@selvajs/supabase-provider 0.11.0

package/dist/data/__tests__/test-helpers.js

@@ -0,0 +1,175 @@
+/**
+ * Shared test helpers for Supabase data conformance tests.
+ *
+ * Every suite starts with a fully wiped DB so tests are isolated. We use the
+ * service-role client for both — seeding users in `auth.users` and wiping
+ * every relevant table.
+ */
+import { createClient } from '@supabase/supabase-js';
+import { buildClientBundle } from '../client.js';
+export function readEnv() {
+    const url = process.env.SUPABASE_URL;
+    const anonKey = process.env.SUPABASE_ANON_KEY;
+    const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
+    if (!url || !anonKey || !serviceRoleKey)
+        return null;
+    // `.env.test` is checked in with local-Supabase defaults so contributors can
+    // `npx supabase start` and run the suite. But `createClient` transitively
+    // loads `@supabase/realtime-js`, which on Node < 22 throws at construction
+    // without a native WebSocket. Swallow that so the suite cleanly skips
+    // instead of crashing test collection.
+    let adminClient;
+    try {
+        adminClient = createClient(url, serviceRoleKey, {
+            auth: { persistSession: false, autoRefreshToken: false }
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes('WebSocket'))
+            return null;
+        throw err;
+    }
+    const bundle = buildClientBundle({ supabaseUrl: url, anonKey, serviceRoleKey });
+    return { url, anonKey, serviceRoleKey, adminClient, bundle };
+}
+/**
+ * Reset every data table this adapter owns. Leaves Supabase-managed tables
+ * (`auth.users`, etc.) alone except via `deleteAllAuthUsers` below.
+ *
+ * Order-sensitive because some FKs don't cascade: we go bottom up from
+ * dependents to parents.
+ */
+export async function resetAllData(ctx) {
+    await truncate(ctx, 'share_links');
+    await truncate(ctx, 'invites');
+    // Versions FK to definitions ON DELETE CASCADE, but `definitions` can't
+    // be wiped while live/draft pointers reference versions (ON DELETE
+    // RESTRICT, spec §6). Null the pointers, drop versions, then drop defs.
+    await ctx.adminClient
+        .from('definitions')
+        .update({ live_version_id: null, draft_version_id: null })
+        .not('guid', 'is', null);
+    await truncate(ctx, 'definition_versions');
+    await truncate(ctx, 'definitions');
+    await truncate(ctx, 'project_members');
+    // compute defaults have a platform_default sibling — reset all three.
+    await truncate(ctx, 'compute_server_org_defaults');
+    await truncate(ctx, 'compute_server_shares');
+    await resetComputePlatformDefault(ctx);
+    await truncate(ctx, 'compute_servers');
+    await truncate(ctx, 'org_members');
+    await truncate(ctx, 'orgs');
+    await truncate(ctx, 'user_profiles');
+    await deleteAllAuthUsers(ctx);
+}
+async function resetComputePlatformDefault(ctx) {
+    // Singleton row — clear `default_server_id` rather than deleting.
+    const { error } = await ctx.adminClient
+        .from('compute_server_platform_default')
+        .update({ default_server_id: null })
+        .eq('singleton', true);
+    if (error)
+        throw error;
+}
+async function truncate(ctx, table) {
+    const { error } = await ctx.adminClient
+        .from(table)
+        .delete()
+        .neq(columnForDeleteAll(table), '00000000-0000-0000-0000-000000000000');
+    if (error)
+        throw error;
+}
+function columnForDeleteAll(table) {
+    if (table === 'org_members')
+        return 'user_id';
+    if (table === 'project_members')
+        return 'user_id';
+    if (table === 'user_profiles')
+        return 'user_id';
+    if (table === 'definitions')
+        return 'guid';
+    if (table === 'definition_versions')
+        return 'id';
+    if (table === 'compute_server_org_defaults')
+        return 'org_id';
+    if (table === 'compute_server_shares')
+        return 'server_id';
+    return 'id';
+}
+async function deleteAllAuthUsers(ctx) {
+    const { data, error } = await ctx.adminClient.auth.admin.listUsers({ perPage: 1000 });
+    if (error)
+        throw error;
+    for (const user of data.users) {
+        const { error: delError } = await ctx.adminClient.auth.admin.deleteUser(user.id);
+        if (delError)
+            throw delError;
+    }
+}
+/**
+ * Seed an `auth.users` row, mark the user as `instance_admin`, sign in, and
+ * return the real id + access token. `auth.admin.createUser` doesn't accept a
+ * caller-supplied id — Supabase generates one. The conformance suite calls us
+ * with a *suggested* id (for adapters that honor it); we ignore it and return
+ * GoTrue's real id.
+ *
+ * The instance_admin grant is what makes RLS open up for the conformance
+ * tests: every policy in the schema accepts `is_instance_admin()` as a
+ * universal pass, mirroring the `instance_admin` default in `makeCtx`.
+ *
+ * The session token is what makes RLS *see* the user at all. Without it, the
+ * Supabase client falls back to the anon role and every write fails.
+ */
+export async function seedUser(ctx, suggestedId) {
+    return seedUserCore(ctx, suggestedId, { promoteToInstanceAdmin: true });
+}
+/**
+ * Variant of `seedUser` that leaves `platform_permissions` empty. Use this
+ * when a test specifically asserts on a fresh user's permission state (e.g.
+ * the platform-permission store conformance suite).
+ */
+export async function seedPlainUser(ctx, suggestedId) {
+    return seedUserCore(ctx, suggestedId, { promoteToInstanceAdmin: false });
+}
+async function seedUserCore(ctx, _suggestedId, opts) {
+    // Unique email per seed so repeated calls don't collide. GoTrue requires
+    // an email even for password-less users.
+    const email = `conformance-${crypto.randomUUID()}@conformance.test`;
+    const password = 'conformance-test-password-1234';
+    const { data, error } = await ctx.adminClient.auth.admin.createUser({
+        email,
+        password,
+        email_confirm: true
+    });
+    if (error)
+        throw error;
+    const userId = data.user.id;
+    if (opts.promoteToInstanceAdmin) {
+        // Trigger auto-created the user_profiles row; promote to instance_admin
+        // so every RLS policy treats this user as fully authorized. Mirrors the
+        // `instance_admin` default in `makeCtx`.
+        const { error: promoteError } = await ctx.adminClient
+            .from('user_profiles')
+            .update({ platform_permissions: ['instance_admin'] })
+            .eq('user_id', userId);
+        if (promoteError)
+            throw promoteError;
+    }
+    // Sign in to get an access token. The conformance suite stuffs this into
+    // `adapterContext.sessionToken` and our client.ts uses it to scope the
+    // request to this user instead of falling back to anon.
+    const signInClient = createClient(ctx.url, ctx.anonKey, {
+        auth: { persistSession: false, autoRefreshToken: false }
+    });
+    const { data: session, error: signInError } = await signInClient.auth.signInWithPassword({
+        email,
+        password
+    });
+    if (signInError)
+        throw signInError;
+    if (!session.session)
+        throw new Error('seedUser: signInWithPassword returned no session');
+    return { userId, sessionToken: session.session.access_token };
+}
+//# sourceMappingURL=test-helpers.js.map

package/dist/data/__tests__/test-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-helpers.js","sourceRoot":"","sources":["../../../src/data/__tests__/test-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAqB,MAAM,cAAc,CAAC;AAUpE,MAAM,UAAU,OAAO;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC9C,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC7D,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACrD,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,uCAAuC;IACvC,IAAI,WAA2B,CAAC;IAChC,IAAI,CAAC;QACJ,WAAW,GAAG,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE;YAC/C,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,GAAG,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAChF,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAgB;IAClD,MAAM,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACnC,MAAM,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,wEAAwE;IACxE,mEAAmE;IACnE,wEAAwE;IACxE,MAAM,GAAG,CAAC,WAAW;SACnB,IAAI,CAAC,aAAa,CAAC;SACnB,MAAM,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;SACzD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1B,MAAM,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC3C,MAAM,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACnC,MAAM,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACvC,sEAAsE;IACtE,MAAM,QAAQ,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IACnD,MAAM,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC7C,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACvC,MAAM,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACnC,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5B,MAAM,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACrC,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,GAAgB;IAC1D,kEAAkE;IAClE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW;SACrC,IAAI,CAAC,iCAAiC,CAAC;SACvC,MAAM,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;SACnC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACxB,IAAI,KAAK;QAAE,MAAM,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAgB,EAAE,KAAa;IACtD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW;SACrC,IAAI,CAAC,KAAK,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,sCAAsC,CAAC,CAAC;IACzE,IAAI,KAAK;QAAE,MAAM,KAAK,CAAC;AACxB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,KAAK,KAAK,iBAAiB;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,KAAK,KAAK,aAAa;QAAE,OAAO,MAAM,CAAC;IAC3C,IAAI,KAAK,KAAK,qBAAqB;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,KAAK,KAAK,6BAA6B;QAAE,OAAO,QAAQ,CAAC;IAC7D,IAAI,KAAK,KAAK,uBAAuB;QAAE,OAAO,WAAW,CAAC;IAC1D,OAAO,IAAI,CAAC;AACb,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAgB;IACjD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,IAAI,KAAK;QAAE,MAAM,KAAK,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,IAAI,QAAQ;YAAE,MAAM,QAAQ,CAAC;IAC9B,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC7B,GAAgB,EAChB,WAAmB;IAEnB,OAAO,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,GAAgB,EAChB,WAAmB;IAEnB,OAAO,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,YAAY,CAC1B,GAAgB,EAChB,YAAoB,EACpB,IAAyC;IAEzC,yEAAyE;IACzE,yCAAyC;IACzC,MAAM,KAAK,GAAG,eAAe,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACpE,MAAM,QAAQ,GAAG,gCAAgC,CAAC;IAClD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QACnE,KAAK;QACL,QAAQ;QACR,aAAa,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,KAAK;QAAE,MAAM,KAAK,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAE5B,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACjC,wEAAwE;QACxE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW;aACnD,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;aACpD,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxB,IAAI,YAAY;YAAE,MAAM,YAAY,CAAC;IACtC,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE;QACvD,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;KACxD,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC;QACxF,KAAK;QACL,QAAQ;KACR,CAAC,CAAC;IACH,IAAI,WAAW;QAAE,MAAM,WAAW,CAAC;IACnC,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC1F,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;AAC/D,CAAC"}

package/dist/data/client.d.ts

@@ -0,0 +1,44 @@
+import { type SupabaseClient } from '@supabase/supabase-js';
+import type { RequestContext } from '@selvajs/platform';
+/**
+ * Build a Supabase client for a given `RequestContext`.
+ *
+ * Three modes — fail-closed:
+ *  - **Service-role** ONLY when `ctx.system === true`. Bypasses RLS. Used for
+ *    admin paths, janitors, bootstrap, and any explicitly-trusted server
+ *    flow. The system flag must never be derived from a user session.
+ *  - **User-scoped** when `ctx.adapterContext.sessionToken` is a JWT: runs
+ *    under `authenticated` role with `auth.uid()` from the token. RLS
+ *    policies enforce per-user visibility.
+ *  - **Anonymous** otherwise: runs under the `anon` role. RLS is active and
+ *    will scope reads/writes accordingly. This is the safety net — any code
+ *    that constructs a context without forwarding the session token AND
+ *    without setting `system: true` is treated as untrusted.
+ *
+ * Previous versions fell back to service-role when the session token was
+ * absent — a fail-OPEN footgun: any synthetic ctx (e.g. share-token resolve)
+ * silently bypassed RLS. The current contract is explicit: opt into
+ * service-role with `system: true`, or you get RLS.
+ *
+ * Per-request WeakMap caching keeps a single client alive for the lifetime
+ * of a RequestContext — multiple store calls in one HTTP handler share one
+ * fetch connection without leaking auth across requests.
+ */
+export interface ClientBundle {
+    /** Long-lived service-role client. Bypasses RLS. */
+    serviceClient: SupabaseClient;
+    /**
+     * Produce (or reuse) a client scoped to this request's identity.
+     *  - `ctx.system === true` → service-role (RLS bypassed).
+     *  - `ctx.adapterContext.sessionToken` set → user-scoped (RLS active).
+     *  - neither → anon client (RLS active, no `auth.uid()`).
+     */
+    forRequest(ctx: RequestContext): SupabaseClient;
+}
+export interface BuildClientOptions {
+    supabaseUrl: string;
+    anonKey: string;
+    serviceRoleKey: string;
+}
+export declare function buildClientBundle(opts: BuildClientOptions): ClientBundle;
+//# sourceMappingURL=client.d.ts.map

package/dist/data/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/data/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,YAAY;IAC5B,oDAAoD;IACpD,aAAa,EAAE,cAAc,CAAC;IAC9B;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,CAAC;CAChD;AAED,MAAM,WAAW,kBAAkB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,YAAY,CAkCxE"}

package/dist/data/client.js

@@ -0,0 +1,40 @@
+import { createClient } from '@supabase/supabase-js';
+export function buildClientBundle(opts) {
+    const serviceClient = createClient(opts.supabaseUrl, opts.serviceRoleKey, {
+        auth: { persistSession: false, autoRefreshToken: false }
+    });
+    // Long-lived anon client — the fail-closed default for ctxes that aren't
+    // explicitly system and don't carry a session token.
+    const anonClient = createClient(opts.supabaseUrl, opts.anonKey, {
+        auth: { persistSession: false, autoRefreshToken: false }
+    });
+    const perRequestCache = new WeakMap();
+    return {
+        serviceClient,
+        forRequest(ctx) {
+            if (ctx.system)
+                return serviceClient;
+            const token = extractSessionToken(ctx.adapterContext);
+            if (!token)
+                return anonClient;
+            const cached = perRequestCache.get(ctx);
+            if (cached)
+                return cached;
+            const client = createClient(opts.supabaseUrl, opts.anonKey, {
+                auth: { persistSession: false, autoRefreshToken: false },
+                global: {
+                    headers: { Authorization: `Bearer ${token}` }
+                }
+            });
+            perRequestCache.set(ctx, client);
+            return client;
+        }
+    };
+}
+function extractSessionToken(adapterContext) {
+    if (!adapterContext || typeof adapterContext !== 'object')
+        return undefined;
+    const maybe = adapterContext.sessionToken;
+    return typeof maybe === 'string' && maybe.length > 0 ? maybe : undefined;
+}
+//# sourceMappingURL=client.js.map

package/dist/data/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/data/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AA6C1E,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACzD,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE;QACzE,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;KACxD,CAAC,CAAC;IAEH,yEAAyE;IACzE,qDAAqD;IACrD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE;QAC/D,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;KACxD,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,IAAI,OAAO,EAAkC,CAAC;IAEtE,OAAO;QACN,aAAa;QACb,UAAU,CAAC,GAAmB;YAC7B,IAAI,GAAG,CAAC,MAAM;gBAAE,OAAO,aAAa,CAAC;YAErC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACtD,IAAI,CAAC,KAAK;gBAAE,OAAO,UAAU,CAAC;YAE9B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE;gBAC3D,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;gBACxD,MAAM,EAAE;oBACP,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;iBAC7C;aACD,CAAC,CAAC;YACH,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO,MAAM,CAAC;QACf,CAAC;KACD,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,cAAuB;IACnD,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,KAAK,GAAI,cAA6C,CAAC,YAAY,CAAC;IAC1E,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC"}

package/dist/data/index.d.ts

@@ -0,0 +1,12 @@
+export { SupabaseOrgStore } from './SupabaseOrgStore.js';
+export { SupabaseProjectStore } from './SupabaseProjectStore.js';
+export { SupabaseDefinitionStore } from './SupabaseDefinitionStore.js';
+export { SupabaseInviteStore } from './SupabaseInviteStore.js';
+export { SupabaseComputeServerStore } from './SupabaseComputeServerStore.js';
+export { SupabaseShareLinkStore } from './SupabaseShareLinkStore.js';
+export { SupabaseDataProvider } from './SupabaseDataProvider.js';
+export { SupabaseEventSink } from './SupabaseEventSink.js';
+export { SupabaseAuditQuery } from './SupabaseAuditQuery.js';
+export { buildClientBundle } from './client.js';
+export type { ClientBundle, BuildClientOptions } from './client.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/data/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/data/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC"}

package/dist/data/index.js

@@ -0,0 +1,11 @@
+export { SupabaseOrgStore } from './SupabaseOrgStore.js';
+export { SupabaseProjectStore } from './SupabaseProjectStore.js';
+export { SupabaseDefinitionStore } from './SupabaseDefinitionStore.js';
+export { SupabaseInviteStore } from './SupabaseInviteStore.js';
+export { SupabaseComputeServerStore } from './SupabaseComputeServerStore.js';
+export { SupabaseShareLinkStore } from './SupabaseShareLinkStore.js';
+export { SupabaseDataProvider } from './SupabaseDataProvider.js';
+export { SupabaseEventSink } from './SupabaseEventSink.js';
+export { SupabaseAuditQuery } from './SupabaseAuditQuery.js';
+export { buildClientBundle } from './client.js';
+//# sourceMappingURL=index.js.map

package/dist/data/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/data/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC"}

package/dist/data/pagination.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Pagination helpers shared across Supabase stores.
+ *
+ * The platform contract specifies cursor pagination (`ListOptions.cursor`).
+ * Because Supabase/Postgres has no built-in opaque cursor format, we encode
+ * an offset as the cursor — simple, correct for stable sorts, and good
+ * enough for the volumes Selva deals with (admin/definition lists are
+ * bounded; nothing is infinite scroll over millions of rows).
+ *
+ * Keyset pagination would be faster at scale if it ever matters.
+ */
+import type { ListOptions } from '@selvajs/platform';
+export interface RangeSpec {
+    from: number;
+    to: number;
+    limit: number;
+}
+/** Decode an opaque cursor string. Returns 0 for missing/invalid cursors. */
+export declare function decodeCursor(cursor: string | undefined): number;
+export declare function encodeCursor(offset: number): string;
+/** Clamp limit + compute the PostgREST `range(from, to)` bounds. */
+export declare function toRange(opts: Pick<ListOptions, 'limit' | 'cursor'> | undefined): RangeSpec;
+/**
+ * Build the `nextCursor` from the count returned by PostgREST. Returns
+ * undefined when there is no next page.
+ */
+export declare function nextCursorFromRange(range: RangeSpec, returnedCount: number, totalCount: number | null | undefined): string | undefined;
+/** Map `ListOptions.orderBy` to a Postgres column name. */
+export declare function orderColumn(orderBy: ListOptions['orderBy'] | undefined): string;
+//# sourceMappingURL=pagination.d.ts.map

package/dist/data/pagination.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../src/data/pagination.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAI/D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,oEAAoE;AACpE,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,SAAS,GAAG,SAAS,CAI1F;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,SAAS,EAChB,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACnC,MAAM,GAAG,SAAS,CAOpB;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,MAAM,CAU/E"}

package/dist/data/pagination.js

@@ -0,0 +1,53 @@
+/**
+ * Pagination helpers shared across Supabase stores.
+ *
+ * The platform contract specifies cursor pagination (`ListOptions.cursor`).
+ * Because Supabase/Postgres has no built-in opaque cursor format, we encode
+ * an offset as the cursor — simple, correct for stable sorts, and good
+ * enough for the volumes Selva deals with (admin/definition lists are
+ * bounded; nothing is infinite scroll over millions of rows).
+ *
+ * Keyset pagination would be faster at scale if it ever matters.
+ */
+import { DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT } from '@selvajs/platform';
+/** Decode an opaque cursor string. Returns 0 for missing/invalid cursors. */
+export function decodeCursor(cursor) {
+    if (!cursor)
+        return 0;
+    const n = parseInt(cursor, 10);
+    return Number.isFinite(n) && n >= 0 ? n : 0;
+}
+export function encodeCursor(offset) {
+    return String(offset);
+}
+/** Clamp limit + compute the PostgREST `range(from, to)` bounds. */
+export function toRange(opts) {
+    const limit = Math.min(Math.max(opts?.limit ?? DEFAULT_PAGE_LIMIT, 1), MAX_PAGE_LIMIT);
+    const from = decodeCursor(opts?.cursor);
+    return { from, to: from + limit - 1, limit };
+}
+/**
+ * Build the `nextCursor` from the count returned by PostgREST. Returns
+ * undefined when there is no next page.
+ */
+export function nextCursorFromRange(range, returnedCount, totalCount) {
+    const consumed = range.from + returnedCount;
+    if (totalCount != null) {
+        return consumed < totalCount ? encodeCursor(consumed) : undefined;
+    }
+    // Without total, we can only infer "there might be more" if we got a full page.
+    return returnedCount >= range.limit ? encodeCursor(consumed) : undefined;
+}
+/** Map `ListOptions.orderBy` to a Postgres column name. */
+export function orderColumn(orderBy) {
+    switch (orderBy) {
+        case 'name':
+            return 'name';
+        case 'updatedAt':
+            return 'updated_at';
+        case 'createdAt':
+        default:
+            return 'created_at';
+    }
+}
+//# sourceMappingURL=pagination.js.map

package/dist/data/pagination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.js","sourceRoot":"","sources":["../../src/data/pagination.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AASvE,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,MAA0B;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,OAAO,CAAC,IAAuD;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,kBAAkB,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,GAAG,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAAgB,EAChB,aAAqB,EACrB,UAAqC;IAErC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5C,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACxB,OAAO,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IACD,gFAAgF;IAChF,OAAO,aAAa,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,OAA2C;IACtE,QAAQ,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM;YACV,OAAO,MAAM,CAAC;QACf,KAAK,WAAW;YACf,OAAO,YAAY,CAAC;QACrB,KAAK,WAAW,CAAC;QACjB;YACC,OAAO,YAAY,CAAC;IACtB,CAAC;AACF,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { SupabaseStorageProvider } from './storage/SupabaseStorageProvider.js';
+export type { SupabaseStorageProviderConfig } from './storage/SupabaseStorageProvider.js';
+export { SupabaseOrgStore, SupabaseProjectStore, SupabaseDefinitionStore, SupabaseInviteStore, SupabaseComputeServerStore, SupabaseShareLinkStore, SupabaseDataProvider, SupabaseEventSink, SupabaseAuditQuery, buildClientBundle } from './data/index.js';
+export type { ClientBundle, BuildClientOptions } from './data/index.js';
+export { SupabaseUserProfileProvider } from './userProfile/index.js';
+export { SupabaseAuthProvider } from './auth/index.js';
+export type { SupabaseAuthProviderConfig } from './auth/index.js';
+export { SupabasePlatformPermissionStore } from './permissions/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,YAAY,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAE1F,OAAO,EACN,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,YAAY,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export { SupabaseStorageProvider } from './storage/SupabaseStorageProvider.js';
+export { SupabaseOrgStore, SupabaseProjectStore, SupabaseDefinitionStore, SupabaseInviteStore, SupabaseComputeServerStore, SupabaseShareLinkStore, SupabaseDataProvider, SupabaseEventSink, SupabaseAuditQuery, buildClientBundle } from './data/index.js';
+export { SupabaseUserProfileProvider } from './userProfile/index.js';
+export { SupabaseAuthProvider } from './auth/index.js';
+export { SupabasePlatformPermissionStore } from './permissions/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAG/E,OAAO,EACN,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAGvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/permissions/SupabasePlatformPermissionStore.d.ts

@@ -0,0 +1,25 @@
+import type { IPlatformPermissionStore, PlatformPermission, RequestContext, UserManagementResult } from '@selvajs/platform';
+import type { ClientBundle } from '../data/client.js';
+/**
+ * Supabase-backed platform-permission store. Reads and writes
+ * `public.user_profiles.platform_permissions` (auto-seeded by the
+ * `handle_new_auth_user` trigger). Service-role throughout — the store's own
+ * `assertAdmin` / `assertCanRead` enforce the auth boundary at the app level
+ * since RLS on `user_profiles` is coarse-grained for cross-user reads.
+ *
+ * Disabled-user state lives on `auth.users.user_metadata.disabled`, so the
+ * invariant counters cross-reference the auth backend to exclude disabled
+ * admins (matches `Permissions.md §10` "enabled instance_admin" semantics).
+ */
+export declare class SupabasePlatformPermissionStore implements IPlatformPermissionStore {
+    private readonly clients;
+    constructor(clients: ClientBundle);
+    private client;
+    getFor(ctx: RequestContext, userId: string): Promise<PlatformPermission[]>;
+    getForBatch(ctx: RequestContext, userIds: readonly string[]): Promise<Map<string, PlatformPermission[]>>;
+    set(ctx: RequestContext, userId: string, permissions: readonly PlatformPermission[]): Promise<UserManagementResult>;
+    hasInstanceAdmin(_ctx: RequestContext): Promise<boolean>;
+    countInstanceAdminsExcluding(_ctx: RequestContext, excludeUserId: string): Promise<number>;
+    private countOtherEnabledAdmins;
+}
+//# sourceMappingURL=SupabasePlatformPermissionStore.d.ts.map

package/dist/permissions/SupabasePlatformPermissionStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabasePlatformPermissionStore.d.ts","sourceRoot":"","sources":["../../src/permissions/SupabasePlatformPermissionStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,qBAAa,+BAAgC,YAAW,wBAAwB;IACnE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,YAAY;IAElD,OAAO,CAAC,MAAM;IAIR,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAW1E,WAAW,CAChB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAevC,GAAG,CACR,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,kBAAkB,EAAE,GACxC,OAAO,CAAC,oBAAoB,CAAC;IA8B1B,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBxD,4BAA4B,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAIlF,uBAAuB;CAgBrC"}

package/dist/permissions/SupabasePlatformPermissionStore.js

@@ -0,0 +1,153 @@
+import { ProviderError, hasPermission, PlatformPermissionSchema } from '@selvajs/platform';
+/**
+ * Supabase-backed platform-permission store. Reads and writes
+ * `public.user_profiles.platform_permissions` (auto-seeded by the
+ * `handle_new_auth_user` trigger). Service-role throughout — the store's own
+ * `assertAdmin` / `assertCanRead` enforce the auth boundary at the app level
+ * since RLS on `user_profiles` is coarse-grained for cross-user reads.
+ *
+ * Disabled-user state lives on `auth.users.user_metadata.disabled`, so the
+ * invariant counters cross-reference the auth backend to exclude disabled
+ * admins (matches `Permissions.md §10` "enabled instance_admin" semantics).
+ */
+export class SupabasePlatformPermissionStore {
+    clients;
+    constructor(clients) {
+        this.clients = clients;
+    }
+    client() {
+        return this.clients.serviceClient;
+    }
+    async getFor(ctx, userId) {
+        assertCanRead(ctx, userId);
+        const { data, error } = await this.client()
+            .from('user_profiles')
+            .select('platform_permissions')
+            .eq('user_id', userId)
+            .maybeSingle();
+        if (error)
+            throw mapError(error);
+        return filterValid(data?.platform_permissions ?? []);
+    }
+    async getForBatch(ctx, userIds) {
+        assertAdmin(ctx);
+        const out = new Map();
+        if (userIds.length === 0)
+            return out;
+        const { data, error } = await this.client()
+            .from('user_profiles')
+            .select('user_id, platform_permissions')
+            .in('user_id', [...userIds]);
+        if (error)
+            throw mapError(error);
+        for (const row of data ?? []) {
+            out.set(row.user_id, filterValid((row.platform_permissions ?? [])));
+        }
+        return out;
+    }
+    async set(ctx, userId, permissions) {
+        assertAdmin(ctx);
+        // 1. Confirm the target exists in the auth backend (the FK + trigger
+        //    means the user_profiles row should exist post-signup; if not,
+        //    treat as not_found rather than auto-creating).
+        const { data: existing, error: fetchError } = await this.client()
+            .from('user_profiles')
+            .select('platform_permissions')
+            .eq('user_id', userId)
+            .maybeSingle();
+        if (fetchError)
+            throw mapError(fetchError);
+        if (!existing)
+            return 'not_found';
+        // 2. §2 invariant: refuse if dropping the last instance_admin.
+        const wasAdmin = (existing.platform_permissions ?? []).includes('instance_admin');
+        const willBeAdmin = permissions.includes('instance_admin');
+        if (wasAdmin && !willBeAdmin) {
+            const others = await this.countOtherEnabledAdmins(userId);
+            if (others === 0)
+                return 'last_admin';
+        }
+        // 3. Apply.
+        const { error } = await this.client()
+            .from('user_profiles')
+            .update({ platform_permissions: [...permissions] })
+            .eq('user_id', userId);
+        if (error)
+            throw mapError(error);
+        return 'ok';
+    }
+    async hasInstanceAdmin(_ctx) {
+        const { data, error } = await this.client()
+            .from('user_profiles')
+            .select('user_id')
+            .contains('platform_permissions', ['instance_admin']);
+        if (error)
+            throw mapError(error);
+        const candidates = (data ?? []).map((r) => r.user_id);
+        if (candidates.length === 0)
+            return false;
+        // Check at least one isn't disabled.
+        for (const id of candidates) {
+            const { data: authData } = await this.clients.serviceClient.auth.admin.getUserById(id);
+            if (authData.user && authData.user.user_metadata?.disabled !== true)
+                return true;
+        }
+        return false;
+    }
+    async countInstanceAdminsExcluding(_ctx, excludeUserId) {
+        return this.countOtherEnabledAdmins(excludeUserId);
+    }
+    async countOtherEnabledAdmins(excludeUserId) {
+        const { data, error } = await this.client()
+            .from('user_profiles')
+            .select('user_id')
+            .contains('platform_permissions', ['instance_admin'])
+            .neq('user_id', excludeUserId);
+        if (error)
+            throw mapError(error);
+        const candidates = (data ?? []).map((r) => r.user_id);
+        if (candidates.length === 0)
+            return 0;
+        let count = 0;
+        for (const id of candidates) {
+            const { data: authData } = await this.clients.serviceClient.auth.admin.getUserById(id);
+            if (authData.user && authData.user.user_metadata?.disabled !== true)
+                count += 1;
+        }
+        return count;
+    }
+}
+function filterValid(raw) {
+    return raw.filter((p) => PlatformPermissionSchema.safeParse(p).success);
+}
+function assertCanRead(ctx, userId) {
+    if (ctx.system)
+        return;
+    if (ctx.userId === userId)
+        return;
+    if (hasPermission(ctx, 'instance_admin'))
+        return;
+    throw new ProviderError('Forbidden: cannot read another user’s permissions', 403);
+}
+function assertAdmin(ctx) {
+    if (ctx.system)
+        return;
+    if (hasPermission(ctx, 'instance_admin'))
+        return;
+    throw new ProviderError('Forbidden: instance admin required', 403);
+}
+function mapError(e) {
+    const pg = e;
+    if (pg?.code === '23505')
+        return new ProviderError(pg.message ?? 'Duplicate record', 409);
+    if (pg?.code === '23503')
+        return new ProviderError(pg.message ?? 'Foreign key violation', 409);
+    if (e instanceof Error)
+        return e;
+    if (e && typeof e === 'object') {
+        const obj = e;
+        return new Error(obj.code ? `[${obj.code}] ${obj.message ?? ''}` : (obj.message ?? String(e)));
+    }
+    return new Error(String(e));
+}
+//# sourceMappingURL=SupabasePlatformPermissionStore.js.map

package/dist/permissions/SupabasePlatformPermissionStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabasePlatformPermissionStore.js","sourceRoot":"","sources":["../../src/permissions/SupabasePlatformPermissionStore.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAG3F;;;;;;;;;;GAUG;AACH,MAAM,OAAO,+BAA+B;IACd;IAA7B,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;IAAG,CAAC;IAE9C,MAAM;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAmB,EAAE,MAAc;QAC/C,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,sBAAsB,CAAC;aAC9B,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,WAAW,EAAE,CAAC;QAChB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,WAAW,CAAC,IAAI,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,GAAmB,EACnB,OAA0B;QAE1B,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACrC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,+BAA+B,CAAC;aACvC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QAC9B,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAiB,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAa,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,GAAG,CACR,GAAmB,EACnB,MAAc,EACd,WAA0C;QAE1C,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,qEAAqE;QACrE,mEAAmE;QACnE,oDAAoD;QACpD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aAC/D,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,sBAAsB,CAAC;aAC9B,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,WAAW,EAAE,CAAC;QAChB,IAAI,UAAU;YAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO,WAAW,CAAC;QAElC,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAClF,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAI,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;QACvC,CAAC;QAED,YAAY;QACZ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACnC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;aAClD,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAoB;QAC1C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,SAAS,CAAC;aACjB,QAAQ,CAAC,sBAAsB,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACvD,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAiB,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,qCAAqC;QACrC,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACvF,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;QAClF,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,IAAoB,EAAE,aAAqB;QAC7E,OAAO,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,aAAqB;QAC1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,SAAS,CAAC;aACjB,QAAQ,CAAC,sBAAsB,EAAE,CAAC,gBAAgB,CAAC,CAAC;aACpD,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAChC,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAiB,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACvF,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;gBAAE,KAAK,IAAI,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;CACD;AAED,SAAS,WAAW,CAAC,GAAsB;IAC1C,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAA2B,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,aAAa,CAAC,GAAmB,EAAE,MAAc;IACzD,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO;IACvB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO;IAClC,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAAE,OAAO;IACjD,MAAM,IAAI,aAAa,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB;IACvC,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO;IACvB,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAAE,OAAO;IACjD,MAAM,IAAI,aAAa,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAOD,SAAS,QAAQ,CAAC,CAAU;IAC3B,MAAM,EAAE,GAAG,CAAmB,CAAC;IAC/B,IAAI,EAAE,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,IAAI,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC1F,IAAI,EAAE,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,IAAI,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC/F,IAAI,CAAC,YAAY,KAAK;QAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,CAAwC,CAAC;QACrD,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}

package/dist/permissions/__tests__/conformance.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=conformance.test.d.ts.map

package/dist/permissions/__tests__/conformance.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.test.d.ts","sourceRoot":"","sources":["../../../src/permissions/__tests__/conformance.test.ts"],"names":[],"mappings":""}