npm - @prisma/orm-extension-supabase - Versions diffs - 0.17.0-dev.8 → 0.17.0-dev.9 - Mend

@prisma/orm-extension-supabase 0.17.0-dev.8 → 0.17.0-dev.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/dist/{contract-C395bPz6-Bg0ja_CK.mjs → contract-DdvPj2sX-3jRwmZSN.mjs} +3 -3
package/dist/{contract-C395bPz6-Bg0ja_CK.mjs.map → contract-DdvPj2sX-3jRwmZSN.mjs.map} +1 -1
package/dist/pack.mjs +1 -1
package/dist/pack.mjs.map +1 -1
package/dist/runtime.mjs +1 -1
package/dist/runtime.mjs.map +1 -1
package/package.json +10 -10

package/dist/pack.mjs CHANGED Viewed

@@ -1,4 +1,4 @@
-import { n as version, t as contract_default } from "./contract-C395bPz6-Bg0ja_CK.mjs";
+import { n as version, t as contract_default } from "./contract-DdvPj2sX-3jRwmZSN.mjs";
 import { blindCast } from "@prisma/orm-framework/utils/casts";
 //#region ../../../3-extensions/supabase/dist/pack.mjs
 const SUPABASE_SPACE_ID = "supabase";

package/dist/pack.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"pack.mjs","names":[],"sources":["../../../../3-extensions/supabase/dist/pack.mjs"],"sourcesContent":["import { n as version, t as contract_default } from \"./contract-~~C395bPz6~~.mjs\";\nimport { blindCast } from \"@internal/utils/casts\";\n//#region src/pack/index.ts\nconst SUPABASE_SPACE_ID = \"supabase\";\nfunction buildContractSpace(contractOverride) {\n\tconst contract = blindCast(contractOverride ?? contract_default);\n\treturn {\n\t\tcontractJson: contract,\n\t\tmigrations: [],\n\t\theadRef: {\n\t\t\thash: contract.storage.storageHash,\n\t\t\tinvariants: []\n\t\t}\n\t};\n}\nconst supabasePackBase = {\n\tkind: \"extension\",\n\tid: SUPABASE_SPACE_ID,\n\tfamilyId: \"sql\",\n\ttargetId: \"postgres\",\n\tversion,\n\tcontractSpace: buildContractSpace(),\n\tcreate: () => ({\n\t\tfamilyId: \"sql\",\n\t\ttargetId: \"postgres\"\n\t})\n};\nconst supabasePack = supabasePackBase;\n/*\n Returns a pack using `contractOverride` in place of the shipped\n* `contract.json` when provided, otherwise returns the default pack.\n\n Intended for tests that need to drive the framework with a synthetic\n* contract while still exercising the full descriptor wiring.\n*/\nfunction supabasePackWith(options) {\n\tif (options?.contractOverride === void 0) return supabasePack;\n\treturn {\n\t\t...supabasePackBase,\n\t\tcontractSpace: buildContractSpace(options.contractOverride)\n\t};\n}\n//#endregion\nexport { supabasePack as default, supabasePackWith };\n\n//# sourceMappingURL=pack.mjs.map"],"mappings":";;;AAGA,MAAM,oBAAoB;AAC1B,SAAS,mBAAmB,kBAAkB;CAC7C,MAAM,WAAW,UAAU,oBAAoB,gBAAgB;CAC/D,OAAO;EACN,cAAc;EACd,YAAY,CAAC;EACb,SAAS;GACR,MAAM,SAAS,QAAQ;GACvB,YAAY,CAAC;EACd;CACD;AACD;AACA,MAAM,mBAAmB;CACxB,MAAM;CACN,IAAI;CACJ,UAAU;CACV,UAAU;CACV;CACA,eAAe,mBAAmB;CAClC,eAAe;EACd,UAAU;EACV,UAAU;CACX;AACD;AACA,MAAM,eAAe;;;;;;;;AAQrB,SAAS,iBAAiB,SAAS;CAClC,IAAI,SAAS,qBAAqB,KAAK,GAAG,OAAO;CACjD,OAAO;EACN,GAAG;EACH,eAAe,mBAAmB,QAAQ,gBAAgB;CAC3D;AACD"}
1	+ {"version":3,"file":"pack.mjs","names":[],"sources":["../../../../3-extensions/supabase/dist/pack.mjs"],"sourcesContent":["import { n as version, t as contract_default } from \"./contract-DdvPj2sX.mjs\";\nimport { blindCast } from \"@internal/utils/casts\";\n//#region src/pack/index.ts\nconst SUPABASE_SPACE_ID = \"supabase\";\nfunction buildContractSpace(contractOverride) {\n\tconst contract = blindCast(contractOverride ?? contract_default);\n\treturn {\n\t\tcontractJson: contract,\n\t\tmigrations: [],\n\t\theadRef: {\n\t\t\thash: contract.storage.storageHash,\n\t\t\tinvariants: []\n\t\t}\n\t};\n}\nconst supabasePackBase = {\n\tkind: \"extension\",\n\tid: SUPABASE_SPACE_ID,\n\tfamilyId: \"sql\",\n\ttargetId: \"postgres\",\n\tversion,\n\tcontractSpace: buildContractSpace(),\n\tcreate: () => ({\n\t\tfamilyId: \"sql\",\n\t\ttargetId: \"postgres\"\n\t})\n};\nconst supabasePack = supabasePackBase;\n/*\n Returns a pack using `contractOverride` in place of the shipped\n* `contract.json` when provided, otherwise returns the default pack.\n\n Intended for tests that need to drive the framework with a synthetic\n* contract while still exercising the full descriptor wiring.\n*/\nfunction supabasePackWith(options) {\n\tif (options?.contractOverride === void 0) return supabasePack;\n\treturn {\n\t\t...supabasePackBase,\n\t\tcontractSpace: buildContractSpace(options.contractOverride)\n\t};\n}\n//#endregion\nexport { supabasePack as default, supabasePackWith };\n\n//# sourceMappingURL=pack.mjs.map"],"mappings":";;;AAGA,MAAM,oBAAoB;AAC1B,SAAS,mBAAmB,kBAAkB;CAC7C,MAAM,WAAW,UAAU,oBAAoB,gBAAgB;CAC/D,OAAO;EACN,cAAc;EACd,YAAY,CAAC;EACb,SAAS;GACR,MAAM,SAAS,QAAQ;GACvB,YAAY,CAAC;EACd;CACD;AACD;AACA,MAAM,mBAAmB;CACxB,MAAM;CACN,IAAI;CACJ,UAAU;CACV,UAAU;CACV;CACA,eAAe,mBAAmB;CAClC,eAAe;EACd,UAAU;EACV,UAAU;CACX;AACD;AACA,MAAM,eAAe;;;;;;;;AAQrB,SAAS,iBAAiB,SAAS;CAClC,IAAI,SAAS,qBAAqB,KAAK,GAAG,OAAO;CACjD,OAAO;EACN,GAAG;EACH,eAAe,mBAAmB,QAAQ,gBAAgB;CAC3D;AACD"}

package/dist/runtime.mjs CHANGED Viewed

@@ -1,4 +1,4 @@
-import { n as version, t as contract_default } from "./contract-C395bPz6-Bg0ja_CK.mjs";
+import { n as version, t as contract_default } from "./contract-DdvPj2sX-3jRwmZSN.mjs";
 import { a as isSupabaseRole, n as SupabaseRole, t as SUPABASE_JWT_ROLE_CLAIM } from "./roles-D5vC3rNp-tYQlvifU.mjs";
 import { blindCast } from "@prisma/orm-framework/utils/casts";
 import postgresAdapter from "@prisma/orm-target-postgres/adapter/runtime";

package/dist/runtime.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"runtime.mjs","names":[],"sources":["../../../../3-extensions/supabase/dist/runtime.mjs"],"sourcesContent":["import { n as version, t as contract_default } from \"./contract-C395bPz6.mjs\";\nimport { a as isSupabaseRole, n as SupabaseRole, t as SUPABASE_JWT_ROLE_CLAIM } from \"./roles-D5vC3rNp.mjs\";\nimport { blindCast } from \"@internal/utils/casts\";\nimport postgresAdapter from \"@internal/adapter-postgres/runtime\";\nimport postgresDriver from \"@internal/driver-postgres/runtime\";\nimport { instantiateExecutionStack } from \"@internal/framework-components/execution\";\nimport { PostgresRuntimeImpl, buildNamespacedNativeEnums, isPgPool } from \"@internal/postgres/runtime\";\nimport { sql } from \"@internal/sql-builder/runtime\";\nimport { orm } from \"@internal/sql-orm-client\";\nimport { createRawSql } from \"@internal/sql-relational-core/expression\";\nimport { createExecutionContext, createSqlExecutionStack, withTransaction } from \"@internal/sql-runtime\";\nimport postgresTarget, { PostgresContractSerializer } from \"@internal/target-postgres/runtime\";\nimport { ifDefined } from \"@internal/utils/defined\";\nimport { InternalError } from \"@internal/utils/internal-error\";\nimport { createRemoteJWKSet, decodeProtectedHeader, jwtVerify } from \"jose\";\nimport { Pool } from \"pg\";\nimport { structuredError } from \"@internal/utils/structured-error\";\nimport { AsyncIterableResult } from \"@internal/framework-components/runtime\";\n//#region src/runtime/descriptor.ts\n/*\n Tells the runtime that the Supabase pack's runtime component is available.\n\n When a contract declares the Supabase pack, the runtime checks that a\n* matching descriptor has been registered. Without this, loading a Supabase\n* contract errors with \"pack runtime component missing\". The `supabase()`\n* factory registers this descriptor automatically — app code never needs to\n* reference it directly.\n/\nconst supabaseRuntimeDescriptor = {\n\tkind: \"extension\",\n\tid: \"supabase\",\n\tversion,\n\tfamilyId: \"sql\",\n\ttargetId: \"postgres\",\n\tcodecs: () => [],\n\tcreate() {\n\t\treturn {\n\t\t\tfamilyId: \"sql\",\n\t\t\ttargetId: \"postgres\"\n\t\t};\n\t}\n};\n//#endregion\n//#region src/runtime/supabase-errors.ts\nfunction supabaseError(code, message, options) {\n\treturn structuredError(code, message, options);\n}\n//#endregion\n//#region src/runtime/supabase-runtime.ts\nvar SupabaseRuntimeImpl = class extends PostgresRuntimeImpl {\n\t/\n\t Opens a raw connection and applies role + JWT claims via session-scoped set_config.\n\t* On bind failure, destroys the connection before rethrowing — no leaked connections.\n\t* Not on the `SupabaseRuntime` interface; consumed by the facade, not by app code.\n\t/\n\tasync openRoleSession(binding) {\n\t\tconst conn = await this.acquireRawConnection();\n\t\ttry {\n\t\t\tawait conn.query(\"SELECT set_config($1, $2, false)\", [\"role\", binding.role]);\n\t\t\tawait conn.query(\"SELECT set_config($1, $2, false)\", [\"request.jwt.claims\", JSON.stringify(binding.claims ?? {})]);\n\t\t} catch (err) {\n\t\t\tawait conn.destroy(err).catch(() => void 0);\n\t\t\tthrow err;\n\t\t}\n\t\tconst self = this;\n\t\treturn {\n\t\t\texecute(plan, options) {\n\t\t\t\treturn self.executeAgainstQueryable(plan, conn, {\n\t\t\t\t\t...options,\n\t\t\t\t\tscope: \"connection\"\n\t\t\t\t});\n\t\t\t},\n\t\t\texecutePrepared(ps, params, options) {\n\t\t\t\treturn self.executePreparedAgainstQueryable(blindCast(ps), blindCast(params), conn, {\n\t\t\t\t\t...options,\n\t\t\t\t\tscope: \"connection\"\n\t\t\t\t});\n\t\t\t},\n\t\t\tasync transaction() {\n\t\t\t\tconst tx = await conn.beginTransaction();\n\t\t\t\treturn {\n\t\t\t\t\tasync commit() {\n\t\t\t\t\t\tawait tx.commit();\n\t\t\t\t\t},\n\t\t\t\t\tasync rollback() {\n\t\t\t\t\t\tawait tx.rollback();\n\t\t\t\t\t},\n\t\t\t\t\texecute(plan, options) {\n\t\t\t\t\t\treturn self.executeAgainstQueryable(plan, tx, {\n\t\t\t\t\t\t\t...options,\n\t\t\t\t\t\t\tscope: \"transaction\"\n\t\t\t\t\t\t});\n\t\t\t\t\t},\n\t\t\t\t\texecutePrepared(ps, params, options) {\n\t\t\t\t\t\treturn self.executePreparedAgainstQueryable(blindCast(ps), blindCast(params), tx, {\n\t\t\t\t\t\t\t...options,\n\t\t\t\t\t\t\tscope: \"transaction\"\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t};\n\t\t\t},\n\t\t\t/\n\t\t\t Resets all session-local config then releases the connection back to the pool.\n\t\t\t* If RESET ALL fails, destroys the connection instead — pool-poisoning guarantee.\n\t\t\t/\n\t\t\tasync release() {\n\t\t\t\ttry {\n\t\t\t\t\tawait conn.query(\"RESET ALL\");\n\t\t\t\t\tawait conn.release();\n\t\t\t\t} catch (resetError) {\n\t\t\t\t\tawait conn.destroy(resetError).catch(() => void 0);\n\t\t\t\t}\n\t\t\t},\n\t\t\tasync destroy(reason) {\n\t\t\t\tawait conn.destroy(reason);\n\t\t\t}\n\t\t};\n\t}\n\t/\n\t Opens a role session, executes the plan, then releases after the stream drains.\n\t* On mid-stream error, destroys the session instead of releasing.\n\t/\n\texecuteWithRole(plan, binding, options) {\n\t\tconst self = this;\n\t\tconst generator = async function () {\n\t\t\tconst session = await self.openRoleSession(binding);\n\t\t\tlet errored = false;\n\t\t\ttry {\n\t\t\t\tfor await (const row of session.execute(plan, options)) yield row;\n\t\t\t} catch (err) {\n\t\t\t\terrored = true;\n\t\t\t\tawait session.destroy(err).catch(() => void 0);\n\t\t\t\tthrow err;\n\t\t\t} finally {\n\t\t\t\tif (!errored) await session.release();\n\t\t\t}\n\t\t};\n\t\treturn new AsyncIterableResult(generator());\n\t}\n};\n//#endregion\n//#region src/runtime/supabase.ts\nfunction hasContractJson(options) {\n\treturn \"contractJson\" in options;\n}\nconst contractSerializer = new PostgresContractSerializer();\nfunction resolveContract(options) {\n\tconst contractJson = hasContractJson(options) ? options.contractJson : contractSerializer.serializeContract(options.contract);\n\treturn blindCast(contractSerializer.deserializeContract(contractJson));\n}\nfunction resolveKeyMaterial(options) {\n\tconst jwtSecret = \"jwtSecret\" in options ? options.jwtSecret : void 0;\n\tconst jwksUrl = \"jwksUrl\" in options ? options.jwksUrl : void 0;\n\tif (jwtSecret !== void 0 && jwksUrl !== void 0) throw supabaseError(\"SUPABASE.CONFIG_INVALID\", \"Provide either jwtSecret or jwksUrl, not both\", { meta: { reason: \"both jwtSecret and jwksUrl provided\" } });\n\tif (jwtSecret !== void 0) return {\n\t\tkind: \"secret\",\n\t\tkey: new TextEncoder().encode(jwtSecret)\n\t};\n\tif (jwksUrl !== void 0) return {\n\t\tkind: \"jwks\",\n\t\tkeyset: createRemoteJWKSet(new URL(jwksUrl))\n\t};\n\tthrow supabaseError(\"SUPABASE.CONFIG_INVALID\", \"Either jwtSecret or jwksUrl is required\", { meta: { reason: \"neither jwtSecret nor jwksUrl provided\" } });\n}\n/*\n Pre-verification check that the token's signing algorithm can possibly\n* match the configured key material. Without it the mismatch surfaces as a\n* jose internal (\"Key for the ES256 algorithm must be one of type\n* CryptoKey... Received an instance of Uint8Array\") that never names the\n* actual problem: current Supabase projects sign ES256 via JWKS by default,\n* while `supabase status` still prints a JWT_SECRET that only fits legacy\n* HS256 projects. Returns `undefined` when the pairing is plausible or the\n* header is unreadable (jwtVerify then produces the canonical error).\n/\nfunction algKeyMismatchReason(jwt, kind) {\n\tlet alg;\n\ttry {\n\t\talg = decodeProtectedHeader(jwt).alg;\n\t} catch {\n\t\treturn;\n\t}\n\tif (alg === void 0) return void 0;\n\tconst asymmetric = /^(?:ES\|RS\|PS)\\d{3}$/.test(alg) \|\| alg === \"EdDSA\" \|\| alg === \"Ed25519\";\n\tif (kind === \"secret\" && asymmetric) return `token is signed with ${alg} but this client is configured with jwtSecret (HS256). Current Supabase projects sign with asymmetric keys by default — configure jwksUrl (https://<project>/auth/v1/.well-known/jwks.json) instead of jwtSecret.`;\n\tif (kind === \"jwks\" && alg.startsWith(\"HS\")) return `token is signed with ${alg} (a symmetric algorithm) but this client is configured with jwksUrl. A legacy HS256 Supabase project needs jwtSecret (the JWT_SECRET from \\`supabase status\\`) instead of jwksUrl.`;\n}\nfunction toPool(options) {\n\tif (options.pg !== void 0 && isPgPool(options.pg)) return {\n\t\tpool: options.pg,\n\t\towned: false\n\t};\n\tif (typeof options.url === \"string\") return {\n\t\tpool: new Pool({\n\t\t\tconnectionString: options.url,\n\t\t\tconnectionTimeoutMillis: options.poolOptions?.connectionTimeoutMillis ?? 2e4,\n\t\t\tidleTimeoutMillis: options.poolOptions?.idleTimeoutMillis ?? 3e4\n\t\t}),\n\t\towned: true\n\t};\n}\nfunction withSupabaseDescriptor(extensions) {\n\tconst packs = extensions ?? [];\n\treturn packs.some((pack) => pack.id === supabaseRuntimeDescriptor.id) ? packs : [...packs, supabaseRuntimeDescriptor];\n}\n/\n Deserializes the Supabase extension's own emitted contract into a runtime\n* contract: namespaces hydrate into `PostgresSchema` instances (with\n* `qualifyTable`), and `typeRef` columns (`Timestamptz`, `Uuid`) resolve\n* through the codec registry. Exposed only via `service_role`'s `.supabase`\n* secondary root — never merged into the app contract.\n*/\nfunction buildExtensionContract() {\n\treturn blindCast(contractSerializer.deserializeContract(contract_default));\n}\nasync function supabase(options) {\n\tconst keyMaterial = resolveKeyMaterial(options);\n\tconst contract = resolveContract(options);\n\tconst stack = createSqlExecutionStack({\n\t\ttarget: postgresTarget,\n\t\tadapter: postgresAdapter,\n\t\tdriver: postgresDriver,\n\t\textensions: withSupabaseDescriptor(options.extensions)\n\t});\n\tconst context = createExecutionContext({\n\t\tcontract,\n\t\tstack\n\t});\n\tconst rawCodecInferer = stack.adapter.rawCodecInferer;\n\tconst rawSqlTag = createRawSql(rawCodecInferer);\n\tconst poolEntry = toPool(options);\n\tlet closed = false;\n\tconst stackInstance = instantiateExecutionStack(stack);\n\tconst driverDescriptor = stack.driver;\n\tif (!driverDescriptor) throw new InternalError(\"Driver descriptor missing from execution stack\");\n\tconst driver = driverDescriptor.create({ cursor: { disabled: true } });\n\tif (poolEntry) await driver.connect({\n\t\tkind: \"pgPool\",\n\t\tpool: poolEntry.pool\n\t});\n\tconst runtime = new SupabaseRuntimeImpl({\n\t\tcontext,\n\t\tadapter: stackInstance.adapter,\n\t\tdriver,\n\t\t...ifDefined(\"verifyMarker\", options.verifyMarker),\n\t\t...ifDefined(\"middleware\", options.middleware)\n\t});\n\tasync function verifyJwt(jwt) {\n\t\tconst mismatch = algKeyMismatchReason(jwt, keyMaterial.kind);\n\t\tif (mismatch !== void 0) throw supabaseError(\"SUPABASE.JWT_INVALID\", `Invalid JWT: ${mismatch}`, { meta: { reason: mismatch } });\n\t\ttry {\n\t\t\tif (keyMaterial.kind === \"secret\") return await jwtVerify(jwt, keyMaterial.key);\n\t\t\treturn await jwtVerify(jwt, keyMaterial.keyset);\n\t\t} catch (err) {\n\t\t\tconst reason = err instanceof Error ? err.message : String(err);\n\t\t\tthrow supabaseError(\"SUPABASE.JWT_INVALID\", `Invalid JWT: ${reason}`, {\n\t\t\t\tmeta: { reason },\n\t\t\t\tcause: err\n\t\t\t});\n\t\t}\n\t}\n\tfunction buildRoleBoundDbWithContext(binding, roleContext, roleRuntime) {\n\t\treturn {\n\t\t\tsql: sql({\n\t\t\t\tcontext: roleContext,\n\t\t\t\trawCodecInferer\n\t\t\t}),\n\t\t\torm: orm({\n\t\t\t\truntime: {\n\t\t\t\t\texecute(plan) {\n\t\t\t\t\t\treturn roleRuntime.executeWithRole(plan, binding);\n\t\t\t\t\t},\n\t\t\t\t\tconnection: () => roleRuntime.openRoleSession(binding)\n\t\t\t\t},\n\t\t\t\tcontext: roleContext\n\t\t\t}),\n\t\t\traw: rawSqlTag,\n\t\t\texecute(plan, execOptions) {\n\t\t\t\treturn roleRuntime.executeWithRole(plan, binding, execOptions);\n\t\t\t},\n\t\t\ttransaction(fn) {\n\t\t\t\treturn withTransaction({ connection: () => roleRuntime.openRoleSession(binding) }, fn);\n\t\t\t}\n\t\t};\n\t}\n\tfunction buildRoleBoundDb(binding) {\n\t\treturn buildRoleBoundDbWithContext(binding, context, runtime);\n\t}\n\tconst serviceRoleBinding = {\n\t\trole: SupabaseRole.members.ServiceRole,\n\t\tclaims: {}\n\t};\n\tconst extContract = buildExtensionContract();\n\tconst extContext = createExecutionContext({\n\t\tcontract: extContract,\n\t\tstack\n\t});\n\tconst extRuntime = new SupabaseRuntimeImpl({\n\t\tcontext: extContext,\n\t\tadapter: stackInstance.adapter,\n\t\tdriver,\n\t\tverifyMarker: false,\n\t\t...ifDefined(\"middleware\", options.middleware)\n\t});\n\tconst extNativeEnums = blindCast(Object.freeze(buildNamespacedNativeEnums(extContract.storage)));\n\tconst supabaseInternal = {\n\t\tsql: sql({\n\t\t\tcontext: extContext,\n\t\t\trawCodecInferer\n\t\t}),\n\t\torm: orm({\n\t\t\truntime: {\n\t\t\t\texecute(plan) {\n\t\t\t\t\treturn extRuntime.executeWithRole(plan, serviceRoleBinding);\n\t\t\t\t},\n\t\t\t\tconnection: () => extRuntime.openRoleSession(serviceRoleBinding)\n\t\t\t},\n\t\t\tcontext: extContext\n\t\t}),\n\t\tnativeEnums: extNativeEnums,\n\t\texecute(plan, execOptions) {\n\t\t\treturn extRuntime.executeWithRole(plan, serviceRoleBinding, execOptions);\n\t\t}\n\t};\n\tasync function closeDb() {\n\t\tif (closed) return;\n\t\tclosed = true;\n\t\tawait runtime.close();\n\t\tif (poolEntry?.owned) await poolEntry.pool.end().catch(() => void 0);\n\t}\n\treturn {\n\t\tcontext,\n\t\tstack,\n\t\tasync asUser(jwt) {\n\t\t\tconst { payload } = await verifyJwt(jwt);\n\t\t\tconst rawRole = payload[SUPABASE_JWT_ROLE_CLAIM];\n\t\t\tconst roleStr = typeof rawRole === \"string\" ? rawRole : SupabaseRole.members.Authenticated;\n\t\t\treturn buildRoleBoundDb({\n\t\t\t\trole: isSupabaseRole(roleStr) ? roleStr : SupabaseRole.members.Authenticated,\n\t\t\t\tclaims: payload\n\t\t\t});\n\t\t},\n\t\tasAnon() {\n\t\t\treturn buildRoleBoundDb({\n\t\t\t\trole: SupabaseRole.members.Anon,\n\t\t\t\tclaims: {}\n\t\t\t});\n\t\t},\n\t\tasServiceRole() {\n\t\t\treturn {\n\t\t\t\t...buildRoleBoundDbWithContext(serviceRoleBinding, context, runtime),\n\t\t\t\tsupabase: supabaseInternal\n\t\t\t};\n\t\t},\n\t\tclose: closeDb,\n\t\t[Symbol.asyncDispose]: closeDb\n\t};\n}\n//#endregion\n//#region src/exports/runtime.ts\nvar runtime_default = supabaseRuntimeDescriptor;\n//#endregion\nexport { SupabaseRuntimeImpl, runtime_default as default, supabase };\n\n//# sourceMappingURL=runtime.mjs.map"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,4BAA4B;CACjC,MAAM;CACN,IAAI;CACJ;CACA,UAAU;CACV,UAAU;CACV,cAAc,CAAC;CACf,SAAS;EACR,OAAO;GACN,UAAU;GACV,UAAU;EACX;CACD;AACD;AAGA,SAAS,cAAc,MAAM,SAAS,SAAS;CAC9C,OAAO,gBAAgB,MAAM,SAAS,OAAO;AAC9C;AAGA,IAAI,sBAAsB,cAAc,oBAAoB;;;;;;CAM3D,MAAM,gBAAgB,SAAS;EAC9B,MAAM,OAAO,MAAM,KAAK,qBAAqB;EAC7C,IAAI;GACH,MAAM,KAAK,MAAM,oCAAoC,CAAC,QAAQ,QAAQ,IAAI,CAAC;GAC3E,MAAM,KAAK,MAAM,oCAAoC,CAAC,sBAAsB,KAAK,UAAU,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC;EAClH,SAAS,KAAK;GACb,MAAM,KAAK,QAAQ,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC;GAC1C,MAAM;EACP;EACA,MAAM,OAAO;EACb,OAAO;GACN,QAAQ,MAAM,SAAS;IACtB,OAAO,KAAK,wBAAwB,MAAM,MAAM;KAC/C,GAAG;KACH,OAAO;IACR,CAAC;GACF;GACA,gBAAgB,IAAI,QAAQ,SAAS;IACpC,OAAO,KAAK,gCAAgC,UAAU,EAAE,GAAG,UAAU,MAAM,GAAG,MAAM;KACnF,GAAG;KACH,OAAO;IACR,CAAC;GACF;GACA,MAAM,cAAc;IACnB,MAAM,KAAK,MAAM,KAAK,iBAAiB;IACvC,OAAO;KACN,MAAM,SAAS;MACd,MAAM,GAAG,OAAO;KACjB;KACA,MAAM,WAAW;MAChB,MAAM,GAAG,SAAS;KACnB;KACA,QAAQ,MAAM,SAAS;MACtB,OAAO,KAAK,wBAAwB,MAAM,IAAI;OAC7C,GAAG;OACH,OAAO;MACR,CAAC;KACF;KACA,gBAAgB,IAAI,QAAQ,SAAS;MACpC,OAAO,KAAK,gCAAgC,UAAU,EAAE,GAAG,UAAU,MAAM,GAAG,IAAI;OACjF,GAAG;OACH,OAAO;MACR,CAAC;KACF;IACD;GACD;;;;;GAKA,MAAM,UAAU;IACf,IAAI;KACH,MAAM,KAAK,MAAM,WAAW;KAC5B,MAAM,KAAK,QAAQ;IACpB,SAAS,YAAY;KACpB,MAAM,KAAK,QAAQ,UAAU,CAAC,CAAC,YAAY,KAAK,CAAC;IAClD;GACD;GACA,MAAM,QAAQ,QAAQ;IACrB,MAAM,KAAK,QAAQ,MAAM;GAC1B;EACD;CACD;;;;;CAKA,gBAAgB,MAAM,SAAS,SAAS;EACvC,MAAM,OAAO;EACb,MAAM,YAAY,mBAAmB;GACpC,MAAM,UAAU,MAAM,KAAK,gBAAgB,OAAO;GAClD,IAAI,UAAU;GACd,IAAI;IACH,WAAW,MAAM,OAAO,QAAQ,QAAQ,MAAM,OAAO,GAAG,MAAM;GAC/D,SAAS,KAAK;IACb,UAAU;IACV,MAAM,QAAQ,QAAQ,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC;IAC7C,MAAM;GACP,UAAU;IACT,IAAI,CAAC,SAAS,MAAM,QAAQ,QAAQ;GACrC;EACD;EACA,OAAO,IAAI,oBAAoB,UAAU,CAAC;CAC3C;AACD;AAGA,SAAS,gBAAgB,SAAS;CACjC,OAAO,kBAAkB;AAC1B;AACA,MAAM,qBAAqB,IAAI,2BAA2B;AAC1D,SAAS,gBAAgB,SAAS;CACjC,MAAM,eAAe,gBAAgB,OAAO,IAAI,QAAQ,eAAe,mBAAmB,kBAAkB,QAAQ,QAAQ;CAC5H,OAAO,UAAU,mBAAmB,oBAAoB,YAAY,CAAC;AACtE;AACA,SAAS,mBAAmB,SAAS;CACpC,MAAM,YAAY,eAAe,UAAU,QAAQ,YAAY,KAAK;CACpE,MAAM,UAAU,aAAa,UAAU,QAAQ,UAAU,KAAK;CAC9D,IAAI,cAAc,KAAK,KAAK,YAAY,KAAK,GAAG,MAAM,cAAc,2BAA2B,iDAAiD,EAAE,MAAM,EAAE,QAAQ,sCAAsC,EAAE,CAAC;CAC3M,IAAI,cAAc,KAAK,GAAG,OAAO;EAChC,MAAM;EACN,KAAK,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS;CACxC;CACA,IAAI,YAAY,KAAK,GAAG,OAAO;EAC9B,MAAM;EACN,QAAQ,mBAAmB,IAAI,IAAI,OAAO,CAAC;CAC5C;CACA,MAAM,cAAc,2BAA2B,2CAA2C,EAAE,MAAM,EAAE,QAAQ,yCAAyC,EAAE,CAAC;AACzJ;;;;;;;;;;;AAWA,SAAS,qBAAqB,KAAK,MAAM;CACxC,IAAI;CACJ,IAAI;EACH,MAAM,sBAAsB,GAAG,CAAC,CAAC;CAClC,QAAQ;EACP;CACD;CACA,IAAI,QAAQ,KAAK,GAAG,OAAO,KAAK;CAChC,MAAM,aAAa,sBAAsB,KAAK,GAAG,KAAK,QAAQ,WAAW,QAAQ;CACjF,IAAI,SAAS,YAAY,YAAY,OAAO,wBAAwB,IAAI;CACxE,IAAI,SAAS,UAAU,IAAI,WAAW,IAAI,GAAG,OAAO,wBAAwB,IAAI;AACjF;AACA,SAAS,OAAO,SAAS;CACxB,IAAI,QAAQ,OAAO,KAAK,KAAK,SAAS,QAAQ,EAAE,GAAG,OAAO;EACzD,MAAM,QAAQ;EACd,OAAO;CACR;CACA,IAAI,OAAO,QAAQ,QAAQ,UAAU,OAAO;EAC3C,MAAM,IAAI,KAAK;GACd,kBAAkB,QAAQ;GAC1B,yBAAyB,QAAQ,aAAa,2BAA2B;GACzE,mBAAmB,QAAQ,aAAa,qBAAqB;EAC9D,CAAC;EACD,OAAO;CACR;AACD;AACA,SAAS,uBAAuB,YAAY;CAC3C,MAAM,QAAQ,cAAc,CAAC;CAC7B,OAAO,MAAM,MAAM,SAAS,KAAK,OAAO,0BAA0B,EAAE,IAAI,QAAQ,CAAC,GAAG,OAAO,yBAAyB;AACrH;;;;;;;;AAQA,SAAS,yBAAyB;CACjC,OAAO,UAAU,mBAAmB,oBAAoB,gBAAgB,CAAC;AAC1E;AACA,eAAe,SAAS,SAAS;CAChC,MAAM,cAAc,mBAAmB,OAAO;CAC9C,MAAM,WAAW,gBAAgB,OAAO;CACxC,MAAM,QAAQ,wBAAwB;EACrC,QAAQ;EACR,SAAS;EACT,QAAQ;EACR,YAAY,uBAAuB,QAAQ,UAAU;CACtD,CAAC;CACD,MAAM,UAAU,uBAAuB;EACtC;EACA;CACD,CAAC;CACD,MAAM,kBAAkB,MAAM,QAAQ;CACtC,MAAM,YAAY,aAAa,eAAe;CAC9C,MAAM,YAAY,OAAO,OAAO;CAChC,IAAI,SAAS;CACb,MAAM,gBAAgB,0BAA0B,KAAK;CACrD,MAAM,mBAAmB,MAAM;CAC/B,IAAI,CAAC,kBAAkB,MAAM,IAAI,cAAc,gDAAgD;CAC/F,MAAM,SAAS,iBAAiB,OAAO,EAAE,QAAQ,EAAE,UAAU,KAAK,EAAE,CAAC;CACrE,IAAI,WAAW,MAAM,OAAO,QAAQ;EACnC,MAAM;EACN,MAAM,UAAU;CACjB,CAAC;CACD,MAAM,UAAU,IAAI,oBAAoB;EACvC;EACA,SAAS,cAAc;EACvB;EACA,GAAG,UAAU,gBAAgB,QAAQ,YAAY;EACjD,GAAG,UAAU,cAAc,QAAQ,UAAU;CAC9C,CAAC;CACD,eAAe,UAAU,KAAK;EAC7B,MAAM,WAAW,qBAAqB,KAAK,YAAY,IAAI;EAC3D,IAAI,aAAa,KAAK,GAAG,MAAM,cAAc,wBAAwB,gBAAgB,YAAY,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;EAC/H,IAAI;GACH,IAAI,YAAY,SAAS,UAAU,OAAO,MAAM,UAAU,KAAK,YAAY,GAAG;GAC9E,OAAO,MAAM,UAAU,KAAK,YAAY,MAAM;EAC/C,SAAS,KAAK;GACb,MAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC9D,MAAM,cAAc,wBAAwB,gBAAgB,UAAU;IACrE,MAAM,EAAE,OAAO;IACf,OAAO;GACR,CAAC;EACF;CACD;CACA,SAAS,4BAA4B,SAAS,aAAa,aAAa;EACvE,OAAO;GACN,KAAK,IAAI;IACR,SAAS;IACT;GACD,CAAC;GACD,KAAK,IAAI;IACR,SAAS;KACR,QAAQ,MAAM;MACb,OAAO,YAAY,gBAAgB,MAAM,OAAO;KACjD;KACA,kBAAkB,YAAY,gBAAgB,OAAO;IACtD;IACA,SAAS;GACV,CAAC;GACD,KAAK;GACL,QAAQ,MAAM,aAAa;IAC1B,OAAO,YAAY,gBAAgB,MAAM,SAAS,WAAW;GAC9D;GACA,YAAY,IAAI;IACf,OAAO,gBAAgB,EAAE,kBAAkB,YAAY,gBAAgB,OAAO,EAAE,GAAG,EAAE;GACtF;EACD;CACD;CACA,SAAS,iBAAiB,SAAS;EAClC,OAAO,4BAA4B,SAAS,SAAS,OAAO;CAC7D;CACA,MAAM,qBAAqB;EAC1B,MAAM,aAAa,QAAQ;EAC3B,QAAQ,CAAC;CACV;CACA,MAAM,cAAc,uBAAuB;CAC3C,MAAM,aAAa,uBAAuB;EACzC,UAAU;EACV;CACD,CAAC;CACD,MAAM,aAAa,IAAI,oBAAoB;EAC1C,SAAS;EACT,SAAS,cAAc;EACvB;EACA,cAAc;EACd,GAAG,UAAU,cAAc,QAAQ,UAAU;CAC9C,CAAC;CACD,MAAM,iBAAiB,UAAU,OAAO,OAAO,2BAA2B,YAAY,OAAO,CAAC,CAAC;CAC/F,MAAM,mBAAmB;EACxB,KAAK,IAAI;GACR,SAAS;GACT;EACD,CAAC;EACD,KAAK,IAAI;GACR,SAAS;IACR,QAAQ,MAAM;KACb,OAAO,WAAW,gBAAgB,MAAM,kBAAkB;IAC3D;IACA,kBAAkB,WAAW,gBAAgB,kBAAkB;GAChE;GACA,SAAS;EACV,CAAC;EACD,aAAa;EACb,QAAQ,MAAM,aAAa;GAC1B,OAAO,WAAW,gBAAgB,MAAM,oBAAoB,WAAW;EACxE;CACD;CACA,eAAe,UAAU;EACxB,IAAI,QAAQ;EACZ,SAAS;EACT,MAAM,QAAQ,MAAM;EACpB,IAAI,WAAW,OAAO,MAAM,UAAU,KAAK,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC;CACpE;CACA,OAAO;EACN;EACA;EACA,MAAM,OAAO,KAAK;GACjB,MAAM,EAAE,YAAY,MAAM,UAAU,GAAG;GACvC,MAAM,UAAU,QAAQ;GACxB,MAAM,UAAU,OAAO,YAAY,WAAW,UAAU,aAAa,QAAQ;GAC7E,OAAO,iBAAiB;IACvB,MAAM,eAAe,OAAO,IAAI,UAAU,aAAa,QAAQ;IAC/D,QAAQ;GACT,CAAC;EACF;EACA,SAAS;GACR,OAAO,iBAAiB;IACvB,MAAM,aAAa,QAAQ;IAC3B,QAAQ,CAAC;GACV,CAAC;EACF;EACA,gBAAgB;GACf,OAAO;IACN,GAAG,4BAA4B,oBAAoB,SAAS,OAAO;IACnE,UAAU;GACX;EACD;EACA,OAAO;GACN,OAAO,eAAe;CACxB;AACD;AAGA,IAAI,kBAAkB"}
1	+ {"version":3,"file":"runtime.mjs","names":[],"sources":["../../../../3-extensions/supabase/dist/runtime.mjs"],"sourcesContent":["import { n as version, t as contract_default } from \"./contract-DdvPj2sX.mjs\";\nimport { a as isSupabaseRole, n as SupabaseRole, t as SUPABASE_JWT_ROLE_CLAIM } from \"./roles-D5vC3rNp.mjs\";\nimport { blindCast } from \"@internal/utils/casts\";\nimport postgresAdapter from \"@internal/adapter-postgres/runtime\";\nimport postgresDriver from \"@internal/driver-postgres/runtime\";\nimport { instantiateExecutionStack } from \"@internal/framework-components/execution\";\nimport { PostgresRuntimeImpl, buildNamespacedNativeEnums, isPgPool } from \"@internal/postgres/runtime\";\nimport { sql } from \"@internal/sql-builder/runtime\";\nimport { orm } from \"@internal/sql-orm-client\";\nimport { createRawSql } from \"@internal/sql-relational-core/expression\";\nimport { createExecutionContext, createSqlExecutionStack, withTransaction } from \"@internal/sql-runtime\";\nimport postgresTarget, { PostgresContractSerializer } from \"@internal/target-postgres/runtime\";\nimport { ifDefined } from \"@internal/utils/defined\";\nimport { InternalError } from \"@internal/utils/internal-error\";\nimport { createRemoteJWKSet, decodeProtectedHeader, jwtVerify } from \"jose\";\nimport { Pool } from \"pg\";\nimport { structuredError } from \"@internal/utils/structured-error\";\nimport { AsyncIterableResult } from \"@internal/framework-components/runtime\";\n//#region src/runtime/descriptor.ts\n/*\n Tells the runtime that the Supabase pack's runtime component is available.\n\n When a contract declares the Supabase pack, the runtime checks that a\n* matching descriptor has been registered. Without this, loading a Supabase\n* contract errors with \"pack runtime component missing\". The `supabase()`\n* factory registers this descriptor automatically — app code never needs to\n* reference it directly.\n/\nconst supabaseRuntimeDescriptor = {\n\tkind: \"extension\",\n\tid: \"supabase\",\n\tversion,\n\tfamilyId: \"sql\",\n\ttargetId: \"postgres\",\n\tcodecs: () => [],\n\tcreate() {\n\t\treturn {\n\t\t\tfamilyId: \"sql\",\n\t\t\ttargetId: \"postgres\"\n\t\t};\n\t}\n};\n//#endregion\n//#region src/runtime/supabase-errors.ts\nfunction supabaseError(code, message, options) {\n\treturn structuredError(code, message, options);\n}\n//#endregion\n//#region src/runtime/supabase-runtime.ts\nvar SupabaseRuntimeImpl = class extends PostgresRuntimeImpl {\n\t/\n\t Opens a raw connection and applies role + JWT claims via session-scoped set_config.\n\t* On bind failure, destroys the connection before rethrowing — no leaked connections.\n\t* Not on the `SupabaseRuntime` interface; consumed by the facade, not by app code.\n\t/\n\tasync openRoleSession(binding) {\n\t\tconst conn = await this.acquireRawConnection();\n\t\ttry {\n\t\t\tawait conn.query(\"SELECT set_config($1, $2, false)\", [\"role\", binding.role]);\n\t\t\tawait conn.query(\"SELECT set_config($1, $2, false)\", [\"request.jwt.claims\", JSON.stringify(binding.claims ?? {})]);\n\t\t} catch (err) {\n\t\t\tawait conn.destroy(err).catch(() => void 0);\n\t\t\tthrow err;\n\t\t}\n\t\tconst self = this;\n\t\treturn {\n\t\t\texecute(plan, options) {\n\t\t\t\treturn self.executeAgainstQueryable(plan, conn, {\n\t\t\t\t\t...options,\n\t\t\t\t\tscope: \"connection\"\n\t\t\t\t});\n\t\t\t},\n\t\t\texecutePrepared(ps, params, options) {\n\t\t\t\treturn self.executePreparedAgainstQueryable(blindCast(ps), blindCast(params), conn, {\n\t\t\t\t\t...options,\n\t\t\t\t\tscope: \"connection\"\n\t\t\t\t});\n\t\t\t},\n\t\t\tasync transaction() {\n\t\t\t\tconst tx = await conn.beginTransaction();\n\t\t\t\treturn {\n\t\t\t\t\tasync commit() {\n\t\t\t\t\t\tawait tx.commit();\n\t\t\t\t\t},\n\t\t\t\t\tasync rollback() {\n\t\t\t\t\t\tawait tx.rollback();\n\t\t\t\t\t},\n\t\t\t\t\texecute(plan, options) {\n\t\t\t\t\t\treturn self.executeAgainstQueryable(plan, tx, {\n\t\t\t\t\t\t\t...options,\n\t\t\t\t\t\t\tscope: \"transaction\"\n\t\t\t\t\t\t});\n\t\t\t\t\t},\n\t\t\t\t\texecutePrepared(ps, params, options) {\n\t\t\t\t\t\treturn self.executePreparedAgainstQueryable(blindCast(ps), blindCast(params), tx, {\n\t\t\t\t\t\t\t...options,\n\t\t\t\t\t\t\tscope: \"transaction\"\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t};\n\t\t\t},\n\t\t\t/\n\t\t\t Resets all session-local config then releases the connection back to the pool.\n\t\t\t* If RESET ALL fails, destroys the connection instead — pool-poisoning guarantee.\n\t\t\t/\n\t\t\tasync release() {\n\t\t\t\ttry {\n\t\t\t\t\tawait conn.query(\"RESET ALL\");\n\t\t\t\t\tawait conn.release();\n\t\t\t\t} catch (resetError) {\n\t\t\t\t\tawait conn.destroy(resetError).catch(() => void 0);\n\t\t\t\t}\n\t\t\t},\n\t\t\tasync destroy(reason) {\n\t\t\t\tawait conn.destroy(reason);\n\t\t\t}\n\t\t};\n\t}\n\t/\n\t Opens a role session, executes the plan, then releases after the stream drains.\n\t* On mid-stream error, destroys the session instead of releasing.\n\t/\n\texecuteWithRole(plan, binding, options) {\n\t\tconst self = this;\n\t\tconst generator = async function () {\n\t\t\tconst session = await self.openRoleSession(binding);\n\t\t\tlet errored = false;\n\t\t\ttry {\n\t\t\t\tfor await (const row of session.execute(plan, options)) yield row;\n\t\t\t} catch (err) {\n\t\t\t\terrored = true;\n\t\t\t\tawait session.destroy(err).catch(() => void 0);\n\t\t\t\tthrow err;\n\t\t\t} finally {\n\t\t\t\tif (!errored) await session.release();\n\t\t\t}\n\t\t};\n\t\treturn new AsyncIterableResult(generator());\n\t}\n};\n//#endregion\n//#region src/runtime/supabase.ts\nfunction hasContractJson(options) {\n\treturn \"contractJson\" in options;\n}\nconst contractSerializer = new PostgresContractSerializer();\nfunction resolveContract(options) {\n\tconst contractJson = hasContractJson(options) ? options.contractJson : contractSerializer.serializeContract(options.contract);\n\treturn blindCast(contractSerializer.deserializeContract(contractJson));\n}\nfunction resolveKeyMaterial(options) {\n\tconst jwtSecret = \"jwtSecret\" in options ? options.jwtSecret : void 0;\n\tconst jwksUrl = \"jwksUrl\" in options ? options.jwksUrl : void 0;\n\tif (jwtSecret !== void 0 && jwksUrl !== void 0) throw supabaseError(\"SUPABASE.CONFIG_INVALID\", \"Provide either jwtSecret or jwksUrl, not both\", { meta: { reason: \"both jwtSecret and jwksUrl provided\" } });\n\tif (jwtSecret !== void 0) return {\n\t\tkind: \"secret\",\n\t\tkey: new TextEncoder().encode(jwtSecret)\n\t};\n\tif (jwksUrl !== void 0) return {\n\t\tkind: \"jwks\",\n\t\tkeyset: createRemoteJWKSet(new URL(jwksUrl))\n\t};\n\tthrow supabaseError(\"SUPABASE.CONFIG_INVALID\", \"Either jwtSecret or jwksUrl is required\", { meta: { reason: \"neither jwtSecret nor jwksUrl provided\" } });\n}\n/*\n Pre-verification check that the token's signing algorithm can possibly\n* match the configured key material. Without it the mismatch surfaces as a\n* jose internal (\"Key for the ES256 algorithm must be one of type\n* CryptoKey... Received an instance of Uint8Array\") that never names the\n* actual problem: current Supabase projects sign ES256 via JWKS by default,\n* while `supabase status` still prints a JWT_SECRET that only fits legacy\n* HS256 projects. Returns `undefined` when the pairing is plausible or the\n* header is unreadable (jwtVerify then produces the canonical error).\n/\nfunction algKeyMismatchReason(jwt, kind) {\n\tlet alg;\n\ttry {\n\t\talg = decodeProtectedHeader(jwt).alg;\n\t} catch {\n\t\treturn;\n\t}\n\tif (alg === void 0) return void 0;\n\tconst asymmetric = /^(?:ES\|RS\|PS)\\d{3}$/.test(alg) \|\| alg === \"EdDSA\" \|\| alg === \"Ed25519\";\n\tif (kind === \"secret\" && asymmetric) return `token is signed with ${alg} but this client is configured with jwtSecret (HS256). Current Supabase projects sign with asymmetric keys by default — configure jwksUrl (https://<project>/auth/v1/.well-known/jwks.json) instead of jwtSecret.`;\n\tif (kind === \"jwks\" && alg.startsWith(\"HS\")) return `token is signed with ${alg} (a symmetric algorithm) but this client is configured with jwksUrl. A legacy HS256 Supabase project needs jwtSecret (the JWT_SECRET from \\`supabase status\\`) instead of jwksUrl.`;\n}\nfunction toPool(options) {\n\tif (options.pg !== void 0 && isPgPool(options.pg)) return {\n\t\tpool: options.pg,\n\t\towned: false\n\t};\n\tif (typeof options.url === \"string\") return {\n\t\tpool: new Pool({\n\t\t\tconnectionString: options.url,\n\t\t\tconnectionTimeoutMillis: options.poolOptions?.connectionTimeoutMillis ?? 2e4,\n\t\t\tidleTimeoutMillis: options.poolOptions?.idleTimeoutMillis ?? 3e4\n\t\t}),\n\t\towned: true\n\t};\n}\nfunction withSupabaseDescriptor(extensions) {\n\tconst packs = extensions ?? [];\n\treturn packs.some((pack) => pack.id === supabaseRuntimeDescriptor.id) ? packs : [...packs, supabaseRuntimeDescriptor];\n}\n/\n Deserializes the Supabase extension's own emitted contract into a runtime\n* contract: namespaces hydrate into `PostgresSchema` instances (with\n* `qualifyTable`), and `typeRef` columns (`Timestamptz`, `Uuid`) resolve\n* through the codec registry. Exposed only via `service_role`'s `.supabase`\n* secondary root — never merged into the app contract.\n*/\nfunction buildExtensionContract() {\n\treturn blindCast(contractSerializer.deserializeContract(contract_default));\n}\nasync function supabase(options) {\n\tconst keyMaterial = resolveKeyMaterial(options);\n\tconst contract = resolveContract(options);\n\tconst stack = createSqlExecutionStack({\n\t\ttarget: postgresTarget,\n\t\tadapter: postgresAdapter,\n\t\tdriver: postgresDriver,\n\t\textensions: withSupabaseDescriptor(options.extensions)\n\t});\n\tconst context = createExecutionContext({\n\t\tcontract,\n\t\tstack\n\t});\n\tconst rawCodecInferer = stack.adapter.rawCodecInferer;\n\tconst rawSqlTag = createRawSql(rawCodecInferer);\n\tconst poolEntry = toPool(options);\n\tlet closed = false;\n\tconst stackInstance = instantiateExecutionStack(stack);\n\tconst driverDescriptor = stack.driver;\n\tif (!driverDescriptor) throw new InternalError(\"Driver descriptor missing from execution stack\");\n\tconst driver = driverDescriptor.create({ cursor: { disabled: true } });\n\tif (poolEntry) await driver.connect({\n\t\tkind: \"pgPool\",\n\t\tpool: poolEntry.pool\n\t});\n\tconst runtime = new SupabaseRuntimeImpl({\n\t\tcontext,\n\t\tadapter: stackInstance.adapter,\n\t\tdriver,\n\t\t...ifDefined(\"verifyMarker\", options.verifyMarker),\n\t\t...ifDefined(\"middleware\", options.middleware)\n\t});\n\tasync function verifyJwt(jwt) {\n\t\tconst mismatch = algKeyMismatchReason(jwt, keyMaterial.kind);\n\t\tif (mismatch !== void 0) throw supabaseError(\"SUPABASE.JWT_INVALID\", `Invalid JWT: ${mismatch}`, { meta: { reason: mismatch } });\n\t\ttry {\n\t\t\tif (keyMaterial.kind === \"secret\") return await jwtVerify(jwt, keyMaterial.key);\n\t\t\treturn await jwtVerify(jwt, keyMaterial.keyset);\n\t\t} catch (err) {\n\t\t\tconst reason = err instanceof Error ? err.message : String(err);\n\t\t\tthrow supabaseError(\"SUPABASE.JWT_INVALID\", `Invalid JWT: ${reason}`, {\n\t\t\t\tmeta: { reason },\n\t\t\t\tcause: err\n\t\t\t});\n\t\t}\n\t}\n\tfunction buildRoleBoundDbWithContext(binding, roleContext, roleRuntime) {\n\t\treturn {\n\t\t\tsql: sql({\n\t\t\t\tcontext: roleContext,\n\t\t\t\trawCodecInferer\n\t\t\t}),\n\t\t\torm: orm({\n\t\t\t\truntime: {\n\t\t\t\t\texecute(plan) {\n\t\t\t\t\t\treturn roleRuntime.executeWithRole(plan, binding);\n\t\t\t\t\t},\n\t\t\t\t\tconnection: () => roleRuntime.openRoleSession(binding)\n\t\t\t\t},\n\t\t\t\tcontext: roleContext\n\t\t\t}),\n\t\t\traw: rawSqlTag,\n\t\t\texecute(plan, execOptions) {\n\t\t\t\treturn roleRuntime.executeWithRole(plan, binding, execOptions);\n\t\t\t},\n\t\t\ttransaction(fn) {\n\t\t\t\treturn withTransaction({ connection: () => roleRuntime.openRoleSession(binding) }, fn);\n\t\t\t}\n\t\t};\n\t}\n\tfunction buildRoleBoundDb(binding) {\n\t\treturn buildRoleBoundDbWithContext(binding, context, runtime);\n\t}\n\tconst serviceRoleBinding = {\n\t\trole: SupabaseRole.members.ServiceRole,\n\t\tclaims: {}\n\t};\n\tconst extContract = buildExtensionContract();\n\tconst extContext = createExecutionContext({\n\t\tcontract: extContract,\n\t\tstack\n\t});\n\tconst extRuntime = new SupabaseRuntimeImpl({\n\t\tcontext: extContext,\n\t\tadapter: stackInstance.adapter,\n\t\tdriver,\n\t\tverifyMarker: false,\n\t\t...ifDefined(\"middleware\", options.middleware)\n\t});\n\tconst extNativeEnums = blindCast(Object.freeze(buildNamespacedNativeEnums(extContract.storage)));\n\tconst supabaseInternal = {\n\t\tsql: sql({\n\t\t\tcontext: extContext,\n\t\t\trawCodecInferer\n\t\t}),\n\t\torm: orm({\n\t\t\truntime: {\n\t\t\t\texecute(plan) {\n\t\t\t\t\treturn extRuntime.executeWithRole(plan, serviceRoleBinding);\n\t\t\t\t},\n\t\t\t\tconnection: () => extRuntime.openRoleSession(serviceRoleBinding)\n\t\t\t},\n\t\t\tcontext: extContext\n\t\t}),\n\t\tnativeEnums: extNativeEnums,\n\t\texecute(plan, execOptions) {\n\t\t\treturn extRuntime.executeWithRole(plan, serviceRoleBinding, execOptions);\n\t\t}\n\t};\n\tasync function closeDb() {\n\t\tif (closed) return;\n\t\tclosed = true;\n\t\tawait runtime.close();\n\t\tif (poolEntry?.owned) await poolEntry.pool.end().catch(() => void 0);\n\t}\n\treturn {\n\t\tcontext,\n\t\tstack,\n\t\tasync asUser(jwt) {\n\t\t\tconst { payload } = await verifyJwt(jwt);\n\t\t\tconst rawRole = payload[SUPABASE_JWT_ROLE_CLAIM];\n\t\t\tconst roleStr = typeof rawRole === \"string\" ? rawRole : SupabaseRole.members.Authenticated;\n\t\t\treturn buildRoleBoundDb({\n\t\t\t\trole: isSupabaseRole(roleStr) ? roleStr : SupabaseRole.members.Authenticated,\n\t\t\t\tclaims: payload\n\t\t\t});\n\t\t},\n\t\tasAnon() {\n\t\t\treturn buildRoleBoundDb({\n\t\t\t\trole: SupabaseRole.members.Anon,\n\t\t\t\tclaims: {}\n\t\t\t});\n\t\t},\n\t\tasServiceRole() {\n\t\t\treturn {\n\t\t\t\t...buildRoleBoundDbWithContext(serviceRoleBinding, context, runtime),\n\t\t\t\tsupabase: supabaseInternal\n\t\t\t};\n\t\t},\n\t\tclose: closeDb,\n\t\t[Symbol.asyncDispose]: closeDb\n\t};\n}\n//#endregion\n//#region src/exports/runtime.ts\nvar runtime_default = supabaseRuntimeDescriptor;\n//#endregion\nexport { SupabaseRuntimeImpl, runtime_default as default, supabase };\n\n//# sourceMappingURL=runtime.mjs.map"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,4BAA4B;CACjC,MAAM;CACN,IAAI;CACJ;CACA,UAAU;CACV,UAAU;CACV,cAAc,CAAC;CACf,SAAS;EACR,OAAO;GACN,UAAU;GACV,UAAU;EACX;CACD;AACD;AAGA,SAAS,cAAc,MAAM,SAAS,SAAS;CAC9C,OAAO,gBAAgB,MAAM,SAAS,OAAO;AAC9C;AAGA,IAAI,sBAAsB,cAAc,oBAAoB;;;;;;CAM3D,MAAM,gBAAgB,SAAS;EAC9B,MAAM,OAAO,MAAM,KAAK,qBAAqB;EAC7C,IAAI;GACH,MAAM,KAAK,MAAM,oCAAoC,CAAC,QAAQ,QAAQ,IAAI,CAAC;GAC3E,MAAM,KAAK,MAAM,oCAAoC,CAAC,sBAAsB,KAAK,UAAU,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC;EAClH,SAAS,KAAK;GACb,MAAM,KAAK,QAAQ,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC;GAC1C,MAAM;EACP;EACA,MAAM,OAAO;EACb,OAAO;GACN,QAAQ,MAAM,SAAS;IACtB,OAAO,KAAK,wBAAwB,MAAM,MAAM;KAC/C,GAAG;KACH,OAAO;IACR,CAAC;GACF;GACA,gBAAgB,IAAI,QAAQ,SAAS;IACpC,OAAO,KAAK,gCAAgC,UAAU,EAAE,GAAG,UAAU,MAAM,GAAG,MAAM;KACnF,GAAG;KACH,OAAO;IACR,CAAC;GACF;GACA,MAAM,cAAc;IACnB,MAAM,KAAK,MAAM,KAAK,iBAAiB;IACvC,OAAO;KACN,MAAM,SAAS;MACd,MAAM,GAAG,OAAO;KACjB;KACA,MAAM,WAAW;MAChB,MAAM,GAAG,SAAS;KACnB;KACA,QAAQ,MAAM,SAAS;MACtB,OAAO,KAAK,wBAAwB,MAAM,IAAI;OAC7C,GAAG;OACH,OAAO;MACR,CAAC;KACF;KACA,gBAAgB,IAAI,QAAQ,SAAS;MACpC,OAAO,KAAK,gCAAgC,UAAU,EAAE,GAAG,UAAU,MAAM,GAAG,IAAI;OACjF,GAAG;OACH,OAAO;MACR,CAAC;KACF;IACD;GACD;;;;;GAKA,MAAM,UAAU;IACf,IAAI;KACH,MAAM,KAAK,MAAM,WAAW;KAC5B,MAAM,KAAK,QAAQ;IACpB,SAAS,YAAY;KACpB,MAAM,KAAK,QAAQ,UAAU,CAAC,CAAC,YAAY,KAAK,CAAC;IAClD;GACD;GACA,MAAM,QAAQ,QAAQ;IACrB,MAAM,KAAK,QAAQ,MAAM;GAC1B;EACD;CACD;;;;;CAKA,gBAAgB,MAAM,SAAS,SAAS;EACvC,MAAM,OAAO;EACb,MAAM,YAAY,mBAAmB;GACpC,MAAM,UAAU,MAAM,KAAK,gBAAgB,OAAO;GAClD,IAAI,UAAU;GACd,IAAI;IACH,WAAW,MAAM,OAAO,QAAQ,QAAQ,MAAM,OAAO,GAAG,MAAM;GAC/D,SAAS,KAAK;IACb,UAAU;IACV,MAAM,QAAQ,QAAQ,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC;IAC7C,MAAM;GACP,UAAU;IACT,IAAI,CAAC,SAAS,MAAM,QAAQ,QAAQ;GACrC;EACD;EACA,OAAO,IAAI,oBAAoB,UAAU,CAAC;CAC3C;AACD;AAGA,SAAS,gBAAgB,SAAS;CACjC,OAAO,kBAAkB;AAC1B;AACA,MAAM,qBAAqB,IAAI,2BAA2B;AAC1D,SAAS,gBAAgB,SAAS;CACjC,MAAM,eAAe,gBAAgB,OAAO,IAAI,QAAQ,eAAe,mBAAmB,kBAAkB,QAAQ,QAAQ;CAC5H,OAAO,UAAU,mBAAmB,oBAAoB,YAAY,CAAC;AACtE;AACA,SAAS,mBAAmB,SAAS;CACpC,MAAM,YAAY,eAAe,UAAU,QAAQ,YAAY,KAAK;CACpE,MAAM,UAAU,aAAa,UAAU,QAAQ,UAAU,KAAK;CAC9D,IAAI,cAAc,KAAK,KAAK,YAAY,KAAK,GAAG,MAAM,cAAc,2BAA2B,iDAAiD,EAAE,MAAM,EAAE,QAAQ,sCAAsC,EAAE,CAAC;CAC3M,IAAI,cAAc,KAAK,GAAG,OAAO;EAChC,MAAM;EACN,KAAK,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS;CACxC;CACA,IAAI,YAAY,KAAK,GAAG,OAAO;EAC9B,MAAM;EACN,QAAQ,mBAAmB,IAAI,IAAI,OAAO,CAAC;CAC5C;CACA,MAAM,cAAc,2BAA2B,2CAA2C,EAAE,MAAM,EAAE,QAAQ,yCAAyC,EAAE,CAAC;AACzJ;;;;;;;;;;;AAWA,SAAS,qBAAqB,KAAK,MAAM;CACxC,IAAI;CACJ,IAAI;EACH,MAAM,sBAAsB,GAAG,CAAC,CAAC;CAClC,QAAQ;EACP;CACD;CACA,IAAI,QAAQ,KAAK,GAAG,OAAO,KAAK;CAChC,MAAM,aAAa,sBAAsB,KAAK,GAAG,KAAK,QAAQ,WAAW,QAAQ;CACjF,IAAI,SAAS,YAAY,YAAY,OAAO,wBAAwB,IAAI;CACxE,IAAI,SAAS,UAAU,IAAI,WAAW,IAAI,GAAG,OAAO,wBAAwB,IAAI;AACjF;AACA,SAAS,OAAO,SAAS;CACxB,IAAI,QAAQ,OAAO,KAAK,KAAK,SAAS,QAAQ,EAAE,GAAG,OAAO;EACzD,MAAM,QAAQ;EACd,OAAO;CACR;CACA,IAAI,OAAO,QAAQ,QAAQ,UAAU,OAAO;EAC3C,MAAM,IAAI,KAAK;GACd,kBAAkB,QAAQ;GAC1B,yBAAyB,QAAQ,aAAa,2BAA2B;GACzE,mBAAmB,QAAQ,aAAa,qBAAqB;EAC9D,CAAC;EACD,OAAO;CACR;AACD;AACA,SAAS,uBAAuB,YAAY;CAC3C,MAAM,QAAQ,cAAc,CAAC;CAC7B,OAAO,MAAM,MAAM,SAAS,KAAK,OAAO,0BAA0B,EAAE,IAAI,QAAQ,CAAC,GAAG,OAAO,yBAAyB;AACrH;;;;;;;;AAQA,SAAS,yBAAyB;CACjC,OAAO,UAAU,mBAAmB,oBAAoB,gBAAgB,CAAC;AAC1E;AACA,eAAe,SAAS,SAAS;CAChC,MAAM,cAAc,mBAAmB,OAAO;CAC9C,MAAM,WAAW,gBAAgB,OAAO;CACxC,MAAM,QAAQ,wBAAwB;EACrC,QAAQ;EACR,SAAS;EACT,QAAQ;EACR,YAAY,uBAAuB,QAAQ,UAAU;CACtD,CAAC;CACD,MAAM,UAAU,uBAAuB;EACtC;EACA;CACD,CAAC;CACD,MAAM,kBAAkB,MAAM,QAAQ;CACtC,MAAM,YAAY,aAAa,eAAe;CAC9C,MAAM,YAAY,OAAO,OAAO;CAChC,IAAI,SAAS;CACb,MAAM,gBAAgB,0BAA0B,KAAK;CACrD,MAAM,mBAAmB,MAAM;CAC/B,IAAI,CAAC,kBAAkB,MAAM,IAAI,cAAc,gDAAgD;CAC/F,MAAM,SAAS,iBAAiB,OAAO,EAAE,QAAQ,EAAE,UAAU,KAAK,EAAE,CAAC;CACrE,IAAI,WAAW,MAAM,OAAO,QAAQ;EACnC,MAAM;EACN,MAAM,UAAU;CACjB,CAAC;CACD,MAAM,UAAU,IAAI,oBAAoB;EACvC;EACA,SAAS,cAAc;EACvB;EACA,GAAG,UAAU,gBAAgB,QAAQ,YAAY;EACjD,GAAG,UAAU,cAAc,QAAQ,UAAU;CAC9C,CAAC;CACD,eAAe,UAAU,KAAK;EAC7B,MAAM,WAAW,qBAAqB,KAAK,YAAY,IAAI;EAC3D,IAAI,aAAa,KAAK,GAAG,MAAM,cAAc,wBAAwB,gBAAgB,YAAY,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;EAC/H,IAAI;GACH,IAAI,YAAY,SAAS,UAAU,OAAO,MAAM,UAAU,KAAK,YAAY,GAAG;GAC9E,OAAO,MAAM,UAAU,KAAK,YAAY,MAAM;EAC/C,SAAS,KAAK;GACb,MAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC9D,MAAM,cAAc,wBAAwB,gBAAgB,UAAU;IACrE,MAAM,EAAE,OAAO;IACf,OAAO;GACR,CAAC;EACF;CACD;CACA,SAAS,4BAA4B,SAAS,aAAa,aAAa;EACvE,OAAO;GACN,KAAK,IAAI;IACR,SAAS;IACT;GACD,CAAC;GACD,KAAK,IAAI;IACR,SAAS;KACR,QAAQ,MAAM;MACb,OAAO,YAAY,gBAAgB,MAAM,OAAO;KACjD;KACA,kBAAkB,YAAY,gBAAgB,OAAO;IACtD;IACA,SAAS;GACV,CAAC;GACD,KAAK;GACL,QAAQ,MAAM,aAAa;IAC1B,OAAO,YAAY,gBAAgB,MAAM,SAAS,WAAW;GAC9D;GACA,YAAY,IAAI;IACf,OAAO,gBAAgB,EAAE,kBAAkB,YAAY,gBAAgB,OAAO,EAAE,GAAG,EAAE;GACtF;EACD;CACD;CACA,SAAS,iBAAiB,SAAS;EAClC,OAAO,4BAA4B,SAAS,SAAS,OAAO;CAC7D;CACA,MAAM,qBAAqB;EAC1B,MAAM,aAAa,QAAQ;EAC3B,QAAQ,CAAC;CACV;CACA,MAAM,cAAc,uBAAuB;CAC3C,MAAM,aAAa,uBAAuB;EACzC,UAAU;EACV;CACD,CAAC;CACD,MAAM,aAAa,IAAI,oBAAoB;EAC1C,SAAS;EACT,SAAS,cAAc;EACvB;EACA,cAAc;EACd,GAAG,UAAU,cAAc,QAAQ,UAAU;CAC9C,CAAC;CACD,MAAM,iBAAiB,UAAU,OAAO,OAAO,2BAA2B,YAAY,OAAO,CAAC,CAAC;CAC/F,MAAM,mBAAmB;EACxB,KAAK,IAAI;GACR,SAAS;GACT;EACD,CAAC;EACD,KAAK,IAAI;GACR,SAAS;IACR,QAAQ,MAAM;KACb,OAAO,WAAW,gBAAgB,MAAM,kBAAkB;IAC3D;IACA,kBAAkB,WAAW,gBAAgB,kBAAkB;GAChE;GACA,SAAS;EACV,CAAC;EACD,aAAa;EACb,QAAQ,MAAM,aAAa;GAC1B,OAAO,WAAW,gBAAgB,MAAM,oBAAoB,WAAW;EACxE;CACD;CACA,eAAe,UAAU;EACxB,IAAI,QAAQ;EACZ,SAAS;EACT,MAAM,QAAQ,MAAM;EACpB,IAAI,WAAW,OAAO,MAAM,UAAU,KAAK,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC;CACpE;CACA,OAAO;EACN;EACA;EACA,MAAM,OAAO,KAAK;GACjB,MAAM,EAAE,YAAY,MAAM,UAAU,GAAG;GACvC,MAAM,UAAU,QAAQ;GACxB,MAAM,UAAU,OAAO,YAAY,WAAW,UAAU,aAAa,QAAQ;GAC7E,OAAO,iBAAiB;IACvB,MAAM,eAAe,OAAO,IAAI,UAAU,aAAa,QAAQ;IAC/D,QAAQ;GACT,CAAC;EACF;EACA,SAAS;GACR,OAAO,iBAAiB;IACvB,MAAM,aAAa,QAAQ;IAC3B,QAAQ,CAAC;GACV,CAAC;EACF;EACA,gBAAgB;GACf,OAAO;IACN,GAAG,4BAA4B,oBAAoB,SAAS,OAAO;IACnE,UAAU;GACX;EACD;EACA,OAAO;GACN,OAAO,eAAe;CACxB;AACD;AAGA,IAAI,kBAAkB"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@prisma/orm-extension-supabase",
-  "version": "0.17.0-dev.8",
+  "version": "0.17.0-dev.9",
   "license": "Apache-2.0",
   "type": "module",
   "sideEffects": false,
@@ -9,10 +9,10 @@
     "dist"
   ],
   "dependencies": {
-    "@prisma/orm-family-sql": "0.17.0-dev.8",
-    "@prisma/orm-framework": "0.17.0-dev.8",
-    "@prisma/orm-postgres": "0.17.0-dev.8",
-    "@prisma/orm-toolchain": "0.17.0-dev.8",
+    "@prisma/orm-family-sql": "0.17.0-dev.9",
+    "@prisma/orm-framework": "0.17.0-dev.9",
+    "@prisma/orm-postgres": "0.17.0-dev.9",
+    "@prisma/orm-toolchain": "0.17.0-dev.9",
     "@standard-schema/spec": "^1.1.0",
     "@types/pg": "8.20.0",
     "arktype": "^2.2.2",
@@ -20,15 +20,15 @@
     "pg": "8.22.0"
   },
   "devDependencies": {
-    "@internal/extension-supabase": "0.17.0-dev.8",
-    "@repo/tsconfig": "0.17.0-dev.8",
-    "@repo/tsdown": "0.17.0-dev.8",
-    "@prisma/orm-target-postgres": "0.17.0-dev.8",
+    "@internal/extension-supabase": "0.17.0-dev.9",
+    "@repo/tsconfig": "0.17.0-dev.9",
+    "@repo/tsdown": "0.17.0-dev.9",
+    "@prisma/orm-target-postgres": "0.17.0-dev.9",
     "tsdown": "0.22.14",
     "typescript": "5.9.3"
   },
   "peerDependencies": {
-    "@prisma/orm-target-postgres": "0.17.0-dev.8",
+    "@prisma/orm-target-postgres": "0.17.0-dev.9",
     "typescript": ">=5.9"
   },
   "peerDependenciesMeta": {