@marktiderman/genesis-supabase 0.2.0 → 0.3.0

package/dist/chunk-FAA2FTF4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/web-crypto.ts"],"names":["error"],"mappings":";AAgCA,IAAM,QAAA,mBAAW,MAAA,CAAO,GAAA,CAAI,2BAA2B,CAAA;AAGvD,IAAM,gBAAA,GAAmB,KAAA;AAEzB,SAAS,cAAc,SAAA,EAAwC;AAC7D,EAAA,MAAM,IAAA,GAAO,OAAO,SAAA,KAAc,QAAA,GAAW,YAAa,SAAA,EAAyC,IAAA;AACnG,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,CAAK,aAAY,GAAI,EAAA;AACzD;AAEA,IAAM,cAAA,GAAiB,CAAC,WAAA,EAAa,YAAA,EAAc,mBAAA,EAAqB,cAAc,aAAA,EAAe,YAAA,EAAc,aAAA,EAAe,eAAA,EAAiB,gBAAgB,CAAA;AAEnK,SAAS,eAAe,KAAA,EAA0C;AAChE,EAAA,OAAO,WAAA,CAAY,MAAA,CAAO,KAAK,CAAA,IAAK,eAAe,QAAA,CAAS,MAAA,CAAO,SAAA,CAAU,QAAA,CAAS,KAAK,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAChH;AAEA,SAAS,SAAS,MAAA,EAAwC;AACxD,EAAA,OAAQ,MAAA,CAAmC,MAAA;AAC7C;AAQO,SAAS,aAAA,CAAc,SAAiB,UAAA,EAAqB;AAClE,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,MAAM,MAAA,GAAS,SAAS,MAAM,CAAA;AAC9B,EAAA,OACE,OAAO,MAAA,EAAQ,eAAA,KAAoB,UAAA,IACnC,OAAO,MAAA,EAAQ,MAAA,EAAQ,MAAA,KAAW,UAAA,IAClC,OAAO,CAAA,CAAE,WAAA,KAAgB,UAAA,IACzB,OAAO,EAAE,IAAA,KAAS,UAAA;AAEtB;AAcO,SAAS,gBAAA,CAAiB,UAAA,EAA4B,MAAA,GAAiB,UAAA,EAA6B;AACzG,EAAA,IAAI,OAAO,UAAA,EAAY,eAAA,KAAoB,cAAc,OAAO,UAAA,EAAY,WAAW,UAAA,EAAY;AACjG,IAAA,MAAM,IAAI,UAAU,uFAAuF,CAAA;AAAA,EAC7G;AACA,EAAA,MAAM,QAAA,GAAW,SAAS,MAAM,CAAA;AAChC,EAAA,MAAM,aAAa,QAAA,EAAU,eAAA;AAC7B,EAAA,MAAM,aAAa,QAAA,EAAU,MAAA;AAC7B,EAAA,IAAI,OAAO,UAAA,KAAe,UAAA,IAAc,OAAO,UAAA,EAAY,WAAW,UAAA,EAAY;AAChF,IAAA,OAAQ,QAAA,CAAqC,QAAQ,CAAA,GAAI,UAAA,GAAa,QAAA;AAAA,EACxE;AAEA,EAAA,MAAM,eAAA,GACJ,OAAO,UAAA,KAAe,UAAA,GAClB,WAAW,IAAA,CAAK,QAAQ,CAAA,GACxB,CAA4B,KAAA,KAAgB;AAC1C,IAAA,IAAI,CAAC,cAAA,CAAe,KAAK,GAAG,MAAM,IAAI,UAAU,yDAAyD,CAAA;AACzG,IAAA,IAAI,KAAA,CAAM,aAAa,gBAAA,EAAkB;AACvC,MAAA,MAAM,IAAI,UAAA,CAAW,CAAA,wBAAA,EAA2B,MAAM,UAAU,CAAA,mBAAA,EAAsB,gBAAgB,CAAA,YAAA,CAAc,CAAA;AAAA,IACtH;AAEA,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,KAAA,CAAM,QAAQ,KAAA,CAAM,UAAA,EAAY,MAAM,UAAU,CAAA;AAC7E,IAAA,MAAM,MAAA,GAAkB,UAAA,CAAW,eAAA,CAAgB,KAAK,CAAA;AACxD,IAAA,IAAI,WAAW,KAAA,EAAO;AACpB,MAAA,IAAI,EAAE,MAAA,YAAkB,UAAA,CAAA,IAAe,MAAA,CAAO,UAAA,KAAe,MAAM,UAAA,EAAY;AAC7E,QAAA,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAAA,MACjF;AACA,MAAA,KAAA,CAAM,IAAI,MAAM,CAAA;AAAA,IAClB;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAEN,EAAA,MAAM,MAAA,GAAS,OAAO,SAAA,EAAgC,IAAA,KAA6C;AACjG,IAAA,MAAM,IAAA,GAAO,cAAc,SAAS,CAAA;AACpC,IAAA,IAAI,IAAA,KAAS,SAAA,EAAW,MAAM,IAAI,KAAA,CAAM,yDAAyD,IAAA,IAAQ,MAAA,CAAO,SAAS,CAAC,CAAA,CAAA,CAAG,CAAA;AAC7H,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI,WAAA,CAAY,MAAA,CAAO,IAAI,CAAA,EAAG,KAAA,GAAQ,IAAI,UAAA,CAAW,IAAA,CAAK,MAAA,EAAQ,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,UAAU,CAAA;AAAA,SAAA,IACzF,IAAA,YAAgB,WAAA,EAAa,KAAA,GAAQ,IAAI,WAAW,IAAI,CAAA;AAAA,SAC5D,MAAM,IAAI,SAAA,CAAU,gEAAgE,CAAA;AAEzF,IAAA,OAAO,UAAA,CAAW,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,OAAO,CAAA;AAAA,EACnD,CAAA;AAEA,EAAA,MAAM,SAAS,OAAO,UAAA,EAAY,MAAA,KAAW,UAAA,GAAa,aAAa,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,cAAc,MAAA,CAAO,SAAS,CAAA,EAAa,EAAE,QAAQ,CAAA;AAExJ,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,YAAY,MAAA,CAAO,SAAS,CAAA,EAAa,EAAE,iBAAiB,MAAA,EAAQ,CAAC,QAAQ,GAAG,MAAM,CAAA;AACjI,EAAA,MAAA,CAAO,cAAA,CAAe,MAAA,EAAQ,QAAA,EAAU,EAAE,KAAA,EAAO,MAAA,EAAQ,YAAA,EAAc,IAAA,EAAM,UAAA,EAAY,KAAA,EAAO,QAAA,EAAU,IAAA,EAAM,CAAA;AAChH,EAAA,OAAO,UAAA;AACT;AAMO,SAAS,oBAAA,CAAqB,SAAiB,UAAA,EAAqB;AACzE,EAAA,MAAM,MAAA,GAAS,SAAS,MAAM,CAAA;AAC9B,EAAA,OAAO,OAAA,CAAQ,SAAS,QAAQ,CAAC,KAAK,OAAQ,MAAA,EAAQ,QAAgD,SAAA,KAAc,UAAA;AACtH;AASA,SAAS,UAAU,KAAA,EAAoH;AACrI,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,kBAAA,CAAmB,IAAA,CAAK,CAAC,CAAC,GAAG,OAAO,IAAA;AACjF,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAiB;AAC9B,IAAA,MAAM,SAAS,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,IAAI,KAAA,CAAM,KAAA,CAAA,CAAO,KAAK,MAAA,GAAS,CAAA,IAAK,CAAC,CAAC,CAAA;AACnG,IAAA,OAAO,UAAA,CAAW,KAAK,MAAA,EAAQ,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAC,CAAA;AAAA,EACvD,CAAA;AACA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,CAAC,IAAA,KAAiB,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAA,CAAM,IAAI,CAAC,CAAC,CAAA;AAC/E,IAAA,OAAO,EAAE,MAAA,EAAQ,IAAA,CAAK,MAAM,CAAC,CAAE,GAAG,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAE,CAAA,EAAG,SAAA,EAAW,MAAM,KAAA,CAAM,CAAC,CAAE,CAAA,EAAE;AAAA,EAC1F,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAUO,SAAS,eAAA,CAAgB,MAAwB,UAAA,EAAwC;AAC9F,EAAA,OAAO,OAAO,GAAA,EAAc,OAAA,GAAsC,EAAC,KAAM;AACvE,IAAA,IAAI,KAAA,GAAQ,GAAA;AACZ,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAAA,QAAM,GAAI,MAAM,KAAK,UAAA,EAAW;AAC9C,MAAA,IAAIA,MAAAA,IAAS,CAAC,IAAA,CAAK,OAAA,EAAS,OAAO,EAAE,IAAA,EAAM,IAAA,EAAM,KAAA,EAAOA,MAAAA,IAAS,IAAA,EAAK;AACtE,MAAA,KAAA,GAAQ,KAAK,OAAA,CAAQ,YAAA;AAAA,IACvB;AACA,IAAA,MAAM,OAAA,GAAU,UAAU,KAAK,CAAA;AAC/B,IAAA,IAAI,CAAC,SAAS,OAAO,EAAE,MAAM,IAAA,EAAM,KAAA,EAAO,UAAA,CAAW,uBAAuB,CAAA,EAAE;AAC9E,IAAA,IAAI,CAAC,QAAQ,YAAA,EAAc;AACzB,MAAA,MAAM,GAAA,GAAM,QAAQ,OAAA,CAAQ,GAAA;AAC5B,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,EAAE,MAAM,IAAA,EAAM,KAAA,EAAO,UAAA,CAAW,mBAAmB,CAAA,EAAE;AACzF,MAAA,IAAI,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,KAAI,GAAI,GAAI,CAAA,EAAG,OAAO,EAAE,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,CAAW,iBAAiB,CAAA,EAAE;AAAA,IACtG;AACA,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,QAAQ,KAAK,CAAA;AAC1C,IAAA,IAAI,KAAA,EAAO,OAAO,EAAE,IAAA,EAAM,MAAM,KAAA,EAAM;AACtC,IAAA,OAAO,EAAE,IAAA,EAAM,EAAE,MAAA,EAAQ,QAAQ,OAAA,EAAS,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,EAAG,OAAO,IAAA,EAAK;AAAA,EAChH,CAAA;AACF;AAIA,SAAS,KAAA,GAAiB;AACxB,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,EAAa,OAAO,QAAQ,OAAO,CAAA;AAC1D,EAAA,OAAO,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,CAAQ,KAAK,QAAA,KAAa,YAAA;AACrE;AAQO,SAAS,gBAAA,CAAiB,SAAiB,UAAA,EAAkB;AAClE,EAAA,IAAI,aAAA,CAAc,MAAM,CAAA,EAAG;AAC3B,EAAA,MAAM,OAAA,GACJ,wSAAA;AAEF,EAAA,IAAI,KAAA,EAAM,EAAG,MAAM,IAAI,MAAM,OAAO,CAAA;AACpC,EAAA,OAAA,CAAQ,MAAM,OAAO,CAAA;AACvB","file":"chunk-FAA2FTF4.js","sourcesContent":["/**\n * The two WebCrypto calls supabase-js's PKCE flow needs, for runtimes that\n * lack them (Hermes in React Native has no `crypto.subtle`).\n *\n * supabase-js makes the PKCE code verifier with `crypto.getRandomValues` and\n * the S256 code challenge with `crypto.subtle.digest(\"SHA-256\", …)`. When\n * `crypto.subtle` is missing it warns and sends the verifier itself as a\n * \"plain\" challenge; when `crypto` is missing altogether it also makes the\n * verifier with `Math.random`. Either way an intercepted redirect is enough to\n * finish someone else's sign-in. This installs both calls on `globalThis.crypto`\n * from `expo-crypto`, which hashes and draws random bytes natively.\n *\n * Platform-neutral: nothing here imports Expo. Pass the module in.\n */\n\n/** The parts of `expo-crypto` the polyfill uses: `import * as ExpoCrypto from \"expo-crypto\"`. */\nexport interface ExpoCryptoLike {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getRandomValues(typedArray: any): any;\n  /** `algorithm` is `CryptoDigestAlgorithm`, whose SHA-256 member is the string `\"SHA-256\"`. */\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  digest(algorithm: any, data: BufferSource): Promise<ArrayBuffer>;\n}\n\n/** What {@link installWebCrypto} found: real WebCrypto left alone, or the polyfill in place. */\nexport type WebCryptoSource = \"native\" | \"polyfill\";\n\ninterface CryptoLike {\n  getRandomValues?: (array: ArrayBufferView) => ArrayBufferView;\n  subtle?: { digest?: (algorithm: AlgorithmIdentifier, data: BufferSource) => Promise<ArrayBuffer> };\n}\n\nconst POLYFILL = Symbol.for(\"genesis.webCryptoPolyfill\");\n\n/** WebCrypto's quota for one `getRandomValues` call. */\nconst MAX_RANDOM_BYTES = 65536;\n\nfunction algorithmName(algorithm: AlgorithmIdentifier): string {\n  const name = typeof algorithm === \"string\" ? algorithm : (algorithm as { name?: unknown } | null)?.name;\n  return typeof name === \"string\" ? name.toUpperCase() : \"\";\n}\n\nconst INTEGER_ARRAYS = [\"Int8Array\", \"Uint8Array\", \"Uint8ClampedArray\", \"Int16Array\", \"Uint16Array\", \"Int32Array\", \"Uint32Array\", \"BigInt64Array\", \"BigUint64Array\"];\n\nfunction isIntegerArray(value: unknown): value is ArrayBufferView {\n  return ArrayBuffer.isView(value) && INTEGER_ARRAYS.includes(Object.prototype.toString.call(value).slice(8, -1));\n}\n\nfunction cryptoOf(target: object): CryptoLike | undefined {\n  return (target as { crypto?: CryptoLike }).crypto;\n}\n\n/**\n * True when `target` has everything supabase-js needs for an S256 PKCE\n * challenge made from secure random bytes.\n *\n * @stability Beta\n */\nexport function hasPkceCrypto(target: object = globalThis): boolean {\n  const g = target as { TextEncoder?: unknown; btoa?: unknown };\n  const crypto = cryptoOf(target);\n  return (\n    typeof crypto?.getRandomValues === \"function\" &&\n    typeof crypto?.subtle?.digest === \"function\" &&\n    typeof g.TextEncoder === \"function\" &&\n    typeof g.btoa === \"function\"\n  );\n}\n\n/**\n * Give `globalThis.crypto` a `getRandomValues` and a SHA-256\n * `subtle.digest`, backed by `expo-crypto`, when the runtime has none. Real\n * WebCrypto is never replaced: a `crypto` that has one of the two keeps it.\n * Only SHA-256 is offered: `subtle.digest` rejects any other algorithm, and no\n * other `subtle` method is added, so a library that needs more fails instead\n * of getting a stand-in. Safe to call more than once.\n *\n * `createGenesisSupabase({ platform: \"native\", crypto })` calls this for you.\n *\n * @stability Beta\n */\nexport function installWebCrypto(expoCrypto: ExpoCryptoLike, target: object = globalThis): WebCryptoSource {\n  if (typeof expoCrypto?.getRandomValues !== \"function\" || typeof expoCrypto?.digest !== \"function\") {\n    throw new TypeError('installWebCrypto needs expo-crypto: pass `import * as ExpoCrypto from \"expo-crypto\"`.');\n  }\n  const existing = cryptoOf(target);\n  const realRandom = existing?.getRandomValues;\n  const realSubtle = existing?.subtle;\n  if (typeof realRandom === \"function\" && typeof realSubtle?.digest === \"function\") {\n    return (existing as Record<symbol, unknown>)[POLYFILL] ? \"polyfill\" : \"native\";\n  }\n\n  const getRandomValues =\n    typeof realRandom === \"function\"\n      ? realRandom.bind(existing)\n      : <T extends ArrayBufferView>(array: T): T => {\n          if (!isIntegerArray(array)) throw new TypeError(\"crypto.getRandomValues: expected an integer TypedArray.\");\n          if (array.byteLength > MAX_RANDOM_BYTES) {\n            throw new RangeError(`crypto.getRandomValues: ${array.byteLength} bytes is over the ${MAX_RANDOM_BYTES}-byte quota.`);\n          }\n          // Through a byte view, so every element of any TypedArray gets random bits in every byte.\n          const bytes = new Uint8Array(array.buffer, array.byteOffset, array.byteLength);\n          const filled: unknown = expoCrypto.getRandomValues(bytes);\n          if (filled !== bytes) {\n            if (!(filled instanceof Uint8Array) || filled.byteLength !== bytes.byteLength) {\n              throw new Error(\"crypto.getRandomValues: expo-crypto returned no random bytes.\");\n            }\n            bytes.set(filled);\n          }\n          return array;\n        };\n\n  const digest = async (algorithm: AlgorithmIdentifier, data: BufferSource): Promise<ArrayBuffer> => {\n    const name = algorithmName(algorithm);\n    if (name !== \"SHA-256\") throw new Error(`crypto.subtle.digest: only SHA-256 is polyfilled, not ${name || String(algorithm)}.`);\n    let bytes: Uint8Array;\n    if (ArrayBuffer.isView(data)) bytes = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);\n    else if (data instanceof ArrayBuffer) bytes = new Uint8Array(data);\n    else throw new TypeError(\"crypto.subtle.digest: expected an ArrayBuffer or a TypedArray.\");\n    // A copy, so the hash reads these bytes even if the caller reuses its buffer.\n    return expoCrypto.digest(\"SHA-256\", bytes.slice());\n  };\n  // A runtime's own `subtle` (without digest) stays the prototype, so none of its methods are lost.\n  const subtle = typeof realSubtle?.digest === \"function\" ? realSubtle : Object.assign(Object.create(realSubtle ?? Object.prototype) as object, { digest });\n\n  const crypto = Object.assign(Object.create(existing ?? Object.prototype) as object, { getRandomValues, subtle, [POLYFILL]: true });\n  Object.defineProperty(target, \"crypto\", { value: crypto, configurable: true, enumerable: false, writable: true });\n  return \"polyfill\";\n}\n\n/**\n * True when `globalThis.crypto.subtle` is this polyfill's digest-only stand-in\n * (no `importKey` or `verify`), which supabase-js's `getClaims` can't use.\n */\nexport function isDigestOnlyPolyfill(target: object = globalThis): boolean {\n  const crypto = cryptoOf(target) as (CryptoLike & Record<symbol, unknown>) | undefined;\n  return Boolean(crypto?.[POLYFILL]) && typeof (crypto?.subtle as { importKey?: unknown } | undefined)?.importKey !== \"function\";\n}\n\n/** The parts of supabase-js's auth client that {@link claimsViaServer} uses. */\nexport interface ClaimsAuthClient {\n  getSession(): Promise<{ data: { session: { access_token: string } | null }; error: unknown }>;\n  getUser(jwt?: string): Promise<{ error: unknown }>;\n}\n\n/** A JWT's three parts, decoded (header and payload as JSON, the signature as bytes). */\nfunction decodeJwt(token: string): { header: Record<string, unknown>; payload: Record<string, unknown>; signature: Uint8Array } | null {\n  const parts = token.split(\".\");\n  if (parts.length !== 3 || parts.some((p) => !/^[A-Za-z0-9_-]*$/.test(p))) return null;\n  const bytes = (part: string) => {\n    const binary = atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"===\".slice((part.length + 3) % 4));\n    return Uint8Array.from(binary, (c) => c.charCodeAt(0));\n  };\n  try {\n    const json = (part: string) => JSON.parse(new TextDecoder().decode(bytes(part))) as Record<string, unknown>;\n    return { header: json(parts[0]!), payload: json(parts[1]!), signature: bytes(parts[2]!) };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * `auth.getClaims` for a runtime whose `crypto.subtle` is the digest-only\n * polyfill. supabase-js verifies an asymmetric JWT locally whenever\n * `crypto.subtle` exists, and would throw on the missing `importKey`; this\n * always takes supabase-js's own fallback instead: the server checks the\n * token (`getUser`), and the claims are returned only if it accepts it.\n * Same result shape as `getClaims`.\n */\nexport function claimsViaServer(auth: ClaimsAuthClient, invalidJwt: (message: string) => Error) {\n  return async (jwt?: string, options: { allowExpired?: boolean } = {}) => {\n    let token = jwt;\n    if (!token) {\n      const { data, error } = await auth.getSession();\n      if (error || !data.session) return { data: null, error: error ?? null };\n      token = data.session.access_token;\n    }\n    const decoded = decodeJwt(token);\n    if (!decoded) return { data: null, error: invalidJwt(\"Invalid JWT structure\") };\n    if (!options.allowExpired) {\n      const exp = decoded.payload.exp;\n      if (typeof exp !== \"number\") return { data: null, error: invalidJwt(\"Missing exp claim\") };\n      if (exp <= Math.floor(Date.now() / 1000)) return { data: null, error: invalidJwt(\"JWT has expired\") };\n    }\n    const { error } = await auth.getUser(token);\n    if (error) return { data: null, error };\n    return { data: { claims: decoded.payload, header: decoded.header, signature: decoded.signature }, error: null };\n  };\n}\n\ndeclare const __DEV__: boolean | undefined;\n\nfunction isDev(): boolean {\n  if (typeof __DEV__ !== \"undefined\") return Boolean(__DEV__);\n  return typeof process !== \"undefined\" && process.env?.NODE_ENV !== \"production\";\n}\n\n/**\n * Fail loudly when PKCE would fall back to \"plain\": throws in development,\n * logs an error in a release build (a crash at launch helps no one there).\n *\n * @stability Beta\n */\nexport function assertPkceCrypto(target: object = globalThis): void {\n  if (hasPkceCrypto(target)) return;\n  const message =\n    'Genesis Supabase: this runtime has no WebCrypto (crypto.getRandomValues and crypto.subtle.digest), so supabase-js would send PKCE challenges as \"plain\". ' +\n    'Pass expo-crypto: createGenesisSupabase({ platform: \"native\", crypto: ExpoCrypto, … }) with `import * as ExpoCrypto from \"expo-crypto\"`.';\n  if (isDev()) throw new Error(message);\n  console.error(message);\n}\n"]}

package/dist/chunk-T2HGFC4C.js

@@ -0,0 +1,37 @@
+import { defineBlock } from '@marktiderman/genesis-features/blocks';
+
+// src/blocks.ts
+var PACKAGE = "@marktiderman/genesis-supabase";
+var accountBlock = defineBlock({
+  id: "account",
+  platforms: ["web", "native"],
+  contributes: {
+    migrations: [
+      { package: PACKAGE, file: "migrations/0001_genesis_account_deletion.sql", test: "migrations/tests/0001_genesis_account_deletion.test.sql" },
+      // With Sign in with Apple, with the genesis-apple-revoke function beside it.
+      { package: PACKAGE, file: "migrations/0003_genesis_apple_token_revocation.sql", test: "migrations/tests/0003_genesis_apple_token_revocation.test.sql" }
+    ],
+    privacy: {
+      collects: [
+        { type: "email address", purposes: ["app functionality"], linked: true, tracking: false },
+        { type: "user id", purposes: ["app functionality"], linked: true, tracking: false },
+        { type: "name", purposes: ["app functionality"], linked: true, tracking: false }
+      ],
+      notes: [
+        "People delete their account from inside the app; their login and the rows that cascade from it go with it.",
+        "With Sign in with Apple, the person's Apple tokens are revoked when the account is deleted."
+      ]
+    }
+  }
+});
+var tenantFeaturesBlock = defineBlock({
+  id: "tenant-features",
+  contributes: {
+    migrations: [{ package: PACKAGE, file: "migrations/0004_genesis_tenant_features.sql", test: "migrations/tests/0004_genesis_tenant_features.test.sql" }],
+    privacy: { notes: ["Keeps who changed a tenant's switches; a deleted person's changes stay, without the person."] }
+  }
+});
+
+export { accountBlock, tenantFeaturesBlock };
+//# sourceMappingURL=chunk-T2HGFC4C.js.map
+//# sourceMappingURL=chunk-T2HGFC4C.js.map

package/dist/chunk-T2HGFC4C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/blocks.ts"],"names":[],"mappings":";;;AAQA,IAAM,OAAA,GAAU,gCAAA;AAST,IAAM,eAAe,WAAA,CAAY;AAAA,EACtC,EAAA,EAAI,SAAA;AAAA,EACJ,SAAA,EAAW,CAAC,KAAA,EAAO,QAAQ,CAAA;AAAA,EAC3B,WAAA,EAAa;AAAA,IACX,UAAA,EAAY;AAAA,MACV,EAAE,OAAA,EAAS,OAAA,EAAS,IAAA,EAAM,8CAAA,EAAgD,MAAM,yDAAA,EAA0D;AAAA;AAAA,MAE1I,EAAE,OAAA,EAAS,OAAA,EAAS,IAAA,EAAM,oDAAA,EAAsD,MAAM,+DAAA;AAAgE,KACxJ;AAAA,IACA,OAAA,EAAS;AAAA,MACP,QAAA,EAAU;AAAA,QACR,EAAE,IAAA,EAAM,eAAA,EAAiB,QAAA,EAAU,CAAC,mBAAmB,CAAA,EAAG,MAAA,EAAQ,IAAA,EAAM,QAAA,EAAU,KAAA,EAAM;AAAA,QACxF,EAAE,IAAA,EAAM,SAAA,EAAW,QAAA,EAAU,CAAC,mBAAmB,CAAA,EAAG,MAAA,EAAQ,IAAA,EAAM,QAAA,EAAU,KAAA,EAAM;AAAA,QAClF,EAAE,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAU,CAAC,mBAAmB,CAAA,EAAG,MAAA,EAAQ,IAAA,EAAM,QAAA,EAAU,KAAA;AAAM,OACjF;AAAA,MACA,KAAA,EAAO;AAAA,QACL,4GAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ,CAAC;AAQM,IAAM,sBAAsB,WAAA,CAAY;AAAA,EAC7C,EAAA,EAAI,iBAAA;AAAA,EACJ,WAAA,EAAa;AAAA,IACX,UAAA,EAAY,CAAC,EAAE,OAAA,EAAS,SAAS,IAAA,EAAM,6CAAA,EAA+C,IAAA,EAAM,wDAAA,EAA0D,CAAA;AAAA,IACtJ,OAAA,EAAS,EAAE,KAAA,EAAO,CAAC,6FAA6F,CAAA;AAAE;AAEtH,CAAC","file":"chunk-T2HGFC4C.js","sourcesContent":["/**\n * The blocks this package carries the server half of, as `defineBlock`\n * declarations: what each needs in the database, and what it means for the\n * stores' privacy forms. The functions themselves (`deleteMyAccount`,\n * `tenantFeatures`, …) don't change.\n */\nimport { defineBlock } from \"@marktiderman/genesis-features/blocks\";\n\nconst PACKAGE = \"@marktiderman/genesis-supabase\";\n\n/**\n * The account block: sign-in, profile and in-app account deletion. Its\n * screens are the app's (or genesis-ui-native's `AuthScreen`); this names its\n * migrations and its data.\n *\n * @stability Beta\n */\nexport const accountBlock = defineBlock({\n  id: \"account\",\n  platforms: [\"web\", \"native\"],\n  contributes: {\n    migrations: [\n      { package: PACKAGE, file: \"migrations/0001_genesis_account_deletion.sql\", test: \"migrations/tests/0001_genesis_account_deletion.test.sql\" },\n      // With Sign in with Apple, with the genesis-apple-revoke function beside it.\n      { package: PACKAGE, file: \"migrations/0003_genesis_apple_token_revocation.sql\", test: \"migrations/tests/0003_genesis_apple_token_revocation.test.sql\" },\n    ],\n    privacy: {\n      collects: [\n        { type: \"email address\", purposes: [\"app functionality\"], linked: true, tracking: false },\n        { type: \"user id\", purposes: [\"app functionality\"], linked: true, tracking: false },\n        { type: \"name\", purposes: [\"app functionality\"], linked: true, tracking: false },\n      ],\n      notes: [\n        \"People delete their account from inside the app; their login and the rows that cascade from it go with it.\",\n        \"With Sign in with Apple, the person's Apple tokens are revoked when the account is deleted.\",\n      ],\n    },\n  },\n});\n\n/**\n * The tenant features block: per-tenant on/off switches for shipped\n * features, set by the tenant's admins with a reason.\n *\n * @stability Beta\n */\nexport const tenantFeaturesBlock = defineBlock({\n  id: \"tenant-features\",\n  contributes: {\n    migrations: [{ package: PACKAGE, file: \"migrations/0004_genesis_tenant_features.sql\", test: \"migrations/tests/0004_genesis_tenant_features.test.sql\" }],\n    privacy: { notes: [\"Keeps who changed a tenant's switches; a deleted person's changes stay, without the person.\"] },\n  },\n});\n"]}

package/dist/index-BSGz3RGk.d.ts

@@ -0,0 +1,317 @@
+import { SupabaseClientOptions, SupabaseClient } from '@supabase/supabase-js';
+import './blocks.js';
+
+/**
+ * The app's side of Sign in with Apple token revocation: hand the sign-in's
+ * authorization code to the `genesis-apple-revoke` Edge Function (it keeps
+ * Apple's refresh token server-side), and ask it to revoke after the account
+ * is deleted. The function and its migration ship in this package; see the
+ * README ("Revoking Apple's tokens").
+ */
+/** The Edge Function's default name, as shipped in `functions/genesis-apple-revoke`. */
+declare const APPLE_REVOKE_FUNCTION = "genesis-apple-revoke";
+/** The parts of a Supabase client these helpers use. A `SupabaseClient` fits. */
+interface FunctionsClient {
+    functions: {
+        invoke: (name: string, options?: any) => PromiseLike<{
+            data: unknown;
+            error: unknown;
+        }>;
+    };
+}
+/** @stability Beta */
+interface StoreAppleTokenOptions {
+    /** `authorizationCode` from `signInWithApple`'s result. Single-use, valid for five minutes: send it straight after sign-in. */
+    authorizationCode: string;
+    /** The client id the code was issued for: your bundle id on iOS. Must be in the function's APPLE_CLIENT_IDS; default its first. */
+    clientId?: string;
+    /** The Edge Function's name. Default `genesis-apple-revoke`. */
+    functionName?: string;
+}
+/** @stability Beta */
+type StoreAppleTokenResult = {
+    ok: true;
+} | {
+    ok: false;
+    error: Error;
+};
+/**
+ * After a Sign in with Apple, sends the authorization code to the Edge
+ * Function, which exchanges it for Apple's refresh token and keeps it where
+ * only the server reads it, so deleting the account can revoke it. Call it
+ * with the session from that sign-in. Never throws: the person is signed in
+ * either way, so log a failure rather than showing it.
+ *
+ * @stability Beta
+ */
+declare function storeAppleToken(client: FunctionsClient, { authorizationCode, clientId, functionName }: StoreAppleTokenOptions): Promise<StoreAppleTokenResult>;
+/**
+ * Asks the Edge Function to revoke the tokens of deleted accounts now, rather
+ * than at its next scheduled run. Never throws and never fails the caller:
+ * the account is already gone and the queue keeps the token until a run
+ * succeeds.
+ */
+declare function requestAppleRevocation(client: FunctionsClient, functionName?: string): Promise<boolean>;
+
+/**
+ * The two WebCrypto calls supabase-js's PKCE flow needs, for runtimes that
+ * lack them (Hermes in React Native has no `crypto.subtle`).
+ *
+ * supabase-js makes the PKCE code verifier with `crypto.getRandomValues` and
+ * the S256 code challenge with `crypto.subtle.digest("SHA-256", …)`. When
+ * `crypto.subtle` is missing it warns and sends the verifier itself as a
+ * "plain" challenge; when `crypto` is missing altogether it also makes the
+ * verifier with `Math.random`. Either way an intercepted redirect is enough to
+ * finish someone else's sign-in. This installs both calls on `globalThis.crypto`
+ * from `expo-crypto`, which hashes and draws random bytes natively.
+ *
+ * Platform-neutral: nothing here imports Expo. Pass the module in.
+ */
+/** The parts of `expo-crypto` the polyfill uses: `import * as ExpoCrypto from "expo-crypto"`. */
+interface ExpoCryptoLike {
+    getRandomValues(typedArray: any): any;
+    /** `algorithm` is `CryptoDigestAlgorithm`, whose SHA-256 member is the string `"SHA-256"`. */
+    digest(algorithm: any, data: BufferSource): Promise<ArrayBuffer>;
+}
+/** What {@link installWebCrypto} found: real WebCrypto left alone, or the polyfill in place. */
+type WebCryptoSource = "native" | "polyfill";
+/**
+ * True when `target` has everything supabase-js needs for an S256 PKCE
+ * challenge made from secure random bytes.
+ *
+ * @stability Beta
+ */
+declare function hasPkceCrypto(target?: object): boolean;
+/**
+ * Give `globalThis.crypto` a `getRandomValues` and a SHA-256
+ * `subtle.digest`, backed by `expo-crypto`, when the runtime has none. Real
+ * WebCrypto is never replaced: a `crypto` that has one of the two keeps it.
+ * Only SHA-256 is offered: `subtle.digest` rejects any other algorithm, and no
+ * other `subtle` method is added, so a library that needs more fails instead
+ * of getting a stand-in. Safe to call more than once.
+ *
+ * `createGenesisSupabase({ platform: "native", crypto })` calls this for you.
+ *
+ * @stability Beta
+ */
+declare function installWebCrypto(expoCrypto: ExpoCryptoLike, target?: object): WebCryptoSource;
+/**
+ * True when `globalThis.crypto.subtle` is this polyfill's digest-only stand-in
+ * (no `importKey` or `verify`), which supabase-js's `getClaims` can't use.
+ */
+declare function isDigestOnlyPolyfill(target?: object): boolean;
+/**
+ * Fail loudly when PKCE would fall back to "plain": throws in development,
+ * logs an error in a release build (a crash at launch helps no one there).
+ *
+ * @stability Beta
+ */
+declare function assertPkceCrypto(target?: object): void;
+
+/**
+ * Tenant features: the client half of `migrations/0004_genesis_tenant_features.sql`.
+ * A tenant's admins turn a shipped feature off (or back on) for their tenant,
+ * with a reason; its members read which ids are off and hide them.
+ *
+ * Exposure only: a switch hides a feature, it never grants or denies access
+ * to data (that is RLS) and never sells it (that is an entitlement).
+ */
+
+/** The parts of a Supabase client these helpers use. A `SupabaseClient` fits. */
+interface TenantFeaturesClient {
+    rpc: (fn: any, ...rest: any[]) => PromiseLike<{
+        data: unknown;
+        error: PostgrestErrorLike | null;
+    }>;
+}
+/** Which features a tenant has turned off. A feature not in `off` is on. @stability Beta */
+interface TenantFeatures {
+    readonly tenantId: string;
+    readonly off: ReadonlySet<string>;
+    isOn(featureId: string): boolean;
+}
+/**
+ * The features `tenantId` has turned off, for one of its members (or
+ * admins): `tenant_features_off`. Throws a `SupabaseQueryError` (`42501`)
+ * for anyone else, so a refusal is never mistaken for "everything on".
+ *
+ * ```ts
+ * const features = await tenantFeatures(supabase, teamId);
+ * if (features.isOn("chat")) showChatTab();
+ * ```
+ *
+ * @stability Beta
+ */
+declare function tenantFeatures(client: TenantFeaturesClient, tenantId: string): Promise<TenantFeatures>;
+/** @stability Beta */
+interface SetTenantFeatureInput {
+    tenantId: string;
+    featureId: string;
+    enabled: boolean;
+    /** Why, in at most 500 characters. Required: it goes in the history. */
+    reason: string;
+}
+/**
+ * Turn a feature on or off for a tenant: `set_tenant_feature`. Only the
+ * tenant's admins (the app's `private.genesis_tenant_admin` hook); throws a
+ * `SupabaseQueryError` otherwise (`42501`), for a blank reason (`22023`) or
+ * a malformed feature id (`23514`).
+ *
+ * @stability Beta
+ */
+declare function setTenantFeature(client: TenantFeaturesClient, input: SetTenantFeatureInput): Promise<void>;
+/** One switch a tenant has set. @stability Beta */
+interface TenantFeatureSetting {
+    feature_id: string;
+    enabled: boolean;
+    reason: string;
+    updated_by: string | null;
+    updated_at: string;
+}
+/** Every switch a tenant has set, with its reason, for its admins: `tenant_feature_settings`. @stability Beta */
+declare function tenantFeatureSettings(client: TenantFeaturesClient, tenantId: string): Promise<TenantFeatureSetting[]>;
+/** One change to a tenant's switches. `enabled` is null when a switch row was deleted (back to on). @stability Beta */
+interface TenantFeatureChange {
+    feature_id: string;
+    enabled: boolean | null;
+    reason: string | null;
+    /** The person, or null for the service role, a migration, or a person since deleted. */
+    changed_by: string | null;
+    changed_role: string;
+    changed_at: string;
+}
+/** A tenant's history of changes, newest first (at most `maxRows`, 1 to 1000, default 100), for its admins. @stability Beta */
+declare function tenantFeatureHistory(client: TenantFeaturesClient, tenantId: string, options?: {
+    maxRows?: number;
+}): Promise<TenantFeatureChange[]>;
+
+/**
+ * Supabase for Genesis apps. Platform-neutral: web, React Native and the
+ * server import it. Native-only helpers (Keychain storage, foreground
+ * refresh, reinstall wipe) are on `@marktiderman/genesis-supabase/native`.
+ */
+
+/** The async key-value store Supabase auth keeps its session in. */
+interface SessionStorage {
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+}
+/** @stability Beta */
+interface GenesisSupabaseOptions {
+    url: string;
+    /** The publishable (anon) key. Never the secret key in an app. */
+    publishableKey: string;
+    /** Where the session lives. Native: `keychainStorage(SecureStore)`. Web: leave out for supabase-js's own default. */
+    storage?: SessionStorage;
+    /** `"native"` sets the React Native defaults (no session from the URL). Default `"web"`. */
+    platform?: "web" | "native";
+    /**
+     * Read a session from the URL after an OAuth redirect. Default: `true` on
+     * web, `false` on native, where the app hands the redirect URL to
+     * `exchangeCodeForSession` itself.
+     */
+    detectSessionInUrl?: boolean;
+    /**
+     * `expo-crypto` (`import * as ExpoCrypto from "expo-crypto"`), on native.
+     * Hermes has no `crypto.subtle`, and without it supabase-js sends the PKCE
+     * challenge as "plain"; this installs `crypto.getRandomValues` and a SHA-256
+     * `crypto.subtle.digest` from it (real WebCrypto is kept), so the challenge
+     * is S256. A PKCE client made where there is neither throws in development
+     * and logs an error in a release build. With the polyfill in place,
+     * `auth.getClaims` always has the server check the token (`getUser`), as
+     * supabase-js does where WebCrypto is missing: the polyfill can hash but
+     * not verify a signature.
+     */
+    crypto?: ExpoCryptoLike;
+    /** Anything else for supabase-js, merged last. */
+    options?: SupabaseClientOptions<"public">;
+}
+/**
+ * A Supabase client with Genesis's defaults: PKCE sign-in (the code flow, not
+ * tokens in a redirect URL, with an S256 challenge: pass `crypto` on native),
+ * a persisted session that refreshes itself, and
+ * the session storage you pass.
+ *
+ * @stability Beta
+ */
+declare function createGenesisSupabase<Database = unknown>({ url, publishableKey, storage, platform, detectSessionInUrl, crypto, options, }: GenesisSupabaseOptions): SupabaseClient<Database>;
+/** What a Supabase or PostgREST error carries. */
+interface PostgrestErrorLike {
+    message: string;
+    code?: string;
+    details?: string | null;
+    hint?: string | null;
+}
+/**
+ * A failed query, with the database's `code` (`23505` unique violation,
+ * `42501` permission denied, `PGRST116` no rows…), `details` and `hint`, so a
+ * caller can tell an RLS refusal from a conflict. The original error is the
+ * `cause`.
+ *
+ * @stability Beta
+ */
+declare class SupabaseQueryError extends Error {
+    name: string;
+    readonly code?: string;
+    readonly details?: string | null;
+    readonly hint?: string | null;
+    constructor(error: PostgrestErrorLike);
+}
+/**
+ * The data, or a thrown {@link SupabaseQueryError}: for query results where an
+ * error should fail the caller (a TanStack Query `queryFn`). The return type
+ * keeps `null` when the query can return no row (`.maybeSingle()`).
+ *
+ * @stability Beta
+ */
+declare function must<T>(result: {
+    data: T;
+    error: null;
+} | {
+    data: null;
+    error: PostgrestErrorLike;
+}): T;
+/** The parts of a Supabase client {@link deleteMyAccount} uses. A `SupabaseClient` fits. */
+interface DeleteAccountClient {
+    rpc: (fn: any, ...rest: any[]) => PromiseLike<{
+        data: unknown;
+        error: PostgrestErrorLike | null;
+    }>;
+    auth: {
+        signOut(options?: {
+            scope?: "global" | "local" | "others";
+        }): Promise<unknown>;
+    };
+    /** Needed only with `revokeAppleTokens`. */
+    functions?: FunctionsClient["functions"];
+}
+/** @stability Beta */
+interface DeleteMyAccountOptions {
+    /**
+     * After the delete, ask the `genesis-apple-revoke` Edge Function to revoke
+     * the person's Sign in with Apple tokens now (`true`, or the function's
+     * name). Best effort: the delete has already queued them and the
+     * function's schedule retries, so a failure here never fails the call.
+     */
+    revokeAppleTokens?: boolean | string;
+}
+/**
+ * In-app account deletion (App Store Review Guideline 5.1.1(v)), on web and
+ * native: calls the `delete_my_account` RPC (this package's
+ * `migrations/0001_genesis_account_deletion.sql`), which deletes the login
+ * and, through the app's `on delete cascade` foreign keys, its data; then
+ * clears the session on this device. Throws a {@link SupabaseQueryError} when
+ * the database refuses (`42501`: not signed in) and keeps the session then.
+ *
+ * With Sign in with Apple, ship the `genesis-apple-revoke` function and
+ * migration 0003 and pass `{ revokeAppleTokens: true }`: App Review requires
+ * the person's Apple tokens to be revoked.
+ *
+ * Put it behind a confirmation; see the README.
+ *
+ * @stability Beta
+ */
+declare function deleteMyAccount(client: DeleteAccountClient, options?: DeleteMyAccountOptions): Promise<void>;
+
+export { APPLE_REVOKE_FUNCTION as A, type DeleteAccountClient as D, type ExpoCryptoLike as E, type FunctionsClient as F, type GenesisSupabaseOptions as G, type PostgrestErrorLike as P, type SessionStorage as S, type TenantFeatureChange as T, type WebCryptoSource as W, assertPkceCrypto as a, isDigestOnlyPolyfill as b, type DeleteMyAccountOptions as c, type SetTenantFeatureInput as d, type StoreAppleTokenOptions as e, type StoreAppleTokenResult as f, SupabaseQueryError as g, hasPkceCrypto as h, installWebCrypto as i, type TenantFeatureSetting as j, type TenantFeatures as k, type TenantFeaturesClient as l, createGenesisSupabase as m, deleteMyAccount as n, must as o, storeAppleToken as p, tenantFeatureSettings as q, requestAppleRevocation as r, setTenantFeature as s, tenantFeatureHistory as t, tenantFeatures as u };

package/dist/index.d.ts

@@ -1,103 +1,4 @@
-import { SupabaseClientOptions, SupabaseClient } from '@supabase/supabase-js';
-
-/**
- * Supabase for Genesis apps. Platform-neutral: web, React Native and the
- * server import it. Native-only helpers (Keychain storage, foreground
- * refresh, reinstall wipe) are on `@marktiderman/genesis-supabase/native`.
- */
-
-/** The async key-value store Supabase auth keeps its session in. */
-interface SessionStorage {
-    getItem(key: string): Promise<string | null>;
-    setItem(key: string, value: string): Promise<void>;
-    removeItem(key: string): Promise<void>;
-}
-/** @stability Beta */
-interface GenesisSupabaseOptions {
-    url: string;
-    /** The publishable (anon) key. Never the secret key in an app. */
-    publishableKey: string;
-    /** Where the session lives. Native: `keychainStorage(SecureStore)`. Web: leave out for supabase-js's own default. */
-    storage?: SessionStorage;
-    /** `"native"` sets the React Native defaults (no session from the URL). Default `"web"`. */
-    platform?: "web" | "native";
-    /**
-     * Read a session from the URL after an OAuth redirect. Default: `true` on
-     * web, `false` on native, where the app hands the redirect URL to
-     * `exchangeCodeForSession` itself.
-     */
-    detectSessionInUrl?: boolean;
-    /** Anything else for supabase-js, merged last. */
-    options?: SupabaseClientOptions<"public">;
-}
-/**
- * A Supabase client with Genesis's defaults: PKCE sign-in (the code flow, not
- * tokens in a redirect URL), a persisted session that refreshes itself, and
- * the session storage you pass.
- *
- * @stability Beta
- */
-declare function createGenesisSupabase<Database = unknown>({ url, publishableKey, storage, platform, detectSessionInUrl, options, }: GenesisSupabaseOptions): SupabaseClient<Database>;
-/** What a Supabase or PostgREST error carries. */
-interface PostgrestErrorLike {
-    message: string;
-    code?: string;
-    details?: string | null;
-    hint?: string | null;
-}
-/**
- * A failed query, with the database's `code` (`23505` unique violation,
- * `42501` permission denied, `PGRST116` no rows…), `details` and `hint`, so a
- * caller can tell an RLS refusal from a conflict. The original error is the
- * `cause`.
- *
- * @stability Beta
- */
-declare class SupabaseQueryError extends Error {
-    name: string;
-    readonly code?: string;
-    readonly details?: string | null;
-    readonly hint?: string | null;
-    constructor(error: PostgrestErrorLike);
-}
-/**
- * The data, or a thrown {@link SupabaseQueryError}: for query results where an
- * error should fail the caller (a TanStack Query `queryFn`). The return type
- * keeps `null` when the query can return no row (`.maybeSingle()`).
- *
- * @stability Beta
- */
-declare function must<T>(result: {
-    data: T;
-    error: null;
-} | {
-    data: null;
-    error: PostgrestErrorLike;
-}): T;
-/** The parts of a Supabase client {@link deleteMyAccount} uses. A `SupabaseClient` fits. */
-interface DeleteAccountClient {
-    rpc: (fn: any, ...rest: any[]) => PromiseLike<{
-        data: unknown;
-        error: PostgrestErrorLike | null;
-    }>;
-    auth: {
-        signOut(options?: {
-            scope?: "global" | "local" | "others";
-        }): Promise<unknown>;
-    };
-}
-/**
- * In-app account deletion (App Store Review Guideline 5.1.1(v)), on web and
- * native: calls the `delete_my_account` RPC (this package's
- * `migrations/0001_genesis_account_deletion.sql`), which deletes the login
- * and, through the app's `on delete cascade` foreign keys, its data; then
- * clears the session on this device. Throws a {@link SupabaseQueryError} when
- * the database refuses (`42501`: not signed in) and keeps the session then.
- *
- * Put it behind a confirmation; see the README.
- *
- * @stability Beta
- */
-declare function deleteMyAccount(client: DeleteAccountClient): Promise<void>;
-
-export { type DeleteAccountClient, type GenesisSupabaseOptions, type PostgrestErrorLike, type SessionStorage, SupabaseQueryError, createGenesisSupabase, deleteMyAccount, must };
+import '@supabase/supabase-js';
+export { A as APPLE_REVOKE_FUNCTION, D as DeleteAccountClient, c as DeleteMyAccountOptions, E as ExpoCryptoLike, F as FunctionsClient, G as GenesisSupabaseOptions, P as PostgrestErrorLike, S as SessionStorage, d as SetTenantFeatureInput, e as StoreAppleTokenOptions, f as StoreAppleTokenResult, g as SupabaseQueryError, T as TenantFeatureChange, j as TenantFeatureSetting, k as TenantFeatures, l as TenantFeaturesClient, m as createGenesisSupabase, n as deleteMyAccount, o as must, r as requestAppleRevocation, s as setTenantFeature, p as storeAppleToken, t as tenantFeatureHistory, q as tenantFeatureSettings, u as tenantFeatures } from './index-BSGz3RGk.js';
+export { accountBlock, tenantFeaturesBlock } from './blocks.js';
+import '@marktiderman/genesis-features/blocks';

package/dist/index.js

@@ -1,4 +1,52 @@
-import { createClient } from '@supabase/supabase-js';
+import { installWebCrypto, assertPkceCrypto, isDigestOnlyPolyfill, claimsViaServer } from './chunk-FAA2FTF4.js';
+export { accountBlock, tenantFeaturesBlock } from './chunk-T2HGFC4C.js';
+import { createClient, AuthInvalidJwtError } from '@supabase/supabase-js';
+
+// src/apple-tokens.ts
+var APPLE_REVOKE_FUNCTION = "genesis-apple-revoke";
+var STORE_TIMEOUT_MS = 2e4;
+var REVOKE_TIMEOUT_MS = 5e3;
+async function storeAppleToken(client, { authorizationCode, clientId, functionName = APPLE_REVOKE_FUNCTION }) {
+  try {
+    const { error } = await client.functions.invoke(functionName, { body: { action: "store", code: authorizationCode, ...clientId ? { clientId } : {} }, timeout: STORE_TIMEOUT_MS });
+    if (error) return { ok: false, error: error instanceof Error ? error : new Error(String(error.message ?? error)) };
+    return { ok: true };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error : new Error(String(error)) };
+  }
+}
+async function requestAppleRevocation(client, functionName = APPLE_REVOKE_FUNCTION) {
+  try {
+    const { error } = await client.functions.invoke(functionName, { body: { action: "revoke" }, timeout: REVOKE_TIMEOUT_MS });
+    return !error;
+  } catch {
+    return false;
+  }
+}
+
+// src/tenant-features.ts
+async function tenantFeatures(client, tenantId) {
+  const data = must(await client.rpc("tenant_features_off", { tenant: tenantId }));
+  const off = new Set(Array.isArray(data) ? data.filter((id) => typeof id === "string") : []);
+  return Object.freeze({ tenantId, off, isOn: (featureId) => !off.has(featureId) });
+}
+async function setTenantFeature(client, input) {
+  must(
+    await client.rpc("set_tenant_feature", {
+      tenant: input.tenantId,
+      feature: input.featureId,
+      enabled: input.enabled,
+      reason: input.reason
+    })
+  );
+}
+async function tenantFeatureSettings(client, tenantId) {
+  return must(await client.rpc("tenant_feature_settings", { tenant: tenantId })) ?? [];
+}
+async function tenantFeatureHistory(client, tenantId, options = {}) {
+  const args = options.maxRows === void 0 ? { tenant: tenantId } : { tenant: tenantId, max_rows: options.maxRows };
+  return must(await client.rpc("tenant_feature_history", args)) ?? [];
+}
 
 // src/index.ts
 function createGenesisSupabase({
@@ -7,8 +55,11 @@ function createGenesisSupabase({
   storage,
   platform = "web",
   detectSessionInUrl = platform === "web",
+  crypto,
   options = {}
 }) {
+  if (crypto) installWebCrypto(crypto);
+  if ((options.auth?.flowType ?? "pkce") === "pkce") assertPkceCrypto();
   const client = createClient(url, publishableKey, {
     ...options,
     auth: {
@@ -20,6 +71,10 @@ function createGenesisSupabase({
       ...options.auth
     }
   });
+  if (isDigestOnlyPolyfill()) {
+    const auth = client.auth;
+    auth.getClaims = claimsViaServer(auth, (message) => new AuthInvalidJwtError(message));
+  }
   return client;
 }
 var SupabaseQueryError = class extends Error {
@@ -38,11 +93,13 @@ function must(result) {
   if (result.error) throw new SupabaseQueryError(result.error);
   return result.data;
 }
-async function deleteMyAccount(client) {
+async function deleteMyAccount(client, options = {}) {
   must(await client.rpc("delete_my_account"));
+  const revoke = options.revokeAppleTokens;
+  if (revoke && client.functions) await requestAppleRevocation({ functions: client.functions }, typeof revoke === "string" ? revoke : APPLE_REVOKE_FUNCTION);
   await client.auth.signOut({ scope: "local" });
 }
 
-export { SupabaseQueryError, createGenesisSupabase, deleteMyAccount, must };
+export { APPLE_REVOKE_FUNCTION, SupabaseQueryError, createGenesisSupabase, deleteMyAccount, must, requestAppleRevocation, setTenantFeature, storeAppleToken, tenantFeatureHistory, tenantFeatureSettings, tenantFeatures };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map