAA,CAAU,cAAA,CAAe,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA;AAM/E,SAAS,eAAe,GAAA,EAAqC;AAClE,EAAA,MAAM,MAAA,mBAAiC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC5B,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC7B,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,KAAA,IAAS,CAAA,KAAM,IAAA,GAAO,CAAA,IAAK,QAAQ,IAAA,CAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,KAAA,GAAQ,CAAA,EAAG,IAAA,IAAQ,CAAA,GAAI,IAAA,GAAO,MAAS,CAAA,GAAI,EAAA;AAAA,IAChG,QAAQ,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,IAAA,GAAO,CAAC,CAAA,GAAI;AAAA,GACpC;AACA,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,EAAG;AAClC,MAAA,IAAI,CAAC,IAAA,EAAM;AACX,MAAA,MAAM,EAAA,GAAK,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC3B,MAAA,MAAM,GAAA,GAAM,OAAO,EAAA,IAAM,CAAA,GAAI,KAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,IAAI,CAAA;AACrD,MAAA,IAAI,CAAC,MAAA,CAAO,MAAA,EAAQ,GAAG,CAAA,SAAU,GAAG,CAAA,GAAG,MAAA,CAAO,EAAA,IAAM,IAAI,IAAA,CAAK,KAAA,CAAM,EAAA,GAAK,CAAC,IAAI,EAAE,CAAA;AAAA,IACjF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,OAAO,CAAA,EAAmB;AACjC,EAAA,IAAI;AACF,IAAA,OAAO,kBAAA,CAAmB,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAC,CAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA;AAAA,EACT;AACF;AAqBA,eAAsB,qBAAA,CAAsB,QAAsB,GAAA,EAA2C;AAC3G,EAAA,MAAM,MAAA,GAAS,eAAe,GAAG,CAAA;AACjC,EAAA,IAAI,MAAA,CAAO,KAAA,IAAS,MAAA,CAAO,iBAAA,IAAqB,OAAO,UAAA,EAAY;AACjE,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,UAAA,IAAc,MAAA,CAAO,KAAA,IAAS,aAAA;AAClD,IAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,IAAI,CAAA,KAAM,MAAA,CAAO,QAAQ,iBAAA,CAAkB,MAAA,CAAO,KAAK,CAAA,GAAI,MAAA,CAAA,IAAc,iBAAA;AAC3G,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,IAAA,EAAM,OAAA,EAAS,EAAE,eAAA,EAAiB,MAAA,CAAO,iBAAA,IAAqB,MAAA,EAAW,CAAA,EAAE;AAAA,EAClH;AACA,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,EAAM,OAAO,EAAE,OAAO,IAAI,gBAAA,CAAiB,cAAA,EAAgB,sCAAsC,CAAA,EAAE;AAC/G,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,CAAK,sBAAA;AAAA,MACxC,MAAA,CAAO,IAAA;AAAA,MACP,OAAO,UAAA,GAAa,EAAE,MAAA,EAAQ,MAAA,CAAO,YAAW,GAAI,KAAA;AAAA,KACtD;AACA,IAAA,IAAI,KAAA,EAAO,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,KAAA,CAAM,IAAA,IAAQ,iBAAA,EAAmB,MAAM,OAAA,EAAS,EAAE,KAAA,EAAO,KAAA,EAAO,CAAA,EAAE;AAClH,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,OAAO,EAAE,OAAO,IAAI,gBAAA,CAAiB,YAAA,EAAc,uCAAuC,CAAA,EAAE;AAE/G,IAAA,MAAM,YAAA,GAAgB,KAA0C,YAAA,IAAgB,IAAA;AAChF,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,YAAA,EAAa;AAAA,EAC/C,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,mBAAmB,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,0BAAA,EAA4B,EAAE,KAAA,EAAO,CAAA,EAAG,CAAA,EAAE;AAAA,EACrI;AACF;AAqEA,eAAsB,gBACpB,MAAA,EACA,KAAA,EACA,EAAE,MAAA,EAAQ,WAAA,GAAc,cAAa,EACL;AAChC,EAAA,MAAM,WAAA,GAAc,CAAC,KAAA,MAAqB;AAAA,IACxC,OAAO,IAAI,gBAAA,CAAiB,qBAAqB,mDAAA,EAAqD,EAAE,OAAO;AAAA,GACjH,CAAA;AACA,EAAA,IAAI;AACF,IAAA,IAAI,CAAE,MAAM,KAAA,CAAM,gBAAA,EAAiB,SAAW,WAAA,EAAY;AAAA,EAC5D,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,YAAY,CAAC,CAAA;AAAA,EACtB;AACA,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQ,WAAA,EAAY;AACpB,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,KAAK,CAAA;AACjC,IAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,MAAM,CAAA,EAAG;AAClC,MAAA,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,YAAA,EAAc,4EAA4E,CAAA,EAAE;AAAA,IACnI;AACA,IAAA,UAAA,GAAa,MAAM,MAAM,WAAA,CAAY;AAAA,MACnC,iBAAiB,CAAC,KAAA,CAAM,yBAAyB,SAAA,EAAW,KAAA,CAAM,yBAAyB,KAAK,CAAA;AAAA,MAChG,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH,SAAS,CAAA,EAAG;AACV,IAAA,IAAK,GAAiC,IAAA,KAAS,sBAAA,EAAwB,OAAO,EAAE,UAAU,IAAA,EAAK;AAC/F,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,gBAAgB,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,2BAAA,EAA6B,EAAE,KAAA,EAAO,CAAA,EAAG,CAAA,EAAE;AAAA,EACnI;AACA,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,UAAA,CAAW,QAAQ,CAAA;AACnD,EAAA,IAAI,CAAC,UAAA,CAAW,aAAA,EAAe,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,gBAAA,EAAkB,kCAAkC,CAAA,EAAG,QAAA,EAAS;AACpI,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,iBAAA,CAAkB,EAAE,UAAU,OAAA,EAAS,KAAA,EAAO,UAAA,CAAW,aAAA,EAAe,OAAO,CAAA;AACzH,IAAA,IAAI,OAAO,OAAO,EAAE,KAAA,EAAO,IAAI,iBAAiB,KAAA,CAAM,IAAA,IAAQ,gBAAA,EAAkB,KAAA,CAAM,SAAS,EAAE,KAAA,EAAO,KAAA,EAAO,GAAG,QAAA,EAAS;AAC3H,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,CAAC,KAAK,IAAA,EAAM,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,YAAA,EAAc,6BAA6B,GAAG,QAAA,EAAS;AAC7H,IAAA,OAAO;AAAA,MACL,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,QAAA;AAAA,MACA,KAAA,EAAO,WAAW,KAAA,IAAS,IAAA;AAAA,MAC3B,iBAAA,EAAmB,WAAW,iBAAA,IAAqB;AAAA,KACrD;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,kBAAkB,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,kBAAkB,EAAE,KAAA,EAAO,CAAA,EAAG,GAAG,QAAA,EAAS;AAAA,EACpI;AACF;AAGO,SAAS,eAAe,IAAA,EAA2D;AACxF,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,OAAO,CAAC,KAAK,SAAA,EAAW,IAAA,CAAK,YAAY,IAAA,CAAK,UAAU,EAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,IAAK,IAAA;AAC/G;AAEA,SAAS,YAAA,GAAuB;AAC9B,EAAA,MAAM,IAAK,UAAA,CAAgF,MAAA;AAC3F,EAAA,IAAI,CAAC,CAAA,EAAG,eAAA,EAAiB,MAAM,IAAI,MAAM,6GAA6G,CAAA;AACtJ,EAAA,OAAO,KAAA,CAAM,KAAK,CAAA,CAAE,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA,EAAG,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAC,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA;AAC1G;;;AC/MO,SAAS,eAAA,CAAgB,WAAA,EAA8B,OAAA,GAAkC,EAAC,EAAmB;AAClH,EAAA,MAAM,IAAA,GAAO,QAAQ,SAAA,IAAa,IAAA;AAClC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,kBAAA,KAAuB,WAAA,CAAY,kBAAA,KAAuB,MAAA,GAAY,EAAE,kBAAA,EAAoB,WAAA,CAAY,kBAAA,EAAmB,GAAI,EAAC,CAAA;AACrJ,EAAA,MAAM,QAAA,GAAW,CAAC,GAAA,EAAa,GAAA,EAAa,CAAA,KAAc,GAAG,GAAG,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA;AAC5E,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,MAAA,uBAAa,GAAA,EAA8B;AAGjD,EAAA,MAAM,MAAA,GAAS,CAAI,GAAA,EAAa,IAAA,KAAuC;AACrE,IAAA,MAAM,GAAA,GAAA,CAAO,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,OAAA,CAAQ,OAAA,EAAQ,EAAG,KAAA,CAAM,MAAM,MAAS,CAAA,CAAE,KAAK,IAAI,CAAA;AACnF,IAAA,MAAA,CAAO,GAAA,CAAI,KAAK,GAAG,CAAA;AACnB,IAAA,OAAO,GAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAA,KAAuB;AACpC,IAAA,MAAM,CAAC,GAAA,EAAK,KAAK,KAAK,GAAA,IAAO,EAAA,EAAI,MAAM,GAAG,CAAA;AAC1C,IAAA,OAAO,GAAA,IAAO,MAAA,CAAO,KAAK,CAAA,GAAI,CAAA,GAAI,EAAE,GAAA,EAAK,KAAA,EAAO,MAAA,CAAO,KAAK,CAAA,EAAE,GAAI,IAAA;AAAA,EACpE,CAAA;AACA,EAAA,MAAM,QAAA,GAAW,OAAO,GAAA,KAAgB,KAAA,CAAM,MAAM,WAAA,CAAY,YAAA,CAAa,CAAA,EAAG,GAAG,CAAA,EAAA,CAAA,EAAM,IAAI,CAAC,CAAA;AAC9F,EAAA,MAAM,OAAA,GAAU,OAAO,GAAA,KAAgB,KAAA,CAAM,MAAM,WAAA,CAAY,YAAA,CAAa,CAAA,EAAG,GAAG,CAAA,EAAA,CAAA,EAAM,IAAI,CAAC,CAAA;AAC7F,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,GAAA,EAAa,KAAA,KACtC,QAAQ,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,IAAS,CAAC,CAAA,EAAG,CAAA,KAAM,WAAA,CAAY,eAAA,CAAgB,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,CAAC,CAAA,EAAG,IAAI,CAAC,CAAC,CAAA;AAG/G,EAAA,MAAM,YAAA,GAAe,OAAO,GAAA,EAAa,OAAA,KAAgC;AACvE,IAAA,MAAM,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,IAAI,CAAA,CAAE,QAAQ,OAAA,EAAS,MAAM,KAAK,GAAA,EAAK,CAAA,CAAE,GAAA,EAAK,CAAA,CAAE,KAAK,CAAA;AACrD,IAAA,MAAM,WAAA,CAAY,eAAA,CAAgB,CAAA,EAAG,GAAG,MAAM,IAAI,CAAA;AAAA,EACpD,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,QAAQ,GAAA,EAAK;AAGX,MAAA,OAAO,MAAA,CAAO,KAAK,YAAY;AAC7B,QAAA,MAAM,CAAA,GAAI,MAAM,QAAA,CAAS,GAAG,CAAA;AAC5B,QAAA,IAAI,CAAC,GAAG,OAAO,IAAA;AACf,QAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAK,EAAE,MAAA,EAAQ,CAAA,CAAE,KAAA,EAAM,EAAG,CAAC,GAAG,CAAA,KAAM,WAAA,CAAY,YAAA,CAAa,QAAA,CAAS,GAAA,EAAK,CAAA,CAAE,KAAK,CAAC,CAAA,EAAG,IAAI,CAAC,CAAC,CAAA;AAClI,QAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,KAAM,IAAI,CAAA,GAAI,IAAA,GAAO,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA;AAAA,MAC7D,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IACA,OAAA,CAAQ,KAAK,KAAA,EAAO;AAClB,MAAA,OAAO,MAAA,CAAO,KAAK,YAAY;AAC7B,QAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,GAAG,CAAA;AACjC,QAAA,MAAM,YAAA,CAAa,GAAA,EAAK,MAAA,EAAQ,GAAG,CAAA;AACnC,QAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,GAAA,EAAI,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA,EAAA,CAAI,OAAA,EAAA,EAAW,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AACjE,QAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AACnC,QAAA,MAAM,WAAA,CAAY,YAAA,CAAa,CAAA,EAAG,GAAG,CAAA,EAAA,CAAA,EAAM,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,KAAA,CAAM,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA;AAGzE,QAAA,MAAM,UAAU,MAAM,OAAA,CAAQ,WAAW,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,EAAG,CAAA,KAAM,YAAY,YAAA,CAAa,QAAA,CAAS,KAAK,GAAA,EAAK,CAAC,GAAG,CAAA,EAAG,IAAI,CAAC,CAAC,CAAA;AACtH,QAAA,MAAM,SAAS,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAkC,CAAA,CAAE,WAAW,UAAU,CAAA;AACtF,QAAA,IAAI,MAAA,QAAc,MAAA,CAAO,MAAA;AACzB,QAAA,MAAM,WAAA,CAAY,YAAA,CAAa,CAAA,EAAG,GAAG,CAAA,EAAA,CAAA,EAAM,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,KAAA,CAAM,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA;AACzE,QAAA,MAAM,WAAA,CAAY,eAAA,CAAgB,CAAA,EAAG,GAAG,MAAM,IAAI,CAAA;AAClD,QAAA,IAAI,QAAQ,MAAM,IAAA,CAAK,KAAK,MAAA,CAAO,GAAA,EAAK,OAAO,KAAK,CAAA;AAAA,MACtD,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IACA,WAAW,GAAA,EAAK;AACd,MAAA,OAAO,MAAA,CAAO,KAAK,YAAY;AAC7B,QAAA,MAAM,CAAA,GAAI,MAAM,QAAA,CAAS,GAAG,CAAA;AAC5B,QAAA,MAAM,YAAA,CAAa,GAAA,EAAK,CAAA,EAAG,GAAG,CAAA;AAE9B,QAAA,IAAI,GAAG,MAAM,IAAA,CAAK,KAAK,CAAA,CAAE,GAAA,EAAK,EAAE,KAAK,CAAA;AACrC,QAAA,MAAM,WAAA,CAAY,eAAA,CAAgB,CAAA,EAAG,GAAG,MAAM,IAAI,CAAA;AAAA,MACpD,CAAC,CAAA;AAAA,IACH;AAAA,GACF;AACF;AAmBO,SAAS,kBAAA,CAAmB,QAAyB,QAAA,EAAoC;AAC9F,EAAA,MAAM,KAAA,GAAQ,CAAC,KAAA,KAAqC;AAClD,IAAA,IAAI,KAAA,KAAU,QAAA,EAAU,KAAK,MAAA,CAAO,KAAK,gBAAA,EAAiB;AAAA,SACrD,KAAK,MAAA,CAAO,IAAA,CAAK,eAAA,EAAgB;AAAA,EACxC,CAAA;AACA,EAAA,KAAA,CAAM,QAAA,CAAS,gBAAgB,QAAQ,CAAA;AACvC,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,gBAAA,CAAiB,QAAA,EAAU,KAAK,CAAA;AACrD,EAAA,OAAO,MAAM;AACX,IAAA,GAAA,CAAI,MAAA,EAAO;AACX,IAAA,KAAK,MAAA,CAAO,KAAK,eAAA,EAAgB;AAAA,EACnC,CAAA;AACF;AAsBA,eAAsB,uBAAuB,EAAE,OAAA,EAAS,YAAY,aAAA,EAAe,SAAA,GAAY,qBAAoB,EAA6C;AAC9J,EAAA,IAAK,MAAM,aAAA,CAAc,OAAA,CAAQ,SAAS,CAAA,KAAO,MAAM,OAAO,KAAA;AAI9D,EAAA,MAAM,QAAA,GAAW,GAAG,UAAU,CAAA,oBAAA,CAAA;AAC9B,EAAA,KAAA,MAAW,MAAA,IAAU,cAAA,CAAe,MAAM,OAAA,CAAQ,QAAQ,QAAQ,CAAC,CAAA,EAAG,MAAM,QAAQ,UAAA,CAAW,CAAA,EAAG,UAAU,CAAA,MAAA,EAAS,MAAM,CAAA,cAAA,CAAgB,CAAA;AAC3I,EAAA,KAAA,MAAW,GAAA,IAAO,CAAC,UAAA,EAAY,CAAA,EAAG,UAAU,CAAA,cAAA,CAAA,EAAkB,QAAA,EAAU,CAAA,EAAG,UAAU,CAAA,KAAA,CAAO,CAAA,EAAG,MAAM,OAAA,CAAQ,WAAW,GAAG,CAAA;AAC3H,EAAA,MAAM,aAAA,CAAc,OAAA,CAAQ,SAAA,EAAW,GAAG,CAAA;AAC1C,EAAA,OAAO,IAAA;AACT;AAGA,IAAM,UAAA,GAAa,CAAC,SAAA,KAAuB,SAAA,GAAY,GAAA,GAAO,CAAA,GAAI,SAAA,GAAY,IAAA,GAAQ,CAAA,GAAI,SAAA,GAAY,KAAA,GAAU,CAAA,GAAI,CAAA;AAG7G,SAAS,SAAA,CAAU,MAAc,QAAA,EAA4B;AAClE,EAAA,IAAI,IAAA,KAAS,EAAA,EAAI,OAAO,CAAC,EAAE,CAAA;AAC3B,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,MAAM,IAAA,EAAM;AACrB,IAAA,MAAM,CAAA,GAAI,UAAA,CAAW,EAAA,CAAG,WAAA,CAAY,CAAC,CAAE,CAAA;AACvC,IAAA,IAAI,KAAA,GAAQ,CAAA,GAAI,QAAA,IAAY,OAAA,EAAS;AACnC,MAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAClB,MAAA,OAAA,GAAU,EAAA;AACV,MAAA,KAAA,GAAQ,CAAA;AAAA,IACV;AACA,IAAA,OAAA,IAAW,EAAA;AACX,IAAA,KAAA,IAAS,CAAA;AAAA,EACX;AACA,EAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAClB,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,eAAe,GAAA,EAA8B;AACpD,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAe,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACnC,IAAA,OAAO,MAAM,OAAA,CAAQ,GAAG,CAAA,GAAI,GAAA,CAAI,OAAO,CAAC,EAAA,KAAqB,OAAO,EAAA,KAAO,YAAY,gBAAA,CAAiB,IAAA,CAAK,EAAE,CAAC,IAAI,EAAC;AAAA,EACvH,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF","file":"native.js","sourcesContent":["/**\n * Native sign-in onto a Supabase session: finishing an OAuth redirect (PKCE)\n * and Sign in with Apple. Nothing here imports Expo: pass the modules in.\n * Exported from `@marktiderman/genesis-supabase/native`.\n */\nimport type { Session, SupabaseClient, User } from \"@supabase/supabase-js\";\n\n/**\n * Why a sign-in didn't produce a session. `code` is the provider's error\n * (`access_denied`…), Supabase Auth's error code, or one of Genesis's own:\n * `missing_code` (the redirect carried neither a code nor an error),\n * `oauth_error`, `exchange_failed`, `apple_unavailable`, `apple_failed`,\n * `apple_no_token`, `bad_digest`, `sign_in_failed`, `no_session`.\n *\n * @stability Beta\n */\nexport class GenesisAuthError extends Error {\n  override name = \"GenesisAuthError\";\n  readonly code: string;\n  /**\n   * The provider's own `error_description`, as it came in the redirect.\n   * UNTRUSTED: any app or web page can open your callback link with any text\n   * here, so never show it as an official message. Log it; show `message`.\n   */\n  readonly providerMessage?: string;\n  constructor(code: string, message: string, options: { cause?: unknown; providerMessage?: string } = {}) {\n    super(message, options.cause === undefined ? undefined : { cause: options.cause });\n    this.code = code;\n    if (options.providerMessage !== undefined) this.providerMessage = options.providerMessage;\n  }\n}\n\n/** Fixed, safe copy for the redirect errors an app is likely to see; anything else gets the fallback. */\nconst REDIRECT_MESSAGES: Record<string, string> = {\n  access_denied: \"Sign-in was canceled or not allowed.\",\n  otp_expired: \"That sign-in link has expired. Ask for a new one.\",\n  flow_state_expired: \"That sign-in took too long. Try again.\",\n  flow_state_not_found: \"That sign-in has already been used or has expired. Try again.\",\n  bad_oauth_state: \"That sign-in couldn't be checked. Try again.\",\n  bad_oauth_callback: \"That sign-in couldn't be checked. Try again.\",\n  provider_email_needs_verification: \"Verify your email with the provider, then try again.\",\n  server_error: \"The sign-in service had a problem. Try again.\",\n  temporarily_unavailable: \"The sign-in service is busy. Try again in a moment.\",\n};\nconst REDIRECT_FALLBACK = \"Sign-in didn't complete. Try again.\";\n\n/** The parts of a Supabase client the sign-in helpers use. A `SupabaseClient` fits. */\nexport interface SignInClient {\n  auth: Pick<SupabaseClient[\"auth\"], \"exchangeCodeForSession\" | \"signInWithIdToken\">;\n}\n\n/** @stability Beta */\nexport type OAuthRedirectResult =\n  | {\n      session: Session;\n      /** `\"recovery\"` after a password-reset link (send them to set a new password), otherwise `null`. */\n      redirectType: string | null;\n      error?: undefined;\n    }\n  | { session?: undefined; redirectType?: undefined; error: GenesisAuthError };\n\nconst hasOwn = (o: object, key: string) => Object.prototype.hasOwnProperty.call(o, key);\n\n/**\n * The query and fragment parameters of a URL (the query wins for a key in\n * both). Hand-parsed: React Native's `URL` has no reliable `searchParams`.\n */\nexport function redirectParams(url: string): Record<string, string> {\n  const params: Record<string, string> = Object.create(null);\n  const hash = url.indexOf(\"#\");\n  const query = url.indexOf(\"?\");\n  const parts = [\n    query >= 0 && (hash < 0 || query < hash) ? url.slice(query + 1, hash >= 0 ? hash : undefined) : \"\",\n    hash >= 0 ? url.slice(hash + 1) : \"\",\n  ];\n  for (const part of parts) {\n    for (const pair of part.split(\"&\")) {\n      if (!pair) continue;\n      const eq = pair.indexOf(\"=\");\n      const key = decode(eq >= 0 ? pair.slice(0, eq) : pair);\n      if (!hasOwn(params, key)) params[key] =decode(eq >= 0 ? pair.slice(eq + 1) : \"\");\n    }\n  }\n  return params;\n}\n\nfunction decode(s: string): string {\n  try {\n    return decodeURIComponent(s.replace(/\\+/g, \" \"));\n  } catch {\n    return s;\n  }\n}\n\n/**\n * Finish an OAuth sign-in from the URL the browser came back to. With a `code`\n * it exchanges it for a session (PKCE: the verifier is already in the client's\n * storage), passing the redirect's `sb_flow_id` so the right flow's verifier\n * is used; with an `error` it returns that error and makes no request.\n * Nothing is thrown; every failure is `{ error }`.\n *\n * Pass only the URL `WebBrowser.openAuthSessionAsync` resolved with, for the\n * sign-in this app just started. A code is single-use and the exchange uses\n * up the stored verifier whatever happens, so a stray `?code=` from another\n * link spends the sign-in in progress, and handling the same redirect twice\n * (the auth-session result and a `Linking` listener) fails the second time.\n * Handle each redirect once.\n *\n * The error `message` is fixed copy chosen by `code`; the redirect's own text\n * is only in `providerMessage`, which is untrusted.\n *\n * @stability Beta\n */\nexport async function completeOAuthRedirect(client: SignInClient, url: string): Promise<OAuthRedirectResult> {\n  const params = redirectParams(url);\n  if (params.error || params.error_description || params.error_code) {\n    const code = params.error_code || params.error || \"oauth_error\";\n    const message = REDIRECT_MESSAGES[code] ?? (params.error ? REDIRECT_MESSAGES[params.error] : undefined) ?? REDIRECT_FALLBACK;\n    return { error: new GenesisAuthError(code, message, { providerMessage: params.error_description || undefined }) };\n  }\n  if (!params.code) return { error: new GenesisAuthError(\"missing_code\", \"The sign-in redirect carried no code\") };\n  try {\n    const { data, error } = await client.auth.exchangeCodeForSession(\n      params.code,\n      params.sb_flow_id ? { flowId: params.sb_flow_id } : undefined,\n    );\n    if (error) return { error: new GenesisAuthError(error.code ?? \"exchange_failed\", error.message, { cause: error }) };\n    if (!data.session) return { error: new GenesisAuthError(\"no_session\", \"The code exchange returned no session\") };\n    // supabase-js returns redirectType at run time without typing it.\n    const redirectType = (data as { redirectType?: string | null }).redirectType ?? null;\n    return { session: data.session, redirectType };\n  } catch (e) {\n    return { error: new GenesisAuthError(\"exchange_failed\", e instanceof Error ? e.message : \"The code exchange failed\", { cause: e }) };\n  }\n}\n\n/** A person's name as `expo-apple-authentication` returns it. */\nexport interface AppleFullNameLike {\n  givenName?: string | null;\n  middleName?: string | null;\n  familyName?: string | null;\n}\n\n/** The parts of `expo-apple-authentication` that {@link signInWithApple} uses. Pass the module itself. */\nexport interface AppleAuthenticationLike {\n  isAvailableAsync(): Promise<boolean>;\n  signInAsync(options: { requestedScopes?: number[]; nonce?: string }): Promise<{\n    identityToken: string | null;\n    /** Single-use, valid about five minutes: what a server exchanges for the Apple refresh token it revokes on deletion. */\n    authorizationCode: string | null;\n    fullName: AppleFullNameLike | null;\n    email: string | null;\n  }>;\n  AppleAuthenticationScope: { FULL_NAME: number; EMAIL: number };\n}\n\n/** @stability Beta */\nexport interface SignInWithAppleOptions {\n  /**\n   * SHA-256 of a string as lowercase hex, e.g.\n   * `(s) => Crypto.digestStringAsync(Crypto.CryptoDigestAlgorithm.SHA256, s)` from `expo-crypto`.\n   * Apple gets the hash; Supabase gets the raw nonce and checks the token against it.\n   */\n  digest(value: string): Promise<string>;\n  /** A fresh random nonce. Default: 32 bytes from `crypto.getRandomValues`, as hex (pass one, e.g. `Crypto.randomUUID`, where that's missing). */\n  randomNonce?: () => string;\n}\n\n/** @stability Beta */\nexport type SignInWithAppleResult =\n  | {\n      session: Session;\n      user: User;\n      /** The name Apple shared. Apple sends it on the first sign-in only: save it then. */\n      fullName: string | null;\n      /** The email Apple shared (possibly a private relay address), on the first sign-in only. */\n      email: string | null;\n      /**\n       * Apple's single-use authorization code (valid about five minutes). Send it\n       * to your server straight away: it exchanges it for the Apple refresh token\n       * that account deletion must revoke. See the README.\n       */\n      authorizationCode: string | null;\n      canceled?: undefined;\n      error?: undefined;\n    }\n  | { canceled: true; session?: undefined; error?: undefined }\n  | {\n      error: GenesisAuthError;\n      /** When Apple shared a name but Supabase then refused: Apple won't send it again, so keep it for the retry. */\n      fullName?: string | null;\n      session?: undefined;\n      canceled?: undefined;\n    };\n\n/**\n * Native Sign in with Apple straight into a Supabase session: checks the\n * device supports it, asks for name and email with a SHA-256 hashed nonce, and\n * signs in with the identity token. Closing Apple's sheet is `{ canceled: true }`,\n * not an error. Nothing is thrown; every failure is `{ error }`.\n *\n * @stability Beta\n */\nexport async function signInWithApple(\n  client: SignInClient,\n  apple: AppleAuthenticationLike,\n  { digest, randomNonce = defaultNonce }: SignInWithAppleOptions,\n): Promise<SignInWithAppleResult> {\n  const unavailable = (cause?: unknown) => ({\n    error: new GenesisAuthError(\"apple_unavailable\", \"Sign in with Apple isn't available on this device\", { cause }),\n  });\n  try {\n    if (!(await apple.isAvailableAsync())) return unavailable();\n  } catch (e) {\n    return unavailable(e);\n  }\n  let credential: Awaited<ReturnType<AppleAuthenticationLike[\"signInAsync\"]>>;\n  let nonce: string;\n  try {\n    nonce = randomNonce();\n    const hashed = await digest(nonce);\n    if (!/^[0-9a-f]{64}$/.test(hashed)) {\n      return { error: new GenesisAuthError(\"bad_digest\", \"signInWithApple: digest must return SHA-256 as 64 lowercase hex characters\") };\n    }\n    credential = await apple.signInAsync({\n      requestedScopes: [apple.AppleAuthenticationScope.FULL_NAME, apple.AppleAuthenticationScope.EMAIL],\n      nonce: hashed,\n    });\n  } catch (e) {\n    if ((e as { code?: unknown } | null)?.code === \"ERR_REQUEST_CANCELED\") return { canceled: true };\n    return { error: new GenesisAuthError(\"apple_failed\", e instanceof Error ? e.message : \"Sign in with Apple failed\", { cause: e }) };\n  }\n  const fullName = formatFullName(credential.fullName);\n  if (!credential.identityToken) return { error: new GenesisAuthError(\"apple_no_token\", \"Apple returned no identity token\"), fullName };\n  try {\n    const { data, error } = await client.auth.signInWithIdToken({ provider: \"apple\", token: credential.identityToken, nonce });\n    if (error) return { error: new GenesisAuthError(error.code ?? \"sign_in_failed\", error.message, { cause: error }), fullName };\n    if (!data.session || !data.user) return { error: new GenesisAuthError(\"no_session\", \"Sign-in returned no session\"), fullName };\n    return {\n      session: data.session,\n      user: data.user,\n      fullName,\n      email: credential.email ?? null,\n      authorizationCode: credential.authorizationCode ?? null,\n    };\n  } catch (e) {\n    return { error: new GenesisAuthError(\"sign_in_failed\", e instanceof Error ? e.message : \"Sign-in failed\", { cause: e }), fullName };\n  }\n}\n\n/** \"Given Middle Family\", or null when Apple shared no name. */\nexport function formatFullName(name: AppleFullNameLike | null | undefined): string | null {\n  if (!name) return null;\n  return [name.givenName, name.middleName, name.familyName].map((p) => p?.trim()).filter(Boolean).join(\" \") || null;\n}\n\nfunction defaultNonce(): string {\n  const c = (globalThis as { crypto?: { getRandomValues?: (a: Uint8Array) => Uint8Array } }).crypto;\n  if (!c?.getRandomValues) throw new Error(\"[genesis] signInWithApple: no crypto.getRandomValues here; pass randomNonce (e.g. expo-crypto's randomUUID)\");\n  return Array.from(c.getRandomValues(new Uint8Array(32)), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n","/**\n * React Native helpers for a Supabase session. Nothing here imports React\n * Native or Expo: pass in `expo-secure-store`, `AppState`,\n * `expo-apple-authentication` and a plain store, so the package stays light\n * and the helpers are easy to test.\n */\nimport type { SessionStorage } from \"./index\";\n\nexport {\n  GenesisAuthError,\n  completeOAuthRedirect,\n  formatFullName,\n  redirectParams,\n  signInWithApple,\n  type AppleAuthenticationLike,\n  type AppleFullNameLike,\n  type OAuthRedirectResult,\n  type SignInClient,\n  type SignInWithAppleOptions,\n  type SignInWithAppleResult,\n} from \"./sign-in\";\n\n/** The parts of `expo-secure-store` the Keychain storage uses. */\nexport interface SecureStoreLike {\n  getItemAsync(key: string, options?: Record<string, unknown>): Promise<string | null>;\n  setItemAsync(key: string, value: string, options?: Record<string, unknown>): Promise<void>;\n  deleteItemAsync(key: string, options?: Record<string, unknown>): Promise<void>;\n  /** `SecureStore.AFTER_FIRST_UNLOCK`, when available. */\n  AFTER_FIRST_UNLOCK?: unknown;\n}\n\n/** @stability Beta */\nexport interface KeychainStorageOptions {\n  /** UTF-8 bytes per Keychain item. A Keychain item should stay under about 2 KB; a Supabase session is larger. Default 1800. */\n  chunkSize?: number;\n  /** Extra options for every SecureStore call. Default: readable after first unlock, so a background refresh works. */\n  secureStoreOptions?: Record<string, unknown>;\n}\n\n/**\n * Session storage in the Keychain (iOS) or Keystore (Android).\n *\n * A value is split into numbered chunks. Each write goes to a new generation of\n * chunks, and one manifest item (`<key>.n` = `generation:count`) switches to it\n * only once every chunk is written, so a write cut short leaves the previous\n * session whole. Chunks split between characters (never inside one) and\n * stay under `chunkSize` UTF-8 bytes. A pending marker (`<key>.p`) names a\n * generation while it is being written, so chunks left by a write that was\n * cut short or crashed are swept on the next write or remove. Writes to the\n * same key run one at a time, so two token refreshes can't interleave.\n *\n * @stability Beta\n */\nexport function keychainStorage(secureStore: SecureStoreLike, options: KeychainStorageOptions = {}): SessionStorage {\n  const size = options.chunkSize ?? 1800;\n  const opts = options.secureStoreOptions ?? (secureStore.AFTER_FIRST_UNLOCK !== undefined ? { keychainAccessible: secureStore.AFTER_FIRST_UNLOCK } : {});\n  const chunkKey = (key: string, gen: string, i: number) => `${key}.${gen}.${i}`;\n  let counter = 0;\n  const queues = new Map<string, Promise<unknown>>();\n\n  /** Run `task` after every earlier write to `key` has settled. */\n  const serial = <T>(key: string, task: () => Promise<T>): Promise<T> => {\n    const run = (queues.get(key) ?? Promise.resolve()).catch(() => undefined).then(task);\n    queues.set(key, run);\n    return run;\n  };\n\n  const parse = (raw: string | null) => {\n    const [gen, count] = (raw ?? \"\").split(\":\");\n    return gen && Number(count) > 0 ? { gen, count: Number(count) } : null;\n  };\n  const manifest = async (key: string) => parse(await secureStore.getItemAsync(`${key}.n`, opts));\n  const pending = async (key: string) => parse(await secureStore.getItemAsync(`${key}.p`, opts));\n  const drop = (key: string, gen: string, count: number) =>\n    Promise.all(Array.from({ length: count }, (_, i) => secureStore.deleteItemAsync(chunkKey(key, gen, i), opts)));\n\n  /** Remove chunks of a write that never completed (unless they are the current generation). */\n  const sweepPending = async (key: string, current: string | undefined) => {\n    const p = await pending(key);\n    if (!p) return;\n    if (p.gen !== current) await drop(key, p.gen, p.count);\n    await secureStore.deleteItemAsync(`${key}.p`, opts);\n  };\n\n  return {\n    getItem(key) {\n      // Reads queue with writes, so a write can't swap the manifest and drop\n      // the old chunks halfway through a read.\n      return serial(key, async () => {\n        const m = await manifest(key);\n        if (!m) return null;\n        const parts = await Promise.all(Array.from({ length: m.count }, (_, i) => secureStore.getItemAsync(chunkKey(key, m.gen, i), opts)));\n        return parts.some((p) => p === null) ? null : parts.join(\"\");\n      });\n    },\n    setItem(key, value) {\n      return serial(key, async () => {\n        const before = await manifest(key);\n        await sweepPending(key, before?.gen);\n        const gen = `${Date.now().toString(36)}${(counter++).toString(36)}`;\n        const parts = splitUtf8(value, size);\n        await secureStore.setItemAsync(`${key}.p`, `${gen}:${parts.length}`, opts);\n        // Let every chunk write settle before failing, so a late write can't land\n        // after the next operation has swept this generation.\n        const written = await Promise.allSettled(parts.map((p, i) => secureStore.setItemAsync(chunkKey(key, gen, i), p, opts)));\n        const failed = written.find((r): r is PromiseRejectedResult => r.status === \"rejected\");\n        if (failed) throw failed.reason;\n        await secureStore.setItemAsync(`${key}.n`, `${gen}:${parts.length}`, opts);\n        await secureStore.deleteItemAsync(`${key}.p`, opts);\n        if (before) await drop(key, before.gen, before.count);\n      });\n    },\n    removeItem(key) {\n      return serial(key, async () => {\n        const m = await manifest(key);\n        await sweepPending(key, m?.gen);\n        // Chunks first: the manifest is what finds them, so it goes last.\n        if (m) await drop(key, m.gen, m.count);\n        await secureStore.deleteItemAsync(`${key}.n`, opts);\n      });\n    },\n  };\n}\n\n/** The parts of a Supabase client's auth the refresh helper uses. */\nexport interface AutoRefreshAuth {\n  auth: { startAutoRefresh(): Promise<void> | void; stopAutoRefresh(): Promise<void> | void };\n}\n\n/** The parts of React Native's `AppState` the refresh helper uses. */\nexport interface AppStateLike {\n  currentState?: string | null;\n  addEventListener(type: \"change\", listener: (state: string) => void): { remove(): void };\n}\n\n/**\n * Refresh the session only while the app is in front, as Supabase recommends\n * for React Native. Returns the unsubscribe.\n *\n * @stability Beta\n */\nexport function refreshWhileActive(client: AutoRefreshAuth, appState: AppStateLike): () => void {\n  const apply = (state: string | null | undefined) => {\n    if (state === \"active\") void client.auth.startAutoRefresh();\n    else void client.auth.stopAutoRefresh();\n  };\n  apply(appState.currentState ?? \"active\");\n  const sub = appState.addEventListener(\"change\", apply);\n  return () => {\n    sub.remove();\n    void client.auth.stopAutoRefresh();\n  };\n}\n\n/** @stability Beta */\nexport interface WipeOnReinstallOptions {\n  /** The session storage (usually `keychainStorage`). */\n  session: SessionStorage;\n  /** The session's storage key. Supabase's default is `sb-<project ref>-auth-token`. */\n  sessionKey: string;\n  /** A store that an uninstall deletes, e.g. AsyncStorage. The Keychain survives an uninstall; this is how we notice one. */\n  installMarker: SessionStorage;\n  /** The marker's key. Default `genesis.installed`. */\n  markerKey?: string;\n}\n\n/**\n * On iOS the Keychain outlives an uninstall, so a reinstalled app would sign\n * the last person back in. Call this before creating the client: on the first\n * launch after an install it removes any session left in the Keychain, then\n * sets a marker so later launches keep the session. Returns whether it wiped.\n *\n * @stability Beta\n */\nexport async function wipeSessionOnReinstall({ session, sessionKey, installMarker, markerKey = \"genesis.installed\" }: WipeOnReinstallOptions): Promise<boolean> {\n  if ((await installMarker.getItem(markerKey)) !== null) return false;\n  // The session, plus what supabase-js keeps beside it: the PKCE verifier (the\n  // single legacy slot, each indexed flow's slot and the index) and, with\n  // userStorage, the user.\n  const indexKey = `${sessionKey}-flows-code-verifier`;\n  for (const flowId of parseFlowIndex(await session.getItem(indexKey))) await session.removeItem(`${sessionKey}-flow-${flowId}-code-verifier`);\n  for (const key of [sessionKey, `${sessionKey}-code-verifier`, indexKey, `${sessionKey}-user`]) await session.removeItem(key);\n  await installMarker.setItem(markerKey, \"1\");\n  return true;\n}\n\n/** UTF-8 byte length of one code point. */\nconst utf8Length = (codePoint: number) => (codePoint < 0x80 ? 1 : codePoint < 0x800 ? 2 : codePoint < 0x10000 ? 3 : 4);\n\n/** Split text into pieces of at most `maxBytes` UTF-8 bytes, never inside a character. */\nexport function splitUtf8(text: string, maxBytes: number): string[] {\n  if (text === \"\") return [\"\"];\n  const parts: string[] = [];\n  let current = \"\";\n  let bytes = 0;\n  for (const ch of text) {\n    const n = utf8Length(ch.codePointAt(0)!);\n    if (bytes + n > maxBytes && current) {\n      parts.push(current);\n      current = \"\";\n      bytes = 0;\n    }\n    current += ch;\n    bytes += n;\n  }\n  parts.push(current);\n  return parts;\n}\n\n/** supabase-js's PKCE flow index: a JSON array of flow ids. Anything else is ignored. */\nfunction parseFlowIndex(raw: string | null): string[] {\n  if (!raw) return [];\n  try {\n    const ids: unknown = JSON.parse(raw);\n    return Array.isArray(ids) ? ids.filter((id): id is string => typeof id === \"string\" && /^[\\w-]{1,128}$/.test(id)) : [];\n  } catch {\n    return [];\n  }\n}\n"]}

package/migrations/0001_genesis_account_deletion.sql

@@ -0,0 +1,133 @@
+-- Genesis account deletion: public.delete_my_account()
+--
+-- App Store Review Guideline 5.1.1(v) requires an app that lets people make
+-- an account to let them delete it from inside the app. This function deletes
+-- the signed-in person's login; the client half is `deleteMyAccount(client)`
+-- in @marktiderman/genesis-supabase.
+--
+-- Use: copy this file into your app's `supabase/migrations/` under a new
+-- timestamped name (e.g. `20261024000000_genesis_account_deletion.sql`).
+-- Never edit it once applied; change it with a new migration.
+--
+-- What it refuses, by SQLSTATE (the client sees it as `SupabaseQueryError.code`):
+--   42501  nobody is signed in, or the person has a verified MFA factor and
+--          this session isn't aal2 (verify the second factor first)
+--   GA001  refused by the app's hook (below), e.g. the sole owner of something
+--   GA002  the app requires a recent sign-in and this one isn't (below)
+--   23503  a row still references the login (see "Your data")
+--
+-- Your data: deleting from auth.users removes rows whose foreign keys to
+-- auth.users(id) say `on delete cascade`, and fails (23503) on any that
+-- don't, so the person keeps their whole account rather than half of it. Give
+-- every user-owned table a foreign key to auth.users with `on delete cascade`
+-- (or `set null` for rows that must outlive the person): a table keyed on
+-- auth.uid() with no foreign key keeps orphans, and accepts new ones while an
+-- old access token is still valid (below).
+--
+-- Storage: Supabase documents that a user who owns objects in Storage can't
+-- be deleted, so this fails (23503) while they have files. Remove a person's
+-- files through the Storage API (not SQL) before calling it. (Documented by
+-- Supabase; not verified against a full stack in Genesis's own tests.)
+--
+-- Sign in with Apple: Apple requires apps to revoke the person's Apple tokens
+-- (https://appleid.apple.com/auth/revoke) when the account is deleted. That
+-- needs your Apple client secret, so it is a server step this file can't do;
+-- see the package README ("Not covered yet").
+--
+-- Sessions: the person's refresh tokens go with the login. An access token
+-- already issued stays valid until it expires (the JWT expiry, one hour by
+-- default); `deleteMyAccount` signs this device out straight after.
+--
+-- The app hook: if `private.genesis_before_account_delete(uuid)` exists, it
+-- runs first, in the same transaction, with this function's (the owner's)
+-- rights and the person's id. Use it to scrub data, set flags, or refuse. Any
+-- error it raises refuses the delete and nothing is deleted; it reaches the
+-- client as GA001 (or as the hook's own code when that starts with GA), e.g.
+--
+--   create function private.genesis_before_account_delete(person uuid) returns void
+--   language plpgsql set search_path = '' as $$
+--   begin
+--     if exists (select 1 from public.teams t where t.sole_owner = person) then
+--       raise exception 'Hand over your teams before deleting your account';
+--     end if;
+--     -- Optional: require a sign-in in the last 10 minutes (GA002 otherwise).
+--     perform private.genesis_require_recent_sign_in(interval '10 minutes');
+--   end $$;
+--   revoke execute on function private.genesis_before_account_delete(uuid) from public, anon, authenticated;
+--
+-- Verify: the pgTAP test beside this file (`tests/0001_genesis_account_deletion.test.sql`).
+
+create schema if not exists private;
+
+-- Raises GA002 unless the person authenticated (password, OTP, OAuth, MFA…)
+-- within `max_age`. Reads the newest `amr` timestamp in the JWT, which records
+-- when they actually signed in and survives token refreshes; falls back to
+-- `iat` (when this token was issued, which a refresh renews) without one.
+-- Not called by default: an app turns it on from its hook.
+create or replace function private.genesis_require_recent_sign_in(max_age interval)
+returns void
+language plpgsql
+stable
+set search_path = ''
+as $$
+declare
+  claims jsonb := coalesce(nullif(current_setting('request.jwt.claims', true), '')::jsonb, '{}'::jsonb);
+  signed_in bigint;
+begin
+  select max((m ->> 'timestamp')::bigint) into signed_in
+  from jsonb_array_elements(case when jsonb_typeof(claims -> 'amr') = 'array' then claims -> 'amr' else '[]'::jsonb end) m
+  where m ->> 'timestamp' ~ '^\d+$';
+  signed_in := coalesce(signed_in, nullif(claims ->> 'iat', '')::bigint);
+  if signed_in is null or to_timestamp(signed_in) < now() - max_age then
+    raise exception 'delete_my_account: sign in again to delete your account'
+      using errcode = 'GA002', hint = 'Ask the person to sign in again, then retry.';
+  end if;
+end;
+$$;
+
+create or replace function public.delete_my_account()
+returns void
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  me uuid := auth.uid();
+  claims jsonb := coalesce(nullif(current_setting('request.jwt.claims', true), '')::jsonb, '{}'::jsonb);
+begin
+  if me is null then
+    raise exception 'delete_my_account: not signed in' using errcode = '42501';
+  end if;
+
+  -- MFA step-up: with a verified second factor, only an aal2 session may delete.
+  if exists (select 1 from auth.mfa_factors f where f.user_id = me and f.status = 'verified')
+     and coalesce(claims ->> 'aal', '') <> 'aal2' then
+    raise exception 'delete_my_account: verify your second factor first'
+      using errcode = '42501', hint = 'Complete MFA (aal2), then retry.';
+  end if;
+
+  if to_regprocedure('private.genesis_before_account_delete(uuid)') is not null then
+    begin
+      perform private.genesis_before_account_delete(me);
+    exception when others then
+      if left(sqlstate, 2) = 'GA' then
+        raise;
+      end if;
+      raise exception '%', sqlerrm
+        using errcode = 'GA001', detail = format('Refused by private.genesis_before_account_delete (SQLSTATE %s).', sqlstate);
+    end;
+  end if;
+
+  delete from auth.users where id = me;
+end;
+$$;
+
+comment on function public.delete_my_account() is
+  'Deletes the signed-in person''s login (auth.users) and, through on delete cascade, their data. Genesis account block.';
+
+-- Privileges by name. Revoking here doesn't survive a later blanket grant
+-- (`grant execute on all functions in schema public to anon` hands this back
+-- to anon), so a blanket grant must exclude these functions.
+revoke execute on function public.delete_my_account() from public, anon;
+grant execute on function public.delete_my_account() to authenticated;
+revoke execute on function private.genesis_require_recent_sign_in(interval) from public, anon, authenticated;

package/migrations/0002_genesis_app_release_policy.sql

@@ -0,0 +1,82 @@
+-- Genesis app release policy: public.app_release_policy
+--
+-- What a native app reads at launch to decide whether this install must
+-- update from the store, whether the app is down for maintenance, and which
+-- release notes to show. The client half is `supabasePolicySource(client)` in
+-- @marktiderman/genesis-native/updates.
+--
+-- Use: copy this file into your app's `supabase/migrations/` under a new
+-- timestamped name (e.g. `20261024000000_genesis_app_release_policy.sql`).
+-- Never edit it once applied; change it with a new migration.
+--
+-- Access: anyone may read (anon included: the app reads it before sign-in);
+-- nobody but the service role (or a migration) may write. Edit the row from
+-- the SQL editor, a migration, or a server job with the secret key.
+--
+-- Failing open: the client never blocks on a missing row, a malformed value
+-- or a failed read. The checks below keep malformed values out in the first
+-- place: a minimum version is plain dotted numbers (`1`, `1.4`, `1.4.0`),
+-- store links are https (or the stores' own schemes), a minimum version
+-- comes with its platform's store link, and notes are an array of
+-- `{ "version": "1.4.0", "title"?: "...", "body": "..." }`.
+--
+-- One row per app (`app_id`, default 'default'). For example:
+--
+--   insert into public.app_release_policy (app_id, min_version_ios, store_url_ios)
+--   values ('default', '1.4.0', 'https://apps.apple.com/app/id0000000000')
+--   on conflict (app_id) do update set min_version_ios = excluded.min_version_ios,
+--     store_url_ios = excluded.store_url_ios, updated_at = now();
+--
+-- Maintenance: set `maintenance = true` (and a `maintenance_message`). The
+-- client honours it only from a live read, never from its cache, so a phone
+-- offline when maintenance ends is never stuck behind it.
+--
+-- Verify: the pgTAP test beside this file (`tests/0002_genesis_app_release_policy.test.sql`).
+
+create table if not exists public.app_release_policy (
+  app_id text primary key default 'default'
+    constraint app_release_policy_app_id_format check (app_id ~ '^[a-z0-9][a-z0-9._-]{0,63}$'),
+  min_version_ios text
+    constraint app_release_policy_min_version_ios_format check (min_version_ios ~ '^[0-9]{1,9}(\.[0-9]{1,9}){0,3}$'),
+  min_version_android text
+    constraint app_release_policy_min_version_android_format check (min_version_android ~ '^[0-9]{1,9}(\.[0-9]{1,9}){0,3}$'),
+  store_url_ios text
+    constraint app_release_policy_store_url_ios_format check (store_url_ios ~ '^(https|itms-apps)://'),
+  store_url_android text
+    constraint app_release_policy_store_url_android_format check (store_url_android ~ '^(https|market)://'),
+  maintenance boolean not null default false,
+  maintenance_message text
+    constraint app_release_policy_maintenance_message_length check (char_length(maintenance_message) <= 500),
+  -- An array of objects, each with a string version and body (and a string title, if any).
+  -- `strict` stops lax mode unwrapping nested arrays; `.type()` rejects arrays where strings belong.
+  notes jsonb not null default '[]'::jsonb
+    constraint app_release_policy_notes_shape check (
+      jsonb_typeof(notes) = 'array'
+      and not jsonb_path_exists(notes, 'strict $[*] ? (@.type() != "object")')
+      and not jsonb_path_exists(notes, '$[*] ? (!(@.version.type() == "string") || !(@.body.type() == "string") || (exists(@.title) && !(@.title.type() == "string")))')
+    ),
+  updated_at timestamptz not null default now(),
+  -- A minimum version needs a store link: the force-upgrade screen's only way out is the store.
+  -- (The client also forces nothing without one.)
+  constraint app_release_policy_ios_store_link check (min_version_ios is null or store_url_ios is not null),
+  constraint app_release_policy_android_store_link check (min_version_android is null or store_url_android is not null)
+);
+
+comment on table public.app_release_policy is
+  'Minimum store versions, maintenance switch and release notes for native apps. Readable by everyone, written only by the service role. Genesis updates block.';
+
+alter table public.app_release_policy enable row level security;
+
+-- Reading: everyone, every row. No insert, update or delete policy exists, so
+-- under RLS anon and authenticated can't write even if a later grant lets them try.
+drop policy if exists app_release_policy_read on public.app_release_policy;
+create policy app_release_policy_read on public.app_release_policy
+  for select to anon, authenticated
+  using (true);
+
+-- Privileges by name. Supabase's default privileges give anon and
+-- authenticated every privilege on a new public table; take them back and
+-- grant only select. The service role bypasses RLS and keeps write access.
+revoke all on table public.app_release_policy from public, anon, authenticated;
+grant select on table public.app_release_policy to anon, authenticated;
+grant select, insert, update, delete on table public.app_release_policy to service_role;

package/migrations/tests/0001_genesis_account_deletion.test.sql

@@ -0,0 +1,138 @@
+-- pgTAP test for 0001_genesis_account_deletion.sql.
+-- Copy into your app's `supabase/tests/database/` and run `supabase test db`.
+-- It reads only its own users and tables and rolls everything back. If your
+-- app already has `private.genesis_before_account_delete`, the hook cases
+-- replace it inside this transaction only.
+--
+-- Signing in: auth.uid() reads request.jwt.claims (and the legacy
+-- request.jwt.claim.sub on older images), so each case sets both, then
+-- switches to the authenticated role.
+begin;
+create extension if not exists pgtap with schema extensions;
+select plan(20);
+
+insert into auth.users (id, aud, role, email, instance_id)
+select ('00000000-0000-4000-8000-0000000000' || n)::uuid, 'authenticated', 'authenticated', 'genesis-delete-' || n || '@example.test', '00000000-0000-0000-0000-000000000000'
+from unnest(array['a1', 'b2', 'c3', 'd4', 'e5', 'f6', '07']) n;
+
+create function pg_temp.exists_user(n text) returns boolean language sql as $$
+  select exists (select 1 from auth.users where id = ('00000000-0000-4000-8000-0000000000' || n)::uuid)
+$$;
+
+-- Shape and privileges -------------------------------------------------------
+select ok(
+  (select prosecdef from pg_proc where oid = 'public.delete_my_account()'::regprocedure),
+  'delete_my_account is security definer'
+);
+select ok(
+  (select proconfig @> array['search_path=""'] from pg_proc where oid = 'public.delete_my_account()'::regprocedure),
+  'delete_my_account pins an empty search_path'
+);
+select is(
+  (select proowner::regrole::text from pg_proc where oid = 'public.delete_my_account()'::regprocedure),
+  'postgres',
+  'delete_my_account is owned by postgres, as hosted migrations run'
+);
+select ok(not has_function_privilege('anon', 'public.delete_my_account()', 'execute'), 'anon cannot execute it');
+select ok(
+  not exists (
+    select 1 from pg_proc p, aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) a
+    where p.oid = 'public.delete_my_account()'::regprocedure and a.grantee = 0 and a.privilege_type = 'EXECUTE'
+  ),
+  'public has no execute grant'
+);
+select ok(has_function_privilege('authenticated', 'public.delete_my_account()', 'execute'), 'authenticated can execute it');
+select ok(
+  not has_function_privilege('authenticated', 'private.genesis_require_recent_sign_in(interval)', 'execute'),
+  'authenticated cannot call the recent-sign-in helper directly'
+);
+
+-- Deletes only the caller ------------------------------------------------------
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000a1","role":"authenticated"}', true);
+select set_config('request.jwt.claim.sub', '00000000-0000-4000-8000-0000000000a1', true);
+set local role authenticated;
+select lives_ok($$ select public.delete_my_account() $$, 'a signed-in person deletes their account');
+reset role;
+select ok(not pg_temp.exists_user('a1') and pg_temp.exists_user('b2'), 'only the caller''s login is gone');
+
+select set_config('request.jwt.claims', '{"role":"authenticated"}', true);
+select set_config('request.jwt.claim.sub', '', true);
+set local role authenticated;
+select throws_ok($$ select public.delete_my_account() $$, '42501', null, 'a call with no signed-in person is refused');
+reset role;
+
+-- Foreign keys -------------------------------------------------------------------
+create table public.genesis_test_kept (person uuid references auth.users (id));
+create table public.genesis_test_cascaded (person uuid references auth.users (id) on delete cascade);
+insert into public.genesis_test_kept values ('00000000-0000-4000-8000-0000000000c3');
+insert into public.genesis_test_cascaded values ('00000000-0000-4000-8000-0000000000d4');
+
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000c3","role":"authenticated"}', true);
+select set_config('request.jwt.claim.sub', '00000000-0000-4000-8000-0000000000c3', true);
+set local role authenticated;
+select throws_ok($$ select public.delete_my_account() $$, '23503', null, 'a row without on delete cascade refuses the delete');
+reset role;
+select ok(pg_temp.exists_user('c3'), '... and the login is kept');
+
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000d4","role":"authenticated"}', true);
+select set_config('request.jwt.claim.sub', '00000000-0000-4000-8000-0000000000d4', true);
+set local role authenticated;
+select lives_ok($$ select public.delete_my_account() $$, 'a person with cascading rows deletes their account');
+reset role;
+select is((select count(*) from public.genesis_test_cascaded)::int, 0, '... and their cascading rows go with it');
+
+-- MFA step-up -------------------------------------------------------------------
+insert into auth.mfa_factors (id, user_id, friendly_name, factor_type, status, created_at, updated_at)
+values (gen_random_uuid(), '00000000-0000-4000-8000-0000000000e5', 'genesis-test', 'totp', 'verified', now(), now());
+
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000e5","role":"authenticated","aal":"aal1"}', true);
+select set_config('request.jwt.claim.sub', '00000000-0000-4000-8000-0000000000e5', true);
+set local role authenticated;
+select throws_ok($$ select public.delete_my_account() $$, '42501', null, 'an aal1 session cannot delete an account with a verified factor');
+reset role;
+
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000e5","role":"authenticated","aal":"aal2"}', true);
+set local role authenticated;
+select lives_ok($$ select public.delete_my_account() $$, 'an aal2 session can');
+reset role;
+
+-- The app hook -------------------------------------------------------------------
+create or replace function private.genesis_before_account_delete(person uuid) returns void
+language plpgsql set search_path = '' as $$
+begin
+  if person = '00000000-0000-4000-8000-0000000000f6' then
+    raise exception 'sole owner';
+  end if;
+  if person = '00000000-0000-4000-8000-000000000007' then
+    perform private.genesis_require_recent_sign_in(interval '10 minutes');
+  end if;
+end $$;
+
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000f6","role":"authenticated"}', true);
+select set_config('request.jwt.claim.sub', '00000000-0000-4000-8000-0000000000f6', true);
+set local role authenticated;
+select throws_ok($$ select public.delete_my_account() $$, 'GA001', 'sole owner', 'a hook that raises refuses the delete, as GA001');
+reset role;
+select ok(pg_temp.exists_user('f6'), '... and the login is kept');
+
+-- Recent sign-in, turned on from the hook: an hour-old sign-in is refused, a fresh one isn't.
+select set_config('request.jwt.claims', json_build_object(
+  'sub', '00000000-0000-4000-8000-000000000007', 'role', 'authenticated',
+  'iat', extract(epoch from now())::bigint,
+  'amr', json_build_array(json_build_object('method', 'password', 'timestamp', extract(epoch from now() - interval '1 hour')::bigint))
+)::text, true);
+select set_config('request.jwt.claim.sub', '00000000-0000-4000-8000-000000000007', true);
+set local role authenticated;
+select throws_ok($$ select public.delete_my_account() $$, 'GA002', null, 'a refreshed token from an old sign-in is refused when the app requires a recent one');
+reset role;
+
+select set_config('request.jwt.claims', json_build_object(
+  'sub', '00000000-0000-4000-8000-000000000007', 'role', 'authenticated',
+  'amr', json_build_array(json_build_object('method', 'password', 'timestamp', extract(epoch from now() - interval '1 minute')::bigint))
+)::text, true);
+set local role authenticated;
+select lives_ok($$ select public.delete_my_account() $$, 'a recent sign-in passes');
+reset role;
+
+select * from finish();
+rollback;

package/migrations/tests/0002_genesis_app_release_policy.test.sql

@@ -0,0 +1,148 @@
+-- @feat:app-updates
+-- pgTAP test for 0002_genesis_app_release_policy.sql.
+-- Copy into your app's `supabase/tests/database/` and run `supabase test db`.
+-- It writes only its own `genesis-test-*` rows and rolls everything back.
+begin;
+create extension if not exists pgtap with schema extensions;
+select plan(29);
+
+-- Shape -------------------------------------------------------------------------
+select has_table('public', 'app_release_policy', 'app_release_policy exists');
+select col_is_pk('public', 'app_release_policy', 'app_id', 'one row per app');
+select ok(
+  (select relrowsecurity from pg_class where oid = 'public.app_release_policy'::regclass),
+  'row level security is on'
+);
+select is(
+  (select array_agg(polname::text order by polname) from pg_policy where polrelid = 'public.app_release_policy'::regclass),
+  array['app_release_policy_read'],
+  'the only policy is the read policy'
+);
+select is(
+  (select polcmd::text from pg_policy where polrelid = 'public.app_release_policy'::regclass),
+  'r',
+  '... and it is for select'
+);
+
+-- Privileges ------------------------------------------------------------------------
+select ok(has_table_privilege('anon', 'public.app_release_policy', 'select'), 'anon can read');
+select ok(has_table_privilege('authenticated', 'public.app_release_policy', 'select'), 'authenticated can read');
+select ok(
+  not has_table_privilege('anon', 'public.app_release_policy', 'insert')
+  and not has_table_privilege('anon', 'public.app_release_policy', 'update')
+  and not has_table_privilege('anon', 'public.app_release_policy', 'delete')
+  and not has_table_privilege('anon', 'public.app_release_policy', 'truncate'),
+  'anon cannot write'
+);
+select ok(
+  not has_table_privilege('authenticated', 'public.app_release_policy', 'insert')
+  and not has_table_privilege('authenticated', 'public.app_release_policy', 'update')
+  and not has_table_privilege('authenticated', 'public.app_release_policy', 'delete')
+  and not has_table_privilege('authenticated', 'public.app_release_policy', 'truncate'),
+  'authenticated cannot write'
+);
+select ok(
+  not exists (
+    select 1 from pg_class c, aclexplode(coalesce(c.relacl, acldefault('r', c.relowner))) a
+    where c.oid = 'public.app_release_policy'::regclass and a.grantee = 0
+  ),
+  'public has no grant'
+);
+select ok(
+  has_table_privilege('service_role', 'public.app_release_policy', 'insert')
+  and has_table_privilege('service_role', 'public.app_release_policy', 'update')
+  and has_table_privilege('service_role', 'public.app_release_policy', 'delete'),
+  'the service role can write'
+);
+
+-- Writing and reading as each role ----------------------------------------------------------
+set local role service_role;
+select lives_ok(
+  $$ insert into public.app_release_policy (app_id, min_version_ios, min_version_android, store_url_ios, store_url_android, maintenance, maintenance_message, notes)
+     values ('genesis-test-a', '1.4.0', '1.4', 'https://apps.apple.com/app/id1', 'market://details?id=x', true, 'Back soon',
+             '[{"version": "1.4.0", "title": "Faster", "body": "Everything loads quicker."}]') $$,
+  'the service role writes a policy'
+);
+reset role;
+
+set local role anon;
+select is(
+  (select min_version_ios from public.app_release_policy where app_id = 'genesis-test-a'),
+  '1.4.0',
+  'anon reads it'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id) values ('genesis-test-b') $$,
+  '42501', null, 'anon cannot insert'
+);
+select throws_ok(
+  $$ update public.app_release_policy set maintenance = false where app_id = 'genesis-test-a' $$,
+  '42501', null, 'anon cannot update'
+);
+reset role;
+
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000a1","role":"authenticated"}', true);
+set local role authenticated;
+select is(
+  (select maintenance from public.app_release_policy where app_id = 'genesis-test-a'),
+  true,
+  'authenticated reads it'
+);
+select throws_ok(
+  $$ delete from public.app_release_policy where app_id = 'genesis-test-a' $$,
+  '42501', null, 'authenticated cannot delete'
+);
+select throws_ok(
+  $$ update public.app_release_policy set min_version_ios = '0' where app_id = 'genesis-test-a' $$,
+  '42501', null, 'authenticated cannot update'
+);
+reset role;
+
+-- Checks keep malformed values out (the client fails open on them anyway) -------------------
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, min_version_ios, store_url_ios) values ('genesis-test-c', '1.4-beta', 'https://apps.apple.com/app/id1') $$,
+  '23514', null, 'a minimum version must be plain dotted numbers'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, min_version_android, store_url_android) values ('genesis-test-c', '1.2.3.4.5', 'market://details?id=x') $$,
+  '23514', null, '... of at most four parts'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, store_url_ios) values ('genesis-test-c', 'javascript:alert(1)') $$,
+  '23514', null, 'a store link must be https or the store''s scheme'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, notes) values ('genesis-test-c', '{"version": "1.0"}') $$,
+  '23514', null, 'notes must be an array'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, notes) values ('genesis-test-c', '[{"version": 1, "body": "x"}]') $$,
+  '23514', null, 'each note needs a string version and body'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, notes) values ('genesis-test-c', '[{"version": "1.0"}]') $$,
+  '23514', null, '... a note without a body is refused'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, notes) values ('genesis-test-c', '[{"version": ["1.0"], "body": ["x", "y"]}]') $$,
+  '23514', null, '... arrays where strings belong are refused'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, notes) values ('genesis-test-c', '[[{"version": "1.0", "body": "x"}]]') $$,
+  '23514', null, '... a nested array is refused'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, notes) values ('genesis-test-c', '[{"version": "1.0", "body": "x", "title": 3}]') $$,
+  '23514', null, '... a title must be a string'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, min_version_android) values ('genesis-test-c', '2.0') $$,
+  '23514', null, 'a minimum version without its store link is refused (no way out of the screen)'
+);
+select lives_ok(
+  $$ insert into public.app_release_policy (app_id) values ('genesis-test-d') $$,
+  'a row with nothing set is valid: no minimum, no maintenance, no notes'
+);
+
+select * from finish();
+rollback;

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@marktiderman/genesis-supabase",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "private": false,
   "type": "module",
   "sideEffects": false,
-  "description": "Supabase for Genesis apps on web and React Native: a client with PKCE and safe defaults, Keychain session storage that survives interrupted writes, refresh only while the app is in front, and a result helper. Part of the Genesis framework.",
+  "description": "Supabase for Genesis apps on web and React Native: a client with PKCE and safe defaults, Keychain session storage that survives interrupted writes, refresh only while the app is in front, native Sign in with Apple and OAuth redirects, in-app account deletion, and a result helper. Part of the Genesis framework.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/marktiderman/genesis.git",
@@ -31,6 +31,7 @@
   },
   "files": [
     "dist",
+    "migrations",
     "README.md"
   ],
   "peerDependencies": {