@selvajs/supabase-provider 0.19.7 → 0.20.0-beta.1

package/README.md

@@ -62,6 +62,8 @@ Images are transcoded to WebP (1200px cap, quality 85) via the shared `transcode
 
 `SupabaseAuthProvider.verifyLogin` wraps `supabase.auth.signInWithPassword`, returning the JWT directly as `sessionToken`. `verifyToken` calls `supabase.auth.getUser(token)` — GoTrue validates the signature for us. Platform permissions merge in from `user_profiles.platform_permissions`.
 
+`delegatedSession` signs a 60-second session JWT for an API token's owner, so a token request reaches the stores as `adapterContext.sessionToken` and RLS treats it like that user's browser session. It signs ES256 with `SUPABASE_JWT_SIGNING_KEY` (or HS256 with the legacy `SUPABASE_JWT_SECRET`) and checks once, with a PostgREST read, that the project accepts the key. Claims are fixed (`role` and `aud` are `authenticated`, no `session_id`). Operator setup: [API tokens](../../../docs/self-hosting/providers/supabase.md#api-tokens).
+
 MFA methods on `IPasswordAuth` are currently undefined — MFA is deferred. If a user enrolls a factor via the Supabase dashboard, `signInWithPassword` returns an AAL1 session and routes that gate on AAL2 would fail; no route does today.
 
 ### Data + RLS

package/dist/auth/SupabaseAuthProvider.d.ts

@@ -1,5 +1,5 @@
 import { type ILogger } from '@selvajs/platform';
-import type { IAuthProvider, IEmailLinkAuth, IOAuthAuth, IPasswordAuth, ISessionRefresh, AuthUser, UserManagementResult, ListOptions, Page } from '@selvajs/platform';
+import type { IAuthProvider, IDelegatedSession, IEmailLinkAuth, IOAuthAuth, IPasswordAuth, ISessionRefresh, AuthUser, UserManagementResult, ListOptions, Page } from '@selvajs/platform';
 /**
  * Auth backed by Supabase Auth (GoTrue). Identity-only — platform permissions
  * live on `IPlatformPermissionStore`, profile state on `IUserProfileStore`.
@@ -30,6 +30,13 @@ export interface SupabaseAuthProviderConfig {
     tokenVerification?: 'hybrid' | 'strict';
     /** Recheck window for `'hybrid'` verification, in ms. Default 60s. */
     revalidateMs?: number;
+    /**
+     * Private ES256 JWK the project trusts, for API-token requests. Without it
+     * (or `jwtSecret`), API tokens are off; sign-in is unaffected.
+     */
+    jwtSigningKey?: string;
+    /** Legacy HS256 secret, used only when `jwtSigningKey` is unset. */
+    jwtSecret?: string;
     /**
      * Sink for best-effort failures the provider swallows rather than throwing
      * (currently `touchLastLogin`). Defaults to `NoopLogger`. Only identifiers
@@ -43,6 +50,7 @@ export declare class SupabaseAuthProvider implements IAuthProvider {
     readonly oauth: IOAuthAuth;
     readonly emailLink: IEmailLinkAuth;
     readonly sessionRefresh: ISessionRefresh;
+    readonly delegatedSession: IDelegatedSession;
     private readonly admin;
     /**
      * Service-role client pinned to the `selva` schema. `this.admin` stays

package/dist/auth/SupabaseAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SupabaseAuthProvider.d.ts","sourceRoot":"","sources":["../../src/auth/SupabaseAuthProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,KAAK,EACX,aAAa,EACb,cAAc,EACd,UAAU,EACV,aAAa,EACb,eAAe,EACf,QAAQ,EAER,oBAAoB,EACpB,WAAW,EACX,IAAI,EACJ,MAAM,mBAAmB,CAAC;AAE3B;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACxC,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAUD,qBAAa,oBAAqB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC;IAEzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsB;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IAEjC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6B;gBAEnD,MAAM,EAAE,0BAA0B;IAqC9C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,oBAAoB;IA0B/F;;;;;;;;;;;;;;;;;OAiBG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAgC1D,yEAAyE;YAC3D,gBAAgB;IAO9B,8EAA8E;YAChE,eAAe;IAU7B,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,eAAe;IAcjB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAM7C,SAAS,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAgB7D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAW5C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAarD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoBtD,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B/C,uFAAuF;YACzE,MAAM;IAUpB,2DAA2D;IAC3D,OAAO,CAAC,OAAO;IAWf,+HAA+H;IAC/H,mBAAmB,IAAI;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAG/D"}
+{"version":3,"file":"SupabaseAuthProvider.d.ts","sourceRoot":"","sources":["../../src/auth/SupabaseAuthProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG7D,OAAO,KAAK,EACX,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,aAAa,EACb,eAAe,EACf,QAAQ,EAER,oBAAoB,EACpB,WAAW,EACX,IAAI,EACJ,MAAM,mBAAmB,CAAC;AAE3B;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACxC,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAUD,qBAAa,oBAAqB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsB;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IAEjC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6B;gBAEnD,MAAM,EAAE,0BAA0B;IA4C9C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,oBAAoB;IA4B/F;;;;;;;;;;;;;;;;;OAiBG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAgC1D,yEAAyE;YAC3D,gBAAgB;IAO9B,8EAA8E;YAChE,eAAe;IAU7B,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,eAAe;IAcjB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAM7C,SAAS,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAgB7D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAW5C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAarD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoBtD,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B/C,uFAAuF;YACzE,MAAM;IAUpB,2DAA2D;IAC3D,OAAO,CAAC,OAAO;IAWf,+HAA+H;IAC/H,mBAAmB,IAAI;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAG/D"}

package/dist/auth/SupabaseAuthProvider.js

@@ -1,6 +1,7 @@
 import { createClient } from '@supabase/supabase-js';
 import { NoopLogger } from '@selvajs/platform';
 import { DEFAULT_SCHEMA } from '../data/client.js';
+import { SupabaseDelegatedSession } from './SupabaseDelegatedSession.js';
 const DEFAULT_REVALIDATE_MS = 60_000;
 function parsePositiveInt(raw) {
     if (!raw)
@@ -14,6 +15,7 @@ export class SupabaseAuthProvider {
     oauth;
     emailLink;
     sessionRefresh;
+    delegatedSession;
     admin;
     /**
      * Service-role client pinned to the `selva` schema. `this.admin` stays
@@ -55,6 +57,13 @@ export class SupabaseAuthProvider {
         this.sessionRefresh = new SupabaseSessionRefresh(this.anon, this.admin, this.logger);
         this.oauth = new SupabaseOAuthAuth(this.anon, (user) => this.hydrate(user), config.oauthProviders ?? [], this.sessionRefresh);
         this.emailLink = new SupabaseEmailLinkAuth(this.anon, (user) => this.hydrate(user), config.allowEmailLinkSignup ?? true);
+        this.delegatedSession = new SupabaseDelegatedSession({
+            supabaseUrl: config.supabaseUrl,
+            anonKey: config.anonKey,
+            ...(config.jwtSigningKey ? { signingKey: config.jwtSigningKey } : {}),
+            ...(config.jwtSecret ? { jwtSecret: config.jwtSecret } : {}),
+            logger: this.logger
+        });
     }
     static fromEnv(env, logger) {
         const supabaseUrl = env.SUPABASE_URL;
@@ -81,7 +90,9 @@ export class SupabaseAuthProvider {
             allowEmailLinkSignup: env.SUPABASE_ALLOW_EMAIL_LINK_SIGNUP !== 'false',
             tokenVerification,
             ...(revalidateMs !== undefined ? { revalidateMs } : {}),
-            ...(logger ? { logger } : {})
+            ...(logger ? { logger } : {}),
+            ...(env.SUPABASE_JWT_SIGNING_KEY ? { jwtSigningKey: env.SUPABASE_JWT_SIGNING_KEY } : {}),
+            ...(env.SUPABASE_JWT_SECRET ? { jwtSecret: env.SUPABASE_JWT_SECRET } : {})
         });
     }
     /**

package/dist/auth/SupabaseAuthProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"SupabaseAuthProvider.js","sourceRoot":"","sources":["../../src/auth/SupabaseAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAkC,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,UAAU,EAAgB,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAA0B,MAAM,mBAAmB,CAAC;AAoD3E,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,SAAS,gBAAgB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,MAAM,OAAO,oBAAoB;IACvB,IAAI,GAAG,eAAe,CAAC;IACvB,YAAY,CAAgB;IAC5B,KAAK,CAAa;IAClB,SAAS,CAAiB;IAC1B,cAAc,CAAkB;IAExB,KAAK,CAAiB;IACvC;;;;;OAKG;IACc,EAAE,CAAoB;IACtB,IAAI,CAAiB;IACrB,OAAO,CAAS;IAChB,WAAW,CAAS;IACpB,iBAAiB,CAAsB;IACvC,YAAY,CAAS;IACrB,MAAM,CAAU;IAEjC;;;;;OAKG;IACc,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/D,YAAY,MAAkC;QAC7C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,CAAC;QAC9D,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAC;QACjE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE;YACpE,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE;YACjE,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;YAC9B,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAsB,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE;YAC5D,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,oBAAoB,CAC3C,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,IAAI,EACT,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjD,MAAM,CAAC,gBAAgB,IAAI,KAAK,EAChC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAiB,CACjC,IAAI,CAAC,IAAI,EACT,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAC5B,MAAM,CAAC,cAAc,IAAI,EAAE,EAC3B,IAAI,CAAC,cAAc,CACnB,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,qBAAqB,CACzC,IAAI,CAAC,IAAI,EACT,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAC5B,MAAM,CAAC,oBAAoB,IAAI,IAAI,CACnC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAuC,EAAE,MAAgB;QACvE,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC;QACtC,MAAM,cAAc,GAAG,GAAG,CAAC,yBAAyB,CAAC;QACrD,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7E,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5F,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;aACzD,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9B,MAAM,iBAAiB,GAAG,GAAG,CAAC,2BAA2B,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7F,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAClE,OAAO,IAAI,oBAAoB,CAAC;YAC/B,WAAW;YACX,OAAO;YACP,cAAc;YACd,gBAAgB,EAAE,GAAG,CAAC,2BAA2B,KAAK,MAAM;YAC5D,cAAc;YACd,oBAAoB,EAAE,GAAG,CAAC,gCAAgC,KAAK,OAAO;YACtE,iBAAiB;YACjB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7B,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC9B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,IAAI,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAK,MAAM,CAAC,aAAoD,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;YACrF,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACzF,IAAI,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzC,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC;QACd,CAAC;QAED,OAAO;YACN,EAAE,EAAE,MAAM,CAAC,GAAG;YACd,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAClE,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,MAAM,CAAC,aAAa;SAC9B,CAAC;IACH,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAC3C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,eAAe,CAAC,KAAa;QAC1C,IAAI,CAAC;YACJ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAChC,OAAO,IAAI,CAAC,MAAM,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAEO,gBAAgB,CAAC,SAAiB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC;IACrE,CAAC;IAEO,eAAe,CAAC,SAAiB;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC3C,wEAAwE;QACxE,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;YAC3C,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC/C,IAAI,EAAE,GAAG,MAAM;oBAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpD,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAkB;QACjC,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAC7D,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnD,OAAO;SACP,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa;QAC7B,2DAA2D;QAC3D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC9D,KAAK;YACL,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QAC1B,4DAA4D;QAC5D,oEAAoE;QACpE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,KAAK,EAAE,CAAC;YACX,qEAAqE;YACrE,MAAM,CAAC,GAAG,KAAyD,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAAE,OAAO,WAAW,CAAC;YAChF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC3B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO,WAAW,CAAC;QACrD,qEAAqE;QACrE,+BAA+B;QAC/B,MAAM,cAAc,GAAG;YACtB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;YACtC,QAAQ,EAAE,IAAI;SACd,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE;YAChE,aAAa,EAAE,cAAc;SAC7B,CAAC,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,KAAyD,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAAE,OAAO,WAAW,CAAC;YAChF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC9B,0EAA0E;QAC1E,kEAAkE;QAClE,uDAAuD;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3D,2EAA2E;QAC3E,oEAAoE;QACpE,qEAAqE;QACrE,uDAAuD;QACvD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC7B,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;aACnD,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;aACjB,EAAE,CAAC,0CAA0C,MAAM,EAAE,CAAC,CAAC;QACzD,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBACzC,MAAM,EAAE,EAAE;gBACV,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACtB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,+EAA+E;IAC/E,YAAY;IACZ,+EAA+E;IAC/E,uFAAuF;IAC/E,KAAK,CAAC,MAAM,CACnB,KAAa,EACb,QAAgB;QAEhB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrF,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IACnF,CAAC;IAED,2DAA2D;IACnD,OAAO,CAAC,IAAU;QACzB,OAAO;YACN,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;YACvC,WAAW,EAAE,IAAI,CAAC,eAAe,IAAI,SAAS;YAC9C,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAC/C,QAAQ,EAAE,IAAI,CAAC,aAAa;SAC5B,CAAC;IACH,CAAC;IAED,+HAA+H;IAC/H,mBAAmB;QAClB,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACjE,CAAC;CACD;AAED,MAAM,oBAAoB;IAEP;IACA;IACA;IAIA;IACA;IARlB,YACkB,KAAqB,EACrB,IAAoB,EACpB,MAG4C,EAC5C,gBAAyB,EACzB,OAAiC;QAPjC,UAAK,GAAL,KAAK,CAAgB;QACrB,SAAI,GAAJ,IAAI,CAAgB;QACpB,WAAM,GAAN,MAAM,CAGsC;QAC5C,qBAAgB,GAAhB,gBAAgB,CAAS;QACzB,YAAO,GAAP,OAAO,CAA0B;IAChD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,QAAgB;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,QAAgB;QAC3D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC9D,KAAK;YACL,QAAQ;YACR,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACjD,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,iBAAiB;IAEJ;IACA;IACA;IACA;IAJlB,YACkB,IAAoB,EACpB,OAAiC,EACjC,SAA4B,EAC5B,cAA+B;QAH/B,SAAI,GAAJ,IAAI,CAAgB;QACpB,YAAO,GAAP,OAAO,CAA0B;QACjC,cAAS,GAAT,SAAS,CAAmB;QAC5B,mBAAc,GAAd,cAAc,CAAiB;IAC9C,CAAC;IAEJ,aAAa;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC7B,QAAkD,EAClD,UAAkB;QAElB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;YAC5D,QAAQ;YACR,OAAO,EAAE,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE;SAClD,CAAC,CAAC;QACH,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAY;QAKnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,cAAc,CAAC,YAAoB;QAIxC,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,sBAAsB;IAET;IACA;IACA;IAHlB,YACkB,IAAoB,EACpB,KAAqB,EACrB,MAAe;QAFf,SAAI,GAAJ,IAAI,CAAgB;QACpB,UAAK,GAAL,KAAK,CAAgB;QACrB,WAAM,GAAN,MAAM,CAAS;IAC9B,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,YAAoB;QAIxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7F,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACxC,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,qCAAqC;QACrC,IAAI,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC7D,OAAO;YACN,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAChC,wEAAwE;QACxE,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,oEAAoE;QACpE,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,CAAC,GAAG,KAAyD,CAAC;QACpE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,mCAAmC;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC;IACd,CAAC;CACD;AAED;;;;;;;GAOG;AACH,MAAM,qBAAqB;IAER;IACA;IACA;IAHlB,YACkB,IAAoB,EACpB,OAAiC,EACjC,WAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAgB;QACpB,YAAO,GAAP,OAAO,CAA0B;QACjC,gBAAW,GAAX,WAAW,CAAS;IACnC,CAAC;IAEJ,KAAK,CAAC,aAAa,CAClB,KAAa,EACb,WAAmB;QAInB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACpD,KAAK;YACL,OAAO,EAAE;gBACR,eAAe,EAAE,WAAW;gBAC5B,gBAAgB,EAAE,IAAI,CAAC,WAAW;aAClC;SACD,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAEhC,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,MAAM,GAAI,KAA6B,CAAC,MAAM,CAAC;QACrD,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC9C,IACC,IAAI,KAAK,cAAc;YACvB,IAAI,KAAK,iBAAiB;YAC1B,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAChC,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,KAAK,mBAAmB,IAAI,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAK3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QAEnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACtD,UAAU,EAAE,SAAS;YACrB,IAAI;SACJ,CAAC,CAAC;QACH,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;CACD;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC3B,GAAW;IAEX,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO;QACN,SAAS;QACT,IAAI,EAAE,IAAgE;KACtE,CAAC;AACH,CAAC"}
+{"version":3,"file":"SupabaseAuthProvider.js","sourceRoot":"","sources":["../../src/auth/SupabaseAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAkC,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,UAAU,EAAgB,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAA0B,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AA4DzE,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,SAAS,gBAAgB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,MAAM,OAAO,oBAAoB;IACvB,IAAI,GAAG,eAAe,CAAC;IACvB,YAAY,CAAgB;IAC5B,KAAK,CAAa;IAClB,SAAS,CAAiB;IAC1B,cAAc,CAAkB;IAChC,gBAAgB,CAAoB;IAE5B,KAAK,CAAiB;IACvC;;;;;OAKG;IACc,EAAE,CAAoB;IACtB,IAAI,CAAiB;IACrB,OAAO,CAAS;IAChB,WAAW,CAAS;IACpB,iBAAiB,CAAsB;IACvC,YAAY,CAAS;IACrB,MAAM,CAAU;IAEjC;;;;;OAKG;IACc,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/D,YAAY,MAAkC;QAC7C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,CAAC;QAC9D,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAC;QACjE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE;YACpE,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE;YACjE,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;YAC9B,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAsB,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE;YAC5D,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,oBAAoB,CAC3C,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,IAAI,EACT,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjD,MAAM,CAAC,gBAAgB,IAAI,KAAK,EAChC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAiB,CACjC,IAAI,CAAC,IAAI,EACT,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAC5B,MAAM,CAAC,cAAc,IAAI,EAAE,EAC3B,IAAI,CAAC,cAAc,CACnB,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,qBAAqB,CACzC,IAAI,CAAC,IAAI,EACT,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAC5B,MAAM,CAAC,oBAAoB,IAAI,IAAI,CACnC,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,wBAAwB,CAAC;YACpD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,EAAE,IAAI,CAAC,MAAM;SACnB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAuC,EAAE,MAAgB;QACvE,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC;QACtC,MAAM,cAAc,GAAG,GAAG,CAAC,yBAAyB,CAAC;QACrD,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7E,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5F,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;aACzD,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9B,MAAM,iBAAiB,GAAG,GAAG,CAAC,2BAA2B,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7F,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAClE,OAAO,IAAI,oBAAoB,CAAC;YAC/B,WAAW;YACX,OAAO;YACP,cAAc;YACd,gBAAgB,EAAE,GAAG,CAAC,2BAA2B,KAAK,MAAM;YAC5D,cAAc;YACd,oBAAoB,EAAE,GAAG,CAAC,gCAAgC,KAAK,OAAO;YACtE,iBAAiB;YACjB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC9B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,IAAI,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAK,MAAM,CAAC,aAAoD,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;YACrF,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACzF,IAAI,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzC,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC;QACd,CAAC;QAED,OAAO;YACN,EAAE,EAAE,MAAM,CAAC,GAAG;YACd,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAClE,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,MAAM,CAAC,aAAa;SAC9B,CAAC;IACH,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAC3C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,eAAe,CAAC,KAAa;QAC1C,IAAI,CAAC;YACJ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAChC,OAAO,IAAI,CAAC,MAAM,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAEO,gBAAgB,CAAC,SAAiB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC;IACrE,CAAC;IAEO,eAAe,CAAC,SAAiB;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC3C,wEAAwE;QACxE,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;YAC3C,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC/C,IAAI,EAAE,GAAG,MAAM;oBAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpD,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAkB;QACjC,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAC7D,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnD,OAAO;SACP,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa;QAC7B,2DAA2D;QAC3D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC9D,KAAK;YACL,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QAC1B,4DAA4D;QAC5D,oEAAoE;QACpE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,KAAK,EAAE,CAAC;YACX,qEAAqE;YACrE,MAAM,CAAC,GAAG,KAAyD,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAAE,OAAO,WAAW,CAAC;YAChF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC3B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO,WAAW,CAAC;QACrD,qEAAqE;QACrE,+BAA+B;QAC/B,MAAM,cAAc,GAAG;YACtB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;YACtC,QAAQ,EAAE,IAAI;SACd,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE;YAChE,aAAa,EAAE,cAAc;SAC7B,CAAC,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,KAAyD,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAAE,OAAO,WAAW,CAAC;YAChF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC9B,0EAA0E;QAC1E,kEAAkE;QAClE,uDAAuD;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3D,2EAA2E;QAC3E,oEAAoE;QACpE,qEAAqE;QACrE,uDAAuD;QACvD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC7B,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;aACnD,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;aACjB,EAAE,CAAC,0CAA0C,MAAM,EAAE,CAAC,CAAC;QACzD,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBACzC,MAAM,EAAE,EAAE;gBACV,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACtB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,+EAA+E;IAC/E,YAAY;IACZ,+EAA+E;IAC/E,uFAAuF;IAC/E,KAAK,CAAC,MAAM,CACnB,KAAa,EACb,QAAgB;QAEhB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrF,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IACnF,CAAC;IAED,2DAA2D;IACnD,OAAO,CAAC,IAAU;QACzB,OAAO;YACN,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;YACvC,WAAW,EAAE,IAAI,CAAC,eAAe,IAAI,SAAS;YAC9C,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAC/C,QAAQ,EAAE,IAAI,CAAC,aAAa;SAC5B,CAAC;IACH,CAAC;IAED,+HAA+H;IAC/H,mBAAmB;QAClB,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACjE,CAAC;CACD;AAED,MAAM,oBAAoB;IAEP;IACA;IACA;IAIA;IACA;IARlB,YACkB,KAAqB,EACrB,IAAoB,EACpB,MAG4C,EAC5C,gBAAyB,EACzB,OAAiC;QAPjC,UAAK,GAAL,KAAK,CAAgB;QACrB,SAAI,GAAJ,IAAI,CAAgB;QACpB,WAAM,GAAN,MAAM,CAGsC;QAC5C,qBAAgB,GAAhB,gBAAgB,CAAS;QACzB,YAAO,GAAP,OAAO,CAA0B;IAChD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,QAAgB;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,QAAgB;QAC3D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC9D,KAAK;YACL,QAAQ;YACR,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACjD,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,iBAAiB;IAEJ;IACA;IACA;IACA;IAJlB,YACkB,IAAoB,EACpB,OAAiC,EACjC,SAA4B,EAC5B,cAA+B;QAH/B,SAAI,GAAJ,IAAI,CAAgB;QACpB,YAAO,GAAP,OAAO,CAA0B;QACjC,cAAS,GAAT,SAAS,CAAmB;QAC5B,mBAAc,GAAd,cAAc,CAAiB;IAC9C,CAAC;IAEJ,aAAa;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC7B,QAAkD,EAClD,UAAkB;QAElB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;YAC5D,QAAQ;YACR,OAAO,EAAE,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE;SAClD,CAAC,CAAC;QACH,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAY;QAKnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,cAAc,CAAC,YAAoB;QAIxC,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,sBAAsB;IAET;IACA;IACA;IAHlB,YACkB,IAAoB,EACpB,KAAqB,EACrB,MAAe;QAFf,SAAI,GAAJ,IAAI,CAAgB;QACpB,UAAK,GAAL,KAAK,CAAgB;QACrB,WAAM,GAAN,MAAM,CAAS;IAC9B,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,YAAoB;QAIxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7F,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACxC,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,qCAAqC;QACrC,IAAI,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC7D,OAAO;YACN,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAChC,wEAAwE;QACxE,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,oEAAoE;QACpE,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,CAAC,GAAG,KAAyD,CAAC;QACpE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,mCAAmC;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC;IACd,CAAC;CACD;AAED;;;;;;;GAOG;AACH,MAAM,qBAAqB;IAER;IACA;IACA;IAHlB,YACkB,IAAoB,EACpB,OAAiC,EACjC,WAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAgB;QACpB,YAAO,GAAP,OAAO,CAA0B;QACjC,gBAAW,GAAX,WAAW,CAAS;IACnC,CAAC;IAEJ,KAAK,CAAC,aAAa,CAClB,KAAa,EACb,WAAmB;QAInB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACpD,KAAK;YACL,OAAO,EAAE;gBACR,eAAe,EAAE,WAAW;gBAC5B,gBAAgB,EAAE,IAAI,CAAC,WAAW;aAClC;SACD,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAEhC,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,MAAM,GAAI,KAA6B,CAAC,MAAM,CAAC;QACrD,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC9C,IACC,IAAI,KAAK,cAAc;YACvB,IAAI,KAAK,iBAAiB;YAC1B,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAChC,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,KAAK,mBAAmB,IAAI,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAK3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QAEnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACtD,UAAU,EAAE,SAAS;YACrB,IAAI;SACJ,CAAC,CAAC;QACH,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;CACD;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC3B,GAAW;IAEX,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO;QACN,SAAS;QACT,IAAI,EAAE,IAAgE;KACtE,CAAC;AACH,CAAC"}

package/dist/auth/SupabaseDelegatedSession.d.ts

@@ -0,0 +1,49 @@
+import { type DelegatedSessionStatus, type IDelegatedSession, type ILogger } from '@selvajs/platform';
+export interface SupabaseDelegatedSessionConfig {
+    supabaseUrl: string;
+    anonKey: string;
+    /** `SUPABASE_JWT_SIGNING_KEY`: a private ES256 JWK the project trusts. Preferred. */
+    signingKey?: string;
+    /** `SUPABASE_JWT_SECRET`: the legacy HS256 secret. Used only without `signingKey`. */
+    jwtSecret?: string;
+    logger?: ILogger;
+    fetch?: typeof fetch;
+    now?: () => number;
+}
+/**
+ * Signs short-lived Supabase session JWTs so API-token requests run under the
+ * owner's row security. The claims are fixed: `role` is always
+ * `authenticated`, never caller-chosen, because the same key can sign a
+ * `service_role` token that bypasses every policy.
+ *
+ * `aud` is required by GoTrue's `getUser` (400 without it); `session_id` is
+ * omitted because GoTrue looks it up and rejects one with no session row.
+ *
+ * `selva_org` marks the session as delegated. `selva.is_instance_admin()`
+ * returns false for any session carrying it, so an instance admin's key can't
+ * reach other orgs through the policies' admin bypass.
+ */
+export declare class SupabaseDelegatedSession implements IDelegatedSession {
+    private readonly config;
+    private readonly signer;
+    private readonly configError;
+    private readonly logger;
+    private readonly fetchFn;
+    private readonly now;
+    private readonly baseUrl;
+    private check;
+    constructor(config: SupabaseDelegatedSessionConfig);
+    status(): Promise<DelegatedSessionStatus>;
+    mint(userId: string, { orgId }: {
+        orgId: string;
+    }): Promise<string>;
+    /**
+     * Proves PostgREST accepts what this key signs, which a JWKS lookup alone
+     * doesn't: Supabase lists a standby key in the JWKS but only trusts it once
+     * the project has rotated to it. The random `sub` matches no rows, so the
+     * read is empty either way; only a 401 means the key is refused.
+     */
+    private probe;
+    private signFor;
+}
+//# sourceMappingURL=SupabaseDelegatedSession.d.ts.map

package/dist/auth/SupabaseDelegatedSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabaseDelegatedSession.d.ts","sourceRoot":"","sources":["../../src/auth/SupabaseDelegatedSession.ts"],"names":[],"mappings":"AACA,OAAO,EAGN,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACZ,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,8BAA8B;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAsBD;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAyB,YAAW,iBAAiB;IASrD,OAAO,CAAC,QAAQ,CAAC,MAAM;IARnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgB;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,KAAK,CAA2B;gBAEX,MAAM,EAAE,8BAA8B;IAwBnE,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAwBnC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAMzE;;;;;OAKG;YACW,KAAK;IA4BnB,OAAO,CAAC,OAAO;CAef"}

package/dist/auth/SupabaseDelegatedSession.js

@@ -0,0 +1,176 @@
+import { createHmac, createPrivateKey, randomUUID, sign } from 'node:crypto';
+import { NoopLogger, ProviderError } from '@selvajs/platform';
+/** Long enough for one request, short enough that a ban takes effect quickly. */
+const TTL_SECONDS = 60;
+/** A failed check (network, or a key not yet rotated in) is retried after this long. */
+const RECHECK_FAILED_MS = 30_000;
+/**
+ * Signs short-lived Supabase session JWTs so API-token requests run under the
+ * owner's row security. The claims are fixed: `role` is always
+ * `authenticated`, never caller-chosen, because the same key can sign a
+ * `service_role` token that bypasses every policy.
+ *
+ * `aud` is required by GoTrue's `getUser` (400 without it); `session_id` is
+ * omitted because GoTrue looks it up and rejects one with no session row.
+ *
+ * `selva_org` marks the session as delegated. `selva.is_instance_admin()`
+ * returns false for any session carrying it, so an instance admin's key can't
+ * reach other orgs through the policies' admin bypass.
+ */
+export class SupabaseDelegatedSession {
+    config;
+    signer;
+    configError;
+    logger;
+    fetchFn;
+    now;
+    baseUrl;
+    check = null;
+    constructor(config) {
+        this.config = config;
+        this.baseUrl = config.supabaseUrl.replace(/\/+$/, '');
+        this.logger = config.logger ?? new NoopLogger();
+        this.fetchFn = config.fetch ?? fetch;
+        this.now = config.now ?? Date.now;
+        let signer = null;
+        let configError = null;
+        try {
+            signer = config.signingKey
+                ? es256Signer(config.signingKey)
+                : config.jwtSecret
+                    ? hs256Signer(config.jwtSecret)
+                    : null;
+            if (!signer) {
+                configError =
+                    'API tokens need SUPABASE_JWT_SIGNING_KEY (or the legacy SUPABASE_JWT_SECRET) so Selva can act as the token owner under row security.';
+            }
+        }
+        catch (err) {
+            configError = err instanceof Error ? err.message : String(err);
+        }
+        this.signer = signer;
+        this.configError = configError;
+    }
+    status() {
+        if (!this.signer)
+            return Promise.resolve({ ok: false, message: this.configError });
+        const current = this.check;
+        if (current &&
+            (current.failedAt === null || this.now() - current.failedAt < RECHECK_FAILED_MS)) {
+            return current.result;
+        }
+        const next = { failedAt: null };
+        next.result = this.probe(this.signer).then((status) => {
+            if (!status.ok) {
+                next.failedAt = this.now();
+                this.logger.error('API tokens are off: delegated sessions failed their check', {
+                    component: 'delegatedSession',
+                    reason: status.message
+                });
+            }
+            return status;
+        });
+        this.check = next;
+        return next.result;
+    }
+    async mint(userId, { orgId }) {
+        const status = await this.status();
+        if (!status.ok)
+            throw new ProviderError(status.message, 503);
+        return this.signFor(this.signer, userId, orgId);
+    }
+    /**
+     * Proves PostgREST accepts what this key signs, which a JWKS lookup alone
+     * doesn't: Supabase lists a standby key in the JWKS but only trusts it once
+     * the project has rotated to it. The random `sub` matches no rows, so the
+     * read is empty either way; only a 401 means the key is refused.
+     */
+    async probe(signer) {
+        try {
+            const res = await this.fetchFn(`${this.baseUrl}/rest/v1/orgs?select=id&limit=1`, {
+                headers: {
+                    apikey: this.config.anonKey,
+                    Authorization: `Bearer ${this.signFor(signer, randomUUID(), randomUUID())}`,
+                    'Accept-Profile': 'selva'
+                }
+            });
+            if (res.ok)
+                return { ok: true };
+            if (res.status === 401) {
+                return {
+                    ok: false,
+                    message: `Supabase rejected a session signed with ${signer.label}. ${signer.hint}`
+                };
+            }
+            return {
+                ok: false,
+                message: `Couldn't check ${signer.label}: Supabase answered ${res.status}.`
+            };
+        }
+        catch (err) {
+            return {
+                ok: false,
+                message: `Couldn't reach Supabase to check ${signer.label}: ${err instanceof Error ? err.message : String(err)}`
+            };
+        }
+    }
+    signFor(signer, userId, orgId) {
+        const iat = Math.floor(this.now() / 1000);
+        const header = { alg: signer.alg, typ: 'JWT', ...(signer.kid ? { kid: signer.kid } : {}) };
+        const payload = {
+            sub: userId,
+            role: 'authenticated',
+            aud: 'authenticated',
+            iat,
+            exp: iat + TTL_SECONDS,
+            iss: `${this.baseUrl}/auth/v1`,
+            selva_org: orgId
+        };
+        const input = `${base64url(header)}.${base64url(payload)}`;
+        return `${input}.${signer.sign(Buffer.from(input)).toString('base64url')}`;
+    }
+}
+function base64url(value) {
+    return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+/** Accepts the JWK `supabase gen signing-key` prints, or an array of them (a `signing_keys.json`). */
+function es256Signer(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('SUPABASE_JWT_SIGNING_KEY is not valid JSON. Expected the private JWK from `supabase gen signing-key --algorithm ES256`.');
+    }
+    const keys = (Array.isArray(parsed) ? parsed : [parsed]);
+    const jwk = keys.find((k) => k?.key_ops?.includes('sign')) ?? keys[0];
+    if (!jwk || jwk.kty !== 'EC' || jwk.crv !== 'P-256' || !jwk.d || !jwk.x || !jwk.y) {
+        throw new Error('SUPABASE_JWT_SIGNING_KEY must be a private ES256 key: kty "EC", crv "P-256", with "d".');
+    }
+    if (!jwk.kid) {
+        throw new Error('SUPABASE_JWT_SIGNING_KEY has no "kid". Supabase matches tokens to keys by it.');
+    }
+    const key = createPrivateKey({
+        key: { kty: 'EC', crv: 'P-256', x: jwk.x, y: jwk.y, d: jwk.d },
+        format: 'jwk'
+    });
+    return {
+        alg: 'ES256',
+        kid: jwk.kid,
+        label: `SUPABASE_JWT_SIGNING_KEY (kid ${jwk.kid})`,
+        hint: 'On hosted Supabase, import it as a standby key under Settings → JWT signing keys, then rotate to it. ' +
+            'Self-hosted, it must be in JWT_KEYS and JWT_JWKS.',
+        // JWS wants the raw r||s form, not DER.
+        sign: (data) => sign('sha256', data, { key, dsaEncoding: 'ieee-p1363' })
+    };
+}
+/** Legacy fallback. Stops working once the project revokes its legacy secret. */
+function hs256Signer(secret) {
+    return {
+        alg: 'HS256',
+        label: 'SUPABASE_JWT_SECRET',
+        hint: "Check it matches the project's legacy JWT secret and that the secret hasn't been revoked.",
+        sign: (data) => createHmac('sha256', secret).update(data).digest()
+    };
+}
+//# sourceMappingURL=SupabaseDelegatedSession.js.map

package/dist/auth/SupabaseDelegatedSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabaseDelegatedSession.js","sourceRoot":"","sources":["../../src/auth/SupabaseDelegatedSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EACN,UAAU,EACV,aAAa,EAIb,MAAM,mBAAmB,CAAC;AAc3B,iFAAiF;AACjF,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,wFAAwF;AACxF,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAiBjC;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,wBAAwB;IASP;IARZ,MAAM,CAAgB;IACtB,WAAW,CAAgB;IAC3B,MAAM,CAAU;IAChB,OAAO,CAAe;IACtB,GAAG,CAAe;IAClB,OAAO,CAAS;IACzB,KAAK,GAAsB,IAAI,CAAC;IAExC,YAA6B,MAAsC;QAAtC,WAAM,GAAN,MAAM,CAAgC;QAClE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAClC,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,CAAC;YACJ,MAAM,GAAG,MAAM,CAAC,UAAU;gBACzB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC;gBAChC,CAAC,CAAC,MAAM,CAAC,SAAS;oBACjB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC;oBAC/B,CAAC,CAAC,IAAI,CAAC;YACT,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,WAAW;oBACV,sIAAsI,CAAC;YACzI,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,WAAW,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IAChC,CAAC;IAED,MAAM;QACL,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,WAAY,EAAE,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3B,IACC,OAAO;YACP,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,iBAAiB,CAAC,EAC/E,CAAC;YACF,OAAO,OAAO,CAAC,MAAM,CAAC;QACvB,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAgB,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACrD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;oBAC9E,SAAS,EAAE,kBAAkB;oBAC7B,MAAM,EAAE,MAAM,CAAC,OAAO;iBACtB,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,EAAE,KAAK,EAAqB;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,KAAK,CAAC,MAAc;QACjC,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,iCAAiC,EAAE;gBAChF,OAAO,EAAE;oBACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;oBAC3B,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;oBAC3E,gBAAgB,EAAE,OAAO;iBACzB;aACD,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAChC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,OAAO;oBACN,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,2CAA2C,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,EAAE;iBAClF,CAAC;YACH,CAAC;YACD,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,kBAAkB,MAAM,CAAC,KAAK,uBAAuB,GAAG,CAAC,MAAM,GAAG;aAC3E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,oCAAoC,MAAM,CAAC,KAAK,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAChH,CAAC;QACH,CAAC;IACF,CAAC;IAEO,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,KAAa;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3F,MAAM,OAAO,GAAG;YACf,GAAG,EAAE,MAAM;YACX,IAAI,EAAE,eAAe;YACrB,GAAG,EAAE,eAAe;YACpB,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,WAAW;YACtB,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC9B,SAAS,EAAE,KAAK;SAChB,CAAC;QACF,MAAM,KAAK,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC5E,CAAC;CACD;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjE,CAAC;AAYD,sGAAsG;AACtG,SAAS,WAAW,CAAC,GAAW;IAC/B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CACd,yHAAyH,CACzH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAY,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CACd,wFAAwF,CACxF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACd,+EAA+E,CAC/E,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC;QAC5B,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;QAC9D,MAAM,EAAE,KAAK;KACb,CAAC,CAAC;IACH,OAAO;QACN,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK,EAAE,iCAAiC,GAAG,CAAC,GAAG,GAAG;QAClD,IAAI,EACH,uGAAuG;YACvG,mDAAmD;QACpD,wCAAwC;QACxC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;KACxE,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,MAAc;IAClC,OAAO;QACN,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,2FAA2F;QACjG,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;KAClE,CAAC;AACH,CAAC"}

package/dist/data/SupabaseApiTokenStore.d.ts

@@ -0,0 +1,33 @@
+import type { ApiToken, ApiTokenRevokeReason, ApiTokenSummary, IApiTokenStore, IEventSink, ListOptions, Page, RequestContext } from '@selvajs/platform';
+import type { ClientBundle } from './client.js';
+/**
+ * API token store. `getByTokenHash` and `touchLastUsed` are called with
+ * `SYSTEM_CONTEXT`, so they run as service role. Every other call runs under
+ * the caller's session, and RLS limits it to their own keys plus, for
+ * `manage_org_members`, the org's roster.
+ */
+export declare class SupabaseApiTokenStore implements IApiTokenStore {
+    private readonly clients;
+    private readonly events;
+    constructor(clients: ClientBundle, events?: IEventSink);
+    create(ctx: RequestContext, token: ApiToken): Promise<void>;
+    getByTokenHash(ctx: RequestContext, tokenHash: string): Promise<ApiToken | null>;
+    get(ctx: RequestContext, id: string): Promise<ApiTokenSummary | null>;
+    listByOrg(ctx: RequestContext, orgId: string, opts?: ListOptions & {
+        userId?: string;
+    }): Promise<Page<ApiTokenSummary>>;
+    revoke(ctx: RequestContext, id: string, reason: ApiTokenRevokeReason): Promise<void>;
+    revokeAllForUser(ctx: RequestContext, userId: string, opts: {
+        orgId?: string;
+        reason: ApiTokenRevokeReason;
+    }): Promise<string[]>;
+    touchLastUsed(ctx: RequestContext, id: string, at: string): Promise<void>;
+    /**
+     * Deleting the auth user does this through the FKs already. This covers a
+     * caller erasing the rows before (or without) deleting the identity.
+     */
+    eraseUser(_ctx: RequestContext, userId: string): Promise<void>;
+    deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
+    private emitRevoked;
+}
+//# sourceMappingURL=SupabaseApiTokenStore.d.ts.map

package/dist/data/SupabaseApiTokenStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabaseApiTokenStore.d.ts","sourceRoot":"","sources":["../../src/data/SupabaseApiTokenStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,UAAU,EACV,WAAW,EACX,IAAI,EACJ,cAAc,EACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQhD;;;;;GAKG;AACH,qBAAa,qBAAsB,YAAW,cAAc;IAE1D,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,YAAY,EACrB,MAAM,GAAE,UAAgC;IAGpD,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAe3D,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAahF,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAWrE,SAAS,CACd,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,WAAW,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACtC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAiB3B,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAapF,gBAAgB,CACrB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,GACpD,OAAO,CAAC,MAAM,EAAE,CAAC;IAed,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS/E;;;OAGG;IACG,SAAS,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW9D,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASpE,OAAO,CAAC,WAAW;CAanB"}

package/dist/data/SupabaseApiTokenStore.js

@@ -0,0 +1,183 @@
+import { NoopEventSink, actorOf } from '@selvajs/platform';
+import { mapPostgrestError } from './errors.js';
+import { nextCursorFromRange, toRange } from './pagination.js';
+/** Every column a session may read: the hash is granted to service role only. */
+const SUMMARY_COLUMNS = 'id, user_id, created_by, org_id, name, scopes, created_at, expires_at, last_used_at, revoked_at';
+/**
+ * API token store. `getByTokenHash` and `touchLastUsed` are called with
+ * `SYSTEM_CONTEXT`, so they run as service role. Every other call runs under
+ * the caller's session, and RLS limits it to their own keys plus, for
+ * `manage_org_members`, the org's roster.
+ */
+export class SupabaseApiTokenStore {
+    clients;
+    events;
+    constructor(clients, events = new NoopEventSink()) {
+        this.clients = clients;
+        this.events = events;
+    }
+    async create(ctx, token) {
+        const { error } = await this.clients
+            .forRequest(ctx)
+            .from('api_tokens')
+            .insert(tokenToRow(token));
+        if (error)
+            throw mapPostgrestError(error);
+        await this.events.emit({
+            type: 'api_token.created',
+            apiTokenId: token.id,
+            orgId: token.orgId,
+            userId: token.userId,
+            ...actorOf(ctx)
+        });
+    }
+    async getByTokenHash(ctx, tokenHash) {
+        const { data, error } = await this.clients
+            .forRequest(ctx)
+            .from('api_tokens')
+            .select(`${SUMMARY_COLUMNS}, token_hash`)
+            .eq('token_hash', tokenHash)
+            .is('revoked_at', null)
+            .gt('expires_at', new Date().toISOString())
+            .maybeSingle();
+        if (error)
+            throw mapPostgrestError(error);
+        return data ? rowToToken(data) : null;
+    }
+    async get(ctx, id) {
+        const { data, error } = await this.clients
+            .forRequest(ctx)
+            .from('api_tokens')
+            .select(SUMMARY_COLUMNS)
+            .eq('id', id)
+            .maybeSingle();
+        if (error)
+            throw mapPostgrestError(error);
+        return data ? rowToSummary(data) : null;
+    }
+    async listByOrg(ctx, orgId, opts) {
+        const range = toRange(opts);
+        let query = this.clients
+            .forRequest(ctx)
+            .from('api_tokens')
+            .select(SUMMARY_COLUMNS, { count: 'exact' })
+            .eq('org_id', orgId);
+        if (opts?.userId)
+            query = query.eq('user_id', opts.userId);
+        const { data, error, count } = await query
+            .order('created_at', { ascending: (opts?.orderDir ?? 'desc') === 'asc' })
+            .order('id')
+            .range(range.from, range.to);
+        if (error)
+            throw mapPostgrestError(error);
+        const items = (data ?? []).map(rowToSummary);
+        return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
+    }
+    async revoke(ctx, id, reason) {
+        // `.is('revoked_at', null)` keeps the first revocation time and makes a repeat a no-op.
+        const { data, error } = await this.clients
+            .forRequest(ctx)
+            .from('api_tokens')
+            .update({ revoked_at: new Date().toISOString() })
+            .eq('id', id)
+            .is('revoked_at', null)
+            .select('id, org_id');
+        if (error)
+            throw mapPostgrestError(error);
+        for (const row of (data ?? []))
+            await this.emitRevoked(ctx, row, reason);
+    }
+    async revokeAllForUser(ctx, userId, opts) {
+        let query = this.clients
+            .forRequest(ctx)
+            .from('api_tokens')
+            .update({ revoked_at: new Date().toISOString() })
+            .eq('user_id', userId)
+            .is('revoked_at', null);
+        if (opts.orgId)
+            query = query.eq('org_id', opts.orgId);
+        const { data, error } = await query.select('id, org_id');
+        if (error)
+            throw mapPostgrestError(error);
+        const rows = (data ?? []);
+        for (const row of rows)
+            await this.emitRevoked(ctx, row, opts.reason);
+        return rows.map((r) => r.id);
+    }
+    async touchLastUsed(ctx, id, at) {
+        const { error } = await this.clients
+            .forRequest(ctx)
+            .from('api_tokens')
+            .update({ last_used_at: at })
+            .eq('id', id);
+        if (error)
+            throw mapPostgrestError(error);
+    }
+    /**
+     * Deleting the auth user does this through the FKs already. This covers a
+     * caller erasing the rows before (or without) deleting the identity.
+     */
+    async eraseUser(_ctx, userId) {
+        const client = this.clients.serviceClient;
+        const deleted = await client.from('api_tokens').delete().eq('user_id', userId);
+        if (deleted.error)
+            throw mapPostgrestError(deleted.error);
+        const cleared = await client
+            .from('api_tokens')
+            .update({ created_by: null })
+            .eq('created_by', userId);
+        if (cleared.error)
+            throw mapPostgrestError(cleared.error);
+    }
+    async deleteByOrg(ctx, orgId) {
+        const { error } = await this.clients
+            .forRequest(ctx)
+            .from('api_tokens')
+            .delete()
+            .eq('org_id', orgId);
+        if (error)
+            throw mapPostgrestError(error);
+    }
+    emitRevoked(ctx, row, reason) {
+        return this.events.emit({
+            type: 'api_token.revoked',
+            apiTokenId: row.id,
+            orgId: row.org_id,
+            reason,
+            ...actorOf(ctx)
+        });
+    }
+}
+function rowToSummary(row) {
+    return {
+        id: row.id,
+        userId: row.user_id,
+        createdBy: row.created_by,
+        orgId: row.org_id,
+        name: row.name,
+        scopes: row.scopes,
+        createdAt: row.created_at,
+        expiresAt: row.expires_at,
+        lastUsedAt: row.last_used_at,
+        revokedAt: row.revoked_at
+    };
+}
+function rowToToken(row) {
+    return { ...rowToSummary(row), tokenHash: row.token_hash };
+}
+function tokenToRow(t) {
+    return {
+        id: t.id,
+        user_id: t.userId,
+        created_by: t.createdBy,
+        org_id: t.orgId,
+        name: t.name,
+        token_hash: t.tokenHash,
+        scopes: t.scopes,
+        created_at: t.createdAt,
+        expires_at: t.expiresAt,
+        last_used_at: t.lastUsedAt,
+        revoked_at: t.revokedAt
+    };
+}
+//# sourceMappingURL=SupabaseApiTokenStore.js.map