@selvajs/supabase-provider 0.11.0

package/dist/auth/SupabaseAuthProvider.js

@@ -0,0 +1,383 @@
+import { createClient } from '@supabase/supabase-js';
+export class SupabaseAuthProvider {
+    name = 'Supabase Auth';
+    passwordAuth;
+    oauth;
+    emailLink;
+    admin;
+    anon;
+    anonKey;
+    supabaseUrl;
+    constructor(config) {
+        this.supabaseUrl = config.supabaseUrl;
+        this.anonKey = config.anonKey;
+        this.admin = createClient(config.supabaseUrl, config.serviceRoleKey, {
+            auth: { persistSession: false, autoRefreshToken: false }
+        });
+        this.anon = createClient(config.supabaseUrl, config.anonKey, {
+            auth: { persistSession: false, autoRefreshToken: false }
+        });
+        this.passwordAuth = new SupabasePasswordAuth(this.admin, this.anon, (email, password) => this.signIn(email, password), config.enableSelfSignup ?? false, (user) => this.hydrate(user));
+        this.oauth = new SupabaseOAuthAuth(this.anon, (user) => this.hydrate(user), config.oauthProviders ?? []);
+        this.emailLink = new SupabaseEmailLinkAuth(this.anon, (user) => this.hydrate(user), config.allowEmailLinkSignup ?? true);
+    }
+    static fromEnv(env) {
+        const supabaseUrl = env.SUPABASE_URL;
+        const anonKey = env.SUPABASE_ANON_KEY;
+        const serviceRoleKey = env.SUPABASE_SERVICE_ROLE_KEY;
+        if (!supabaseUrl)
+            throw new Error('Missing required env var: SUPABASE_URL');
+        if (!anonKey)
+            throw new Error('Missing required env var: SUPABASE_ANON_KEY');
+        if (!serviceRoleKey)
+            throw new Error('Missing required env var: SUPABASE_SERVICE_ROLE_KEY');
+        const oauthProviders = (env.SUPABASE_OAUTH_PROVIDERS ?? '')
+            .split(',')
+            .map((p) => p.trim().toLowerCase())
+            .filter((p) => p.length > 0);
+        return new SupabaseAuthProvider({
+            supabaseUrl,
+            anonKey,
+            serviceRoleKey,
+            enableSelfSignup: env.SUPABASE_ENABLE_SELF_SIGNUP === 'true',
+            oauthProviders,
+            // Default true; set SUPABASE_ALLOW_EMAIL_LINK_SIGNUP=false to lock down
+            // to invite-only and reject magic-link signups for new addresses.
+            allowEmailLinkSignup: env.SUPABASE_ALLOW_EMAIL_LINK_SIGNUP !== 'false'
+        });
+    }
+    async verifyToken(token) {
+        if (!token)
+            return null;
+        // Per-request anon client with the JWT attached. `getUser(token)` also
+        // works, but routing through a scoped client keeps future sub-calls
+        // (profile fetch, etc.) RLS-aware if we ever move them here.
+        const { data, error } = await this.anon.auth.getUser(token);
+        if (error || !data.user)
+            return null;
+        if (data.user.user_metadata?.disabled === true)
+            return null;
+        return this.hydrate(data.user);
+    }
+    async getUser(id) {
+        const { data, error } = await this.admin.auth.admin.getUserById(id);
+        if (error || !data.user)
+            return null;
+        return this.hydrate(data.user);
+    }
+    async listUsers(opts) {
+        // GoTrue's admin.listUsers uses its own pagination (page/perPage).
+        // Translate our cursor (offset) into page number.
+        const perPage = opts?.limit ?? 50;
+        const page = opts?.cursor ? parseInt(opts.cursor, 10) : 1;
+        const { data, error } = await this.admin.auth.admin.listUsers({
+            page: Number.isFinite(page) && page >= 1 ? page : 1,
+            perPage
+        });
+        if (error)
+            throw error;
+        const users = data.users;
+        const hydrated = users.map((u) => this.hydrate(u));
+        // If the page was full, assume there may be more.
+        const nextCursor = users.length >= perPage ? String(page + 1) : undefined;
+        return { items: hydrated, nextCursor };
+    }
+    async createUser(email) {
+        // Allowlist variant: create without a password. The user receives a
+        // magic-link / OIDC handoff from the consuming app. Identity-only;
+        // platform permissions are granted via IPlatformPermissionStore.
+        const { data, error } = await this.admin.auth.admin.createUser({
+            email,
+            email_confirm: true
+        });
+        if (error)
+            throw error;
+        if (!data.user)
+            throw new Error('createUser returned no user');
+        return this.hydrate(data.user);
+    }
+    async deleteUser(id) {
+        // Identity-only delete. The §2 sole-`instance_admin` invariant lives
+        // on IPlatformPermissionStore; callers consult it before calling here.
+        const { error } = await this.admin.auth.admin.deleteUser(id);
+        if (error) {
+            // 404-shaped errors from GoTrue surface as { status: 404 } or a
+            // specific message. Normalize to 'not_found' rather than throwing.
+            const e = error;
+            if (e.status === 404 || /not.?found/i.test(e.message ?? ''))
+                return 'not_found';
+            throw error;
+        }
+        return 'ok';
+    }
+    async disableUser(id) {
+        const { data: existing, error: fetchError } = await this.admin.auth.admin.getUserById(id);
+        if (fetchError || !existing.user)
+            return 'not_found';
+        // GoTrue's user_metadata update merges shallowly — preserve existing
+        // fields by spreading them in.
+        const mergedMetadata = {
+            ...(existing.user.user_metadata ?? {}),
+            disabled: true
+        };
+        const { error } = await this.admin.auth.admin.updateUserById(id, {
+            user_metadata: mergedMetadata
+        });
+        if (error) {
+            const e = error;
+            if (e.status === 404 || /not.?found/i.test(e.message ?? ''))
+                return 'not_found';
+            throw error;
+        }
+        return 'ok';
+    }
+    async touchLastLogin(id) {
+        // 60-second debounce. Matches the local provider.
+        const { data, error } = await this.admin
+            .from('user_profiles')
+            .select('last_login_at')
+            .eq('user_id', id)
+            .maybeSingle();
+        if (error)
+            return;
+        if (data?.last_login_at) {
+            const prev = Date.parse(data.last_login_at);
+            if (Number.isFinite(prev) && Date.now() - prev < 60_000)
+                return;
+        }
+        await this.admin
+            .from('user_profiles')
+            .update({ last_login_at: new Date().toISOString() })
+            .eq('user_id', id);
+    }
+    // OAuth lives on `this.oauth` (typed `IOAuthAuth`); see `SupabaseOAuthAuth`
+    // below. Mirrors the `passwordAuth` capability split.
+    // ============================================================================
+    // Internals
+    // ============================================================================
+    /**
+     * Sign in via GoTrue. Returns the access token string and the hydrated
+     * user. Called by `SupabasePasswordAuth.verifyLogin` — kept on the
+     * provider class so it has access to the hydrate helper without plumbing.
+     */
+    async signIn(email, password) {
+        const { data, error } = await this.anon.auth.signInWithPassword({ email, password });
+        if (error || !data.user || !data.session)
+            return null;
+        if (data.user.user_metadata?.disabled === true)
+            return null;
+        return { user: this.hydrate(data.user), sessionToken: data.session.access_token };
+    }
+    /**
+     * Map a GoTrue `User` to our identity-only `AuthUser`. Platform permissions
+     * live on `IPlatformPermissionStore` and profile fields (displayName,
+     * starred, recentRuns) on `IUserProfileStore` — neither is in AuthUser.
+     */
+    hydrate(user) {
+        return {
+            id: user.id,
+            email: user.email ?? undefined,
+            createdAt: user.created_at ?? undefined,
+            lastLoginAt: user.last_sign_in_at ?? undefined,
+            disabled: user.user_metadata?.disabled === true,
+            metadata: user.user_metadata
+        };
+    }
+    /**
+     * Expose the anon URL + key so other code (e.g. the same process's
+     * storage provider or per-request client factories) can build user-scoped
+     * clients without requiring a second config read.
+     */
+    getAnonClientConfig() {
+        return { supabaseUrl: this.supabaseUrl, anonKey: this.anonKey };
+    }
+}
+class SupabasePasswordAuth {
+    admin;
+    anon;
+    signIn;
+    enableSelfSignup;
+    hydrate;
+    constructor(admin, anon, signIn, enableSelfSignup, hydrate) {
+        this.admin = admin;
+        this.anon = anon;
+        this.signIn = signIn;
+        this.enableSelfSignup = enableSelfSignup;
+        this.hydrate = hydrate;
+    }
+    async verifyLogin(email, password) {
+        const result = await this.signIn(email, password);
+        if (!result)
+            return { kind: 'failed', reason: 'invalid_credentials' };
+        return { kind: 'success', user: result.user, sessionToken: result.sessionToken };
+    }
+    async createUserWithPassword(email, password) {
+        // Identity-only — platform permissions are granted separately via
+        // IPlatformPermissionStore.set after creation.
+        const { data, error } = await this.admin.auth.admin.createUser({
+            email,
+            password,
+            email_confirm: true
+        });
+        if (error)
+            throw error;
+        if (!data.user)
+            throw new Error('createUserWithPassword returned no user');
+        return this.hydrate(data.user);
+    }
+    async registerUser(email, password) {
+        if (!this.enableSelfSignup)
+            return null;
+        const { data, error } = await this.anon.auth.signUp({ email, password });
+        if (error || !data.user)
+            return null;
+        return this.hydrate(data.user);
+    }
+}
+/**
+ * Supabase-backed `IOAuthAuth`. Thin wrappers over GoTrue's `signInWithOAuth`
+ * / `exchangeCodeForSession` / `refreshSession` — the failure-shape mapping
+ * (return null vs throw) is the only logic.
+ */
+class SupabaseOAuthAuth {
+    anon;
+    hydrate;
+    providers;
+    constructor(anon, hydrate, providers) {
+        this.anon = anon;
+        this.hydrate = hydrate;
+        this.providers = providers;
+    }
+    listProviders() {
+        return this.providers;
+    }
+    async getOAuthAuthorizationUrl(provider, redirectTo) {
+        const { data, error } = await this.anon.auth.signInWithOAuth({
+            provider,
+            options: { redirectTo, skipBrowserRedirect: true }
+        });
+        if (error || !data.url)
+            throw error ?? new Error('signInWithOAuth returned no URL');
+        return data.url;
+    }
+    async exchangeOAuthCode(code) {
+        const { data, error } = await this.anon.auth.exchangeCodeForSession(code);
+        if (error || !data.user || !data.session)
+            return null;
+        if (data.user.user_metadata?.disabled === true)
+            return null;
+        return {
+            user: this.hydrate(data.user),
+            sessionToken: data.session.access_token,
+            refreshToken: data.session.refresh_token
+        };
+    }
+    async refreshSession(refreshToken) {
+        const { data, error } = await this.anon.auth.refreshSession({ refresh_token: refreshToken });
+        if (error || !data.session)
+            return null;
+        return {
+            sessionToken: data.session.access_token,
+            refreshToken: data.session.refresh_token
+        };
+    }
+}
+/**
+ * Supabase-backed `IEmailLinkAuth`. Wraps GoTrue's `signInWithOtp` (send the
+ * link) and `verifyOtp` with `type: 'magiclink' | 'email' | 'signup'`
+ * (verify on click).
+ *
+ * Token shape: Supabase emails the user `{callbackUrl}?token_hash=…&type=…`.
+ * `verifyMagicLink` accepts either the full URL or just the raw `token_hash`
+ * — adapters MAY support either to give the route layer flexibility. The
+ * `type` query param decides which OTP variant `verifyOtp` runs (signup vs
+ * magic-link returning user vs invite acceptance), so we pass it through.
+ */
+class SupabaseEmailLinkAuth {
+    anon;
+    hydrate;
+    allowSignup;
+    constructor(anon, hydrate, allowSignup) {
+        this.anon = anon;
+        this.hydrate = hydrate;
+        this.allowSignup = allowSignup;
+    }
+    async sendMagicLink(email, callbackUrl) {
+        const { error } = await this.anon.auth.signInWithOtp({
+            email,
+            options: {
+                emailRedirectTo: callbackUrl,
+                shouldCreateUser: this.allowSignup
+            }
+        });
+        if (!error)
+            return { ok: true };
+        // Map GoTrue's classified errors to our coarse reasons. Anything we
+        // don't recognize we throw — the route returns 500 and we get a stack
+        // trace, instead of swallowing a real bug as "rate limited".
+        const status = error.status;
+        const code = error.code;
+        const message = error.message ?? '';
+        if (status === 429 || /rate.?limit/i.test(message))
+            return { ok: false, reason: 'rate_limited' };
+        if (code === 'otp_disabled' ||
+            code === 'signup_disabled' ||
+            /signup.*disabled/i.test(message)) {
+            return { ok: false, reason: 'signup_disabled' };
+        }
+        if (code === 'validation_failed' || /invalid.*email|email.*invalid/i.test(message)) {
+            return { ok: false, reason: 'invalid_email' };
+        }
+        throw error;
+    }
+    async verifyMagicLink(rawCallbackUrl) {
+        const params = parseCallbackParams(rawCallbackUrl);
+        if (!params)
+            return null;
+        const { tokenHash, type } = params;
+        const { data, error } = await this.anon.auth.verifyOtp({
+            token_hash: tokenHash,
+            type
+        });
+        if (error || !data.user || !data.session)
+            return null;
+        if (data.user.user_metadata?.disabled === true)
+            return null;
+        return {
+            user: this.hydrate(data.user),
+            sessionToken: data.session.access_token,
+            refreshToken: data.session.refresh_token
+        };
+    }
+}
+/**
+ * Pull `token_hash` + `type` from either a full callback URL or a bare
+ * `token_hash=…&type=…` query string. Tolerant of both shapes so the route
+ * layer can pass whichever form is convenient.
+ *
+ * Returns null when the inputs aren't recognizable — the caller treats null
+ * as "send the user back to /login".
+ */
+function parseCallbackParams(raw) {
+    let search;
+    try {
+        // Full URL path
+        search = new URL(raw).searchParams;
+    }
+    catch {
+        // Query-string-only path — treat as bare params.
+        search = new URLSearchParams(raw.startsWith('?') ? raw.slice(1) : raw);
+    }
+    const tokenHash = search.get('token_hash');
+    const type = search.get('type');
+    if (!tokenHash)
+        return null;
+    const allowed = new Set(['magiclink', 'email', 'signup', 'invite', 'recovery']);
+    if (!type || !allowed.has(type))
+        return null;
+    return {
+        tokenHash,
+        type: type
+    };
+}
+//# sourceMappingURL=SupabaseAuthProvider.js.map

package/dist/auth/SupabaseAuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabaseAuthProvider.js","sourceRoot":"","sources":["../../src/auth/SupabaseAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAkC,MAAM,uBAAuB,CAAC;AAqDrF,MAAM,OAAO,oBAAoB;IACvB,IAAI,GAAG,eAAe,CAAC;IACvB,YAAY,CAAgB;IAC5B,KAAK,CAAa;IAClB,SAAS,CAAiB;IAElB,KAAK,CAAiB;IACtB,IAAI,CAAiB;IACrB,OAAO,CAAS;IAChB,WAAW,CAAS;IAErC,YAAY,MAAkC;QAC7C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE;YACpE,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE;YAC5D,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,oBAAoB,CAC3C,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,IAAI,EACT,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjD,MAAM,CAAC,gBAAgB,IAAI,KAAK,EAChC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAiB,CACjC,IAAI,CAAC,IAAI,EACT,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAC5B,MAAM,CAAC,cAAc,IAAI,EAAE,CAC3B,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,qBAAqB,CACzC,IAAI,CAAC,IAAI,EACT,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAC5B,MAAM,CAAC,oBAAoB,IAAI,IAAI,CACnC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAuC;QACrD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC;QACtC,MAAM,cAAc,GAAG,GAAG,CAAC,yBAAyB,CAAC;QACrD,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7E,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5F,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;aACzD,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,IAAI,oBAAoB,CAAC;YAC/B,WAAW;YACX,OAAO;YACP,cAAc;YACd,gBAAgB,EAAE,GAAG,CAAC,2BAA2B,KAAK,MAAM;YAC5D,cAAc;YACd,wEAAwE;YACxE,kEAAkE;YAClE,oBAAoB,EAAE,GAAG,CAAC,gCAAgC,KAAK,OAAO;SACtE,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC9B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,uEAAuE;QACvE,oEAAoE;QACpE,6DAA6D;QAC7D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAkB;QACjC,mEAAmE;QACnE,kDAAkD;QAClD,MAAM,OAAO,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAC7D,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnD,OAAO;SACP,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,kDAAkD;QAClD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa;QAC7B,oEAAoE;QACpE,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC9D,KAAK;YACL,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QAC1B,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,KAAK,EAAE,CAAC;YACX,gEAAgE;YAChE,mEAAmE;YACnE,MAAM,CAAC,GAAG,KAAyD,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAAE,OAAO,WAAW,CAAC;YAChF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC3B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO,WAAW,CAAC;QACrD,qEAAqE;QACrE,+BAA+B;QAC/B,MAAM,cAAc,GAAG;YACtB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;YACtC,QAAQ,EAAE,IAAI;SACd,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE;YAChE,aAAa,EAAE,cAAc;SAC7B,CAAC,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,KAAyD,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAAE,OAAO,WAAW,CAAC;YAChF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC9B,kDAAkD;QAClD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK;aACtC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,eAAe,CAAC;aACvB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;aACjB,WAAW,EAAE,CAAC;QAChB,IAAI,KAAK;YAAE,OAAO;QAElB,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM;gBAAE,OAAO;QACjE,CAAC;QACD,MAAM,IAAI,CAAC,KAAK;aACd,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;aACnD,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,4EAA4E;IAC5E,sDAAsD;IAEtD,+EAA+E;IAC/E,YAAY;IACZ,+EAA+E;IAC/E;;;;OAIG;IACK,KAAK,CAAC,MAAM,CACnB,KAAa,EACb,QAAgB;QAEhB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrF,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACK,OAAO,CAAC,IAAU;QACzB,OAAO;YACN,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;YACvC,WAAW,EAAE,IAAI,CAAC,eAAe,IAAI,SAAS;YAC9C,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAC/C,QAAQ,EAAE,IAAI,CAAC,aAAa;SAC5B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,mBAAmB;QAClB,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACjE,CAAC;CACD;AAED,MAAM,oBAAoB;IAEP;IACA;IACA;IAIA;IACA;IARlB,YACkB,KAAqB,EACrB,IAAoB,EACpB,MAG4C,EAC5C,gBAAyB,EACzB,OAAiC;QAPjC,UAAK,GAAL,KAAK,CAAgB;QACrB,SAAI,GAAJ,IAAI,CAAgB;QACpB,WAAM,GAAN,MAAM,CAGsC;QAC5C,qBAAgB,GAAhB,gBAAgB,CAAS;QACzB,YAAO,GAAP,OAAO,CAA0B;IAChD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,QAAgB;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,QAAgB;QAC3D,kEAAkE;QAClE,+CAA+C;QAC/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC9D,KAAK;YACL,QAAQ;YACR,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACjD,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,iBAAiB;IAEJ;IACA;IACA;IAHlB,YACkB,IAAoB,EACpB,OAAiC,EACjC,SAA4B;QAF5B,SAAI,GAAJ,IAAI,CAAgB;QACpB,YAAO,GAAP,OAAO,CAA0B;QACjC,cAAS,GAAT,SAAS,CAAmB;IAC3C,CAAC;IAEJ,aAAa;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC7B,QAAkD,EAClD,UAAkB;QAElB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;YAC5D,QAAQ;YACR,OAAO,EAAE,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE;SAClD,CAAC,CAAC;QACH,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAY;QAKnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,YAAoB;QAIxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7F,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO;YACN,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;CACD;AAED;;;;;;;;;;GAUG;AACH,MAAM,qBAAqB;IAER;IACA;IACA;IAHlB,YACkB,IAAoB,EACpB,OAAiC,EACjC,WAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAgB;QACpB,YAAO,GAAP,OAAO,CAA0B;QACjC,gBAAW,GAAX,WAAW,CAAS;IACnC,CAAC;IAEJ,KAAK,CAAC,aAAa,CAClB,KAAa,EACb,WAAmB;QAInB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACpD,KAAK;YACL,OAAO,EAAE;gBACR,eAAe,EAAE,WAAW;gBAC5B,gBAAgB,EAAE,IAAI,CAAC,WAAW;aAClC;SACD,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAEhC,oEAAoE;QACpE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,MAAM,GAAI,KAA6B,CAAC,MAAM,CAAC;QACrD,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC9C,IACC,IAAI,KAAK,cAAc;YACvB,IAAI,KAAK,iBAAiB;YAC1B,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAChC,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,KAAK,mBAAmB,IAAI,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAK3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QAEnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACtD,UAAU,EAAE,SAAS;YACrB,IAAI;SACJ,CAAC,CAAC;QACH,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;CACD;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC3B,GAAW;IAEX,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACJ,gBAAgB;QAChB,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,iDAAiD;QACjD,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO;QACN,SAAS;QACT,IAAI,EAAE,IAAgE;KACtE,CAAC;AACH,CAAC"}

package/dist/auth/__tests__/conformance.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=conformance.test.d.ts.map

package/dist/auth/__tests__/conformance.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/conformance.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/conformance.test.js

@@ -0,0 +1,76 @@
+import { describe, beforeEach, it } from 'vitest';
+import { runAuthProviderConformance, runEmailLinkAuthConformance } from '@selvajs/platform/testing';
+import { SupabaseAuthProvider } from '../SupabaseAuthProvider.js';
+import { readEnv, resetAllData } from '../../data/__tests__/test-helpers.js';
+const envCtx = readEnv();
+if (!envCtx) {
+    describe.skip('SupabaseAuthProvider (skipped: no live stack)', () => {
+        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
+    });
+}
+else {
+    const ctx = envCtx; // non-null in this branch
+    // The auth conformance suite expects `verifyLogin('', adminPassword)` to
+    // succeed. Supabase requires a non-empty email, so we seed a deterministic
+    // admin email and have the suite use that via the `adminEmail` option.
+    const ADMIN_EMAIL = 'admin@conformance.test';
+    const ADMIN_PASSWORD = 'conformance-admin-password-1234';
+    async function ensureAdmin() {
+        const { data: existing } = await ctx.adminClient.auth.admin.listUsers({ perPage: 1000 });
+        const match = existing.users.find((u) => u.email === ADMIN_EMAIL);
+        if (match)
+            return match.id;
+        const { data, error } = await ctx.adminClient.auth.admin.createUser({
+            email: ADMIN_EMAIL,
+            password: ADMIN_PASSWORD,
+            email_confirm: true
+        });
+        if (error)
+            throw error;
+        return data.user.id;
+    }
+    async function makeProvider() {
+        const provider = new SupabaseAuthProvider({
+            supabaseUrl: ctx.url,
+            anonKey: ctx.anonKey,
+            serviceRoleKey: ctx.serviceRoleKey
+        });
+        // Ensure the admin account exists + has instance_admin.
+        const id = await ensureAdmin();
+        const { error: upError } = await ctx.adminClient
+            .from('user_profiles')
+            .update({ platform_permissions: ['instance_admin'] })
+            .eq('user_id', id);
+        if (upError)
+            throw upError;
+        return { provider, adminPassword: ADMIN_PASSWORD };
+    }
+    describe('SupabaseAuthProvider', () => {
+        beforeEach(async () => {
+            await resetAllData(ctx);
+        });
+        runAuthProviderConformance({
+            name: 'SupabaseAuthProvider',
+            createProvider: async () => {
+                const { provider, adminPassword } = await makeProvider();
+                return { provider, adminPassword, adminEmail: ADMIN_EMAIL };
+            },
+            userManagement: true
+        });
+        runEmailLinkAuthConformance({
+            name: 'SupabaseEmailLinkAuth',
+            createAdapter: async () => {
+                const { provider } = await makeProvider();
+                return {
+                    adapter: provider.emailLink,
+                    // `validEmail` isn't used by the suite for live mail delivery;
+                    // it just needs to look like a real address. The malformed
+                    // case is what we actually assert on.
+                    validEmail: 'real-looking@conformance.test',
+                    invalidEmail: 'not-an-email-address'
+                };
+            }
+        });
+    });
+}
+//# sourceMappingURL=conformance.test.js.map

package/dist/auth/__tests__/conformance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAE7E,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACnE,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,0BAA0B;IAC9C,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,WAAW,GAAG,wBAAwB,CAAC;IAC7C,MAAM,cAAc,GAAG,iCAAiC,CAAC;IAEzD,KAAK,UAAU,WAAW;QACzB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;QAClE,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YACnE,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,cAAc;YACxB,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,YAAY;QAC1B,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG,CAAC,GAAG;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,cAAc,EAAE,GAAG,CAAC,cAAc;SAClC,CAAC,CAAC;QACH,wDAAwD;QACxD,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW;aAC9C,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;aACpD,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACpB,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC;IAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACrC,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QAEH,0BAA0B,CAAC;YAC1B,IAAI,EAAE,sBAAsB;YAC5B,cAAc,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;gBACzD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;YAC7D,CAAC;YACD,cAAc,EAAE,IAAI;SACpB,CAAC,CAAC;QAEH,2BAA2B,CAAC;YAC3B,IAAI,EAAE,uBAAuB;YAC7B,aAAa,EAAE,KAAK,IAAI,EAAE;gBACzB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;gBAC1C,OAAO;oBACN,OAAO,EAAE,QAAQ,CAAC,SAAS;oBAC3B,+DAA+D;oBAC/D,2DAA2D;oBAC3D,sCAAsC;oBACtC,UAAU,EAAE,+BAA+B;oBAC3C,YAAY,EAAE,sBAAsB;iBACpC,CAAC;YACH,CAAC;SACD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,3 @@
+export { SupabaseAuthProvider } from './SupabaseAuthProvider.js';
+export type { SupabaseAuthProviderConfig } from './SupabaseAuthProvider.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,YAAY,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,2 @@
+export { SupabaseAuthProvider } from './SupabaseAuthProvider.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/data/SupabaseAuditQuery.d.ts

@@ -0,0 +1,16 @@
+import type { AuditQueryFilters, AuditQueryResult, IAuditQuery, RequestContext } from '@selvajs/platform';
+import type { ClientBundle } from './client.js';
+/**
+ * Read-side for `audit_events`. Always uses the service-role client — RLS
+ * blocks all read access by design, so the route layer is the single trust
+ * boundary (callers must gate on `instance_admin`).
+ *
+ * Pagination is keyset on `(occurred_at desc, id desc)`. The `id` tie-breaker
+ * prevents skipped rows when multiple events land in the same millisecond.
+ */
+export declare class SupabaseAuditQuery implements IAuditQuery {
+    private readonly clients;
+    constructor(clients: ClientBundle);
+    list(_ctx: RequestContext, filters: AuditQueryFilters): Promise<AuditQueryResult>;
+}
+//# sourceMappingURL=SupabaseAuditQuery.d.ts.map

package/dist/data/SupabaseAuditQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabaseAuditQuery.d.ts","sourceRoot":"","sources":["../../src/data/SupabaseAuditQuery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEX,iBAAiB,EACjB,gBAAgB,EAEhB,WAAW,EACX,cAAc,EACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAUhD;;;;;;;GAOG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,YAAY;IAE5C,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAmEvF"}

package/dist/data/SupabaseAuditQuery.js

@@ -0,0 +1,83 @@
+const MAX_LIMIT = 200;
+const DEFAULT_LIMIT = 100;
+// Cursor values are interpolated into PostgREST filter strings — both formats
+// must be validated before any string concatenation reaches the query.
+const ISO_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})$/;
+const UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+/**
+ * Read-side for `audit_events`. Always uses the service-role client — RLS
+ * blocks all read access by design, so the route layer is the single trust
+ * boundary (callers must gate on `instance_admin`).
+ *
+ * Pagination is keyset on `(occurred_at desc, id desc)`. The `id` tie-breaker
+ * prevents skipped rows when multiple events land in the same millisecond.
+ */
+export class SupabaseAuditQuery {
+    clients;
+    constructor(clients) {
+        this.clients = clients;
+    }
+    async list(_ctx, filters) {
+        const limit = clampLimit(filters.limit);
+        let q = this.clients.serviceClient
+            .from('audit_events')
+            .select('id, type, actor_id, occurred_at, data')
+            .order('occurred_at', { ascending: false })
+            .order('id', { ascending: false })
+            // Fetch one extra row to detect "has next page" without a count query.
+            .limit(limit + 1);
+        if (filters.types && filters.types.length > 0) {
+            q = q.in('type', [...filters.types]);
+        }
+        if (filters.actorId) {
+            q = q.eq('actor_id', filters.actorId);
+        }
+        if (filters.sinceIso) {
+            q = q.gte('occurred_at', filters.sinceIso);
+        }
+        if (filters.untilIso) {
+            q = q.lte('occurred_at', filters.untilIso);
+        }
+        if (filters.cursor) {
+            // `(occurred_at, id) < (cursorTs, cursorId)` expressed for PostgREST:
+            // strictly older OR same timestamp with a strictly smaller id.
+            //
+            // Both values are interpolated into a `.or()` filter string. Validate
+            // shape before interpolation — without these guards a malformed cursor
+            // (or a hand-crafted URL by a route caller) could break out of the
+            // filter and combine with arbitrary PostgREST operators.
+            const ts = filters.cursor.occurredAt;
+            const id = filters.cursor.id;
+            if (!ISO_RE.test(ts) || !UUID_RE.test(id)) {
+                throw new Error('audit_events query: malformed cursor');
+            }
+            q = q.or(`occurred_at.lt.${ts},and(occurred_at.eq.${ts},id.lt.${id})`);
+        }
+        const { data, error } = await q;
+        if (error) {
+            throw new Error(`audit_events query failed: ${error.message}`);
+        }
+        const fetched = (data ?? []);
+        const hasMore = fetched.length > limit;
+        const page = hasMore ? fetched.slice(0, limit) : fetched;
+        const last = page[page.length - 1];
+        return {
+            rows: page.map((r) => ({
+                id: r.id,
+                type: r.type,
+                actorId: r.actor_id,
+                occurredAt: r.occurred_at,
+                data: r.data
+            })),
+            nextCursor: hasMore && last ? { occurredAt: last.occurred_at, id: last.id } : null
+        };
+    }
+}
+function clampLimit(requested) {
+    if (!requested || requested <= 0)
+        return DEFAULT_LIMIT;
+    if (requested > MAX_LIMIT)
+        return MAX_LIMIT;
+    return Math.floor(requested);
+}
+//# sourceMappingURL=SupabaseAuditQuery.js.map

package/dist/data/SupabaseAuditQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabaseAuditQuery.js","sourceRoot":"","sources":["../../src/data/SupabaseAuditQuery.ts"],"names":[],"mappings":"AAUA,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,MAAM,GAAG,uEAAuE,CAAC;AACvF,MAAM,OAAO,GAAG,+EAA+E,CAAC;AAEhG;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACD;IAA7B,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;IAAG,CAAC;IAEtD,KAAK,CAAC,IAAI,CAAC,IAAoB,EAAE,OAA0B;QAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAExC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa;aAChC,IAAI,CAAC,cAAc,CAAC;aACpB,MAAM,CAAC,uCAAuC,CAAC;aAC/C,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;aAC1C,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAClC,uEAAuE;aACtE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAEnB,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,sEAAsE;YACtE,+DAA+D;YAC/D,EAAE;YACF,sEAAsE;YACtE,uEAAuE;YACvE,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;YACrC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACzD,CAAC;YACD,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAMzB,CAAC;QAEH,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEnC,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAA2B;gBACnC,OAAO,EAAE,CAAC,CAAC,QAAQ;gBACnB,UAAU,EAAE,CAAC,CAAC,WAAW;gBACzB,IAAI,EAAE,CAAC,CAAC,IAAI;aACZ,CAAC,CAA2B;YAC7B,UAAU,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;SAClF,CAAC;IACH,CAAC;CACD;AAED,SAAS,UAAU,CAAC,SAA6B;IAChD,IAAI,CAAC,SAAS,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC;IACvD,IAAI,SAAS,GAAG,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC9B,CAAC"}

package/dist/data/SupabaseComputeServerStore.d.ts

@@ -0,0 +1,26 @@
+import { type IComputeServerStore, type ComputeConfig, type ComputeServerConfig, type RequestContext } from '@selvajs/platform';
+import type { ClientBundle } from './client.js';
+/**
+ * Compute-server config backed by three tables:
+ *   - `compute_servers`: one row per server. `scope = 'platform' | 'org'`.
+ *     Platform rows carry a `shared_with_all` flag + `compute_server_shares`
+ *     allowlist; org rows carry `owner_org_id`.
+ *   - `compute_server_shares`: many-to-many for platform servers shared
+ *     with specific orgs (when `shared_with_all = false`).
+ *   - `compute_server_org_defaults`: per-org `orgDefaults[orgId]` choice.
+ *   - `compute_server_platform_default`: single-row sentinel for the global
+ *     `defaultServerId`.
+ *
+ * `getConfig` returns the full doc; the visibility predicate is applied by
+ * callers (resolver, page loaders) using helpers in `@selvajs/platform`.
+ */
+export declare class SupabaseComputeServerStore implements IComputeServerStore {
+    private readonly clients;
+    constructor(clients: ClientBundle);
+    getConfig(ctx: RequestContext): Promise<ComputeConfig>;
+    savePlatformServers(ctx: RequestContext, servers: ComputeServerConfig[], defaultServerId: string | undefined): Promise<void>;
+    saveOrgServers(ctx: RequestContext, orgId: string, servers: ComputeServerConfig[], defaultServerId?: string | null): Promise<void>;
+    setOrgDefault(ctx: RequestContext, orgId: string, serverId: string | null): Promise<void>;
+    deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
+}
+//# sourceMappingURL=SupabaseComputeServerStore.d.ts.map

package/dist/data/SupabaseComputeServerStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabaseComputeServerStore.d.ts","sourceRoot":"","sources":["../../src/data/SupabaseComputeServerStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;;;;;;;;GAaG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,YAAY;IAE5C,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAyCtD,mBAAmB,CACxB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC;IAiCV,cAAc,CACnB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAC7B,OAAO,CAAC,IAAI,CAAC;IAgCV,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBzF,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA0BpE"}