@selvajs/supabase-provider 0.11.0

package/src/data/__tests__/definition-conformance.test.ts

@@ -0,0 +1,89 @@
+import { describe, beforeEach, it } from 'vitest';
+import { runDefinitionStoreConformance } from '@selvajs/platform/testing';
+import { DEFAULT_ORG_PERMISSIONS } from '@selvajs/platform';
+import { SupabaseDefinitionStore } from '../SupabaseDefinitionStore.js';
+import { readEnv, resetAllData, seedUser } from './test-helpers.js';
+
+const envCtx = readEnv();
+
+if (!envCtx) {
+	describe.skip('SupabaseDefinitionStore (skipped: no live stack)', () => {
+		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
+	});
+} else {
+	describe('SupabaseDefinitionStore', () => {
+		beforeEach(async () => {
+			await resetAllData(envCtx);
+		});
+
+		runDefinitionStoreConformance({
+			name: 'SupabaseDefinitionStore',
+			createStore: () => new SupabaseDefinitionStore(envCtx.bundle),
+			createScope: async () => {
+				// Seed: 1 owner + 1 secondary user + 1 org + 2 projects. Definitions
+				// created in the suite FK to one of those two projects.
+				const { userId: ownerId, sessionToken: ownerSessionToken } = await seedUser(envCtx, '');
+				const { userId: secondaryUserId, sessionToken: secondaryUserSessionToken } = await seedUser(
+					envCtx,
+					''
+				);
+				const orgId = crypto.randomUUID();
+				const projectId = crypto.randomUUID();
+				const secondaryProjectId = crypto.randomUUID();
+				const now = new Date().toISOString();
+				const admin = envCtx.adminClient;
+
+				const { error: orgError } = await admin.from('orgs').insert({
+					id: orgId,
+					name: 'Definition Test Org',
+					slug: `def-test-${orgId.slice(0, 8)}`,
+					owner_id: ownerId,
+					created_at: now,
+					updated_at: now
+				});
+				if (orgError) throw orgError;
+				const { error: memberError } = await admin.from('org_members').insert({
+					org_id: orgId,
+					user_id: ownerId,
+					role: 'owner',
+					permissions: [...DEFAULT_ORG_PERMISSIONS.owner],
+					joined_at: now
+				});
+				if (memberError) throw memberError;
+
+				const { error: p1Error } = await admin.from('projects').insert([
+					{
+						id: projectId,
+						org_id: orgId,
+						name: 'Project A',
+						slug: `proj-a-${projectId.slice(0, 8)}`,
+						visibility: 'public',
+						owner_id: ownerId,
+						created_at: now,
+						updated_at: now
+					},
+					{
+						id: secondaryProjectId,
+						org_id: orgId,
+						name: 'Project B',
+						slug: `proj-b-${secondaryProjectId.slice(0, 8)}`,
+						visibility: 'public',
+						owner_id: ownerId,
+						created_at: now,
+						updated_at: now
+					}
+				]);
+				if (p1Error) throw p1Error;
+
+				return {
+					ownerId,
+					ownerSessionToken,
+					projectId,
+					secondaryProjectId,
+					secondaryUserId,
+					secondaryUserSessionToken
+				};
+			}
+		});
+	});
+}

package/src/data/__tests__/event-sink-conformance.test.ts

@@ -0,0 +1,32 @@
+import { describe, beforeEach, it } from 'vitest';
+import { runEventSinkConformance, type RecordingEventSink } from '@selvajs/platform/testing';
+import { SupabaseDataProvider } from '../SupabaseDataProvider.js';
+import { readEnv, resetAllData, seedUser } from './test-helpers.js';
+
+const envCtx = readEnv();
+
+if (!envCtx) {
+	describe.skip('SupabaseDataProvider event-sink (skipped: no live stack)', () => {
+		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
+	});
+} else {
+	describe('SupabaseDataProvider event-sink', () => {
+		beforeEach(async () => {
+			await resetAllData(envCtx);
+		});
+
+		runEventSinkConformance({
+			name: 'SupabaseDataProvider',
+			createProvider: (sink: RecordingEventSink) =>
+				SupabaseDataProvider.create(
+					{
+						supabaseUrl: envCtx.url,
+						anonKey: envCtx.anonKey,
+						serviceRoleKey: envCtx.serviceRoleKey
+					},
+					sink
+				),
+			createActorId: () => seedUser(envCtx, '')
+		});
+	});
+}

package/src/data/__tests__/invite-conformance.test.ts

@@ -0,0 +1,46 @@
+import { describe, beforeEach, it } from 'vitest';
+import { runInviteStoreConformance } from '@selvajs/platform/testing';
+import { DEFAULT_ORG_PERMISSIONS } from '@selvajs/platform';
+import { SupabaseInviteStore } from '../SupabaseInviteStore.js';
+import { readEnv, resetAllData, seedUser } from './test-helpers.js';
+
+const envCtx = readEnv();
+
+if (!envCtx) {
+	describe.skip('SupabaseInviteStore (skipped: no live stack)', () => {
+		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
+	});
+} else {
+	describe('SupabaseInviteStore', () => {
+		beforeEach(async () => {
+			await resetAllData(envCtx);
+		});
+
+		runInviteStoreConformance({
+			name: 'SupabaseInviteStore',
+			createStore: () => new SupabaseInviteStore(envCtx.bundle),
+			createScope: async () => {
+				const { userId: adminId, sessionToken: adminSessionToken } = await seedUser(envCtx, '');
+				const orgId = crypto.randomUUID();
+				const now = new Date().toISOString();
+				await envCtx.adminClient.from('orgs').insert({
+					id: orgId,
+					name: 'Invite Test Org',
+					slug: `invite-test-${orgId.slice(0, 8)}`,
+					owner_id: adminId,
+					created_at: now,
+					updated_at: now
+				});
+				await envCtx.adminClient.from('org_members').insert({
+					org_id: orgId,
+					user_id: adminId,
+					role: 'owner',
+					permissions: [...DEFAULT_ORG_PERMISSIONS.owner],
+					joined_at: now
+				});
+				return { adminId, adminSessionToken, orgId };
+			},
+			seedUser: (id) => seedUser(envCtx, id)
+		});
+	});
+}

package/src/data/__tests__/org-conformance.test.ts

@@ -0,0 +1,30 @@
+import { describe, beforeEach, it } from 'vitest';
+import { runOrgStoreConformance } from '@selvajs/platform/testing';
+import { SupabaseOrgStore } from '../SupabaseOrgStore.js';
+import { SupabaseInviteStore } from '../SupabaseInviteStore.js';
+import { SupabaseComputeServerStore } from '../SupabaseComputeServerStore.js';
+import { readEnv, resetAllData, seedUser } from './test-helpers.js';
+
+const envCtx = readEnv();
+
+if (!envCtx) {
+	describe.skip('SupabaseOrgStore (skipped: no live stack)', () => {
+		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
+	});
+} else {
+	describe('SupabaseOrgStore', () => {
+		beforeEach(async () => {
+			await resetAllData(envCtx);
+		});
+
+		runOrgStoreConformance({
+			name: 'SupabaseOrgStore',
+			createStore: () => new SupabaseOrgStore(envCtx.bundle),
+			seedUser: (id) => seedUser(envCtx, id),
+			createCompanionStores: () => ({
+				invites: new SupabaseInviteStore(envCtx.bundle),
+				computeServer: new SupabaseComputeServerStore(envCtx.bundle)
+			})
+		});
+	});
+}

package/src/data/__tests__/project-conformance.test.ts

@@ -0,0 +1,57 @@
+import { describe, beforeEach, it } from 'vitest';
+import { runProjectStoreConformance } from '@selvajs/platform/testing';
+import { DEFAULT_ORG_PERMISSIONS } from '@selvajs/platform';
+import { SupabaseProjectStore } from '../SupabaseProjectStore.js';
+import { readEnv, resetAllData, seedUser } from './test-helpers.js';
+
+const envCtx = readEnv();
+
+if (!envCtx) {
+	describe.skip('SupabaseProjectStore (skipped: no live stack)', () => {
+		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
+	});
+} else {
+	describe('SupabaseProjectStore', () => {
+		beforeEach(async () => {
+			await resetAllData(envCtx);
+		});
+
+		runProjectStoreConformance({
+			name: 'SupabaseProjectStore',
+			createStore: async () => {
+				// Seed an owner + an org so the project tests have an anchor.
+				const { userId: ownerId, sessionToken: ownerSessionToken } = await seedUser(envCtx, '');
+				const orgId = crypto.randomUUID();
+				const now = new Date().toISOString();
+				const admin = envCtx.adminClient;
+				const { error: orgError } = await admin.from('orgs').insert({
+					id: orgId,
+					name: 'Conformance Org',
+					slug: `conformance-${orgId.slice(0, 8)}`,
+					owner_id: ownerId,
+					created_at: now,
+					updated_at: now
+				});
+				if (orgError) throw orgError;
+				// And an owner membership with `manage_projects` so project
+				// creates pass the `has_org_permission` policy under RLS.
+				const { error: memberError } = await admin.from('org_members').insert({
+					org_id: orgId,
+					user_id: ownerId,
+					role: 'owner',
+					permissions: [...DEFAULT_ORG_PERMISSIONS.owner],
+					joined_at: now
+				});
+				if (memberError) throw memberError;
+
+				return {
+					store: new SupabaseProjectStore(envCtx.bundle),
+					orgId,
+					ownerId,
+					ownerSessionToken
+				};
+			},
+			seedUser: (id) => seedUser(envCtx, id)
+		});
+	});
+}

package/src/data/__tests__/share-link-conformance.test.ts

@@ -0,0 +1,87 @@
+import { describe, beforeEach, it } from 'vitest';
+import { runShareLinkStoreConformance } from '@selvajs/platform/testing';
+import { DEFAULT_ORG_PERMISSIONS } from '@selvajs/platform';
+import { SupabaseShareLinkStore } from '../SupabaseShareLinkStore.js';
+import { readEnv, resetAllData, seedUser } from './test-helpers.js';
+
+const envCtx = readEnv();
+
+if (!envCtx) {
+	describe.skip('SupabaseShareLinkStore (skipped: no live stack)', () => {
+		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
+	});
+} else {
+	describe('SupabaseShareLinkStore', () => {
+		beforeEach(async () => {
+			await resetAllData(envCtx);
+		});
+
+		runShareLinkStoreConformance({
+			name: 'SupabaseShareLinkStore',
+			createStore: () => new SupabaseShareLinkStore(envCtx.bundle),
+			createScope: async () => {
+				// Seed: 1 owner + 1 org + 1 project + 2 definitions. Share links
+				// FK to definitions, definitions FK to projects, projects FK to orgs.
+				const { userId: ownerId, sessionToken: ownerSessionToken } = await seedUser(envCtx, '');
+				const orgId = crypto.randomUUID();
+				const projectId = crypto.randomUUID();
+				const definitionId = crypto.randomUUID();
+				const otherDefinitionId = crypto.randomUUID();
+				const now = new Date().toISOString();
+				const admin = envCtx.adminClient;
+
+				const { error: orgError } = await admin.from('orgs').insert({
+					id: orgId,
+					name: 'Share Link Test Org',
+					slug: `sl-test-${orgId.slice(0, 8)}`,
+					owner_id: ownerId,
+					created_at: now,
+					updated_at: now
+				});
+				if (orgError) throw orgError;
+				const { error: memberError } = await admin.from('org_members').insert({
+					org_id: orgId,
+					user_id: ownerId,
+					role: 'owner',
+					permissions: [...DEFAULT_ORG_PERMISSIONS.owner],
+					joined_at: now
+				});
+				if (memberError) throw memberError;
+				const { error: projError } = await admin.from('projects').insert({
+					id: projectId,
+					org_id: orgId,
+					name: 'Project',
+					slug: `proj-${projectId.slice(0, 8)}`,
+					visibility: 'public',
+					owner_id: ownerId,
+					created_at: now,
+					updated_at: now
+				});
+				if (projError) throw projError;
+				const { error: defError } = await admin.from('definitions').insert([
+					{
+						guid: definitionId,
+						project_id: projectId,
+						owner_id: ownerId,
+						display_name: 'Def A',
+						status: 'published',
+						created_at: now,
+						updated_at: now
+					},
+					{
+						guid: otherDefinitionId,
+						project_id: projectId,
+						owner_id: ownerId,
+						display_name: 'Def B',
+						status: 'published',
+						created_at: now,
+						updated_at: now
+					}
+				]);
+				if (defError) throw defError;
+
+				return { ownerId, ownerSessionToken, definitionId, otherDefinitionId };
+			}
+		});
+	});
+}

package/src/data/__tests__/test-helpers.ts

@@ -0,0 +1,186 @@
+/**
+ * Shared test helpers for Supabase data conformance tests.
+ *
+ * Every suite starts with a fully wiped DB so tests are isolated. We use the
+ * service-role client for both — seeding users in `auth.users` and wiping
+ * every relevant table.
+ */
+
+import { createClient, type SupabaseClient } from '@supabase/supabase-js';
+import { buildClientBundle, type ClientBundle } from '../client.js';
+
+export interface TestContext {
+	url: string;
+	anonKey: string;
+	serviceRoleKey: string;
+	adminClient: SupabaseClient;
+	bundle: ClientBundle;
+}
+
+export function readEnv(): TestContext | null {
+	const url = process.env.SUPABASE_URL;
+	const anonKey = process.env.SUPABASE_ANON_KEY;
+	const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
+	if (!url || !anonKey || !serviceRoleKey) return null;
+	// `.env.test` is checked in with local-Supabase defaults so contributors can
+	// `npx supabase start` and run the suite. But `createClient` transitively
+	// loads `@supabase/realtime-js`, which on Node < 22 throws at construction
+	// without a native WebSocket. Swallow that so the suite cleanly skips
+	// instead of crashing test collection.
+	let adminClient: SupabaseClient;
+	try {
+		adminClient = createClient(url, serviceRoleKey, {
+			auth: { persistSession: false, autoRefreshToken: false }
+		});
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		if (msg.includes('WebSocket')) return null;
+		throw err;
+	}
+	const bundle = buildClientBundle({ supabaseUrl: url, anonKey, serviceRoleKey });
+	return { url, anonKey, serviceRoleKey, adminClient, bundle };
+}
+
+/**
+ * Reset every data table this adapter owns. Leaves Supabase-managed tables
+ * (`auth.users`, etc.) alone except via `deleteAllAuthUsers` below.
+ *
+ * Order-sensitive because some FKs don't cascade: we go bottom up from
+ * dependents to parents.
+ */
+export async function resetAllData(ctx: TestContext): Promise<void> {
+	await truncate(ctx, 'share_links');
+	await truncate(ctx, 'invites');
+	// Versions FK to definitions ON DELETE CASCADE, but `definitions` can't
+	// be wiped while live/draft pointers reference versions (ON DELETE
+	// RESTRICT, spec §6). Null the pointers, drop versions, then drop defs.
+	await ctx.adminClient
+		.from('definitions')
+		.update({ live_version_id: null, draft_version_id: null })
+		.not('guid', 'is', null);
+	await truncate(ctx, 'definition_versions');
+	await truncate(ctx, 'definitions');
+	await truncate(ctx, 'project_members');
+	// compute defaults have a platform_default sibling — reset all three.
+	await truncate(ctx, 'compute_server_org_defaults');
+	await truncate(ctx, 'compute_server_shares');
+	await resetComputePlatformDefault(ctx);
+	await truncate(ctx, 'compute_servers');
+	await truncate(ctx, 'org_members');
+	await truncate(ctx, 'orgs');
+	await truncate(ctx, 'user_profiles');
+	await deleteAllAuthUsers(ctx);
+}
+
+async function resetComputePlatformDefault(ctx: TestContext): Promise<void> {
+	// Singleton row — clear `default_server_id` rather than deleting.
+	const { error } = await ctx.adminClient
+		.from('compute_server_platform_default')
+		.update({ default_server_id: null })
+		.eq('singleton', true);
+	if (error) throw error;
+}
+
+async function truncate(ctx: TestContext, table: string): Promise<void> {
+	const { error } = await ctx.adminClient
+		.from(table)
+		.delete()
+		.neq(columnForDeleteAll(table), '00000000-0000-0000-0000-000000000000');
+	if (error) throw error;
+}
+
+function columnForDeleteAll(table: string): string {
+	if (table === 'org_members') return 'user_id';
+	if (table === 'project_members') return 'user_id';
+	if (table === 'user_profiles') return 'user_id';
+	if (table === 'definitions') return 'guid';
+	if (table === 'definition_versions') return 'id';
+	if (table === 'compute_server_org_defaults') return 'org_id';
+	if (table === 'compute_server_shares') return 'server_id';
+	return 'id';
+}
+
+async function deleteAllAuthUsers(ctx: TestContext): Promise<void> {
+	const { data, error } = await ctx.adminClient.auth.admin.listUsers({ perPage: 1000 });
+	if (error) throw error;
+	for (const user of data.users) {
+		const { error: delError } = await ctx.adminClient.auth.admin.deleteUser(user.id);
+		if (delError) throw delError;
+	}
+}
+
+/**
+ * Seed an `auth.users` row, mark the user as `instance_admin`, sign in, and
+ * return the real id + access token. `auth.admin.createUser` doesn't accept a
+ * caller-supplied id — Supabase generates one. The conformance suite calls us
+ * with a *suggested* id (for adapters that honor it); we ignore it and return
+ * GoTrue's real id.
+ *
+ * The instance_admin grant is what makes RLS open up for the conformance
+ * tests: every policy in the schema accepts `is_instance_admin()` as a
+ * universal pass, mirroring the `instance_admin` default in `makeCtx`.
+ *
+ * The session token is what makes RLS *see* the user at all. Without it, the
+ * Supabase client falls back to the anon role and every write fails.
+ */
+export async function seedUser(
+	ctx: TestContext,
+	suggestedId: string
+): Promise<{ userId: string; sessionToken: string }> {
+	return seedUserCore(ctx, suggestedId, { promoteToInstanceAdmin: true });
+}
+
+/**
+ * Variant of `seedUser` that leaves `platform_permissions` empty. Use this
+ * when a test specifically asserts on a fresh user's permission state (e.g.
+ * the platform-permission store conformance suite).
+ */
+export async function seedPlainUser(
+	ctx: TestContext,
+	suggestedId: string
+): Promise<{ userId: string; sessionToken: string }> {
+	return seedUserCore(ctx, suggestedId, { promoteToInstanceAdmin: false });
+}
+
+async function seedUserCore(
+	ctx: TestContext,
+	_suggestedId: string,
+	opts: { promoteToInstanceAdmin: boolean }
+): Promise<{ userId: string; sessionToken: string }> {
+	// Unique email per seed so repeated calls don't collide. GoTrue requires
+	// an email even for password-less users.
+	const email = `conformance-${crypto.randomUUID()}@conformance.test`;
+	const password = 'conformance-test-password-1234';
+	const { data, error } = await ctx.adminClient.auth.admin.createUser({
+		email,
+		password,
+		email_confirm: true
+	});
+	if (error) throw error;
+	const userId = data.user.id;
+
+	if (opts.promoteToInstanceAdmin) {
+		// Trigger auto-created the user_profiles row; promote to instance_admin
+		// so every RLS policy treats this user as fully authorized. Mirrors the
+		// `instance_admin` default in `makeCtx`.
+		const { error: promoteError } = await ctx.adminClient
+			.from('user_profiles')
+			.update({ platform_permissions: ['instance_admin'] })
+			.eq('user_id', userId);
+		if (promoteError) throw promoteError;
+	}
+
+	// Sign in to get an access token. The conformance suite stuffs this into
+	// `adapterContext.sessionToken` and our client.ts uses it to scope the
+	// request to this user instead of falling back to anon.
+	const signInClient = createClient(ctx.url, ctx.anonKey, {
+		auth: { persistSession: false, autoRefreshToken: false }
+	});
+	const { data: session, error: signInError } = await signInClient.auth.signInWithPassword({
+		email,
+		password
+	});
+	if (signInError) throw signInError;
+	if (!session.session) throw new Error('seedUser: signInWithPassword returned no session');
+	return { userId, sessionToken: session.session.access_token };
+}

package/src/data/client.ts

@@ -0,0 +1,86 @@
+import { createClient, type SupabaseClient } from '@supabase/supabase-js';
+import type { RequestContext } from '@selvajs/platform';
+
+/**
+ * Build a Supabase client for a given `RequestContext`.
+ *
+ * Three modes — fail-closed:
+ *  - **Service-role** ONLY when `ctx.system === true`. Bypasses RLS. Used for
+ *    admin paths, janitors, bootstrap, and any explicitly-trusted server
+ *    flow. The system flag must never be derived from a user session.
+ *  - **User-scoped** when `ctx.adapterContext.sessionToken` is a JWT: runs
+ *    under `authenticated` role with `auth.uid()` from the token. RLS
+ *    policies enforce per-user visibility.
+ *  - **Anonymous** otherwise: runs under the `anon` role. RLS is active and
+ *    will scope reads/writes accordingly. This is the safety net — any code
+ *    that constructs a context without forwarding the session token AND
+ *    without setting `system: true` is treated as untrusted.
+ *
+ * Previous versions fell back to service-role when the session token was
+ * absent — a fail-OPEN footgun: any synthetic ctx (e.g. share-token resolve)
+ * silently bypassed RLS. The current contract is explicit: opt into
+ * service-role with `system: true`, or you get RLS.
+ *
+ * Per-request WeakMap caching keeps a single client alive for the lifetime
+ * of a RequestContext — multiple store calls in one HTTP handler share one
+ * fetch connection without leaking auth across requests.
+ */
+export interface ClientBundle {
+	/** Long-lived service-role client. Bypasses RLS. */
+	serviceClient: SupabaseClient;
+	/**
+	 * Produce (or reuse) a client scoped to this request's identity.
+	 *  - `ctx.system === true` → service-role (RLS bypassed).
+	 *  - `ctx.adapterContext.sessionToken` set → user-scoped (RLS active).
+	 *  - neither → anon client (RLS active, no `auth.uid()`).
+	 */
+	forRequest(ctx: RequestContext): SupabaseClient;
+}
+
+export interface BuildClientOptions {
+	supabaseUrl: string;
+	anonKey: string;
+	serviceRoleKey: string;
+}
+
+export function buildClientBundle(opts: BuildClientOptions): ClientBundle {
+	const serviceClient = createClient(opts.supabaseUrl, opts.serviceRoleKey, {
+		auth: { persistSession: false, autoRefreshToken: false }
+	});
+
+	// Long-lived anon client — the fail-closed default for ctxes that aren't
+	// explicitly system and don't carry a session token.
+	const anonClient = createClient(opts.supabaseUrl, opts.anonKey, {
+		auth: { persistSession: false, autoRefreshToken: false }
+	});
+
+	const perRequestCache = new WeakMap<RequestContext, SupabaseClient>();
+
+	return {
+		serviceClient,
+		forRequest(ctx: RequestContext): SupabaseClient {
+			if (ctx.system) return serviceClient;
+
+			const token = extractSessionToken(ctx.adapterContext);
+			if (!token) return anonClient;
+
+			const cached = perRequestCache.get(ctx);
+			if (cached) return cached;
+
+			const client = createClient(opts.supabaseUrl, opts.anonKey, {
+				auth: { persistSession: false, autoRefreshToken: false },
+				global: {
+					headers: { Authorization: `Bearer ${token}` }
+				}
+			});
+			perRequestCache.set(ctx, client);
+			return client;
+		}
+	};
+}
+
+function extractSessionToken(adapterContext: unknown): string | undefined {
+	if (!adapterContext || typeof adapterContext !== 'object') return undefined;
+	const maybe = (adapterContext as { sessionToken?: unknown }).sessionToken;
+	return typeof maybe === 'string' && maybe.length > 0 ? maybe : undefined;
+}

package/src/data/index.ts

@@ -0,0 +1,11 @@
+export { SupabaseOrgStore } from './SupabaseOrgStore.js';
+export { SupabaseProjectStore } from './SupabaseProjectStore.js';
+export { SupabaseDefinitionStore } from './SupabaseDefinitionStore.js';
+export { SupabaseInviteStore } from './SupabaseInviteStore.js';
+export { SupabaseComputeServerStore } from './SupabaseComputeServerStore.js';
+export { SupabaseShareLinkStore } from './SupabaseShareLinkStore.js';
+export { SupabaseDataProvider } from './SupabaseDataProvider.js';
+export { SupabaseEventSink } from './SupabaseEventSink.js';
+export { SupabaseAuditQuery } from './SupabaseAuditQuery.js';
+export { buildClientBundle } from './client.js';
+export type { ClientBundle, BuildClientOptions } from './client.js';