@supabase/lite 0.8.0 → 0.8.1-next.2

package/dist/vite/index.d.ts

@@ -7,7 +7,7 @@ import * as hono_hono_base from 'hono/hono-base';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import * as hono_types from 'hono/types';
-import { MiddlewareHandler } from 'hono';
+import { Context, MiddlewareHandler } from 'hono';
 import { Kysely } from 'kysely';
 import { ReadableStream as ReadableStream$1 } from 'node:stream/web';
 
@@ -67,6 +67,8 @@ declare const schema: s.ObjectSchema<{
     readonly auth: s.Schema<s.ISchemaOptions, {
         enabled?: boolean | undefined;
         jwt_secret?: string | undefined;
+        publishable_key?: string | undefined;
+        secret_key?: string | undefined;
         site_url?: string | undefined;
         additional_redirect_urls?: string[] | undefined;
         jwt_expiry?: number | undefined;
@@ -154,6 +156,7 @@ declare const schema: s.ObjectSchema<{
             secure_password_change?: boolean | undefined;
             otp_expiry?: number | undefined;
             smtp?: {
+                enabled?: boolean | undefined;
                 port?: number | undefined;
                 host?: string | undefined;
                 user?: string | undefined;
@@ -207,6 +210,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             azure?: {
                 enabled?: boolean | undefined;
@@ -215,6 +219,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             bitbucket?: {
                 enabled?: boolean | undefined;
@@ -223,6 +228,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             discord?: {
                 enabled?: boolean | undefined;
@@ -231,6 +237,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             facebook?: {
                 enabled?: boolean | undefined;
@@ -239,6 +246,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             github?: {
                 enabled?: boolean | undefined;
@@ -247,6 +255,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             gitlab?: {
                 enabled?: boolean | undefined;
@@ -255,6 +264,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             google?: {
                 enabled?: boolean | undefined;
@@ -263,6 +273,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             kakao?: {
                 enabled?: boolean | undefined;
@@ -271,6 +282,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             keycloak?: {
                 enabled?: boolean | undefined;
@@ -279,6 +291,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             linkedin?: {
                 enabled?: boolean | undefined;
@@ -287,6 +300,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             notion?: {
                 enabled?: boolean | undefined;
@@ -295,6 +309,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             twitch?: {
                 enabled?: boolean | undefined;
@@ -303,6 +318,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             twitter?: {
                 enabled?: boolean | undefined;
@@ -311,6 +327,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             slack?: {
                 enabled?: boolean | undefined;
@@ -319,6 +336,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             spotify?: {
                 enabled?: boolean | undefined;
@@ -327,6 +345,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             workos?: {
                 enabled?: boolean | undefined;
@@ -335,6 +354,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             zoom?: {
                 enabled?: boolean | undefined;
@@ -343,11 +363,14 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
         } | undefined;
     } | undefined, {
         enabled?: boolean | undefined;
         jwt_secret?: string | undefined;
+        publishable_key?: string | undefined;
+        secret_key?: string | undefined;
         site_url?: string | undefined;
         additional_redirect_urls?: string[] | undefined;
         jwt_expiry?: number | undefined;
@@ -435,6 +458,7 @@ declare const schema: s.ObjectSchema<{
             secure_password_change?: boolean | undefined;
             otp_expiry?: number | undefined;
             smtp?: {
+                enabled?: boolean | undefined;
                 port?: number | undefined;
                 host?: string | undefined;
                 user?: string | undefined;
@@ -488,6 +512,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             azure?: {
                 enabled?: boolean | undefined;
@@ -496,6 +521,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             bitbucket?: {
                 enabled?: boolean | undefined;
@@ -504,6 +530,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             discord?: {
                 enabled?: boolean | undefined;
@@ -512,6 +539,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             facebook?: {
                 enabled?: boolean | undefined;
@@ -520,6 +548,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             github?: {
                 enabled?: boolean | undefined;
@@ -528,6 +557,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             gitlab?: {
                 enabled?: boolean | undefined;
@@ -536,6 +566,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             google?: {
                 enabled?: boolean | undefined;
@@ -544,6 +575,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             kakao?: {
                 enabled?: boolean | undefined;
@@ -552,6 +584,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             keycloak?: {
                 enabled?: boolean | undefined;
@@ -560,6 +593,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             linkedin?: {
                 enabled?: boolean | undefined;
@@ -568,6 +602,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             notion?: {
                 enabled?: boolean | undefined;
@@ -576,6 +611,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             twitch?: {
                 enabled?: boolean | undefined;
@@ -584,6 +620,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             twitter?: {
                 enabled?: boolean | undefined;
@@ -592,6 +629,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             slack?: {
                 enabled?: boolean | undefined;
@@ -600,6 +638,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             spotify?: {
                 enabled?: boolean | undefined;
@@ -608,6 +647,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             workos?: {
                 enabled?: boolean | undefined;
@@ -616,6 +656,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
             zoom?: {
                 enabled?: boolean | undefined;
@@ -624,6 +665,7 @@ declare const schema: s.ObjectSchema<{
                 url?: string | undefined;
                 redirect_uri?: string | undefined;
                 skip_nonce_check?: boolean | undefined;
+                email_optional?: boolean | undefined;
             } | undefined;
         } | undefined;
     } | undefined>;
@@ -849,6 +891,26 @@ interface IdentitiesTable {
     created_at: string;
     updated_at: string;
 }
+interface FlowStateTable {
+    id: string;
+    user_id: string | null;
+    auth_code: string | null;
+    authentication_method: string;
+    code_challenge_method: string | null;
+    code_challenge: string | null;
+    provider_type: string;
+    provider_access_token: string | null;
+    provider_refresh_token: string | null;
+    auth_code_issued_at: string | null;
+    invite_token: string | null;
+    referrer: string | null;
+    oauth_client_state_id: string | null;
+    linking_target_id: string | null;
+    email_optional: boolean;
+    created_at: string;
+    updated_at: string;
+}
+type NewFlowState = Pick<FlowStateTable, "id" | "authentication_method" | "provider_type"> & Partial<Pick<FlowStateTable, "user_id" | "auth_code" | "code_challenge_method" | "code_challenge" | "invite_token" | "referrer" | "oauth_client_state_id" | "linking_target_id" | "email_optional">>;
 interface UserResponse {
     id: string;
     aud: string;
@@ -910,14 +972,28 @@ interface AuthConfig {
         otp_length?: number;
         otp_expiry?: number;
         smtp?: {
-            sender_name?: string;
+            enabled?: boolean;
+            host?: string;
+            port?: number;
+            user?: string;
+            pass?: string;
             admin_email?: string;
+            sender_name?: string;
         };
         template?: Partial<Record<EmailTemplateType, EmailTemplateConfig>>;
     };
     enable_confirmations?: boolean;
     site_url?: string;
     additional_redirect_urls?: string[];
+    external?: Record<string, {
+        enabled?: boolean;
+        client_id?: string;
+        secret?: string;
+        url?: string;
+        redirect_uri?: string;
+        skip_nonce_check?: boolean;
+        email_optional?: boolean;
+    }>;
 }
 type EmailTemplateType = "invite" | "confirmation" | "recovery" | "magic_link" | "email_change";
 interface EmailTemplateConfig {
@@ -926,12 +1002,28 @@ interface EmailTemplateConfig {
 }
 
 type Dialect$1 = "postgres" | "sqlite";
+/** Bound `Connection#runInTransaction` — see db/Connection.ts for why this
+ * indirection exists (DO storage has no BEGIN/COMMIT over kysely). */
+type TransactionRunner = <T>(fn: (trx: Kysely<any>) => Promise<T>) => Promise<T>;
 declare class AuthRepository {
     private db;
     private dialect;
+    private runInTransaction;
     private schema;
-    constructor(db: Kysely<any>, dialect: Dialect$1);
+    constructor(db: Kysely<any>, dialect: Dialect$1, runInTransaction?: TransactionRunner);
     private bool;
+    /**
+     * Runs `fn` inside a database transaction, handing it a repository bound to
+     * the transaction's executor. All reads/writes performed through that
+     * repository (including this one's other methods) participate in the same
+     * transaction, and are rolled back together if `fn` throws.
+     *
+     * Callers that need existing private helpers (which close over `this.repo`)
+     * to run against the transaction should swap `this.repo` for the duration
+     * of the callback — safe because AuthService/AuthRepository instances are
+     * constructed fresh per request (see server/auth.ts createAuthService).
+     */
+    transaction<T>(fn: (repo: AuthRepository) => Promise<T>): Promise<T>;
     private table;
     private insertInto;
     private update;
@@ -939,9 +1031,22 @@ declare class AuthRepository {
     findUserByEmail(email: string): Promise<UsersTable | null>;
     findUserById(id: string): Promise<UsersTable | null>;
     findUserByToken(column: string, token: string): Promise<UsersTable | null>;
+    /**
+     * Atomically consumes a one-time token: the UPDATE only matches a row whose
+     * `column` still holds `token`, so exactly one of two concurrent verifies
+     * for the same OTP can win, and a token rotated/cleared by another request
+     * (resend, a competing verify) no longer matches. Returns false when no row
+     * was updated — callers must treat that as an invalid/consumed token and
+     * mutate nothing further.
+     *
+     * This is the guard that survives on D1, whose `runInTransaction` cannot
+     * group statements (see D1SqliteConnection L131-140): a single conditional
+     * UPDATE with a rowcount check is atomic on every driver.
+     */
+    claimUserToken(userId: string, column: string, token: string): Promise<boolean>;
     createUser(user: Partial<UsersTable> & {
         id: string;
-        email: string;
+        email: string | null;
     }): Promise<UsersTable>;
     updateUser(id: string, updates: Partial<UsersTable>): Promise<UsersTable | null>;
     createSession(session: {
@@ -977,6 +1082,52 @@ declare class AuthRepository {
     }): Promise<IdentitiesTable>;
     findIdentitiesByUserId(userId: string): Promise<IdentitiesTable[]>;
     updateIdentity(id: string, updates: Partial<IdentitiesTable>): Promise<void>;
+    deleteIdentitiesExcept(userId: string, keepId: string): Promise<void>;
+    findIdentityByProviderAndId(provider: string, providerId: string): Promise<IdentitiesTable | null>;
+    findIdentitiesByEmails(emails: string[]): Promise<IdentitiesTable[]>;
+    createFlowState(flow: NewFlowState): Promise<FlowStateTable>;
+    findFlowStateById(id: string): Promise<FlowStateTable | null>;
+    findFlowStateByAuthCode(authCode: string): Promise<FlowStateTable | null>;
+    updateFlowState(id: string, updates: Partial<FlowStateTable>): Promise<void>;
+    /**
+     * Atomically claims a PKCE flow_state row for a callback: the UPDATE only
+     * matches (and thus only succeeds for) a row whose user_id is still null,
+     * so exactly one of two concurrent callbacks for the same state can win.
+     * Returns false if the row was already claimed (or no longer exists) —
+     * callers should treat that as a replay (flow_state_already_used).
+     */
+    claimFlowStateForPkce(id: string, updates: {
+        user_id: string;
+        provider_access_token: string;
+        provider_refresh_token: string;
+        auth_code_issued_at: string;
+    }): Promise<boolean>;
+    /**
+     * Atomically deletes a flow_state row, returning whether a row was
+     * actually removed. A single DELETE...WHERE id = ? is inherently atomic
+     * (at most one caller can ever delete a given row), so this doubles as the
+     * "claim" step for implicit-flow callbacks and PKCE auth-code redemption:
+     * only the caller that observes `true` may proceed to issue a session.
+     */
+    /**
+     * Deletes at most {@link FLOW_STATE_CLEANUP_BATCH} flow_state rows created
+     * before `cutoffIso`. Ports the flow_state statement of GoTrue's periodic
+     * cleanup (internal/models/cleanup.go L62):
+     *
+     *   delete from "flow_state" where id in (
+     *     select id from "flow_state" where created_at < now() - interval '24 hours'
+     *     limit 100 for update skip locked);
+     *
+     * The bound is the point of that statement: cleanup must never turn into an
+     * unbounded delete that blocks the request it is piggybacking on (lite has
+     * no background scheduler, so this runs opportunistically on the /authorize
+     * insert path). A backlog is drained across subsequent /authorize calls.
+     * `for update skip locked` has no sqlite equivalent and is omitted; the
+     * id-in-subquery-with-LIMIT shape works on both dialects. Returns the number
+     * of rows removed.
+     */
+    deleteFlowStatesCreatedBefore(cutoffIso: string): Promise<number>;
+    deleteFlowState(id: string): Promise<boolean>;
     createAuditLogEntry(entry: {
         id: string;
         payload?: Record<string, unknown>;
@@ -1088,6 +1239,11 @@ declare class AuthService {
         token_hash?: string;
         type: string;
     }): Promise<SessionResponse>;
+    /**
+     * The mutating half of {@link verifyOtp}, always run inside a transaction
+     * (`this.repo` is bound to it) — see the comment at the call site.
+     */
+    private completeVerifyOtp;
     recover(email: string | undefined): Promise<void>;
     resend(type: string, email: string | undefined): Promise<void>;
     reauthenticate(userId: string): Promise<void>;
@@ -1100,6 +1256,51 @@ declare class AuthService {
     private isTokenExpired;
     private getTokenColumnsForType;
     private createAuditLog;
+    /**
+     * Same entry shape as {@link createAuditLog}, for the call sites whose
+     * traits map is not `{provider: ...}` (GoTrue builds the map per call site;
+     * see models.NewAuditLogEntry's `traits map[string]any` argument).
+     */
+    private createAuditLogWithTraits;
+    getExternalProviderRedirectUrl(query: Record<string, string | undefined>, opts: {
+        refererHeader?: string;
+        defaultRedirectUri: string;
+    }): Promise<string>;
+    loadOAuthFlowState(state: string | undefined): Promise<FlowStateTable>;
+    resolveOAuthRedirectTarget(flowState: FlowStateTable): string;
+    handleExternalProviderCallback(flowState: FlowStateTable, params: Record<string, string | undefined>, opts: {
+        defaultRedirectUri: string;
+    }): Promise<{
+        type: "pkce" | "implicit";
+        redirectUrl: string;
+    }>;
+    /**
+     * Tail of the external-provider callback, shared by the account-linking and
+     * invite branches: claims the flow state and either hands back the PKCE
+     * auth code or issues a session in the URL fragment (external.go
+     * L221-286). Runs inside the callback's transaction — `this.repo` is
+     * already bound to it by the caller.
+     */
+    private issueOAuthCallbackResult;
+    /**
+     * Ports internal/api/external.go's processInvite (L449-514): accepts an
+     * invitation with an external identity. The invite token is the user's
+     * `confirmation_token` (models.FindUserByConfirmationToken), the external
+     * email must match the invited email, and the user is confirmed because
+     * they were able to respond to the invite email.
+     *
+     * Runs inside the callback's transaction (`this.repo` is bound to it).
+     */
+    private processInvite;
+    exchangePkceCode(authCode: string | undefined, codeVerifier: string | undefined): Promise<SessionResponse & {
+        provider_token?: string;
+        provider_refresh_token?: string;
+    }>;
+    private resolveOAuthReferrer;
+    private updateUserMetaDataAndProviders;
+    private buildAppMetaDataProviders;
+    private removeUnconfirmedIdentities;
+    private determineAccountLinking;
 }
 
 type CrossReadableStream = ReadableStream | ReadableStream$1;
@@ -1361,31 +1562,25 @@ type HonoContext = {
         userId?: string;
         sessionId?: string;
         jwt?: Record<string, unknown>;
+        apiKeyType?: "publishable" | "secret";
+        ignoreAuthorization?: boolean;
+        /**
+         * Set by `adminAuth()` when local admin mode elevated this request to
+         * `service_role`. Observability/tests only — the elevation itself is
+         * carried by `apiKeyType`/`ignoreAuthorization`/`jwt`.
+         */
+        admin?: boolean;
     };
 };
 
-type Where = Record<string, unknown>;
+type ApiKeyType = "publishable" | "secret";
 
-type PolicyCommand = "SELECT" | "INSERT" | "UPDATE" | "DELETE" | "ALL";
-type PolicyRole = "anon" | "authenticated" | string;
-interface PolicyData {
-    name: string;
-    table: string;
-    schema?: string;
-    command: PolicyCommand;
-    permissive: boolean;
-    roles: PolicyRole[];
-    using?: Where;
-    withCheck?: Where;
-}
-declare class Policy {
-    readonly data: PolicyData;
-    constructor(data: PolicyData);
-    appliesTo(cmd: "SELECT" | "INSERT" | "UPDATE" | "DELETE"): boolean;
-    appliesToRole(role: string): boolean;
-    toJSON(): PolicyData;
-    static fromJSON(data: PolicyData): Policy;
-}
+/** Claims are applied verbatim as `request.jwt.claims` — MUST include `role`. */
+type ResolvedKey = {
+    type: ApiKeyType;
+    claims: Record<string, unknown>;
+};
+type ApiKeyResolver = (key: string, c: Context<HonoContext>) => Promise<ResolvedKey | null>;
 
 type ServerOptions = {
     middlewares?: MiddlewareHandler<HonoContext>[];
@@ -1395,6 +1590,33 @@ type ServerOptions = {
      * Test-only PostgREST mode: execute each request in a transaction and roll it back.
      */
     forceRollback?: boolean;
+    /**
+     * `false` disables apikey enforcement outright. Otherwise a custom
+     * `resolver` can be supplied (the lite-platform seam); when omitted, keys
+     * configured under `config.auth.publishable_key`/`secret_key` are used.
+     */
+    apiKeys?: false | {
+        resolver?: ApiKeyResolver;
+    };
+    /**
+     * Local admin mode (default `false`): run *keyless* `/rest/v1` and
+     * `/storage/v1` requests as `service_role`, so a browser studio can do
+     * privileged work without a secret key shipping to the browser. Only
+     * same-origin requests addressed to loopback are elevated.
+     *
+     * Two caveats, both local-dev only:
+     * 1. RLS is not enforced for keyless traffic while this is on. To exercise
+     *    policies, send an `apikey`: the publishable key for `anon`, or the
+     *    publishable key PLUS `Authorization: Bearer <user JWT>` for
+     *    `authenticated`. Those requests are never elevated. A bearer token on
+     *    its own is rejected before RLS is reached (401), since opaque keys are
+     *    only sourced from `apikey`.
+     * 2. Localhost trust is not per-request trust. Any page open in the
+     *    developer's browser can reach the server; the same-origin and
+     *    loopback guards are what keep that from being a data-exfiltration
+     *    hole. Never enable outside local development.
+     */
+    admin?: boolean;
 };
 declare function createServer(app: App, options?: ServerOptions): hono_hono_base.HonoBase<HonoContext & {
     Variables: {
@@ -1707,32 +1929,9 @@ declare function createServer(app: App, options?: ServerOptions): hono_hono_base
             input: {};
             output: {
                 external: {
-                    anonymous_users: boolean;
-                    apple: boolean;
-                    azure: boolean;
-                    bitbucket: boolean;
-                    discord: boolean;
-                    facebook: boolean;
-                    snapchat: boolean;
-                    figma: boolean;
-                    fly: boolean;
-                    github: boolean;
-                    gitlab: boolean;
-                    google: boolean;
-                    keycloak: boolean;
-                    kakao: boolean;
-                    linkedin: boolean;
-                    linkedin_oidc: boolean;
-                    notion: boolean;
-                    spotify: boolean;
-                    slack: boolean;
-                    slack_oidc: boolean;
-                    workos: boolean;
-                    twitch: boolean;
-                    twitter: boolean;
                     email: boolean;
                     phone: boolean;
-                    zoom: boolean;
+                    anonymous_users: boolean;
                 };
                 disable_signup: boolean;
                 mailer_autoconfirm: boolean;
@@ -1774,6 +1973,33 @@ declare function createServer(app: App, options?: ServerOptions): hono_hono_base
             status: 200;
         };
     };
+} & {
+    "/authorize": {
+        $get: {
+            input: {};
+            output: string;
+            outputFormat: "body";
+            status: 302;
+        };
+    };
+} & {
+    "/callback": {
+        $get: {
+            input: {};
+            output: {};
+            outputFormat: string;
+            status: hono_utils_http_status.StatusCode;
+        };
+    };
+} & {
+    "/callback": {
+        $post: {
+            input: {};
+            output: {};
+            outputFormat: string;
+            status: hono_utils_http_status.StatusCode;
+        };
+    };
 } & {
     "/nonexistent": {
         $all: {
@@ -2126,14 +2352,14 @@ declare function createServer(app: App, options?: ServerOptions): hono_hono_base
                 json: {
                     [x: string]: unknown;
                     search?: string | undefined;
-                    prefix?: string | undefined;
-                    limit?: number | undefined;
-                    offset?: number | undefined;
                     sortBy?: {
                         [x: string]: unknown;
                         column: string;
                         order: string;
                     } | undefined;
+                    limit?: number | undefined;
+                    offset?: number | undefined;
+                    prefix?: string | undefined;
                 };
             } & {
                 param: {
@@ -2415,431 +2641,7 @@ declare function createServer(app: App, options?: ServerOptions): hono_hono_base
     "/config": {
         $get: {
             input: {};
-            output: {
-                project_id?: string | undefined;
-                analytics?: {
-                    enabled?: boolean | undefined;
-                    port?: number | undefined;
-                    vector_port?: number | undefined;
-                    backend?: "postgres" | "bigquery" | undefined;
-                } | undefined;
-                api?: {
-                    enabled?: boolean | undefined;
-                    port?: number | undefined;
-                    schemas?: string[] | undefined;
-                    extra_search_path?: string[] | undefined;
-                    max_rows?: number | undefined;
-                    pg_safe_update?: boolean | undefined;
-                    plan_enabled?: boolean | undefined;
-                    aggregates_enabled?: boolean | undefined;
-                    limited_mutations_enabled?: boolean | undefined;
-                    anonymous_enabled?: boolean | undefined;
-                    external_url?: string | undefined;
-                    tls?: {
-                        enabled?: boolean | undefined;
-                    } | undefined;
-                } | undefined;
-                storage?: {
-                    enabled?: boolean | undefined;
-                    file_size_limit?: string | undefined;
-                    buckets?: {
-                        [x: string]: {
-                            public?: boolean | undefined;
-                            file_size_limit?: string | undefined;
-                            allowed_mime_types?: string[] | undefined;
-                            objects_path?: string | undefined;
-                        };
-                    } | undefined;
-                    image_transformation?: {
-                        enabled?: boolean | undefined;
-                    } | undefined;
-                } | undefined;
-                auth?: {
-                    enabled?: boolean | undefined;
-                    jwt_secret?: string | undefined;
-                    site_url?: string | undefined;
-                    additional_redirect_urls?: string[] | undefined;
-                    jwt_expiry?: number | undefined;
-                    enable_refresh_token_rotation?: boolean | undefined;
-                    refresh_token_reuse_interval?: number | undefined;
-                    enable_manual_linking?: boolean | undefined;
-                    enable_signup?: boolean | undefined;
-                    enable_anonymous_sign_ins?: boolean | undefined;
-                    minimum_password_length?: number | undefined;
-                    password_requirements?: string | undefined;
-                    hook?: {
-                        mfa_verification_attempt?: {
-                            enabled?: boolean | undefined;
-                            uri?: string | undefined;
-                            secrets?: string[] | undefined;
-                        } | undefined;
-                        password_verification_attempt?: {
-                            enabled?: boolean | undefined;
-                            uri?: string | undefined;
-                            secrets?: string[] | undefined;
-                        } | undefined;
-                        custom_access_token?: {
-                            enabled?: boolean | undefined;
-                            uri?: string | undefined;
-                            secrets?: string[] | undefined;
-                        } | undefined;
-                        send_sms?: {
-                            enabled?: boolean | undefined;
-                            uri?: string | undefined;
-                            secrets?: string[] | undefined;
-                        } | undefined;
-                        send_email?: {
-                            enabled?: boolean | undefined;
-                            uri?: string | undefined;
-                            secrets?: string[] | undefined;
-                        } | undefined;
-                    } | undefined;
-                    mfa?: {
-                        max_enrolled_factors?: number | undefined;
-                        totp?: {
-                            enroll_enabled?: boolean | undefined;
-                            verify_enabled?: boolean | undefined;
-                        } | undefined;
-                        phone?: {
-                            template?: string | undefined;
-                            enroll_enabled?: boolean | undefined;
-                            verify_enabled?: boolean | undefined;
-                            otp_length?: number | undefined;
-                            max_frequency?: string | undefined;
-                        } | undefined;
-                    } | undefined;
-                    sessions?: {
-                        timebox?: string | undefined;
-                        inactivity_timeout?: string | undefined;
-                        single_per_user?: boolean | undefined;
-                    } | undefined;
-                    email?: {
-                        template?: {
-                            invite?: {
-                                subject?: string | undefined;
-                                content_path?: string | undefined;
-                            } | undefined;
-                            confirmation?: {
-                                subject?: string | undefined;
-                                content_path?: string | undefined;
-                            } | undefined;
-                            recovery?: {
-                                subject?: string | undefined;
-                                content_path?: string | undefined;
-                            } | undefined;
-                            magic_link?: {
-                                subject?: string | undefined;
-                                content_path?: string | undefined;
-                            } | undefined;
-                            email_change?: {
-                                subject?: string | undefined;
-                                content_path?: string | undefined;
-                            } | undefined;
-                        } | undefined;
-                        enable_signup?: boolean | undefined;
-                        otp_length?: number | undefined;
-                        max_frequency?: string | undefined;
-                        double_confirm_changes?: boolean | undefined;
-                        enable_confirmations?: boolean | undefined;
-                        secure_password_change?: boolean | undefined;
-                        otp_expiry?: number | undefined;
-                        smtp?: {
-                            port?: number | undefined;
-                            host?: string | undefined;
-                            user?: string | undefined;
-                            pass?: string | undefined;
-                            admin_email?: string | undefined;
-                            sender_name?: string | undefined;
-                        } | undefined;
-                    } | undefined;
-                    sms?: {
-                        template?: string | undefined;
-                        enable_signup?: boolean | undefined;
-                        max_frequency?: string | undefined;
-                        enable_confirmations?: boolean | undefined;
-                        test_otp?: {
-                            [x: string]: string;
-                        } | undefined;
-                        twilio?: {
-                            enabled?: boolean | undefined;
-                            account_sid?: string | undefined;
-                            message_service_sid?: string | undefined;
-                            auth_token?: string | undefined;
-                        } | undefined;
-                        twilio_verify?: {
-                            enabled?: boolean | undefined;
-                            account_sid?: string | undefined;
-                            message_service_sid?: string | undefined;
-                            auth_token?: string | undefined;
-                        } | undefined;
-                        messagebird?: {
-                            enabled?: boolean | undefined;
-                            originator?: string | undefined;
-                            api_key?: string | undefined;
-                        } | undefined;
-                        textlocal?: {
-                            enabled?: boolean | undefined;
-                            api_key?: string | undefined;
-                            sender?: string | undefined;
-                        } | undefined;
-                        vonage?: {
-                            enabled?: boolean | undefined;
-                            api_key?: string | undefined;
-                            from?: string | undefined;
-                            api_secret?: string | undefined;
-                        } | undefined;
-                    } | undefined;
-                    external?: {
-                        apple?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        azure?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        bitbucket?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        discord?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        facebook?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        github?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        gitlab?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        google?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        kakao?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        keycloak?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        linkedin?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        notion?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        twitch?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        twitter?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        slack?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        spotify?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        workos?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        zoom?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                    } | undefined;
-                } | undefined;
-                inbucket?: {
-                    enabled?: boolean | undefined;
-                    port?: number | undefined;
-                    smtp_port?: number | undefined;
-                    pop3_port?: number | undefined;
-                } | undefined;
-                functions?: {
-                    [x: string]: {
-                        enabled?: boolean | undefined;
-                        verify_jwt?: boolean | undefined;
-                        import_map?: string | undefined;
-                        entrypoint?: string | undefined;
-                    };
-                } | undefined;
-                realtime?: {
-                    enabled?: boolean | undefined;
-                    ip_version?: string | undefined;
-                    max_header_length?: number | undefined;
-                } | undefined;
-                studio?: {
-                    enabled?: boolean | undefined;
-                    port?: number | undefined;
-                    api_url?: string | undefined;
-                    openai_api_key?: string | undefined;
-                } | undefined;
-                experimental?: {
-                    orioledb_version?: string | undefined;
-                    s3_host?: string | undefined;
-                    s3_region?: string | undefined;
-                    s3_access_key?: string | undefined;
-                    s3_secret_key?: string | undefined;
-                } | undefined;
-                db?: {
-                    [x: string]: hono_utils_types.JSONValue;
-                    port?: number | undefined;
-                    url?: string | undefined;
-                    driver?: "postgres" | "sqlite" | "sqlite-postgres" | "pglite" | undefined;
-                    shadow_port?: number | undefined;
-                    major_version?: number | undefined;
-                    pooler?: {
-                        [x: string]: hono_utils_types.JSONValue;
-                        enabled?: boolean | undefined;
-                        port?: number | undefined;
-                        pool_mode?: string | undefined;
-                        default_pool_size?: number | undefined;
-                        max_client_conn?: number | undefined;
-                    } | undefined;
-                    seed?: {
-                        enabled?: boolean | undefined;
-                        sql_paths?: string[] | undefined;
-                    } | undefined;
-                    migrations?: {
-                        enabled?: boolean | undefined;
-                        schema_paths?: string[] | undefined;
-                    } | undefined;
-                } | undefined;
-                edge_runtime?: {
-                    enabled?: boolean | undefined;
-                    policy?: "oneshot" | "per_worker" | undefined;
-                    inspector_port?: number | undefined;
-                } | undefined;
-                options?: {
-                    defaults?: true | undefined;
-                    server?: {
-                        middlewares?: never[] | undefined;
-                        disableStudio?: boolean | undefined;
-                        disableFallback?: boolean | undefined;
-                        forceRollback?: boolean | undefined;
-                    } | undefined;
-                    drivers?: {
-                        email?: {
-                            send: never;
-                        } | undefined;
-                        sms?: {
-                            send: never;
-                        } | undefined;
-                        cache?: {
-                            get: never;
-                            set: never;
-                            delete: never;
-                        } | undefined;
-                    } | undefined;
-                    system?: {
-                        schemaReconciliation?: "additive" | "full" | undefined;
-                    } | undefined;
-                } | undefined;
-                rls?: {
-                    tables: string[];
-                    policies: {
-                        name: string;
-                        table: string;
-                        schema?: string | undefined;
-                        command: PolicyCommand;
-                        permissive: boolean;
-                        roles: PolicyRole[];
-                        using?: {
-                            [x: string]: hono_utils_types.JSONValue;
-                        } | undefined;
-                        withCheck?: {
-                            [x: string]: hono_utils_types.JSONValue;
-                        } | undefined;
-                    }[];
-                } | undefined;
-            };
+            output: {};
             outputFormat: "json";
             status: hono_utils_http_status.ContentfulStatusCode;
         };
@@ -2848,7 +2650,11 @@ declare function createServer(app: App, options?: ServerOptions): hono_hono_base
     "/info": {
         $get: {
             input: {};
-            output: {};
+            output: {
+                connection: any;
+                config: any;
+                admin: boolean;
+            };
             outputFormat: "json";
             status: hono_utils_http_status.ContentfulStatusCode;
         };
@@ -2987,6 +2793,29 @@ declare function createServer(app: App, options?: ServerOptions): hono_hono_base
     };
 }, "/_system">, "/", "*">;
 
+type Where = Record<string, unknown>;
+
+type PolicyCommand = "SELECT" | "INSERT" | "UPDATE" | "DELETE" | "ALL";
+type PolicyRole = "anon" | "authenticated" | string;
+interface PolicyData {
+    name: string;
+    table: string;
+    schema?: string;
+    command: PolicyCommand;
+    permissive: boolean;
+    roles: PolicyRole[];
+    using?: Where;
+    withCheck?: Where;
+}
+declare class Policy {
+    readonly data: PolicyData;
+    constructor(data: PolicyData);
+    appliesTo(cmd: "SELECT" | "INSERT" | "UPDATE" | "DELETE"): boolean;
+    appliesToRole(role: string): boolean;
+    toJSON(): PolicyData;
+    static fromJSON(data: PolicyData): Policy;
+}
+
 interface IAppConfig extends DefaultSchema {
     connection: Connection | Promise<Connection>;
     rls?: {
@@ -3027,6 +2856,11 @@ declare class App<Config extends IAppConfig = DefaultAppConfig, Conn = Config ex
     private readonly _rls;
     readonly config: DefaultSchema & Omit<Config, "connection">;
     readonly server: ReturnType<typeof createServer>;
+    /**
+     * Resolved local admin mode, after CLI-flag / config-file precedence. Read
+     * this (never the raw CLI flag) when reporting what the server is doing.
+     */
+    readonly adminMode: boolean;
     readonly drivers: AppDrivers;
     _mailer?: Mailer;
     _storageAdapter?: StorageAdapter;
@@ -3052,7 +2886,9 @@ declare class App<Config extends IAppConfig = DefaultAppConfig, Conn = Config ex
         force?: boolean;
     }): Promise<void>;
     isValidConfig(config: Schema | DefaultSchema | IAppConfig): boolean;
-    getClient<SchemaName extends string = "public">(options?: SupabaseClientOptions<SchemaName>): _supabase_supabase_js.SupabaseClient<any, "public", SchemaName, Omit<any, "__InternalSupabase">[SchemaName] extends {
+    getClient<SchemaName extends string = "public">(options?: SupabaseClientOptions<SchemaName> & {
+        apikey?: string;
+    }): _supabase_supabase_js.SupabaseClient<any, "public", SchemaName, Omit<any, "__InternalSupabase">[SchemaName] extends {
         Tables: Record<string, {
             Row: Record<string, unknown>;
             Insert: Record<string, unknown>;
@@ -3116,6 +2952,17 @@ type SupaliteOptions = {
     forceSchema?: boolean;
     initOnBoot?: boolean;
     prefixes?: string[];
+    /**
+     * Local admin mode (default `true`): keyless, same-origin, loopback
+     * requests from the dev server run as `service_role`. In practice that
+     * means `/rest/v1` here — admin mode also covers `/storage/v1`, but this
+     * plugin does not mount that prefix unless you add it to `prefixes`.
+     *
+     * See `ServerOptions.admin` for the caveats. Never applied in
+     * `vite preview`, which serves a production build; an explicit value here
+     * also outranks `options.server.admin` in `config.toml`.
+     */
+    admin?: boolean;
 };
 declare function supalite(options?: SupaliteOptions): Plugin;