@profullstack/affiliates 0.1.0 → 0.2.0

package/README.md

@@ -13,8 +13,9 @@ Scarce invite codes plus open affiliate links, for every Profullstack property.
   (`calculateReferral`, `DEFAULT_SPLIT` = 60% affiliate, 20% customer discount), and its
   `buildReferralUrl` / `extractCode` are re-exported.
 
-Stores: in-memory, SQLite (`bun:sqlite`, `node:sqlite`, `better-sqlite3`) and Postgres (anything
-with a node-postgres style `query`). SQL stores create their own tables (prefix `aff_`).
+Stores: in-memory, SQLite (`bun:sqlite`, `node:sqlite`, `better-sqlite3`), Postgres (anything
+with a node-postgres style `query`) and Supabase (a supabase-js client, through `rpc()` only). SQL
+stores create their own tables (prefix `aff_`); the Supabase store ships its schema as a migration.
 
 ```sh
 npm i @profullstack/affiliates
@@ -52,6 +53,72 @@ import { Affiliates, postgresStore } from '@profullstack/affiliates';
 const aff = new Affiliates(postgresStore(new pg.Pool({ connectionString: process.env.DATABASE_URL })));
 ```
 
+## On Supabase
+
+For apps that only have a supabase-js client (service role key, no direct `DATABASE_URL`). Every
+operation is one `client.rpc()` call to a Postgres function, so the scarce parts are atomic in the
+database, not read-modify-write in JS: the quota check and insert run under a per-inviter advisory
+lock (the same logic as `postgresStore`'s `aff_insert_invite()`), redemption is
+`UPDATE ... WHERE used_by IS NULL`, and attribution is `INSERT ... ON CONFLICT DO NOTHING`.
+`@supabase/supabase-js` is not a dependency; anything with `rpc(fn, args) -> { data, error }` works.
+
+1. Add the migration (tables, RLS on with no policies, `SECURITY DEFINER` functions with a pinned
+   `search_path`, executable only by `service_role`):
+
+   ```sh
+   cp node_modules/@profullstack/affiliates/migrations/supabase.sql supabase/migrations/20261026000000_affiliates.sql
+   # other prefix: node -e "import('@profullstack/affiliates').then(m => process.stdout.write(m.supabaseMigrationSql('gc_')))" > ...
+   ```
+
+2. Use a service-role client on the server only:
+
+   ```ts
+   // lib/affiliates.ts  (server only)
+   import { createClient } from '@supabase/supabase-js';
+   import { Affiliates, supabaseStore } from '@profullstack/affiliates';
+   let aff: Affiliates | undefined;
+   export const getAffiliates = () => (aff ??= new Affiliates(supabaseStore(createClient(
+     process.env.SUPABASE_URL!, process.env.SUPABASE_SERVICE_ROLE_KEY!, { auth: { persistSession: false } }))));
+
+   // app/auth/callback/route.ts, after exchangeCodeForSession() gave you `user`
+   import { refFromRequest } from '@profullstack/affiliates';
+   const ref = refFromRequest(request);                                   // ?ref= or the referral_code cookie
+   if (ref) await getAffiliates().attribute(ref, user.id);                // { external: true } = not ours, see below
+   ```
+
+   Build the client lazily (as above), not at module top level: Next.js inlines `process.env.X` at
+   build time, and a secret that is only present at runtime would compile in as `undefined`.
+
+The tables are the same as `postgresStore`'s, so a script with a direct Postgres URL can use
+`postgresStore` on the same data. `supabaseStore(client, { prefix })` must match the prefix the
+migration was generated with. The anon and authenticated keys can neither read the tables nor call
+the functions.
+
+## Already using @profullstack/referrals
+
+Sites that already ship `@profullstack/referrals` keep it: its tables, its `trackReferralCode`
+middleware and its single `referral_code` cookie. Affiliates reads that cookie instead of setting
+its own, so one sign-up is never counted twice.
+
+- **Do not set a second cookie.** In the signup or auth callback, take the code with
+  `refFromRequest(request)` (it reads `?ref=` and then `REF_COOKIE`, which is `'referral_code'`, the
+  name `@profullstack/referrals/next` sets) and pass it to `aff.attribute(code, newUserId)`.
+- **Codes that are theirs come back `{ ok: false, external: true }`** and nothing is recorded; hand
+  them to the existing referrals flow (`applyReferral`, the site's own usage table). Our codes come
+  back `{ ok: true, affiliateId }`. Unknown codes come back `{ ok: false }`.
+- How "theirs" is decided: `supabaseStore` checks the `referral_codes` table from
+  `20260602000000_referrals.sql` when it exists. Other stores take
+  `new Affiliates(store, { externalCodes })`, where `externalCodes` is your @profullstack/referrals
+  `ReferralStore` (its `getCode` is used) or a function `(code) => boolean | Promise<boolean>`.
+
+```ts
+const code = refFromRequest(request);
+if (code) {
+  const r = await aff.attribute(code, user.id);
+  if (r.external) await applyReferral({ code, newUserId: user.id, amountCents, store: referralStore });
+}
+```
+
 ## Invite-only signup in 5 lines
 
 ```ts
@@ -90,6 +157,18 @@ export function postgresStore(
   pool: { query(sql: string, params?: unknown[]): Promise<{ rows: any[] }> },
   opts?: { prefix?: string },
 ): AffiliateStore;
+export function supabaseStore(
+  client: { rpc(fn: string, args?: Record<string, unknown>): PromiseLike<{ data: any; error: any }> },
+  opts?: { prefix?: string },
+): AffiliateStore;
+export function supabaseMigrationSql(prefix?: string): string;   // = migrations/supabase.sql for 'aff_'
+
+export const REF_COOKIE = 'referral_code';                        // @profullstack/referrals' cookie
+export const REF_PARAM = 'ref';
+export function refFromRequest(
+  req: Request | { headers: Headers; url: string },
+  opts?: { param?: string; cookieName?: string },
+): string | null;                                                 // ?ref= first, then the cookie
 
 export class Affiliates {
   constructor(store: AffiliateStore, opts?: {
@@ -97,6 +176,7 @@ export class Affiliates {
     defaultQuota?: number;           // default 3
     inviteTtlMs?: number | null;     // default 30 days, null = never expires
     split?: ReferralSplit;           // default DEFAULT_SPLIT from @profullstack/referrals
+    externalCodes?: ReferralStore | ((code: string) => boolean | Promise<boolean>);
   });
   quota(userId: string): Promise<{ total: number; used: number; left: number }>;
   setQuota(userId: string, total: number): Promise<void>;
@@ -107,7 +187,8 @@ export class Affiliates {
   invites(inviterId: string): Promise<Omit<Invite, 'code'>[]>;       // newest first; also carries revokedAt
   revokeInvite(inviteId: string): Promise<void>;
   affiliateCode(userId: string): Promise<string>;
-  attribute(code: string, newUserId: string): Promise<{ ok: boolean; affiliateId?: string }>;
+  attribute(code: string, newUserId: string): Promise<{ ok: boolean; affiliateId?: string; external?: boolean }>;
+  isExternalCode(code: string): Promise<boolean>;
   affiliateOf(userId: string): Promise<string | null>;
   commission(amountCents: number): { discountCents: number; commissionCents: number };
 }
@@ -130,7 +211,8 @@ Semantics worth knowing:
   `O` to `0` and `I`/`L` to `1`. Invite codes come back as `INV-XXXX-XXXX-XXXX` (the `INV` prefix is
   optional on input), so `inv 7k3m qx9d 2f8h` redeems.
 - **Affiliate attribution** is first touch: a second `attribute` for the same user returns
-  `{ ok: false, affiliateId: <the original> }`. Users cannot attribute themselves.
+  `{ ok: false, affiliateId: <the original> }`. Users cannot attribute themselves. A code that is not
+  ours but belongs to the site's @profullstack/referrals setup returns `{ ok: false, external: true }`.
 
 Tables (prefix configurable): `aff_invites`, `aff_quotas`, `aff_codes`, `aff_attributions`.
 
@@ -157,7 +239,10 @@ command takes `--json`. Other options: `--prefix`, `--default-quota`, `--ttl-day
 
 ```sh
 npm test                 # node --experimental-strip-types --test (memory + node:sqlite)
-AFFILIATES_TEST_PG_URL=postgres://postgres:x@127.0.0.1:55432/postgres npm test   # adds real Postgres
+AFFILIATES_TEST_PG_URL=postgres://postgres:x@127.0.0.1:55432/postgres npm test   # adds real Postgres + supabaseStore over rpc()
+# adds real PostgREST too (see .github/workflows and test/setup-postgrest.ts):
+#   AFFILIATES_TEST_POSTGREST_URL=http://127.0.0.1:3000 AFFILIATES_TEST_POSTGREST_JWT_SECRET=... npm test
+npm run gen:migration    # rewrite migrations/supabase.sql after changing supabaseMigrationSql()
 npm run build            # tsc to dist/
 ```
 

package/dist/affiliates.d.ts

@@ -19,6 +19,16 @@ export type RedeemInviteResult = {
     ok: false;
     reason: 'invalid' | 'expired' | 'used' | 'self' | 'revoked';
 };
+/** Result of `attribute`. `external: true` means the code belongs to the site's other referral system. */
+export type AttributeResult = {
+    ok: boolean;
+    affiliateId?: string;
+    external?: boolean;
+};
+/** A check for codes owned by another referral system: a function, or an @profullstack/referrals ReferralStore. */
+export type ExternalCodes = ((code: string) => boolean | Promise<boolean>) | {
+    getCode(code: string): Promise<unknown | null>;
+};
 export interface AffiliatesOptions {
     /** Clock in ms. Default Date.now. */
     now?: () => number;
@@ -28,6 +38,13 @@ export interface AffiliatesOptions {
     inviteTtlMs?: number | null;
     /** Commission split passed to @profullstack/referrals. Default DEFAULT_SPLIT (60% affiliate, 20% customer). */
     split?: ReferralSplit;
+    /**
+     * Codes that belong to an existing referral system (sites already on @profullstack/referrals).
+     * When `attribute()` gets a code that is not ours and this says it is theirs, it returns
+     * `{ ok: false, external: true }` and records nothing, so the existing flow handles it.
+     * Default: the store's `isExternalCode` when it has one (supabaseStore checks `referral_codes`).
+     */
+    externalCodes?: ExternalCodes;
 }
 /** Scarce invite codes plus open affiliate links over any AffiliateStore. */
 export declare class Affiliates {
@@ -36,7 +53,10 @@ export declare class Affiliates {
     readonly defaultQuota: number;
     readonly inviteTtlMs: number | null;
     readonly split: ReferralSplit;
+    private readonly externalCodes;
     constructor(store: AffiliateStore, opts?: AffiliatesOptions);
+    /** True when `code` belongs to the site's other referral system (see `externalCodes`). */
+    isExternalCode(code: string): Promise<boolean>;
     private total;
     /** Invites a user may create, has created (revoked-before-use ones are refunded), and has left. */
     quota(userId: string): Promise<{
@@ -65,11 +85,12 @@ export declare class Affiliates {
     revokeInvite(inviteId: string): Promise<void>;
     /** The user's public affiliate code: stable, created on first call, unlimited use. */
     affiliateCode(userId: string): Promise<string>;
-    /** First-touch attribution of a new user to the affiliate who owns `code`. Never overwrites. */
-    attribute(code: string, newUserId: string): Promise<{
-        ok: boolean;
-        affiliateId?: string;
-    }>;
+    /**
+     * First-touch attribution of a new user to the affiliate who owns `code`. Never overwrites.
+     * A code that is not ours but belongs to the site's existing referral system returns
+     * `{ ok: false, external: true }` and records nothing.
+     */
+    attribute(code: string, newUserId: string): Promise<AttributeResult>;
     /** The affiliate a user is attributed to, or null. */
     affiliateOf(userId: string): Promise<string | null>;
     /** Discount for the new customer and commission for the affiliate, via @profullstack/referrals. */

package/dist/affiliates.js

@@ -20,12 +20,29 @@ export class Affiliates {
     defaultQuota;
     inviteTtlMs;
     split;
+    externalCodes;
     constructor(store, opts = {}) {
         this.store = store;
         this.now = opts.now ?? Date.now;
         this.defaultQuota = opts.defaultQuota ?? 3;
         this.inviteTtlMs = opts.inviteTtlMs === undefined ? 30 * DAY : opts.inviteTtlMs;
         this.split = opts.split ?? DEFAULT_SPLIT;
+        this.externalCodes = opts.externalCodes;
+    }
+    /** True when `code` belongs to the site's other referral system (see `externalCodes`). */
+    async isExternalCode(code) {
+        const raw = String(code ?? '').trim();
+        if (!raw)
+            return false;
+        const ext = this.externalCodes;
+        if (typeof ext === 'function')
+            return Boolean(await ext(raw));
+        // @profullstack/referrals looks codes up upper-cased and trimmed (validateCode)
+        if (ext)
+            return (await ext.getCode(raw.toUpperCase())) != null;
+        if (this.store.isExternalCode)
+            return this.store.isExternalCode(raw);
+        return false;
     }
     async total(userId) {
         const q = await this.store.getQuota(userId);
@@ -131,13 +148,19 @@ export class Affiliates {
         }
         throw new Error('could not mint a unique affiliate code');
     }
-    /** First-touch attribution of a new user to the affiliate who owns `code`. Never overwrites. */
+    /**
+     * First-touch attribution of a new user to the affiliate who owns `code`. Never overwrites.
+     * A code that is not ours but belongs to the site's existing referral system returns
+     * `{ ok: false, external: true }` and records nothing.
+     */
     async attribute(code, newUserId) {
         if (!code || !newUserId)
             return { ok: false };
         const norm = normalizeCode(code);
-        const affiliateId = await this.store.affiliateByCode(norm);
-        if (!affiliateId || affiliateId === newUserId)
+        const affiliateId = norm ? await this.store.affiliateByCode(norm) : null;
+        if (!affiliateId)
+            return (await this.isExternalCode(code)) ? { ok: false, external: true } : { ok: false };
+        if (affiliateId === newUserId)
             return { ok: false };
         const inserted = await this.store.attribute({ userId: newUserId, affiliateId, code: norm, at: this.now() });
         if (inserted)

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { Affiliates } from './affiliates.js';
-export type { Invite, RedeemInviteResult, AffiliatesOptions } from './affiliates.js';
+export type { Invite, RedeemInviteResult, AffiliatesOptions, AttributeResult, ExternalCodes } from './affiliates.js';
 export type { AffiliateStore, InviteRow, AttributionRow } from './store.js';
 export { memoryStore } from './memory.js';
 export { sqliteStore } from './sqlite.js';
@@ -7,6 +7,10 @@ export type { SqliteLike } from './sqlite.js';
 export { postgresStore } from './postgres.js';
 export type { PgLike } from './postgres.js';
 export type { SqlStoreOptions } from './sql.js';
+export { supabaseStore, supabaseMigrationSql } from './supabase.js';
+export type { SupabaseLike, SupabaseStoreOptions } from './supabase.js';
+export { REF_COOKIE, REF_PARAM, refFromRequest } from './ref.js';
+export type { RequestLike } from './ref.js';
 export { normalizeCode, generateInviteCode, hashCode } from './codes.js';
 export { buildReferralUrl, extractCode, calculateReferral, DEFAULT_SPLIT } from '@profullstack/referrals';
 export type { ReferralSplit } from '@profullstack/referrals';

package/dist/index.js

@@ -2,5 +2,7 @@ export { Affiliates } from "./affiliates.js";
 export { memoryStore } from "./memory.js";
 export { sqliteStore } from "./sqlite.js";
 export { postgresStore } from "./postgres.js";
+export { supabaseStore, supabaseMigrationSql } from "./supabase.js";
+export { REF_COOKIE, REF_PARAM, refFromRequest } from "./ref.js";
 export { normalizeCode, generateInviteCode, hashCode } from "./codes.js";
 export { buildReferralUrl, extractCode, calculateReferral, DEFAULT_SPLIT } from '@profullstack/referrals';

package/dist/ref.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Cookie name used by @profullstack/referrals (`trackReferralCode` in its `next` adapter defaults
+ * `cookieName` to this; its React `ReferralProvider` uses the same string as its sessionStorage key).
+ * Sites already on @profullstack/referrals keep setting this one cookie; affiliates reads it and never
+ * sets a second one, so one sign-up is counted once.
+ */
+export declare const REF_COOKIE = "referral_code";
+/** Query parameter for affiliate links, the same default as @profullstack/referrals (`?ref=`). */
+export declare const REF_PARAM = "ref";
+export type RequestLike = Request | {
+    headers: Headers;
+    url: string;
+};
+/**
+ * The referral/affiliate code a request carries: `?ref=` on the URL first (the click being handled),
+ * otherwise the `referral_code` cookie that @profullstack/referrals' middleware set on an earlier
+ * visit. Returns null when neither is present. Pass the result to `aff.attribute(code, newUserId)`.
+ */
+export declare function refFromRequest(req: RequestLike, opts?: {
+    param?: string;
+    cookieName?: string;
+}): string | null;

package/dist/ref.js

@@ -0,0 +1,49 @@
+/**
+ * Cookie name used by @profullstack/referrals (`trackReferralCode` in its `next` adapter defaults
+ * `cookieName` to this; its React `ReferralProvider` uses the same string as its sessionStorage key).
+ * Sites already on @profullstack/referrals keep setting this one cookie; affiliates reads it and never
+ * sets a second one, so one sign-up is counted once.
+ */
+export const REF_COOKIE = 'referral_code';
+/** Query parameter for affiliate links, the same default as @profullstack/referrals (`?ref=`). */
+export const REF_PARAM = 'ref';
+function readCookie(header, name) {
+    if (!header)
+        return null;
+    for (const part of header.split(';')) {
+        const eq = part.indexOf('=');
+        if (eq < 0)
+            continue;
+        if (part.slice(0, eq).trim() !== name)
+            continue;
+        let v = part.slice(eq + 1).trim();
+        if (v.startsWith('"') && v.endsWith('"') && v.length >= 2)
+            v = v.slice(1, -1);
+        try {
+            v = decodeURIComponent(v);
+        }
+        catch {
+            /* keep raw */
+        }
+        return v || null;
+    }
+    return null;
+}
+/**
+ * The referral/affiliate code a request carries: `?ref=` on the URL first (the click being handled),
+ * otherwise the `referral_code` cookie that @profullstack/referrals' middleware set on an earlier
+ * visit. Returns null when neither is present. Pass the result to `aff.attribute(code, newUserId)`.
+ */
+export function refFromRequest(req, opts = {}) {
+    const param = opts.param ?? REF_PARAM;
+    const cookieName = opts.cookieName ?? REF_COOKIE;
+    try {
+        const q = new URL(req.url, 'http://localhost').searchParams.get(param)?.trim();
+        if (q)
+            return q;
+    }
+    catch {
+        /* unparseable url: fall through to the cookie */
+    }
+    return readCookie(req.headers.get('cookie'), cookieName)?.trim() || null;
+}

package/dist/store.d.ts

@@ -53,4 +53,9 @@ export interface AffiliateStore {
     /** First touch: insert only if the user has no attribution. True if inserted. */
     attribute(row: AttributionRow): Promise<boolean>;
     getAttribution(userId: string): Promise<AttributionRow | null>;
+    /**
+     * Optional: true when `code` is not one of ours but belongs to another referral system on the same
+     * site (for example an @profullstack/referrals `referral_codes` row). supabaseStore implements it.
+     */
+    isExternalCode?(code: string): Promise<boolean>;
 }

package/dist/supabase.d.ts

@@ -0,0 +1,31 @@
+import type { AffiliateStore } from './store.js';
+/**
+ * The one supabase-js call this store uses: `client.rpc(fn, args)`. A `SupabaseClient` from
+ * `@supabase/supabase-js` (v2) fits as is; so does any PostgREST client with the same shape.
+ * Use a service-role client: the functions are not executable by `anon` or `authenticated`.
+ */
+export interface SupabaseLike {
+    rpc(fn: string, args?: Record<string, unknown>): PromiseLike<{
+        data: any;
+        error: any;
+    }>;
+}
+export interface SupabaseStoreOptions {
+    /** Table and function name prefix. Default `aff_`. Must match the prefix the migration was generated with. */
+    prefix?: string;
+}
+/**
+ * SQL for a Supabase migration: the four tables (same schema as `postgresStore`, so both stores can
+ * share them), RLS enabled with no policies (anon and authenticated keys see nothing), and one
+ * SECURITY DEFINER function per store operation with a pinned search_path, executable only by
+ * `service_role`. The scarce operations are atomic inside those functions: quota check + insert
+ * under a per-inviter advisory lock, single-use claim with `UPDATE ... WHERE used_by IS NULL`, and
+ * first-touch attribution with `ON CONFLICT DO NOTHING`. Idempotent: safe to run twice.
+ */
+export declare function supabaseMigrationSql(prefix?: string): string;
+/**
+ * Store over supabase-js / PostgREST (service-role client). Every operation is one `rpc()` call to a
+ * function from `supabaseMigrationSql()` (shipped as `migrations/supabase.sql`); apply it first.
+ * Also answers `isExternalCode` from @profullstack/referrals' `referral_codes` table when it exists.
+ */
+export declare function supabaseStore(client: SupabaseLike, opts?: SupabaseStoreOptions): AffiliateStore;

package/dist/supabase.js

@@ -0,0 +1,226 @@
+import { ddl } from "./sql.js";
+function checkPrefix(prefix) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(prefix))
+        throw new Error(`invalid table prefix: ${prefix}`);
+    return prefix;
+}
+const num = (v) => (v === null || v === undefined ? null : Number(v));
+const str = (v) => (v === null || v === undefined ? null : String(v));
+function toInvite(r) {
+    return {
+        id: String(r.id),
+        codeHash: String(r.code_hash),
+        inviterId: String(r.inviter_id),
+        createdAt: Number(r.created_at),
+        expiresAt: num(r.expires_at),
+        usedBy: str(r.used_by),
+        usedAt: num(r.used_at),
+        note: r.note == null ? '' : String(r.note),
+        revokedAt: num(r.revoked_at),
+    };
+}
+/** PostgREST returns a set-returning function as an array and a scalar one as the bare value. */
+const rows = (data) => (Array.isArray(data) ? data : data == null ? [] : [data]);
+const scalar = (data) => (Array.isArray(data) ? (data[0] ?? null) : data);
+const truthy = (v) => v === true || v === 't' || v === 'true' || v === 1;
+/**
+ * SQL for a Supabase migration: the four tables (same schema as `postgresStore`, so both stores can
+ * share them), RLS enabled with no policies (anon and authenticated keys see nothing), and one
+ * SECURITY DEFINER function per store operation with a pinned search_path, executable only by
+ * `service_role`. The scarce operations are atomic inside those functions: quota check + insert
+ * under a per-inviter advisory lock, single-use claim with `UPDATE ... WHERE used_by IS NULL`, and
+ * first-touch attribution with `ON CONFLICT DO NOTHING`. Idempotent: safe to run twice.
+ */
+export function supabaseMigrationSql(prefix = 'aff_') {
+    const p = checkPrefix(prefix);
+    const sigs = [];
+    const bodies = [];
+    const fn = (name, args, returns, body, lang = 'sql') => {
+        const types = args ? args.split(',').map((a) => a.trim().split(/\s+/).slice(1).join(' ')) : [];
+        sigs.push(`public.${p}${name}(${types.join(', ')})`);
+        bodies.push(`CREATE OR REPLACE FUNCTION public.${p}${name}(${args})
+RETURNS ${returns}
+LANGUAGE ${lang}
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+${body.trim()}
+$fn$;
+`);
+    };
+    const T = `public.${p}invites`;
+    const COUNTED = `(revoked_at IS NULL OR used_by IS NOT NULL)`;
+    fn('get_quota', 'p_user TEXT', 'INTEGER', `SELECT total FROM public.${p}quotas WHERE user_id = p_user`);
+    fn('set_quota', 'p_user TEXT, p_total INTEGER', 'VOID', `INSERT INTO public.${p}quotas (user_id, total) VALUES (p_user, p_total)
+  ON CONFLICT (user_id) DO UPDATE SET total = excluded.total`);
+    fn('count_invites', 'p_inviter TEXT', 'INTEGER', `SELECT count(*)::INTEGER FROM ${T} WHERE inviter_id = p_inviter AND ${COUNTED}`);
+    // Same logic and signature as postgresStore's insert_invite(), so the two stores can share a schema.
+    fn('insert_invite', 'p_id TEXT, p_hash TEXT, p_inviter TEXT, p_created BIGINT, p_expires BIGINT, p_note TEXT, p_limit INTEGER', 'BOOLEAN', `BEGIN
+  -- Per-inviter lock; plpgsql takes a fresh snapshot per statement, so the count sees every committed invite.
+  PERFORM pg_advisory_xact_lock(hashtext('${p}invites'), hashtext(p_inviter));
+  IF (SELECT count(*) FROM ${T} WHERE inviter_id = p_inviter AND ${COUNTED}) >= p_limit THEN
+    RETURN FALSE;
+  END IF;
+  INSERT INTO ${T} (id, code_hash, inviter_id, created_at, expires_at, note)
+    VALUES (p_id, p_hash, p_inviter, p_created, p_expires, coalesce(p_note, ''));
+  RETURN TRUE;
+END`, 'plpgsql');
+    fn('get_invite_by_hash', 'p_hash TEXT', `SETOF ${T}`, `SELECT * FROM ${T} WHERE code_hash = p_hash`);
+    fn('get_invite', 'p_id TEXT', `SETOF ${T}`, `SELECT * FROM ${T} WHERE id = p_id`);
+    fn('claim_invite', 'p_id TEXT, p_user TEXT, p_at BIGINT', 'BOOLEAN', `WITH won AS (
+  UPDATE ${T} SET used_by = p_user, used_at = p_at
+  WHERE id = p_id AND used_by IS NULL AND revoked_at IS NULL
+  RETURNING 1
+)
+SELECT EXISTS (SELECT 1 FROM won)`);
+    fn('revoke_invite', 'p_id TEXT, p_at BIGINT', 'VOID', `UPDATE ${T} SET revoked_at = p_at WHERE id = p_id AND revoked_at IS NULL`);
+    fn('list_invites', 'p_inviter TEXT', `SETOF ${T}`, `SELECT * FROM ${T} WHERE inviter_id = p_inviter ORDER BY created_at DESC, id`);
+    fn('invited_by', 'p_user TEXT', 'TEXT', `SELECT inviter_id FROM ${T} WHERE used_by = p_user ORDER BY used_at ASC LIMIT 1`);
+    fn('invitees', 'p_inviter TEXT', 'TABLE (user_id TEXT, at BIGINT)', `SELECT used_by, used_at FROM ${T}
+  WHERE inviter_id = p_inviter AND used_by IS NOT NULL ORDER BY used_at ASC`);
+    fn('get_affiliate_code', 'p_user TEXT', 'TEXT', `SELECT code FROM public.${p}codes WHERE user_id = p_user`);
+    fn('put_affiliate_code', 'p_user TEXT, p_code TEXT, p_at BIGINT', 'TEXT', `BEGIN
+  INSERT INTO public.${p}codes (user_id, code, created_at) VALUES (p_user, p_code, p_at) ON CONFLICT DO NOTHING;
+  RETURN (SELECT code FROM public.${p}codes WHERE user_id = p_user);
+END`, 'plpgsql');
+    fn('affiliate_by_code', 'p_code TEXT', 'TEXT', `SELECT user_id FROM public.${p}codes WHERE code = p_code`);
+    fn('attribute', 'p_user TEXT, p_affiliate TEXT, p_code TEXT, p_at BIGINT', 'BOOLEAN', `WITH ins AS (
+  INSERT INTO public.${p}attributions (user_id, affiliate_id, code, at) VALUES (p_user, p_affiliate, p_code, p_at)
+  ON CONFLICT (user_id) DO NOTHING
+  RETURNING 1
+)
+SELECT EXISTS (SELECT 1 FROM ins)`);
+    fn('get_attribution', 'p_user TEXT', `SETOF public.${p}attributions`, `SELECT * FROM public.${p}attributions WHERE user_id = p_user`);
+    // True when the code is an @profullstack/referrals code: a row in its `referral_codes` table
+    // (20260602000000_referrals.sql, codes stored upper-case). False when that table does not exist.
+    fn('is_external_code', 'p_code TEXT', 'BOOLEAN', `DECLARE found BOOLEAN := FALSE;
+BEGIN
+  IF to_regclass('public.referral_codes') IS NULL THEN
+    RETURN FALSE;
+  END IF;
+  EXECUTE 'SELECT EXISTS (SELECT 1 FROM public.referral_codes WHERE code = $1)'
+    INTO found USING upper(btrim(p_code));
+  RETURN found;
+END`, 'plpgsql');
+    const tables = ddl(p, 'sqlite').map((s) => s.replace(/CREATE (TABLE|INDEX) IF NOT EXISTS (\w+)/, (_m, kind, name) => kind === 'TABLE' ? `CREATE TABLE IF NOT EXISTS public.${name}` : `CREATE INDEX IF NOT EXISTS ${name}`).replace(/ ON (\w+) \(/, ' ON public.$1 (').replace(/\n\s+\)$/, '\n)').replace(/\n\s+/g, '\n  ') + ';');
+    const names = ['invites', 'quotas', 'codes', 'attributions'];
+    const each = (role, stmt) => `  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${role}') THEN\n${sigs.map((s) => `    ${stmt(s)}`).join('\n')}\n  END IF;`;
+    return [
+        `-- @profullstack/affiliates: Supabase migration (prefix ${p})`,
+        `-- Generated by supabaseMigrationSql('${p}'). Same tables as postgresStore, so both stores can share them.`,
+        `-- Use with supabaseStore(serviceRoleClient). Idempotent.`,
+        '',
+        ...tables,
+        '',
+        '-- RLS on with no policies: anon and authenticated keys see nothing. Access goes only through the',
+        '-- SECURITY DEFINER functions below, which only service_role may execute.',
+        ...names.map((n) => `ALTER TABLE public.${p}${n} ENABLE ROW LEVEL SECURITY;`),
+        '',
+        ...bodies,
+        ...sigs.map((s) => `REVOKE ALL ON FUNCTION ${s} FROM PUBLIC;`),
+        '',
+        `DO $grants$
+BEGIN
+${each('anon', (s) => `REVOKE ALL ON FUNCTION ${s} FROM anon;`)}
+${each('authenticated', (s) => `REVOKE ALL ON FUNCTION ${s} FROM authenticated;`)}
+${each('service_role', (s) => `GRANT EXECUTE ON FUNCTION ${s} TO service_role;`)}
+${['anon', 'authenticated'].map((role) => `  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${role}') THEN\n${names.map((n) => `    REVOKE ALL ON TABLE public.${p}${n} FROM ${role};`).join('\n')}\n  END IF;`).join('\n')}
+END
+$grants$;`,
+        '',
+        "NOTIFY pgrst, 'reload schema';",
+        '',
+    ].join('\n');
+}
+/**
+ * Store over supabase-js / PostgREST (service-role client). Every operation is one `rpc()` call to a
+ * function from `supabaseMigrationSql()` (shipped as `migrations/supabase.sql`); apply it first.
+ * Also answers `isExternalCode` from @profullstack/referrals' `referral_codes` table when it exists.
+ */
+export function supabaseStore(client, opts = {}) {
+    const p = checkPrefix(opts.prefix ?? 'aff_');
+    const call = async (name, args) => {
+        const { data, error } = await client.rpc(`${p}${name}`, args);
+        if (error) {
+            const msg = typeof error === 'string' ? error : (error.message ?? JSON.stringify(error));
+            throw new Error(`${p}${name}: ${msg}`, { cause: error });
+        }
+        return data;
+    };
+    return {
+        async getQuota(userId) {
+            return num(scalar(await call('get_quota', { p_user: userId })));
+        },
+        async setQuota(userId, total) {
+            await call('set_quota', { p_user: userId, p_total: total });
+        },
+        async countInvites(inviterId) {
+            return Number(scalar(await call('count_invites', { p_inviter: inviterId })) ?? 0);
+        },
+        async insertInvite(row, limit) {
+            const ok = await call('insert_invite', {
+                p_id: row.id,
+                p_hash: row.codeHash,
+                p_inviter: row.inviterId,
+                p_created: row.createdAt,
+                p_expires: row.expiresAt,
+                p_note: row.note,
+                p_limit: limit,
+            });
+            return truthy(scalar(ok));
+        },
+        async getInviteByHash(codeHash) {
+            const r = rows(await call('get_invite_by_hash', { p_hash: codeHash }))[0];
+            return r ? toInvite(r) : null;
+        },
+        async getInvite(id) {
+            const r = rows(await call('get_invite', { p_id: id }))[0];
+            return r ? toInvite(r) : null;
+        },
+        async claimInvite(id, userId, at) {
+            return truthy(scalar(await call('claim_invite', { p_id: id, p_user: userId, p_at: at })));
+        },
+        async revokeInvite(id, at) {
+            await call('revoke_invite', { p_id: id, p_at: at });
+        },
+        async listInvites(inviterId) {
+            return rows(await call('list_invites', { p_inviter: inviterId })).map(toInvite);
+        },
+        async invitedBy(userId) {
+            return str(scalar(await call('invited_by', { p_user: userId })));
+        },
+        async invitees(inviterId) {
+            return rows(await call('invitees', { p_inviter: inviterId })).map((r) => ({
+                userId: String(r.user_id),
+                at: Number(r.at),
+            }));
+        },
+        async getAffiliateCode(userId) {
+            return str(scalar(await call('get_affiliate_code', { p_user: userId })));
+        },
+        async putAffiliateCode(userId, code, at) {
+            return str(scalar(await call('put_affiliate_code', { p_user: userId, p_code: code, p_at: at })));
+        },
+        async affiliateByCode(code) {
+            return str(scalar(await call('affiliate_by_code', { p_code: code })));
+        },
+        async attribute(row) {
+            const ok = await call('attribute', {
+                p_user: row.userId,
+                p_affiliate: row.affiliateId,
+                p_code: row.code,
+                p_at: row.at,
+            });
+            return truthy(scalar(ok));
+        },
+        async getAttribution(userId) {
+            const r = rows(await call('get_attribution', { p_user: userId }))[0];
+            return r
+                ? { userId: String(r.user_id), affiliateId: String(r.affiliate_id), code: String(r.code), at: Number(r.at) }
+                : null;
+        },
+        async isExternalCode(code) {
+            return truthy(scalar(await call('is_external_code', { p_code: code })));
+        },
+    };
+}

package/migrations/supabase.sql

@@ -0,0 +1,319 @@
+-- @profullstack/affiliates: Supabase migration (prefix aff_)
+-- Generated by supabaseMigrationSql('aff_'). Same tables as postgresStore, so both stores can share them.
+-- Use with supabaseStore(serviceRoleClient). Idempotent.
+
+CREATE TABLE IF NOT EXISTS public.aff_invites (
+  id TEXT PRIMARY KEY,
+  code_hash TEXT NOT NULL UNIQUE,
+  inviter_id TEXT NOT NULL,
+  created_at BIGINT NOT NULL,
+  expires_at BIGINT,
+  used_by TEXT,
+  used_at BIGINT,
+  note TEXT NOT NULL DEFAULT '',
+  revoked_at BIGINT
+);
+CREATE INDEX IF NOT EXISTS aff_invites_inviter_idx ON public.aff_invites (inviter_id);
+CREATE INDEX IF NOT EXISTS aff_invites_used_by_idx ON public.aff_invites (used_by);
+CREATE TABLE IF NOT EXISTS public.aff_quotas (
+  user_id TEXT PRIMARY KEY,
+  total INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS public.aff_codes (
+  user_id TEXT PRIMARY KEY,
+  code TEXT NOT NULL UNIQUE,
+  created_at BIGINT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS public.aff_attributions (
+  user_id TEXT PRIMARY KEY,
+  affiliate_id TEXT NOT NULL,
+  code TEXT NOT NULL,
+  at BIGINT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS aff_attributions_affiliate_idx ON public.aff_attributions (affiliate_id);
+
+-- RLS on with no policies: anon and authenticated keys see nothing. Access goes only through the
+-- SECURITY DEFINER functions below, which only service_role may execute.
+ALTER TABLE public.aff_invites ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.aff_quotas ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.aff_codes ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.aff_attributions ENABLE ROW LEVEL SECURITY;
+
+CREATE OR REPLACE FUNCTION public.aff_get_quota(p_user TEXT)
+RETURNS INTEGER
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+SELECT total FROM public.aff_quotas WHERE user_id = p_user
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_set_quota(p_user TEXT, p_total INTEGER)
+RETURNS VOID
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+INSERT INTO public.aff_quotas (user_id, total) VALUES (p_user, p_total)
+  ON CONFLICT (user_id) DO UPDATE SET total = excluded.total
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_count_invites(p_inviter TEXT)
+RETURNS INTEGER
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+SELECT count(*)::INTEGER FROM public.aff_invites WHERE inviter_id = p_inviter AND (revoked_at IS NULL OR used_by IS NOT NULL)
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_insert_invite(p_id TEXT, p_hash TEXT, p_inviter TEXT, p_created BIGINT, p_expires BIGINT, p_note TEXT, p_limit INTEGER)
+RETURNS BOOLEAN
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+BEGIN
+  -- Per-inviter lock; plpgsql takes a fresh snapshot per statement, so the count sees every committed invite.
+  PERFORM pg_advisory_xact_lock(hashtext('aff_invites'), hashtext(p_inviter));
+  IF (SELECT count(*) FROM public.aff_invites WHERE inviter_id = p_inviter AND (revoked_at IS NULL OR used_by IS NOT NULL)) >= p_limit THEN
+    RETURN FALSE;
+  END IF;
+  INSERT INTO public.aff_invites (id, code_hash, inviter_id, created_at, expires_at, note)
+    VALUES (p_id, p_hash, p_inviter, p_created, p_expires, coalesce(p_note, ''));
+  RETURN TRUE;
+END
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_get_invite_by_hash(p_hash TEXT)
+RETURNS SETOF public.aff_invites
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+SELECT * FROM public.aff_invites WHERE code_hash = p_hash
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_get_invite(p_id TEXT)
+RETURNS SETOF public.aff_invites
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+SELECT * FROM public.aff_invites WHERE id = p_id
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_claim_invite(p_id TEXT, p_user TEXT, p_at BIGINT)
+RETURNS BOOLEAN
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+WITH won AS (
+  UPDATE public.aff_invites SET used_by = p_user, used_at = p_at
+  WHERE id = p_id AND used_by IS NULL AND revoked_at IS NULL
+  RETURNING 1
+)
+SELECT EXISTS (SELECT 1 FROM won)
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_revoke_invite(p_id TEXT, p_at BIGINT)
+RETURNS VOID
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+UPDATE public.aff_invites SET revoked_at = p_at WHERE id = p_id AND revoked_at IS NULL
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_list_invites(p_inviter TEXT)
+RETURNS SETOF public.aff_invites
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+SELECT * FROM public.aff_invites WHERE inviter_id = p_inviter ORDER BY created_at DESC, id
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_invited_by(p_user TEXT)
+RETURNS TEXT
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+SELECT inviter_id FROM public.aff_invites WHERE used_by = p_user ORDER BY used_at ASC LIMIT 1
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_invitees(p_inviter TEXT)
+RETURNS TABLE (user_id TEXT, at BIGINT)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+SELECT used_by, used_at FROM public.aff_invites
+  WHERE inviter_id = p_inviter AND used_by IS NOT NULL ORDER BY used_at ASC
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_get_affiliate_code(p_user TEXT)
+RETURNS TEXT
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+SELECT code FROM public.aff_codes WHERE user_id = p_user
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_put_affiliate_code(p_user TEXT, p_code TEXT, p_at BIGINT)
+RETURNS TEXT
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+BEGIN
+  INSERT INTO public.aff_codes (user_id, code, created_at) VALUES (p_user, p_code, p_at) ON CONFLICT DO NOTHING;
+  RETURN (SELECT code FROM public.aff_codes WHERE user_id = p_user);
+END
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_affiliate_by_code(p_code TEXT)
+RETURNS TEXT
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+SELECT user_id FROM public.aff_codes WHERE code = p_code
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_attribute(p_user TEXT, p_affiliate TEXT, p_code TEXT, p_at BIGINT)
+RETURNS BOOLEAN
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+WITH ins AS (
+  INSERT INTO public.aff_attributions (user_id, affiliate_id, code, at) VALUES (p_user, p_affiliate, p_code, p_at)
+  ON CONFLICT (user_id) DO NOTHING
+  RETURNING 1
+)
+SELECT EXISTS (SELECT 1 FROM ins)
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_get_attribution(p_user TEXT)
+RETURNS SETOF public.aff_attributions
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+SELECT * FROM public.aff_attributions WHERE user_id = p_user
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.aff_is_external_code(p_code TEXT)
+RETURNS BOOLEAN
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $fn$
+DECLARE found BOOLEAN := FALSE;
+BEGIN
+  IF to_regclass('public.referral_codes') IS NULL THEN
+    RETURN FALSE;
+  END IF;
+  EXECUTE 'SELECT EXISTS (SELECT 1 FROM public.referral_codes WHERE code = $1)'
+    INTO found USING upper(btrim(p_code));
+  RETURN found;
+END
+$fn$;
+
+REVOKE ALL ON FUNCTION public.aff_get_quota(TEXT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_set_quota(TEXT, INTEGER) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_count_invites(TEXT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_insert_invite(TEXT, TEXT, TEXT, BIGINT, BIGINT, TEXT, INTEGER) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_get_invite_by_hash(TEXT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_get_invite(TEXT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_claim_invite(TEXT, TEXT, BIGINT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_revoke_invite(TEXT, BIGINT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_list_invites(TEXT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_invited_by(TEXT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_invitees(TEXT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_get_affiliate_code(TEXT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_put_affiliate_code(TEXT, TEXT, BIGINT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_affiliate_by_code(TEXT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_attribute(TEXT, TEXT, TEXT, BIGINT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_get_attribution(TEXT) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.aff_is_external_code(TEXT) FROM PUBLIC;
+
+DO $grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN
+    REVOKE ALL ON FUNCTION public.aff_get_quota(TEXT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_set_quota(TEXT, INTEGER) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_count_invites(TEXT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_insert_invite(TEXT, TEXT, TEXT, BIGINT, BIGINT, TEXT, INTEGER) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_get_invite_by_hash(TEXT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_get_invite(TEXT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_claim_invite(TEXT, TEXT, BIGINT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_revoke_invite(TEXT, BIGINT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_list_invites(TEXT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_invited_by(TEXT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_invitees(TEXT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_get_affiliate_code(TEXT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_put_affiliate_code(TEXT, TEXT, BIGINT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_affiliate_by_code(TEXT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_attribute(TEXT, TEXT, TEXT, BIGINT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_get_attribution(TEXT) FROM anon;
+    REVOKE ALL ON FUNCTION public.aff_is_external_code(TEXT) FROM anon;
+  END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN
+    REVOKE ALL ON FUNCTION public.aff_get_quota(TEXT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_set_quota(TEXT, INTEGER) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_count_invites(TEXT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_insert_invite(TEXT, TEXT, TEXT, BIGINT, BIGINT, TEXT, INTEGER) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_get_invite_by_hash(TEXT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_get_invite(TEXT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_claim_invite(TEXT, TEXT, BIGINT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_revoke_invite(TEXT, BIGINT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_list_invites(TEXT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_invited_by(TEXT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_invitees(TEXT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_get_affiliate_code(TEXT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_put_affiliate_code(TEXT, TEXT, BIGINT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_affiliate_by_code(TEXT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_attribute(TEXT, TEXT, TEXT, BIGINT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_get_attribution(TEXT) FROM authenticated;
+    REVOKE ALL ON FUNCTION public.aff_is_external_code(TEXT) FROM authenticated;
+  END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN
+    GRANT EXECUTE ON FUNCTION public.aff_get_quota(TEXT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_set_quota(TEXT, INTEGER) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_count_invites(TEXT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_insert_invite(TEXT, TEXT, TEXT, BIGINT, BIGINT, TEXT, INTEGER) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_get_invite_by_hash(TEXT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_get_invite(TEXT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_claim_invite(TEXT, TEXT, BIGINT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_revoke_invite(TEXT, BIGINT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_list_invites(TEXT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_invited_by(TEXT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_invitees(TEXT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_get_affiliate_code(TEXT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_put_affiliate_code(TEXT, TEXT, BIGINT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_affiliate_by_code(TEXT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_attribute(TEXT, TEXT, TEXT, BIGINT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_get_attribution(TEXT) TO service_role;
+    GRANT EXECUTE ON FUNCTION public.aff_is_external_code(TEXT) TO service_role;
+  END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN
+    REVOKE ALL ON TABLE public.aff_invites FROM anon;
+    REVOKE ALL ON TABLE public.aff_quotas FROM anon;
+    REVOKE ALL ON TABLE public.aff_codes FROM anon;
+    REVOKE ALL ON TABLE public.aff_attributions FROM anon;
+  END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN
+    REVOKE ALL ON TABLE public.aff_invites FROM authenticated;
+    REVOKE ALL ON TABLE public.aff_quotas FROM authenticated;
+    REVOKE ALL ON TABLE public.aff_codes FROM authenticated;
+    REVOKE ALL ON TABLE public.aff_attributions FROM authenticated;
+  END IF;
+END
+$grants$;
+
+NOTIFY pgrst, 'reload schema';

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@profullstack/affiliates",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
-  "description": "Scarce invite codes (per-user quota, single use, who-invited-whom) plus open affiliate links with first-touch attribution. Commission math from @profullstack/referrals. Memory, SQLite (bun:sqlite, node:sqlite, better-sqlite3) and Postgres stores, plus a CLI.",
+  "description": "Scarce invite codes (per-user quota, single use, who-invited-whom) plus open affiliate links with first-touch attribution. Commission math and the referral_code cookie from @profullstack/referrals. Memory, SQLite (bun:sqlite, node:sqlite, better-sqlite3), Postgres and Supabase (supabase-js rpc) stores, plus a CLI.",
   "keywords": [
     "invite",
     "invite-codes",
@@ -12,6 +12,8 @@
     "attribution",
     "sqlite",
     "postgres",
+    "supabase",
+    "postgrest",
     "profullstack"
   ],
   "license": "MIT",
@@ -28,13 +30,15 @@
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./migrations/supabase.sql": "./migrations/supabase.sql"
   },
   "bin": {
     "affiliates": "./dist/cli.js"
   },
   "files": [
     "dist",
+    "migrations",
     "README.md",
     "LICENSE"
   ],
@@ -42,6 +46,7 @@
     "build": "rm -rf dist && tsc -p tsconfig.build.json && sed -i -E \"s#(from '\\./[a-z-]+)\\.ts'#\\1.js'#\" dist/*.d.ts && chmod +x dist/cli.js",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "test": "node --experimental-strip-types --no-warnings --test test/*.test.ts",
+    "gen:migration": "node --experimental-strip-types --no-warnings scripts/gen-migration.ts",
     "prepublishOnly": "npm run typecheck && npm test && npm run build"
   },
   "dependencies": {