@selvajs/supabase-provider 0.17.0-beta.4 → 0.18.0

package/README.md

@@ -2,7 +2,7 @@
 
 Supabase (Auth + Postgres + Storage) implementation of the `@selvajs/platform` interfaces.
 
-Runs the Selva backend against **either** a managed Supabase project (production) or a local Supabase CLI stack in Docker (development). Same code — different `SUPABASE_URL` and keys.
+Runs against **either** a managed Supabase project (production) or a local Supabase CLI stack in Docker (development) — same code, different `SUPABASE_URL` and keys.
 
 ---
 
@@ -10,7 +10,7 @@ Runs the Selva backend against **either** a managed Supabase project (production
 
 - [Quick start](#quick-start)
 - [Environment variables](#environment-variables)
-- [Wiring into `selva.config.ts`](#wiring-into-selvaconfigts)
+- [Switching to the Supabase provider](#switching-to-the-supabase-provider)
 - [Applying the schema](#applying-the-schema)
 - [Development — local Supabase stack](#development--local-supabase-stack)
 - [Production — hosted Supabase project](#production--hosted-supabase-project)
@@ -25,16 +25,16 @@ Runs the Selva backend against **either** a managed Supabase project (production
 2. Provision Supabase — either local (`npx supabase start`) or hosted (supabase.com).
 3. Apply the migrations from `packages/providers/supabase/supabase/migrations/` (the local CLI does this automatically on `db reset`).
 4. Copy the three env vars into your selva app `.env` (see below).
-5. Edit [`selva.config.ts`](../../../selva.config.ts) at the repo root to swap the local provider for the Supabase provider.
+5. Set `SELVA_AUTH_PROVIDER=supabase`, `SELVA_DATA_PROVIDER=supabase`, `SELVA_STORAGE_PROVIDER=supabase` in the same `.env`.
 6. `pnpm dev` — the selva app now reads and writes from Supabase.
 
 ---
 
 ## Environment variables
 
-All env vars are documented in [`packages/selva/.env.example`](../../selva/.env.example) — copy that file to `.env` and edit it. The Supabase provider needs `SUPABASE_URL`, `SUPABASE_ANON_KEY`, and `SUPABASE_SERVICE_ROLE_KEY`; the optional bucket / private-URL / signup overrides are also listed there.
+All env vars are documented in [`packages/selva/.env.example`](../../selva/.env.example) — copy that file to `.env` and edit it. This provider needs `SUPABASE_URL`, `SUPABASE_ANON_KEY`, and `SUPABASE_SERVICE_ROLE_KEY`; the optional bucket / private-URL / signup overrides are also listed there.
 
-Both `SELVA_*` keys are still required under this provider, for narrower jobs than under the local provider:
+Both `SELVA_*` keys are still required, but for narrower jobs than under the local provider:
 
 - `SELVA_HMAC_KEY` — **not** used for sessions here (those are Supabase JWTs), but still hashes share-link and invite tokens before they're stored.
 - `SELVA_AT_REST_KEY` — encrypts `compute_servers.api_key` before it reaches the database. `SupabaseDataProvider` refuses to construct without it.
@@ -60,28 +60,19 @@ Rhino.Compute URL + API key are configured in `/admin/compute` and persisted in
 
 ---
 
-## Wiring into `selva.config.ts`
-
-The repo's [`selva.config.ts`](../../selva.config.ts) is the single DI point — it picks which provider backs every interface. Switch between providers by changing imports:
-
-```ts
-import { defineConfig } from '@selvajs/platform';
-import * as supa from '@selvajs/supabase-provider';
-
-export default defineConfig((env) => ({
-	tenancy: 'single' as const,
-	flags: {
-		ALLOW_CROSS_ORG_PUBLIC: false,
-		ALLOW_ORG_COMPUTE_OVERRIDE: false,
-		ALLOW_ORG_CREATION: false
-	},
-	auth: supa.SupabaseAuthProvider.fromEnv(env),
-	data: supa.SupabaseDataProvider.fromEnv(env),
-	storage: supa.SupabaseStorageProvider.fromEnv(env)
-}));
+## Switching to the Supabase provider
+
+The selva app picks a provider per interface from env vars, via `createSelvaProviders` (`packages/server/src/providers/create-selva-providers.ts`) and the registry in `packages/selva/src/lib/server/providers.server.ts`:
+
+```
+SELVA_AUTH_PROVIDER=supabase      # local | supabase | header (default: local)
+SELVA_DATA_PROVIDER=supabase      # local | supabase          (default: local)
+SELVA_STORAGE_PROVIDER=supabase   # local | supabase          (default: local)
 ```
 
-To switch back to the local provider, swap the import and the three provider lines. See the commented example in [`selva.config.ts`](../../selva.config.ts).
+To switch back to the local provider, remove the three vars (or set them to `local`) and restart.
+
+For a provider not bundled in the app, point `SELVA_CONFIG_PATH` at an external `selva.config.js`, loaded dynamically at boot in place of the env-driven wiring. It must be an actual `.js` file — there's no TS compiler at runtime.
 
 ---
 
@@ -91,12 +82,12 @@ To switch back to the local provider, swap the import and the three provider lin
 
 The `supabase/migrations/` directory holds timestamp-prefixed files, applied in filename order:
 
-| File                                                 | What it installs                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `20260425155514_selva_initial.sql`                   | Everything: `user_profiles` (+ auto-seed trigger), `orgs` / `org_members` / `projects` / `project_members` (+ RLS helpers), `definitions` / `definition_versions` (+ deletion-protection FKs and the atomic `increment_run_count` RPC), `invites` (+ `get_invite_by_token` RPC), `compute_servers` (+ per-org/instance defaults, spec §3 BYO compute), `share_links` (+ `try_increment_share_link_solve_count` RPC, spec §7), and the `selva-public` / `selva-private` storage policies. |
-| `20260529202220_selva_definition_version_schema.sql` | Adds `definition_versions.schema` + `schema_extracted_at` (cached compute-extracted UI schema) and the previously-missing `change_note` column. All `add column if not exists`, so it's safe to re-run.                                                                                                                                                                                                                                                                                  |
+| File                                                 | What it installs                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `20260425155514_selva_initial.sql`                   | The `selva` schema itself, plus `user_profiles` (+ auto-seed trigger), `orgs` / `org_members` / `projects` / `project_members` (+ RLS helpers), `definitions` / `definition_versions` (+ deletion-protection FKs and the atomic `increment_run_count` RPC), `invites` (+ `get_invite_by_token` RPC), `compute_servers` (+ per-org/instance defaults), `share_links` (+ `try_increment_share_link_solve_count` RPC), and the `selva-public` / `selva-private` storage policies. |
+| `20260529202220_selva_definition_version_schema.sql` | Adds `definition_versions.schema` + `schema_extracted_at` (cached compute-extracted UI schema) and the `change_note` column. All `add column if not exists`, safe to re-run.                                                                                                                                                                                                                                                                                                   |
 
-These two are only the foundation — the directory ships further timestamp-prefixed migrations on top (solve metrics, org assets, definition status/audit, erasure functions, …). The table above is not the full list; `supabase/migrations/` in filename order is authoritative.
+These two are only the foundation — `supabase/migrations/` ships further timestamp-prefixed files on top (solve metrics, org assets, definition status/audit, erasure functions, …). Filename order in that directory is authoritative, not this table.
 
 Future schema changes go in new timestamp-prefixed files: `<UTCtimestamp>_selva_<name>.sql` (e.g. `date -u +%Y%m%d%H%M%S` for the prefix). The `_selva_` infix and timestamp prefix let a consuming app's own migrations interleave by time without ever colliding with Selva's — see [Consuming migrations in an external app](#consuming-migrations-in-an-external-app).
 
@@ -119,7 +110,7 @@ npx supabase db diff
 npx supabase db push
 ```
 
-Alternatively you can copy each `.sql` file into Supabase Dashboard → **SQL Editor** and run them in order. The CLI path is strongly preferred: it tracks which migrations already ran, so re-running it is safe, and the files stay under version control.
+You can also copy each `.sql` file into Supabase Dashboard → **SQL Editor** and run them in order, but prefer the CLI: it tracks which migrations already ran, so re-running it is safe.
 
 ### Exposing the `selva` schema to PostgREST
 
@@ -138,9 +129,9 @@ No backfill step is required for the schema-caching migration: existing definiti
 
 #### Migrated from the old `000N_` filenames?
 
-Earlier releases shipped `0001_initial.sql` / `0002_definition_version_schema.sql`. These were renamed to timestamp-prefixed names (`20260425155514_selva_initial.sql`, `20260529202220_selva_definition_version_schema.sql`) so they slot into a consuming app's migration timeline without collisions. The **file contents are unchanged** — only the names.
+Earlier releases shipped `0001_initial.sql` / `0002_definition_version_schema.sql`, since renamed to `20260425155514_selva_initial.sql` / `20260529202220_selva_definition_version_schema.sql` (contents unchanged, only the names, so the files slot into a consuming app's migration timeline without collisions).
 
-To a database that already applied the `000N_` versions, the renamed files look like brand-new migrations. Both are idempotent (`create or replace`, `add column if not exists`), so a stray re-run is a harmless no-op, but you'd end up with duplicate history rows. To reconcile cleanly:
+To a database that already applied the `000N_` versions, the renamed files look like brand-new migrations. Both are idempotent (`create or replace`, `add column if not exists`), so a stray re-run is a harmless no-op, but you'd end up with duplicate history rows. To reconcile:
 
 - **Local dev stack:** just `npx supabase db reset` — applies the renamed files from scratch.
 - **Hosted project with the old versions applied:** tell the CLI the new versions are already present so it doesn't re-run them:
@@ -198,7 +189,7 @@ SUPABASE_SERVICE_ROLE_KEY=sb_secret_...
 
 Rhino.Compute server URL + API key are registered in `/admin/compute` after first boot.
 
-Switch `selva.config.ts` to Supabase (snippet above), then:
+Set the three `SELVA_*_PROVIDER=supabase` env vars (above), then:
 
 ```bash
 pnpm dev
@@ -235,7 +226,7 @@ Studio is a full admin UI at `http://127.0.0.1:54323`. Use it to inspect tables,
    SUPABASE_SERVICE_ROLE_KEY=sb_secret_...
    ```
    After deploying, register your Rhino.Compute server URL (+ optional API key) via `/admin/compute`.
-6. Deploy the selva app with `selva.config.ts` wired to `@selvajs/supabase-provider`.
+6. Deploy the selva app with the three `SELVA_*_PROVIDER=supabase` env vars set.
 7. Bootstrap the first user:
    - Open `/setup` once — creates the first admin with `instance_admin`.
    - Or manually: Dashboard → **Authentication** → **Add user**, then in the SQL Editor: `UPDATE selva.user_profiles SET platform_permissions = ARRAY['instance_admin']::text[] WHERE user_id = '<uuid>';`
@@ -312,10 +303,6 @@ Helper SQL functions (`selva.is_instance_admin`, `selva.is_org_member`, `selva.v
 
 - **`incrementRunCount`** uses a SQL function (`UPDATE … SET run_count = run_count + 1`) — atomic. The local provider does read-modify-write and can lose bumps under concurrent solves.
 
-### Findings
-
-Every abstraction-pressure point hit during implementation is logged in [FINDINGS.md](./FINDINGS.md). Short version: six items, none requiring platform contract changes beyond the Phase 0 set.
-
 ---
 
 ## Status

package/dist/auth/SupabaseAuthProvider.d.ts

@@ -1,65 +1,39 @@
 import { type ILogger } from '@selvajs/platform';
 import type { IAuthProvider, IEmailLinkAuth, IOAuthAuth, IPasswordAuth, ISessionRefresh, AuthUser, UserManagementResult, ListOptions, Page } from '@selvajs/platform';
 /**
- * Auth backed by Supabase Auth (GoTrue).
- *
- * Identity + session lifecycle are fully delegated:
- *  - `verifyLogin` wraps `auth.signInWithPassword` — returns the access_token
- *    straight from Supabase as the session token.
- *  - `verifyToken` calls `auth.getUser(token)` against an anon client scoped
- *    to that bearer; GoTrue validates the JWT for us.
- *  - User management uses `auth.admin.*` with the service-role client.
- *
- * Identity-only — platform permissions live on `IPlatformPermissionStore`
- * (`SupabasePlatformPermissionStore` reads `user_profiles.platform_permissions`)
- * and profile state on `IUserProfileStore`.
+ * Auth backed by Supabase Auth (GoTrue). Identity-only — platform permissions
+ * live on `IPlatformPermissionStore`, profile state on `IUserProfileStore`.
  */
 export interface SupabaseAuthProviderConfig {
     supabaseUrl: string;
     anonKey: string;
     serviceRoleKey: string;
-    /**
-     * Whether self-service signup is allowed via `passwordAuth.registerUser`.
-     * Default false — production deployments start with invite-only.
-     */
+    /** Allow self-service signup via `passwordAuth.registerUser`. Default false. */
     enableSelfSignup?: boolean;
     /**
-     * OAuth providers enabled in the Supabase dashboard (lowercased:
-     * "google", "github", …). Surfaced via `oauth.listProviders()` so the
-     * driving layer doesn't read provider-specific env vars itself. Defaults
-     * to an empty list.
+     * OAuth providers enabled in the Supabase dashboard (lowercased: "google",
+     * "github", …), surfaced via `oauth.listProviders()`. Default empty.
      */
     oauthProviders?: readonly string[];
     /**
      * Allow `emailLink.sendMagicLink` to create new users on first request.
-     * Default true — matches Supabase's `signInWithOtp` default and gives
-     * fresh installs a working signup path. Set false for invite-only
-     * deployments; `sendMagicLink` for an unknown email returns
-     * `{ ok: false, reason: 'signup_disabled' }`.
+     * Default true, matching Supabase's `signInWithOtp` default. Set false for
+     * invite-only deployments; `sendMagicLink` for an unknown email then
+     * returns `{ ok: false, reason: 'signup_disabled' }`.
      */
     allowEmailLinkSignup?: boolean;
     /**
-     * How `verifyToken` validates session JWTs (see the method for the full
-     * rationale):
-     *  - `'hybrid'` (default): verify the JWT LOCALLY via `getClaims()` on every
-     *    request (no network call when the project uses asymmetric signing keys —
-     *    the modern default), and additionally re-check against GoTrue at most
-     *    once per `revalidateMs` per session to catch server-side sign-outs and
-     *    `disabled` flips. Bounds revocation latency to `revalidateMs`.
-     *  - `'strict'`: call `getUser()` on every request (the pre-1b behavior).
-     *    Instant revocation, one network round-trip per request. For operators
-     *    who don't accept any revocation lag.
+     * How `verifyToken` validates session JWTs — see that method for the
+     * rationale. `'hybrid'` (default) verifies locally and rechecks GoTrue
+     * periodically; `'strict'` calls GoTrue on every request.
      */
     tokenVerification?: 'hybrid' | 'strict';
-    /**
-     * Recheck window for `'hybrid'` verification, in ms. A verified session is
-     * re-validated against GoTrue at most once per this interval. Default 60s.
-     */
+    /** Recheck window for `'hybrid'` verification, in ms. Default 60s. */
     revalidateMs?: number;
     /**
      * Sink for best-effort failures the provider swallows rather than throwing
-     * (currently `touchLastLogin`). Defaults to `NoopLogger` — pass one to make
-     * those failures visible. Only identifiers are ever logged, never payloads.
+     * (currently `touchLastLogin`). Defaults to `NoopLogger`. Only identifiers
+     * are ever logged, never payloads.
      */
     logger?: ILogger;
 }
@@ -71,11 +45,10 @@ export declare class SupabaseAuthProvider implements IAuthProvider {
     readonly sessionRefresh: ISessionRefresh;
     private readonly admin;
     /**
-     * Service-role client pinned to the engine schema (`selva`). Engine tables
-     * live there, not in `public` — `this.admin` is deliberately left unpinned
-     * because it exists to drive `auth.admin.*` (GoTrue's own REST surface,
-     * which the PostgREST schema setting does not affect). Any table read or
-     * write from this provider MUST go through this client instead.
+     * Service-role client pinned to the `selva` schema. `this.admin` stays
+     * unpinned because it only drives `auth.admin.*` (GoTrue's own REST
+     * surface, unaffected by the PostgREST schema setting) — any table read
+     * or write must go through `db` instead.
      */
     private readonly db;
     private readonly anon;
@@ -85,37 +58,31 @@ export declare class SupabaseAuthProvider implements IAuthProvider {
     private readonly revalidateMs;
     private readonly logger;
     /**
-     * Last time a given session was re-validated against GoTrue (epoch ms),
-     * keyed by the JWT `session_id`. Bounds the hybrid recheck to once per
-     * `revalidateMs` per session. Swept lazily (see `verifyToken`) so a burst of
-     * distinct sessions can't leak memory. Per-process; multi-instance drift is
-     * harmless (each instance rechecks on its own schedule).
+     * Last GoTrue recheck per session (epoch ms), keyed by JWT `session_id`.
+     * Swept lazily in `markRevalidated` so session churn can't leak memory.
+     * Per-process — multi-instance drift is harmless, each instance rechecks
+     * on its own schedule.
      */
     private readonly lastRevalidatedAt;
     constructor(config: SupabaseAuthProviderConfig);
     static fromEnv(env: Record<string, string | undefined>, logger?: ILogger): SupabaseAuthProvider;
     /**
      * Verify a session JWT and return the user, or null if invalid/disabled.
-     * Runs on EVERY authenticated request, so the fast path avoids a network
+     * Runs on every authenticated request, so the fast path avoids a network
      * round-trip.
      *
-     * `'hybrid'` (default):
-     *  1. `getClaims(token)` verifies the JWT. With asymmetric signing keys (the
-     *     modern Supabase default) this is LOCAL — the SDK verifies against the
-     *     cached JWKS via Web Crypto, no call to GoTrue. With a legacy symmetric
-     *     HS256 secret the SDK transparently falls back to a network verify, so
-     *     this is correct for both project types without us detecting the scheme
-     *     or hand-rolling JWKS handling (which the Supabase docs warn against —
-     *     it breaks under key rotation).
-     *  2. Local verification can't see a server-side sign-out or a `disabled`
-     *     flip that happened AFTER the token was issued (the claims are a
-     *     snapshot). So we additionally re-check against GoTrue via `getUser`,
-     *     but at most once per `revalidateMs` per session — bounding revocation
-     *     latency to that window while eliminating ~all per-request network
-     *     calls under steady load.
+     * `'hybrid'` (default): `getClaims(token)` verifies the JWT locally with
+     * asymmetric signing keys (the modern Supabase default — the SDK checks
+     * against the cached JWKS via Web Crypto, no GoTrue call), and falls back
+     * to a network verify for legacy symmetric HS256 projects. Either way, a
+     * local check can't see a server-side sign-out or `disabled` flip that
+     * happened after the token was issued — the claims are a snapshot — so we
+     * also re-check against GoTrue via `getUser`, at most once per
+     * `revalidateMs` per session, bounding revocation latency to that window
+     * while skipping the network call on most requests.
      *
-     * `'strict'`: `getUser` on every request — instant revocation, one round
-     * trip per request. The pre-1b behavior, for operators who accept no lag.
+     * `'strict'`: `getUser` on every request. Instant revocation, one round
+     * trip per request.
      */
     verifyToken(token: string): Promise<AuthUser | null>;
     /** Full network verify against GoTrue. Also the `'strict'`-mode path. */
@@ -130,23 +97,11 @@ export declare class SupabaseAuthProvider implements IAuthProvider {
     deleteUser(id: string): Promise<UserManagementResult>;
     disableUser(id: string): Promise<UserManagementResult>;
     touchLastLogin(id: string): Promise<void>;
-    /**
-     * Sign in via GoTrue. Returns the access token string and the hydrated
-     * user. Called by `SupabasePasswordAuth.verifyLogin` — kept on the
-     * provider class so it has access to the hydrate helper without plumbing.
-     */
+    /** Kept on the provider class so it can call `hydrate` without plumbing it through. */
     private signIn;
-    /**
-     * Map a GoTrue `User` to our identity-only `AuthUser`. Platform permissions
-     * live on `IPlatformPermissionStore` and profile fields (displayName,
-     * starred, recentRuns) on `IUserProfileStore` — neither is in AuthUser.
-     */
+    /** Map a GoTrue `User` to our identity-only `AuthUser`. */
     private hydrate;
-    /**
-     * Expose the anon URL + key so other code (e.g. the same process's
-     * storage provider or per-request client factories) can build user-scoped
-     * clients without requiring a second config read.
-     */
+    /** Lets other code (storage provider, per-request client factories) build user-scoped clients without a second config read. */
     getAnonClientConfig(): {
         supabaseUrl: string;
         anonKey: string;

package/dist/auth/SupabaseAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SupabaseAuthProvider.d.ts","sourceRoot":"","sources":["../../src/auth/SupabaseAuthProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,KAAK,EACX,aAAa,EACb,cAAc,EACd,UAAU,EACV,aAAa,EACb,eAAe,EACf,QAAQ,EAER,oBAAoB,EACpB,WAAW,EACX,IAAI,EACJ,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,0BAA0B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACxC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAYD,qBAAa,oBAAqB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC;IAEzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsB;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IAEjC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6B;gBAEnD,MAAM,EAAE,0BAA0B;IAqC9C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,oBAAoB;IA+B/F;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAsC1D,yEAAyE;YAC3D,gBAAgB;IAO9B,8EAA8E;YAChE,eAAe;IAU7B,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,eAAe;IAcjB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAM7C,SAAS,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAkB7D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAa5C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAcrD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoBtD,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiC/C;;;;OAIG;YACW,MAAM;IAUpB;;;;OAIG;IACH,OAAO,CAAC,OAAO;IAWf;;;;OAIG;IACH,mBAAmB,IAAI;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAG/D"}
+{"version":3,"file":"SupabaseAuthProvider.d.ts","sourceRoot":"","sources":["../../src/auth/SupabaseAuthProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,KAAK,EACX,aAAa,EACb,cAAc,EACd,UAAU,EACV,aAAa,EACb,eAAe,EACf,QAAQ,EAER,oBAAoB,EACpB,WAAW,EACX,IAAI,EACJ,MAAM,mBAAmB,CAAC;AAE3B;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACxC,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAUD,qBAAa,oBAAqB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC;IAEzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsB;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IAEjC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6B;gBAEnD,MAAM,EAAE,0BAA0B;IAqC9C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,oBAAoB;IA0B/F;;;;;;;;;;;;;;;;;OAiBG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAgC1D,yEAAyE;YAC3D,gBAAgB;IAO9B,8EAA8E;YAChE,eAAe;IAU7B,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,eAAe;IAcjB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAM7C,SAAS,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAgB7D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAW5C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAarD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoBtD,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B/C,uFAAuF;YACzE,MAAM;IAUpB,2DAA2D;IAC3D,OAAO,CAAC,OAAO;IAWf,+HAA+H;IAC/H,mBAAmB,IAAI;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAG/D"}