@prisma-next/extension-supabase 0.14.0-dev.6 → 0.14.0-dev.61

package/src/contract/contract.d.ts

@@ -30,7 +30,7 @@ import type {
 } from '@prisma-next/contract/types';
 
 export type StorageHash =
-  StorageHashBase<'sha256:61dac13aa56bcb5b7f1c5441c2bd8fc07d88f6c870c80b4c1640fd0d180fb423'>;
+  StorageHashBase<'sha256:01edbb5adbbc0711bed516ea61b0585de2aa906f9aebacedbead613eff89f194'>;
 export type ExecutionHash = ExecutionHashBase<string>;
 export type ProfileHash =
   ProfileHashBase<'sha256:9c8aa3114e84ed3b7ea2bd57526d9c2e1bf7c5292be694e9d3801f566fda7ccb'>;
@@ -51,6 +51,12 @@ export type FieldOutputTypes = {
       readonly created_at: CodecTypes['pg/timestamptz@1']['output'];
       readonly updated_at: CodecTypes['pg/timestamptz@1']['output'];
     };
+    readonly AuthSession: {
+      readonly id: CodecTypes['pg/uuid@1']['output'];
+      readonly user_id: CodecTypes['pg/uuid@1']['output'];
+      readonly aal: 'aal1' | 'aal2' | 'aal3' | null;
+      readonly created_at: CodecTypes['pg/timestamptz@1']['output'];
+    };
     readonly AuthUser: {
       readonly id: CodecTypes['pg/uuid@1']['output'];
       readonly email: CodecTypes['pg/text@1']['output'];
@@ -83,6 +89,12 @@ export type FieldInputTypes = {
       readonly created_at: CodecTypes['pg/timestamptz@1']['input'];
       readonly updated_at: CodecTypes['pg/timestamptz@1']['input'];
     };
+    readonly AuthSession: {
+      readonly id: CodecTypes['pg/uuid@1']['input'];
+      readonly user_id: CodecTypes['pg/uuid@1']['input'];
+      readonly aal: 'aal1' | 'aal2' | 'aal3' | null;
+      readonly created_at: CodecTypes['pg/timestamptz@1']['input'];
+    };
     readonly AuthUser: {
       readonly id: CodecTypes['pg/uuid@1']['input'];
       readonly email: CodecTypes['pg/text@1']['input'];
@@ -106,11 +118,91 @@ export type FieldInputTypes = {
     };
   };
 };
+export type StorageColumnTypes = {
+  readonly auth: {
+    readonly identities: {
+      readonly created_at: CodecTypes['pg/timestamptz@1']['output'];
+      readonly id: CodecTypes['pg/uuid@1']['output'];
+      readonly provider: CodecTypes['pg/text@1']['output'];
+      readonly updated_at: CodecTypes['pg/timestamptz@1']['output'];
+      readonly user_id: CodecTypes['pg/uuid@1']['output'];
+    };
+    readonly sessions: {
+      readonly aal: 'aal1' | 'aal2' | 'aal3' | null;
+      readonly created_at: CodecTypes['pg/timestamptz@1']['output'];
+      readonly id: CodecTypes['pg/uuid@1']['output'];
+      readonly user_id: CodecTypes['pg/uuid@1']['output'];
+    };
+    readonly users: {
+      readonly created_at: CodecTypes['pg/timestamptz@1']['output'];
+      readonly email: CodecTypes['pg/text@1']['output'];
+      readonly id: CodecTypes['pg/uuid@1']['output'];
+      readonly updated_at: CodecTypes['pg/timestamptz@1']['output'];
+    };
+  };
+  readonly public: {};
+  readonly storage: {
+    readonly buckets: {
+      readonly created_at: CodecTypes['pg/timestamptz@1']['output'];
+      readonly id: CodecTypes['pg/text@1']['output'];
+      readonly name: CodecTypes['pg/text@1']['output'];
+      readonly updated_at: CodecTypes['pg/timestamptz@1']['output'];
+    };
+    readonly objects: {
+      readonly bucket_id: CodecTypes['pg/text@1']['output'];
+      readonly created_at: CodecTypes['pg/timestamptz@1']['output'];
+      readonly id: CodecTypes['pg/uuid@1']['output'];
+      readonly name: CodecTypes['pg/text@1']['output'];
+      readonly updated_at: CodecTypes['pg/timestamptz@1']['output'];
+    };
+  };
+};
+export type StorageColumnInputTypes = {
+  readonly auth: {
+    readonly identities: {
+      readonly created_at: CodecTypes['pg/timestamptz@1']['input'];
+      readonly id: CodecTypes['pg/uuid@1']['input'];
+      readonly provider: CodecTypes['pg/text@1']['input'];
+      readonly updated_at: CodecTypes['pg/timestamptz@1']['input'];
+      readonly user_id: CodecTypes['pg/uuid@1']['input'];
+    };
+    readonly sessions: {
+      readonly aal: 'aal1' | 'aal2' | 'aal3' | null;
+      readonly created_at: CodecTypes['pg/timestamptz@1']['input'];
+      readonly id: CodecTypes['pg/uuid@1']['input'];
+      readonly user_id: CodecTypes['pg/uuid@1']['input'];
+    };
+    readonly users: {
+      readonly created_at: CodecTypes['pg/timestamptz@1']['input'];
+      readonly email: CodecTypes['pg/text@1']['input'];
+      readonly id: CodecTypes['pg/uuid@1']['input'];
+      readonly updated_at: CodecTypes['pg/timestamptz@1']['input'];
+    };
+  };
+  readonly public: {};
+  readonly storage: {
+    readonly buckets: {
+      readonly created_at: CodecTypes['pg/timestamptz@1']['input'];
+      readonly id: CodecTypes['pg/text@1']['input'];
+      readonly name: CodecTypes['pg/text@1']['input'];
+      readonly updated_at: CodecTypes['pg/timestamptz@1']['input'];
+    };
+    readonly objects: {
+      readonly bucket_id: CodecTypes['pg/text@1']['input'];
+      readonly created_at: CodecTypes['pg/timestamptz@1']['input'];
+      readonly id: CodecTypes['pg/uuid@1']['input'];
+      readonly name: CodecTypes['pg/text@1']['input'];
+      readonly updated_at: CodecTypes['pg/timestamptz@1']['input'];
+    };
+  };
+};
 export type TypeMaps = TypeMapsType<
   CodecTypes,
   QueryOperationTypes,
   FieldOutputTypes,
-  FieldInputTypes
+  FieldInputTypes,
+  StorageColumnTypes,
+  StorageColumnInputTypes
 >;
 
 type ContractBase = Omit<
@@ -118,7 +210,7 @@ type ContractBase = Omit<
     readonly namespaces: {
       readonly auth: {
         readonly id: 'auth';
-        readonly kind: 'sql-namespace';
+        readonly kind: 'postgres-schema';
         readonly entries: {
           readonly table: {
             readonly identities: {
@@ -158,6 +250,38 @@ type ContractBase = Omit<
               indexes: readonly [];
               foreignKeys: readonly [];
             };
+            readonly sessions: {
+              columns: {
+                readonly id: {
+                  readonly nativeType: 'uuid';
+                  readonly codecId: 'pg/uuid@1';
+                  readonly nullable: false;
+                  readonly typeRef: 'Uuid';
+                };
+                readonly user_id: {
+                  readonly nativeType: 'uuid';
+                  readonly codecId: 'pg/uuid@1';
+                  readonly nullable: false;
+                  readonly typeRef: 'Uuid';
+                };
+                readonly aal: {
+                  readonly nativeType: 'auth.aal_level';
+                  readonly codecId: 'pg/enum@1';
+                  readonly nullable: true;
+                  readonly typeParams: { readonly typeName: 'auth.aal_level' };
+                };
+                readonly created_at: {
+                  readonly nativeType: 'timestamptz';
+                  readonly codecId: 'pg/timestamptz@1';
+                  readonly nullable: false;
+                  readonly typeRef: 'Timestamptz';
+                };
+              };
+              primaryKey: { readonly columns: readonly ['id'] };
+              uniques: readonly [];
+              indexes: readonly [];
+              foreignKeys: readonly [];
+            };
             readonly users: {
               columns: {
                 readonly id: {
@@ -190,16 +314,22 @@ type ContractBase = Omit<
               foreignKeys: readonly [];
             };
           };
+          readonly valueSet: {
+            readonly AalLevel: {
+              readonly kind: 'valueSet';
+              readonly values: readonly ['aal1', 'aal2', 'aal3'];
+            };
+          };
         };
       };
       readonly public: {
         readonly id: 'public';
-        readonly kind: 'sql-namespace';
+        readonly kind: 'postgres-schema';
         readonly entries: { readonly table: {} };
       };
       readonly storage: {
         readonly id: 'storage';
-        readonly kind: 'sql-namespace';
+        readonly kind: 'postgres-schema';
         readonly entries: {
           readonly table: {
             readonly buckets: {
@@ -298,6 +428,7 @@ type ContractBase = Omit<
       readonly namespace: 'auth' & NamespaceId;
       readonly model: 'AuthIdentity';
     };
+    readonly sessions: { readonly namespace: 'auth' & NamespaceId; readonly model: 'AuthSession' };
     readonly buckets: {
       readonly namespace: 'storage' & NamespaceId;
       readonly model: 'StorageBucket';
@@ -347,6 +478,41 @@ type ContractBase = Omit<
               };
             };
           };
+          readonly AuthSession: {
+            readonly fields: {
+              readonly id: {
+                readonly nullable: false;
+                readonly type: { readonly kind: 'scalar'; readonly codecId: 'pg/uuid@1' };
+              };
+              readonly user_id: {
+                readonly nullable: false;
+                readonly type: { readonly kind: 'scalar'; readonly codecId: 'pg/uuid@1' };
+              };
+              readonly aal: {
+                readonly nullable: true;
+                readonly type: {
+                  readonly kind: 'scalar';
+                  readonly codecId: 'pg/enum@1';
+                  readonly typeParams: { readonly typeName: 'auth.aal_level' };
+                };
+              };
+              readonly created_at: {
+                readonly nullable: false;
+                readonly type: { readonly kind: 'scalar'; readonly codecId: 'pg/timestamptz@1' };
+              };
+            };
+            readonly relations: Record<string, never>;
+            readonly storage: {
+              readonly table: 'sessions';
+              readonly namespaceId: 'auth';
+              readonly fields: {
+                readonly id: { readonly column: 'id' };
+                readonly user_id: { readonly column: 'user_id' };
+                readonly aal: { readonly column: 'aal' };
+                readonly created_at: { readonly column: 'created_at' };
+              };
+            };
+          };
           readonly AuthUser: {
             readonly fields: {
               readonly id: {
@@ -467,6 +633,7 @@ type ContractBase = Omit<
       readonly enums: true;
       readonly lateral: true;
       readonly returning: true;
+      readonly scalarList: true;
     };
   };
   readonly extensionPacks: {};

package/src/contract/contract.json

@@ -16,6 +16,10 @@
       "model": "StorageObject",
       "namespace": "storage"
     },
+    "sessions": {
+      "model": "AuthSession",
+      "namespace": "auth"
+    },
     "users": {
       "model": "AuthUser",
       "namespace": "auth"
@@ -86,6 +90,60 @@
               "table": "identities"
             }
           },
+          "AuthSession": {
+            "fields": {
+              "aal": {
+                "nullable": true,
+                "type": {
+                  "codecId": "pg/enum@1",
+                  "kind": "scalar",
+                  "typeParams": {
+                    "typeName": "auth.aal_level"
+                  }
+                }
+              },
+              "created_at": {
+                "nullable": false,
+                "type": {
+                  "codecId": "pg/timestamptz@1",
+                  "kind": "scalar"
+                }
+              },
+              "id": {
+                "nullable": false,
+                "type": {
+                  "codecId": "pg/uuid@1",
+                  "kind": "scalar"
+                }
+              },
+              "user_id": {
+                "nullable": false,
+                "type": {
+                  "codecId": "pg/uuid@1",
+                  "kind": "scalar"
+                }
+              }
+            },
+            "relations": {},
+            "storage": {
+              "fields": {
+                "aal": {
+                  "column": "aal"
+                },
+                "created_at": {
+                  "column": "created_at"
+                },
+                "id": {
+                  "column": "id"
+                },
+                "user_id": {
+                  "column": "user_id"
+                }
+              },
+              "namespaceId": "auth",
+              "table": "sessions"
+            }
+          },
           "AuthUser": {
             "fields": {
               "created_at": {
@@ -261,6 +319,17 @@
     "namespaces": {
       "auth": {
         "entries": {
+          "native_enum": {
+            "AalLevel": {
+              "kind": "postgres-enum",
+              "members": [
+                "aal1",
+                "aal2",
+                "aal3"
+              ],
+              "typeName": "aal_level"
+            }
+          },
           "table": {
             "identities": {
               "columns": {
@@ -303,6 +372,50 @@
               },
               "uniques": []
             },
+            "sessions": {
+              "columns": {
+                "aal": {
+                  "codecId": "pg/enum@1",
+                  "nativeType": "auth.aal_level",
+                  "nullable": true,
+                  "typeParams": {
+                    "typeName": "auth.aal_level"
+                  },
+                  "valueSet": {
+                    "entityKind": "valueSet",
+                    "entityName": "AalLevel",
+                    "namespaceId": "auth",
+                    "plane": "storage"
+                  }
+                },
+                "created_at": {
+                  "codecId": "pg/timestamptz@1",
+                  "nativeType": "timestamptz",
+                  "nullable": false,
+                  "typeRef": "Timestamptz"
+                },
+                "id": {
+                  "codecId": "pg/uuid@1",
+                  "nativeType": "uuid",
+                  "nullable": false,
+                  "typeRef": "Uuid"
+                },
+                "user_id": {
+                  "codecId": "pg/uuid@1",
+                  "nativeType": "uuid",
+                  "nullable": false,
+                  "typeRef": "Uuid"
+                }
+              },
+              "foreignKeys": [],
+              "indexes": [],
+              "primaryKey": {
+                "columns": [
+                  "id"
+                ]
+              },
+              "uniques": []
+            },
             "users": {
               "columns": {
                 "created_at": {
@@ -338,6 +451,16 @@
               },
               "uniques": []
             }
+          },
+          "valueSet": {
+            "AalLevel": {
+              "kind": "valueSet",
+              "values": [
+                "aal1",
+                "aal2",
+                "aal3"
+              ]
+            }
           }
         },
         "id": "auth",
@@ -433,7 +556,7 @@
         "kind": "postgres-schema"
       }
     },
-    "storageHash": "sha256:61dac13aa56bcb5b7f1c5441c2bd8fc07d88f6c870c80b4c1640fd0d180fb423",
+    "storageHash": "sha256:01edbb5adbbc0711bed516ea61b0585de2aa906f9aebacedbead613eff89f194",
     "types": {
       "Timestamptz": {
         "codecId": "pg/timestamptz@1",
@@ -460,7 +583,8 @@
       "defaultInInsert": true,
       "enums": true,
       "lateral": true,
-      "returning": true
+      "returning": true,
+      "scalarList": true
     }
   },
   "extensionPacks": {},

package/src/contract/contract.prisma

@@ -24,6 +24,22 @@ namespace auth {
 
     @@map("identities")
   }
+
+  native_enum AalLevel {
+    aal1 = "aal1"
+    aal2 = "aal2"
+    aal3 = "aal3"
+    @@map("aal_level")
+  }
+
+  model AuthSession {
+    id         Uuid          @id
+    user_id    Uuid
+    aal        pg.enum(AalLevel)?
+    created_at Timestamptz
+
+    @@map("sessions")
+  }
 }
 
 namespace storage {

package/src/exports/runtime.ts

@@ -2,9 +2,12 @@ import { supabaseRuntimeDescriptor } from '../runtime/descriptor';
 
 export default supabaseRuntimeDescriptor;
 
+export type { SupabaseExtensionContract } from '../runtime/ext-contract-type';
 export type {
   RoleBoundDb,
+  ServiceRoleDb,
   SupabaseDb,
+  SupabaseInternalDb,
   SupabaseOptions,
   SupabaseOptionsWithContract,
   SupabaseOptionsWithContractJson,

package/src/runtime/ext-contract-type.ts

@@ -0,0 +1,9 @@
+import type { Contract } from '../contract/contract.d';
+
+/**
+ * The Supabase extension's own emitted contract type (`auth`, `storage`
+ * namespaces), re-exported under a distinct name so the runtime facade can
+ * reference it alongside the framework `Contract` (`@prisma-next/contract/types`)
+ * without an aliased import. Backs the `service_role` `.supabase` secondary root.
+ */
+export type SupabaseExtensionContract = Contract;

package/src/runtime/supabase.ts

@@ -6,6 +6,10 @@ import type {
   AsyncIterableResult,
   RuntimeExecuteOptions,
 } from '@prisma-next/framework-components/runtime';
+import {
+  buildNamespacedNativeEnums,
+  type NamespacedNativeEnums,
+} from '@prisma-next/postgres/runtime';
 import { sql } from '@prisma-next/sql-builder/runtime';
 import type { Db } from '@prisma-next/sql-builder/types';
 import type { SqlStorage } from '@prisma-next/sql-contract/types';
@@ -32,7 +36,9 @@ import { ifDefined } from '@prisma-next/utils/defined';
 import { createRemoteJWKSet, type JWTVerifyResult, jwtVerify } from 'jose';
 import type { Client } from 'pg';
 import { Pool } from 'pg';
+import extensionContractJson from '../contract/contract.json' with { type: 'json' };
 import { supabaseRuntimeDescriptor } from './descriptor';
+import type { SupabaseExtensionContract } from './ext-contract-type';
 import type { SupabaseRoleBinding, SupabaseRuntime } from './supabase-runtime';
 import { SupabaseRuntimeImpl } from './supabase-runtime';
 
@@ -71,12 +77,41 @@ export interface RoleBoundDb<TContract extends Contract<SqlStorage>> {
   transaction<R>(fn: (tx: TransactionContext) => PromiseLike<R>): Promise<R>;
 }
 
+/**
+ * Query surface for the Supabase-internal contract (`auth`, `storage`). Exposed
+ * as a separate secondary root — never merged into the app contract — and only
+ * reachable through `service_role`, the one role with grants on those schemas
+ * over a direct Postgres connection.
+ *
+ * Deliberately omits `transaction` (which {@link RoleBoundDb} has): the primary
+ * app root and this secondary root are served by separate runtimes that do not
+ * share one pinned connection, so a transaction spanning both is out of scope for v1.
+ */
+export interface SupabaseInternalDb {
+  readonly sql: Db<SupabaseExtensionContract>;
+  readonly orm: OrmClient<SupabaseExtensionContract>;
+  readonly nativeEnums: NamespacedNativeEnums<SupabaseExtensionContract>;
+  execute<Row>(
+    plan: (SqlExecutionPlan<Row> | SqlQueryPlan<Row>) & { readonly _row?: Row },
+    options?: RuntimeExecuteOptions,
+  ): AsyncIterableResult<Row>;
+}
+
+/**
+ * The `service_role` db: the app-contract role-bound surface (its `.sql` / `.orm`
+ * are app-only, exactly like `asUser` / `asAnon`), plus a `.supabase` secondary
+ * root for the Supabase-internal namespaces.
+ */
+export type ServiceRoleDb<TContract extends Contract<SqlStorage>> = RoleBoundDb<TContract> & {
+  readonly supabase: SupabaseInternalDb;
+};
+
 export interface SupabaseDb<TContract extends Contract<SqlStorage>> {
   readonly context: ExecutionContext<TContract>;
   readonly stack: SqlExecutionStackWithDriver<SupabaseTargetId>;
   asUser(jwt: string): Promise<RoleBoundDb<TContract>>;
   asAnon(): RoleBoundDb<TContract>;
-  asServiceRole(): RoleBoundDb<TContract>;
+  asServiceRole(): ServiceRoleDb<TContract>;
   close(): Promise<void>;
   [Symbol.asyncDispose](): Promise<void>;
 }
@@ -138,11 +173,13 @@ const contractSerializer = new PostgresContractSerializer();
 function resolveContract<TContract extends Contract<SqlStorage>>(
   options: SupabaseOptions<TContract>,
 ): TContract {
-  const contractInput = hasContractJson(options) ? options.contractJson : options.contract;
+  const contractJson = hasContractJson(options)
+    ? options.contractJson
+    : contractSerializer.serializeContract(options.contract);
   return blindCast<
     TContract,
     'contractSerializer.deserializeContract returns a validated TContract'
-  >(contractSerializer.deserializeContract(contractInput));
+  >(contractSerializer.deserializeContract(contractJson));
 }
 
 function resolveKeyMaterial<TContract extends Contract<SqlStorage>>(
@@ -197,6 +234,20 @@ function withSupabaseDescriptor(
     : [...packs, supabaseRuntimeDescriptor];
 }
 
+/**
+ * Deserializes the Supabase extension's own emitted contract into a runtime
+ * contract: namespaces hydrate into `PostgresSchema` instances (with
+ * `qualifyTable`), and `typeRef` columns (`Timestamptz`, `Uuid`) resolve
+ * through the codec registry. Exposed only via `service_role`'s `.supabase`
+ * secondary root — never merged into the app contract.
+ */
+function buildExtensionContract(): SupabaseExtensionContract {
+  return blindCast<
+    SupabaseExtensionContract,
+    'deserializeContract hydrates JSON namespaces into PostgresSchema instances with qualifyTable'
+  >(contractSerializer.deserializeContract(extensionContractJson));
+}
+
 export default async function supabase<TContract extends Contract<SqlStorage>>(
   options: SupabaseOptionsWithContract<TContract>,
 ): Promise<SupabaseDb<TContract>>;
@@ -254,18 +305,20 @@ export default async function supabase<TContract extends Contract<SqlStorage>>(
     }
   }
 
-  function buildRoleBoundDb(binding: SupabaseRoleBinding): RoleBoundDb<TContract> {
-    const roleSql: Db<TContract> = sql<TContract>({ context, rawCodecInferer });
-    const roleOrm: OrmClient<TContract> = orm({
+  function buildRoleBoundDbWithContext<C extends Contract<SqlStorage>>(
+    binding: SupabaseRoleBinding,
+    roleContext: ExecutionContext<C>,
+    roleRuntime: SupabaseRuntime & SupabaseRuntimeImpl<C>,
+  ): RoleBoundDb<C> {
+    const roleSql: Db<C> = sql<C>({ context: roleContext, rawCodecInferer });
+    const roleOrm: OrmClient<C> = orm({
       runtime: {
         execute(plan) {
-          return runtime.executeWithRole(plan, binding);
+          return roleRuntime.executeWithRole(plan, binding);
         },
-        // connection() returns a role session; this is the enforcement path for ORM scope
-        // operations (mutations, includes) — every statement runs role-bound.
-        connection: () => runtime.openRoleSession(binding),
+        connection: () => roleRuntime.openRoleSession(binding),
       },
-      context,
+      context: roleContext,
     });
 
     return {
@@ -276,14 +329,63 @@ export default async function supabase<TContract extends Contract<SqlStorage>>(
         plan: (SqlExecutionPlan<Row> | SqlQueryPlan<Row>) & { readonly _row?: Row },
         execOptions?: RuntimeExecuteOptions,
       ): AsyncIterableResult<Row> {
-        return runtime.executeWithRole<Row>(plan, binding, execOptions);
+        return roleRuntime.executeWithRole<Row>(plan, binding, execOptions);
       },
       transaction<R>(fn: (tx: TransactionContext) => PromiseLike<R>): Promise<R> {
-        return withTransaction({ connection: () => runtime.openRoleSession(binding) }, fn);
+        return withTransaction({ connection: () => roleRuntime.openRoleSession(binding) }, fn);
       },
     };
   }
 
+  function buildRoleBoundDb(binding: SupabaseRoleBinding): RoleBoundDb<TContract> {
+    return buildRoleBoundDbWithContext(binding, context, runtime);
+  }
+
+  const serviceRoleBinding: SupabaseRoleBinding = { role: 'service_role', claims: {} };
+
+  // The Supabase-internal contract (auth/storage) as a separate secondary root.
+  // It is contract-bound: a plan built against it carries the extension's
+  // storageHash, so it must run on a runtime bound to the extension contract —
+  // the app runtime would reject it (PLAN.HASH_MISMATCH). This runtime shares
+  // the same driver (one pool, no second connection) and disables marker
+  // verification: the extension contract is external and owns no app-space
+  // marker, so its hashes must not be checked against the DB marker.
+  const extContract = buildExtensionContract();
+  const extContext = createExecutionContext({ contract: extContract, stack });
+  const extRuntime: SupabaseRuntime & SupabaseRuntimeImpl<SupabaseExtensionContract> =
+    new SupabaseRuntimeImpl({
+      context: extContext,
+      adapter: stackInstance.adapter,
+      driver,
+      verifyMarker: false,
+      ...ifDefined('middleware', options.middleware),
+    });
+
+  const extNativeEnums = blindCast<
+    NamespacedNativeEnums<SupabaseExtensionContract>,
+    'buildNamespacedNativeEnums returns the namespace-keyed accessor map this contract types'
+  >(Object.freeze(buildNamespacedNativeEnums(extContract.storage)));
+
+  const supabaseInternal: SupabaseInternalDb = {
+    sql: sql<SupabaseExtensionContract>({ context: extContext, rawCodecInferer }),
+    orm: orm({
+      runtime: {
+        execute(plan) {
+          return extRuntime.executeWithRole(plan, serviceRoleBinding);
+        },
+        connection: () => extRuntime.openRoleSession(serviceRoleBinding),
+      },
+      context: extContext,
+    }),
+    nativeEnums: extNativeEnums,
+    execute<Row>(
+      plan: (SqlExecutionPlan<Row> | SqlQueryPlan<Row>) & { readonly _row?: Row },
+      execOptions?: RuntimeExecuteOptions,
+    ): AsyncIterableResult<Row> {
+      return extRuntime.executeWithRole<Row>(plan, serviceRoleBinding, execOptions);
+    },
+  };
+
   async function closeDb(): Promise<void> {
     if (closed) return;
     closed = true;
@@ -313,8 +415,9 @@ export default async function supabase<TContract extends Contract<SqlStorage>>(
       return buildRoleBoundDb({ role: 'anon', claims: {} });
     },
 
-    asServiceRole(): RoleBoundDb<TContract> {
-      return buildRoleBoundDb({ role: 'service_role', claims: {} });
+    asServiceRole(): ServiceRoleDb<TContract> {
+      const roleBound = buildRoleBoundDbWithContext(serviceRoleBinding, context, runtime);
+      return { ...roleBound, supabase: supabaseInternal };
     },
 
     close: closeDb,