better-supabase 0.11.0 → 0.13.0

package/dist/server/index.d.ts

@@ -1,31 +1,31 @@
-import { b as DbError, f as Result } from "../result-BREt7qOh.js";
-import { B as TableKey, a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
-import { lt as SupportEventData, wt as Events } from "../events-P3raDX2E.js";
-import { m as RequestContext } from "../plugin-D-95Q0w0.js";
-import { E as writeSession, S as readSession, a as ResolveAuthOptions, c as resolveAuth, d as CookieRecord, g as StoredSession, i as InvalidReason, l as AUTH_CACHE_HEADERS, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as clientIp, t as AuthResolution, u as CookieOptions, w as sessionCookieName } from "../resolve-Bqb8TMTt.js";
-import { n as SqlClient } from "../executor-D1hECPGG.js";
-import { a as SessionActor, c as agentClaims, i as IDENTITY_SCOPES, l as delegationOf, n as ActorOutcome, o as SessionDelegation, r as AgentActOptions, s as actorOf, t as ActClaim } from "../actor-BAhb-d1S.js";
-import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DCDIQiTA.js";
-import { a as AuthorizationSubject, c as defineAuthorizer, i as AuthorizationResource, n as AuthorizationOutcome, o as Authorizer, r as AuthorizationRequest, s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
-import { i as ResourcePagination } from "../resource-DYEtc-KN.js";
-import { j as StorageApi } from "../bucket-BBSNDFNH.js";
-import { Wt as DbStats, _ as Db, t as BetterSupabase } from "../define-M_r1d2AT.js";
-import { n as Impersonator, r as impersonatorOf, t as ImpersonationOptions } from "../impersonation-D5chOkrO.js";
-import { _ as SupportAuthorize, a as AutomationHooks, b as TicketSubject, c as ChatActionHook, d as IdentityRef, f as IdentityTarget, g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, l as DelegationPermissions, m as Subscriber, n as Approver, o as AutomationRef, p as PrincipalByIdentity, r as ApproverOf, s as ChatAction, t as ApprovalRequestRef, u as DelegationRef, v as SupportAuthorizeInput, x as defineAuthorizationHooks, y as SupportDecision } from "../authorization-hooks-mLi894KH.js";
-import { A as supportCookieValue, B as SupportSessionStore, C as SupportSessions, D as SupportCookieOptions, E as SUPPORT_COOKIE, F as SupportEndedBy, G as PRIMARY_COOKIE, H as sqlSupportStore, I as SupportListFilter, J as DeleteAccountOptions, K as ReplicaState, L as SupportRequest, M as SupportApprovalQuery, N as SupportApprover, O as clearSupportCookie, P as SupportCallerClaims, R as SupportRequestInput, S as SupportPolicy, T as supportSessions, U as supportClaims, V as SupportStartInput, W as RequestIdOptions, X as deleteAccount, Y as DeleteAccountResult, _ as suspendAccount, a as ServerContext, b as SupportExpireRouteOptions, c as ServerOptions, d as EndSessionsResult, f as LastSignIn, g as lastSignIns, h as endSessions, i as ForContextOptions, j as SqlSupportStoreOptions, k as supportCookie, m as SuspendAccountResult, n as BetterServer, o as ServerDbOptions, p as SuspendAccountOptions, q as LiteDriver, r as ContextOptions, s as ServerKeys, t as AdminDb, u as TENANT_HEADER, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions, y as SupportApi, z as SupportSession } from "../server-types-BKN_R4Ws.js";
-import { a as checkAal, i as amrOf, n as AmrEntry, r as aalOf, t as Aal } from "../mfa-YzkRjNad.js";
-import { n as toSession, t as AuthSession } from "../view-Bf7e07rQ.js";
-import { a as serverCore, i as ServerCore, n as SessionEntryConfig, r as withSession, t as AuthOutageHook } from "../session-CwpfitmI.js";
-import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-CEBC6KUX.js";
-import { a as GuardEntryConfig, i as withBetterSupabase, n as BetterSupabaseContributions, o as withGuard, r as BetterSupabaseEntry, t as BetterSupabaseConfig } from "../composite-B1Mmo4TU.js";
-import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-BeZX2pR_.js";
-import { n as subjectReaders, t as SubjectReadersOptions } from "../subject-readers-BNQzBDN9.js";
-import { i as toCsv, n as csvColumns, t as CsvOptions } from "../csv-D3eKxV1T.js";
-import { i as JwsAlgorithm, n as Jwks, r as JwksOfOptions } from "../jws-35a8VhFV.js";
-import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-CGr0BbL-.js";
-import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-AUpl4Ob9.js";
-import { n as supportOf, t as SupportView } from "../support-view-IRnDLuGN.js";
-import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-DQmwYosO.js";
+import { b as DbError, f as Result } from "../result-mijqfoJN.js";
+import { B as TableKey, a as AnyModels, i as AnyFunctions } from "../types-DmshMaXz.js";
+import { lt as SupportEventData, wt as Events } from "../events-DhGgwqQA.js";
+import { m as RequestContext } from "../plugin-DouW0Kvg.js";
+import { E as writeSession, S as readSession, a as ResolveAuthOptions, c as resolveAuth, d as CookieRecord, g as StoredSession, i as InvalidReason, l as AUTH_CACHE_HEADERS, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as clientIp, t as AuthResolution, u as CookieOptions, w as sessionCookieName } from "../resolve-D57oDWNr.js";
+import { n as SqlClient } from "../executor-DXfgDsKd.js";
+import { a as SessionActor, c as agentClaims, i as IDENTITY_SCOPES, l as delegationOf, n as ActorOutcome, o as SessionDelegation, r as AgentActOptions, s as actorOf, t as ActClaim } from "../actor-CoveJgya.js";
+import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-D_DEBfMn.js";
+import { a as AuthorizationSubject, c as defineAuthorizer, i as AuthorizationResource, n as AuthorizationOutcome, o as Authorizer, r as AuthorizationRequest, s as PermissionRef, t as AnyAuthorizer } from "../authorizer-DFP3gHv8.js";
+import { i as ResourcePagination } from "../resource-DxQOPkZ5.js";
+import { Lt as DbStats, o as Db, t as BetterSupabase } from "../define-D0LSXmUP.js";
+import { k as StorageApi } from "../bucket-DBay-ICp.js";
+import { n as Impersonator, r as impersonatorOf, t as ImpersonationOptions } from "../impersonation-YTa9dZUv.js";
+import { a as checkAal, i as amrOf, n as AmrEntry, r as aalOf, t as Aal } from "../mfa-Dt8AdWht.js";
+import { _ as SupportAuthorize, a as AutomationHooks, b as TicketSubject, c as ChatActionHook, d as IdentityRef, f as IdentityTarget, g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, l as DelegationPermissions, m as Subscriber, n as Approver, o as AutomationRef, p as PrincipalByIdentity, r as ApproverOf, s as ChatAction, t as ApprovalRequestRef, u as DelegationRef, v as SupportAuthorizeInput, x as defineAuthorizationHooks, y as SupportDecision } from "../authorization-hooks-HXVZXxUk.js";
+import { n as toSession, t as AuthSession } from "../view-CKzCp8FW.js";
+import { A as supportCookieValue, B as SupportSessionStore, C as SupportSessions, D as SupportCookieOptions, E as SUPPORT_COOKIE, F as SupportEndedBy, G as PRIMARY_COOKIE, H as sqlSupportStore, I as SupportListFilter, J as DeleteAccountOptions, K as ReplicaState, L as SupportRequest, M as SupportApprovalQuery, N as SupportApprover, O as clearSupportCookie, P as SupportCallerClaims, R as SupportRequestInput, S as SupportPolicy, T as supportSessions, U as supportClaims, V as SupportStartInput, W as RequestIdOptions, X as deleteAccount, Y as DeleteAccountResult, _ as suspendAccount, a as ServerContext, b as SupportExpireRouteOptions, c as ServerOptions, d as EndSessionsResult, f as LastSignIn, g as lastSignIns, h as endSessions, i as ForContextOptions, j as SqlSupportStoreOptions, k as supportCookie, m as SuspendAccountResult, n as BetterServer, o as ServerDbOptions, p as SuspendAccountOptions, q as LiteDriver, r as ContextOptions, s as ServerKeys, t as AdminDb, u as TENANT_HEADER, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions, y as SupportApi, z as SupportSession } from "../server-types-D_cQ6OxZ.js";
+import { a as serverCore, i as ServerCore, n as SessionEntryConfig, r as withSession, t as AuthOutageHook } from "../session-DNRYXIOU.js";
+import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-QW-f1yio.js";
+import { a as GuardEntryConfig, i as withBetterSupabase, n as BetterSupabaseContributions, o as withGuard, r as BetterSupabaseEntry, t as BetterSupabaseConfig } from "../composite-BgBzdYP-.js";
+import { a as AuthorizedContext, c as ResourceLoaderContext, d as rolesAt, i as AuthorizeOptions, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as hasRole } from "../kit-LeQGMzLH.js";
+import { n as subjectReaders, t as SubjectReadersOptions } from "../subject-readers-Bbq1i0Ol.js";
+import { i as toCsv, n as csvColumns, t as CsvOptions } from "../csv-DhHQS2x_.js";
+import { i as JwsAlgorithm, n as Jwks, r as JwksOfOptions } from "../jws-D0toeQlA.js";
+import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-NXau9LJE.js";
+import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-tbiuHHMV.js";
+import { n as supportOf, t as SupportView } from "../support-view-BOJJSZKv.js";
+import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-D_Twxl8v.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware, SingleKeyEntry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
@@ -34,7 +34,10 @@ import { PostgresApi } from "@supabase/server/middleware/postgres";
 interface CsvResponseOptions extends CsvOptions {
   /** The download name, such as `invoices.csv`. */
   readonly filename: string;
-  /** Extra headers, such as `cache-control`. `content-type` and `content-disposition` win. */
+  /**
+   * Extra headers, such as `cache-control`. `content-type` and
+   * `content-disposition` win.
+   */
   readonly headers?: ConstructorParameters<typeof Headers>[0];
   readonly status?: number;
 }
@@ -53,19 +56,22 @@ type AccountEventType = "account.suspended" | "account.unsuspended" | "account.d
 //#region src/server/server.d.ts
 /**
  * A framework adapter's server: `server` plus the adapter's own methods,
- * without reading the lazy `env` getter. `extra` can't replace a
- * `BetterServer` method.
+ * without reading the lazy `env` getter. `extra` can't replace a `BetterServer`
+ * method.
  */
 export declare function extendServer<R extends object>(server: object, extra: Omit<R, ServerKeys>): R;
 /**
- * Server-side entry point for APIs, jobs, MCP servers and framework
- * adapters. Holds the secrets; `betterSupabase` stays isomorphic.
+ * Server-side entry point for APIs, jobs, MCP servers and framework adapters.
+ * Holds the secrets; `betterSupabase` stays isomorphic.
  */
 export declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P, B>, options?: ServerOptions): BetterServer<M, F, E, C, P, B>;
 //#endregion
 //#region src/server/adapter.d.ts
 interface HandleOptions extends MiddlewareOptions {
-  /** Include error messages in problem responses. Defaults to `NODE_ENV === 'development'`. */
+  /**
+   * Include error messages in problem responses. Defaults to `NODE_ENV ===
+   * 'development'`.
+   */
   readonly expose?: boolean;
   /** Problem Details `instance`. Defaults to the request path. */
   readonly instance?: string;
@@ -79,14 +85,17 @@ interface HandleOptions extends MiddlewareOptions {
   /** Passed to `server.context()`, e.g. a request-wide stats recorder. */
   readonly context?: Omit<ContextOptions, "refresh">;
   /**
-   * Sees every error the handler throws before it becomes a 500, so
-   * framework control flow (Next's `redirect()`) can be thrown again.
+   * Sees every error the handler throws before it becomes a 500, so framework
+   * control flow (Next's `redirect()`) can be thrown again.
    */
   readonly rethrow?: (cause: unknown) => void;
 }
 /** Hands event sink sends still running to `waitUntil`; a no-op without either. */
 export declare function flushEvents(server: Pick<BetterServer<AnyModels, AnyFunctions, unknown>, "events">, waitUntil: ((promise: Promise<unknown>) => void) | undefined): void;
-/** Runs `run`, then hands pending event sink sends to `waitUntil` even when it throws. */
+/**
+ * Runs `run`, then hands pending event sink sends to `waitUntil` even when it
+ * throws.
+ */
 export declare function withFlush<T>(server: Pick<BetterServer<AnyModels, AnyFunctions, unknown>, "events">, waitUntil: ((promise: Promise<unknown>) => void) | undefined, run: () => Promise<T> | T): Promise<T>;
 /** The 500 for an error a handler threw; the message only when `expose` is set. */
 export declare function unexpectedResponse(cause: unknown, options: {
@@ -95,14 +104,18 @@ export declare function unexpectedResponse(cause: unknown, options: {
 }): Response;
 /**
  * Runs `run` as the request's caller, the way every built-in adapter does:
- * resolves the context, applies the guard (401/403 Problem Details), turns
- * the return value into a response with `respond()`, turns other thrown
- * errors into a 500, adds the context's cookies with `ctx.apply()` and
- * hands pending event sink sends to `waitUntil`.
+ * resolves the context, applies the guard (401/403 Problem Details), turns the
+ * return value into a response with `respond()`, turns other thrown errors into
+ * a 500, adds the context's cookies with `ctx.apply()` and hands pending event
+ * sink sends to `waitUntil`.
  *
  * ```ts
- * export default { fetch: (request, env, ctx) =>
- *   handle(server, request, (c) => c.db.notes.findMany(), { waitUntil: (p) => ctx.waitUntil(p) }) }
+ * export default {
+ *   fetch: (request, env, ctx) =>
+ *     handle(server, request, (c) => c.db.notes.findMany(), {
+ *       waitUntil: (p) => ctx.waitUntil(p),
+ *     }),
+ * };
  * ```
  */
 export declare function handle<M extends AnyModels, F extends AnyFunctions, E, C, P, B>(server: BetterServer<M, F, E, C, P, B>, request: Request, run: (ctx: ServerContext<M, F, E, C, P, B>) => unknown, options?: HandleOptions): Promise<Response>;
@@ -119,19 +132,32 @@ type SupportSessionsEvents = {
   readonly "support.ended": SupportEventData;
   readonly "support.denied": SupportEventData;
 };
-/** The `support-sessions` block's event types, for its manifest and `onBlockEvent`. */
+/**
+ * The `support-sessions` block's event types, for its manifest and
+ * `onBlockEvent`.
+ */
 export declare const supportSessionsEvents: Events<SupportSessionsEvents>;
 //#endregion
 //#region src/server/support-storage.d.ts
 interface SupportStorageOptions {
   /** The service-role `supabase.storage` that serves what the target may read. */
   readonly admin: StorageApi;
-  /** Runs as the target, such as `postgres.asUser(support.claims)`, so RLS on `storage.objects` decides. Writes need its `transaction`. */
+  /**
+   * Runs as the target, such as `postgres.asUser(support.claims)`, so RLS on
+   * `storage.objects` decides. Writes need its `transaction`.
+   */
   readonly sql: SqlClient;
-  /** Runs as the connection-string role, such as `postgres.admin`. Writes need it to make the target the owner of what they store. */
+  /**
+   * Runs as the connection-string role, such as `postgres.admin`. Writes and
+   * signed upload claims need it to make the target the owner of what they
+   * store.
+   */
   readonly adminSql?: SqlClient;
-  /** The session the writes are recorded under. Writes need it. */
-  readonly session?: Pick<SupportSession, "id" | "adminId" | "targetUserId">;
+  /**
+   * The session the writes are recorded under. Writes need it; claims only take
+   * objects stored after its `startedAt`.
+   */
+  readonly session?: Pick<SupportSession, "id" | "adminId" | "targetUserId" | "startedAt">;
   /** Whether the session is read-only. Defaults to true. */
   readonly readOnly?: boolean;
 }
@@ -139,25 +165,33 @@ interface SupportStorageOptions {
  * Storage for a support session, with the same `from(bucket)` file API as
  * `supabase.storage`, so `bucket.connect()` and the blocks take it.
  *
- * Storage policies read `auth.uid()` from the request's token, and there is
- * no token for the target, so reads go through Postgres as the target.
- * `exists`, `info`, `list` and `listV2` run entirely there: the listings
- * call the invoker-rights `storage.search` functions storage-api calls, so
- * RLS filters each page as it would for the target's own request.
- * `download` and the signed URLs first check there that the target may see
- * the object, then the service client serves it. A hidden object answers
- * like a missing one. `getPublicUrl` is built without a check, as it is
- * built without a request.
+ * Storage policies read `auth.uid()` from the request's token, and there is no
+ * token for the target, so reads go through Postgres as the target. `exists`,
+ * `info`, `list` and `listV2` run entirely there: the listings call the
+ * invoker-rights `storage.search` functions storage-api calls, so RLS filters
+ * each page as it would for the target's own request. `download` and the signed
+ * URLs first check there that the target may see the object, then the service
+ * client serves it. A hidden object answers like a missing one. `getPublicUrl`
+ * is built without a check, as it is built without a request.
+ *
+ * In a writable session, `upload`, `update`, `remove`, `copy` and `move` first
+ * run the row change Storage would make as the target, inside a savepoint that
+ * is rolled back, so the policies on `storage.objects` decide as for the
+ * target's own request. Then the service client writes, the admin connection
+ * makes the target the owner of the stored object, and its `user_metadata`
+ * records the session id and the admin's id. A refused dry run resolves to
+ * Storage's `403`.
  *
- * In a writable session, `upload`, `update`, `remove`, `copy` and `move`
- * first run the row change Storage would make as the target, inside a
- * savepoint that is rolled back, so the policies on `storage.objects`
- * decide as for the target's own request. Then the service client writes,
- * the admin connection makes the target the owner of the stored object,
- * and its `user_metadata` records the session id and the admin's id. A
- * refused dry run resolves to Storage's `403`. Signed uploads resolve to a
- * `403` `SUPPORT_STORAGE_WRITES` error, and every write in a read-only
- * session to a `403` `SUPPORT_READ_ONLY` error.
+ * `createSignedUploadUrl` runs the same dry run as `upload` before the service
+ * client signs the URL. The object a browser uploads there has no owner, so
+ * `claimSignedUpload(bucket, path)` finishes the upload: it checks again that
+ * the target may insert at the path, then makes the target the owner of an
+ * object without one that was stored after `session.startedAt`, and stamps the
+ * session on its `user_metadata`. An older object, or one another user owns, is
+ * refused with a `403`. `uploadToSignedUrl` claims what it stores and removes
+ * it when the claim fails. Every write in a read-only session resolves to a
+ * `403` `SUPPORT_READ_ONLY` error, and without `adminSql`, `session` or a `sql`
+ * client with `transaction` to a `403` `SUPPORT_STORAGE_WRITES` error.
  */
 export declare function supportStorage(options: SupportStorageOptions): StorageApi;
 //#endregion
@@ -173,8 +207,8 @@ export declare function contextFromSupabase(ctx: SupabaseAuthContext): RequestCo
 /**
  * Entry contributing `ctx.db`: repositories bound to `ctx.supabase`, the
  * caller-scoped client from `withSupabase`. Use it when `withSupabase`
- * authenticates the request (bearer tokens only); `withBetterSupabase`
- * covers cookie sessions too.
+ * authenticates the request (bearer tokens only); `withBetterSupabase` covers
+ * cookie sessions too.
  *
  * ```ts
  * pipeline([withSupabase({ auth: 'user' }), withBetterDb(betterSupabase)()], (req, ctx) => ...)
@@ -201,23 +235,31 @@ export declare function withBetterPostgres<M extends AnyModels, D, F extends Any
  *
  * ```ts
  * pipeline(
- *   [withBetterSupabase(bs), withPostgresAdminClient(), withBlock('jobs', (ctx) => createJobs({ sql: ctx.postgresAdmin, queues }))],
+ *   [
+ *     withBetterSupabase(bs),
+ *     withPostgresAdminClient(),
+ *     withBlock("jobs", (ctx) =>
+ *       createJobs({ sql: ctx.postgresAdmin, queues }),
+ *     ),
+ *   ],
  *   (req, ctx) => ctx.jobs.drainRoute({ secret, handlers })(req),
- * )
+ * );
  * ```
  */
 export declare function withBlock<const Key extends string, In extends object, Service>(key: Key, create: (ctx: In) => Service): SingleKeyEntry<Key, In, Service>;
 //#endregion
 //#region src/auth/claims.d.ts
-/** `jwtClaims` as `withSupabase` contributes it: the verified token's payload, or `null`. */
+/**
+ * `jwtClaims` as `withSupabase` contributes it: the verified token's payload,
+ * or `null`.
+ */
 export declare function jwtClaimsOf<C>(auth: AuthState<C>): (JWTClaims & C) | null;
 /** `userClaims` as `withSupabase` contributes it, or `null` without a user. */
 export declare function userClaimsOf(auth: AuthState): UserClaims | null;
 /**
- * `authMode` as `withSupabase` names it: `user` for a verified user token
- * or a user's API key, `secret` for a secret key or an organization's API
- * key, `none` otherwise (no credentials, or ones a
- * guard refuses).
+ * `authMode` as `withSupabase` names it: `user` for a verified user token or a
+ * user's API key, `secret` for a secret key or an organization's API key,
+ * `none` otherwise (no credentials, or ones a guard refuses).
  */
 export declare function authModeOf(auth: AuthState): AuthMode;
 //#endregion
@@ -237,8 +279,8 @@ interface JwksSourceOptions extends JwksOfOptions {
 //#region src/auth/access-token.d.ts
 /**
  * Checks whether an access token was revoked, by its `jti` or by the grant it
- * was issued under. `createOAuthServer` from `better-supabase/blocks/oauth-server`
- * has this shape.
+ * was issued under. `createOAuthServer` from
+ * `better-supabase/blocks/oauth-server` has this shape.
  */
 interface AccessTokenRevocation {
   isRevoked(jti: string, grantId: string | undefined): PromiseLike<Result<boolean>>;
@@ -255,8 +297,8 @@ interface AccessTokenResolverOptions {
   /** Seconds of clock skew allowed on `exp`, `nbf` and `iat`. Default: 30. */
   readonly clockSkew?: number;
   /**
-   * The Postgres role queries run as, which the token's `role` must match
-   * when it has one. Default: `authenticated`.
+   * The Postgres role queries run as, which the token's `role` must match when
+   * it has one. Default: `authenticated`.
    */
   readonly role?: string;
   /** Checked on every request after the signature; a failure answers 401. */
@@ -275,18 +317,18 @@ interface AccessTokenResolverOptions {
   readonly now?: () => number;
 }
 /**
- * Resolves an OAuth 2.0 access token in the JWT format of RFC 9068, issued
- * by an authorization server the app trusts, to a `user` auth state with
- * `source: "oauth"`. Its claims keep `sub`, `client_id` and `scope`, so
- * queries run as the user under RLS and the access functions narrow the
- * token to the permissions its scopes map to.
+ * Resolves an OAuth 2.0 access token in the JWT format of RFC 9068, issued by
+ * an authorization server the app trusts, to a `user` auth state with `source:
+ * "oauth"`. Its claims keep `sub`, `client_id` and `scope`, so queries run as
+ * the user under RLS and the access functions narrow the token to the
+ * permissions its scopes map to.
  *
  * Only `Authorization: Bearer` tokens with the `typ` header `at+jwt` are
  * claimed; others fall through to the next resolver and the Supabase token
  * check. A claimed token that fails a check answers 401, never anon.
  *
- * `ctx.supabase` forwards the token to PostgREST, which accepts it only
- * when the issuer is registered as Supabase third-party auth.
+ * `ctx.supabase` forwards the token to PostgREST, which accepts it only when
+ * the issuer is registered as Supabase third-party auth.
  */
 export declare function accessTokenResolver(options: AccessTokenResolverOptions): AuthResolver;
 //#endregion
@@ -299,9 +341,9 @@ interface SessionLookup {
  * `undefined` when the user token's session still exists in `auth.sessions`;
  * otherwise an `unauthorized` error with code `SESSION_REVOKED`. A verified
  * access token stays valid until it expires, even after sign-out; call this
- * before sensitive actions (deleting the account, changing the email) to
- * reject tokens of ended sessions. It costs one query, so nothing calls it
- * by default. Non-user callers pass: `guard` decides about them.
+ * before sensitive actions (deleting the account, changing the email) to reject
+ * tokens of ended sessions. It costs one query, so nothing calls it by default.
+ * Non-user callers pass: `guard` decides about them.
  */
 export declare function checkSession(sql: SessionLookup, auth: {
   readonly kind: "user";
@@ -316,8 +358,8 @@ export declare function checkSession(sql: SessionLookup, auth: {
 //#region src/core/ratelimit-headers.d.ts
 /**
  * The `RateLimit` and `RateLimit-Policy` response fields of
- * draft-ietf-httpapi-ratelimit-headers (`SPEC_PINS.ratelimitHeaders`), as
- * RFC 9651 Structured Fields Lists.
+ * draft-ietf-httpapi-ratelimit-headers (`SPEC_PINS.ratelimitHeaders`), as RFC
+ * 9651 Structured Fields Lists.
  */
 /** One quota policy in `RateLimit-Policy`. */
 interface RateLimitPolicy {
@@ -343,27 +385,30 @@ export declare function rateLimitPolicyHeader(policies: readonly RateLimitPolicy
 /** The `RateLimit` value for `states`. */
 export declare function rateLimitHeader(states: readonly RateLimitState[]): string;
 /**
- * Whole seconds in a period of `count unit` (`1 minute`, `30 seconds`,
- * `2 hours`) or a number of seconds; `undefined` for any other interval.
+ * Whole seconds in a period of `count unit` (`1 minute`, `30 seconds`, `2
+ * hours`) or a number of seconds; `undefined` for any other interval.
  */
 export declare function periodSeconds(period: number | string): number | undefined;
 //#endregion
 //#region src/server/resource.d.ts
 /**
- * Operations over one table, matching the paths and responses of the API
- * model: `GET/POST /<table>`, `GET/PATCH/DELETE /<table>/{id}` and each
- * action's path. Shared by the HTTP adapters and the MCP table tools.
+ * Operations over one table, matching the paths and responses of the API model:
+ * `GET/POST /<table>`, `GET/PATCH/DELETE /<table>/{id}` and each action's path.
+ * Shared by the HTTP adapters and the MCP table tools.
  *
- * With permissions, the authorizer decides before the repository runs:
- * `get`, `update` and `delete` fetch the row first (under RLS) and pass it
- * as the resource's properties, and `list` keeps only the rows it grants.
+ * With permissions, the authorizer decides before the repository runs: `get`,
+ * `update` and `delete` fetch the row first (under RLS) and pass it as the
+ * resource's properties, and `list` keeps only the rows it grants.
  */
 export declare function defineResource<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>, Ref = string, DbT = unknown>(betterSupabase: BetterSupabase<M, D, F, E>, table: T, options?: ResourceRouteOptions<M, T, NoInfer<Ref>, DbT>, authorizer?: Authorizer<Ref>): ResourceHandler<Ref>;
 //#endregion
 //#region src/server/entries/timing.d.ts
 /** The header `withDbStats` sets: `calls;waves;ms`, what `expectDbBudget` reads. */
 export declare const DB_CALLS_HEADER = "x-bs-db-calls";
-/** Parses the stats header back into numbers, or `undefined` when it is malformed. */
+/**
+ * Parses the stats header back into numbers, or `undefined` when it is
+ * malformed.
+ */
 export declare function parseDbStats(value: string | null | undefined): Pick<DbStats, "calls" | "waves" | "ms"> | undefined;
 /** Collects `Server-Timing` metrics for one request. */
 interface ServerTiming {
@@ -373,17 +418,17 @@ interface ServerTiming {
   measure<T>(name: string, fn: () => T | Promise<T>): Promise<T>;
 }
 /**
- * Entry contributing `ctx.timing`, and adding `Server-Timing` to the
- * response: `bs;dur=<ms>` for everything after it, plus the metrics handlers
- * add with `ctx.timing.add()` or `measure()`. Put it first, so it times the
- * whole request. Browsers show it in the network panel.
+ * Entry contributing `ctx.timing`, and adding `Server-Timing` to the response:
+ * `bs;dur=<ms>` for everything after it, plus the metrics handlers add with
+ * `ctx.timing.add()` or `measure()`. Put it first, so it times the whole
+ * request. Browsers show it in the network panel.
  */
 export declare function withServerTiming(now?: () => number): SingleKeyEntry<"timing", Record<never, never>, ServerTiming>;
 /**
- * Entry adding the request's database totals to the response, after the
- * handler ran: `x-bs-db-calls: calls;waves;ms`, which `expectDbBudget(response)`
- * reads, and a `bs-db` `Server-Timing` metric. Put it
- * after `withBetterSupabase`, which contributes `ctx.bs`.
+ * Entry adding the request's database totals to the response, after the handler
+ * ran: `x-bs-db-calls: calls;waves;ms`, which `expectDbBudget(response)` reads,
+ * and a `bs-db` `Server-Timing` metric. Put it after `withBetterSupabase`,
+ * which contributes `ctx.bs`.
  */
 export declare function withDbStats(options?: {
   readonly header?: string;
@@ -393,4 +438,4 @@ export declare function withDbStats(options?: {
   };
 }, () => DbStats>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AccessTokenResolverOptions, type AccessTokenRevocation, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type ActorOutcome, type AdminDb, type AgentActOptions, type AmrEntry, type AnyAuthorizer, type ApprovalRequestRef, type Approver, type ApproverOf, type AuthKind, type AuthOutageHook, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationHooks, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type AutomationHooks, type AutomationRef, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ChatAction, type ChatActionHook, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DelegationPermissions, type DelegationRef, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, IDENTITY_SCOPES, type IdentityRef, type IdentityTarget, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PermissionRef, type PrincipalByIdentity, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RateLimitPolicy, type RateLimitState, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SubjectReadersOptions, type Subscriber, type SubscriberEvent, type SubscriberPolicy, type SupabaseAuthContext, type SupportApi, type SupportApprovalQuery, type SupportApprover, type SupportAuthorize, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportDecision, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportRequest, type SupportRequestInput, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportSessionsEvents, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, type TicketSubject, aalOf, actorOf, agentClaims, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, csvColumns, defineAuthorizationHooks, defineAuthorizer, delegationOf, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, lastSignIns, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, subjectReaders, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, type Aal, type AccessTokenResolverOptions, type AccessTokenRevocation, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type ActorOutcome, type AdminDb, type AgentActOptions, type AmrEntry, type AnyAuthorizer, type ApprovalRequestRef, type Approver, type ApproverOf, type AuthKind, type AuthOutageHook, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationHooks, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type AutomationHooks, type AutomationRef, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ChatAction, type ChatActionHook, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DelegationPermissions, type DelegationRef, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, IDENTITY_SCOPES, type IdentityRef, type IdentityTarget, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PermissionRef, type PrincipalByIdentity, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RateLimitPolicy, type RateLimitState, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourceLoaderContext, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SubjectReadersOptions, type Subscriber, type SubscriberEvent, type SubscriberPolicy, type SupabaseAuthContext, type SupportApi, type SupportApprovalQuery, type SupportApprover, type SupportAuthorize, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportDecision, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportRequest, type SupportRequestInput, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportSessionsEvents, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, type TicketSubject, aalOf, actorOf, agentClaims, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, csvColumns, defineAuthorizationHooks, defineAuthorizer, delegationOf, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, lastSignIns, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, subjectReaders, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };

package/dist/server/index.js

@@ -1,31 +1,31 @@
-import { n as dbError } from "../errors-BV1SKTVs.js";
+import { n as dbError } from "../errors-D7u24ZJH.js";
 import { n as isRecord } from "../guards-6F2bCtQR.js";
-import { t as base64ToText } from "../base64-D4aqdnDR.js";
-import { c as toProblem, i as isProblem, n as PROBLEM_TYPE_BASE, o as problemResponse, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-JRCohp1j.js";
-import { i as delegationOf, n as actorOf, r as agentClaims, t as IDENTITY_SCOPES } from "../actor-CAL8mMih.js";
-import { i as userContext, r as impersonatorOf } from "../impersonation-DxU6yHJV.js";
+import { t as base64ToText } from "../base64-B9Wlsdj7.js";
+import { c as toProblem, i as isProblem, n as PROBLEM_TYPE_BASE, o as problemResponse, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-D0KDiYPk.js";
+import { i as delegationOf, n as actorOf, r as agentClaims, t as IDENTITY_SCOPES } from "../actor-C9pwyCVz.js";
+import { i as userContext, r as impersonatorOf } from "../impersonation-DFfDVJHk.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { r as toCsv, t as csvColumns } from "../csv-CVfXqaAu.js";
-import { A as suspendAccount, C as shouldRefresh, D as SERVER_EVENT_SOURCE, E as defineAuthorizationHooks, O as endSessions, S as shouldCheckSession, T as serverCore, a as unexpectedResponse, b as isPrefetch, c as extendServer, d as clearSupportCookie, f as supportCookie, h as TENANT_HEADER, i as resolveToken, j as deleteAccount, k as lastSignIns, l as supportStorage, m as supportCookieValue, n as flushEvents, o as withFlush, r as handle, s as createServer, u as SUPPORT_COOKIE, x as refreshFor, y as withSession } from "../adapter-B2WRsRIg.js";
+import { r as toCsv, t as csvColumns } from "../csv-2rXGPNtP.js";
+import { A as suspendAccount, C as shouldRefresh, D as SERVER_EVENT_SOURCE, E as defineAuthorizationHooks, O as endSessions, S as shouldCheckSession, T as serverCore, a as unexpectedResponse, b as isPrefetch, c as extendServer, d as clearSupportCookie, f as supportCookie, h as TENANT_HEADER, i as resolveToken, j as deleteAccount, k as lastSignIns, l as supportStorage, m as supportCookieValue, n as flushEvents, o as withFlush, r as handle, s as createServer, u as SUPPORT_COOKIE, x as refreshFor, y as withSession } from "../adapter-D8dW6p2A.js";
 import { n as PRIMARY_COOKIE } from "../replicas-BvIL4_jL.js";
-import { t as authContext } from "../context-BiwgsycK.js";
-import { _ as writeSession, a as clearSessionCookies, h as sessionCookieName, i as refreshSession, o as sessionStatus, p as readSession, r as resolveAuth, s as AUTH_CACHE_HEADERS, t as clientIp } from "../resolve-f8QNuYI3.js";
-import { a as checkAal, i as amrOf, n as toSession, r as aalOf } from "../view-CYX1wsgp.js";
-import { a as respond, i as isResult, o as settle, r as guard } from "../respond-Bhp3G__q.js";
-import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-BAhTqI7y.js";
-import { n as event, t as defineEvents } from "../event-map-Dy2vKHai.js";
-import { t as subjectReaders } from "../subject-readers-BpwUFJtp.js";
-import { t as postgresExecutor } from "../executor-CxGQiQN_.js";
-import { n as jwtClaimsOf, r as userClaimsOf, t as authModeOf } from "../claims-0KZVT804.js";
-import { n as withGuard, t as withBetterSupabase } from "../composite-BFatHqOU.js";
-import { c as verifyCompact, t as JwsError } from "../jws-CwBB5QAT.js";
-import { t as jwksSource } from "../jwks-cache-C4rA69hD.js";
-import { i as rateLimitPolicyHeader, n as periodSeconds, r as rateLimitHeader, t as isRateLimitPolicyName } from "../ratelimit-headers-Bsxx0Tj2.js";
-import { r as defineAuthorizer } from "../authorizer-B3yyCVUF.js";
-import { t as defineResource } from "../resource-Bdkqi8jo.js";
-import { i as withServerTiming, n as parseDbStats, r as withDbStats, t as DB_CALLS_HEADER } from "../timing-BMCWgpdZ.js";
-import { n as tagCache, r as tagFor, t as cacheTagsOf } from "../tags-B99_U9Pp.js";
-import { a as rolesAt, r as hasRole } from "../kit-LTbHrWWD.js";
+import { t as authContext } from "../context-CrojkPNC.js";
+import { _ as writeSession, a as clearSessionCookies, h as sessionCookieName, i as refreshSession, o as sessionStatus, p as readSession, r as resolveAuth, s as AUTH_CACHE_HEADERS, t as clientIp } from "../resolve-sy3_Gz0i.js";
+import { a as checkAal, i as amrOf, n as toSession, r as aalOf } from "../view-CfUd5vI9.js";
+import { a as respond, i as isResult, o as settle, r as guard } from "../respond-DjEmE_DN.js";
+import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-CWVTM2AB.js";
+import { n as event, t as defineEvents } from "../event-map-CtPFhcOp.js";
+import { t as subjectReaders } from "../subject-readers-BJzh7WF7.js";
+import { t as postgresExecutor } from "../executor-C5uyGttm.js";
+import { n as jwtClaimsOf, r as userClaimsOf, t as authModeOf } from "../claims-T8TWZ53E.js";
+import { n as withGuard, t as withBetterSupabase } from "../composite-BgSdL5tk.js";
+import { c as verifyCompact, t as JwsError } from "../jws-DOgHJKHb.js";
+import { t as jwksSource } from "../jwks-cache-DbgNmSgV.js";
+import { i as rateLimitPolicyHeader, n as periodSeconds, r as rateLimitHeader, t as isRateLimitPolicyName } from "../ratelimit-headers-kEcXyO3H.js";
+import { r as defineAuthorizer } from "../authorizer-BVR2vPGA.js";
+import { t as defineResource } from "../resource-BVvIiuX_.js";
+import { i as withServerTiming, n as parseDbStats, r as withDbStats, t as DB_CALLS_HEADER } from "../timing-C5NzaEgy.js";
+import { n as tagCache, r as tagFor, t as cacheTagsOf } from "../tags-C_ym1yDM.js";
+import { a as rolesAt, r as hasRole } from "../kit-BeXTrlZn.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/server/csv.ts
 function disposition(filename) {
@@ -49,7 +49,10 @@ function csvResponse(rows, options) {
 }
 //#endregion
 //#region src/blocks/support-sessions/events.ts
-/** The `support-sessions` block's event types, for its manifest and `onBlockEvent`. */
+/**
+* The `support-sessions` block's event types, for its manifest and
+* `onBlockEvent`.
+*/
 const supportSessionsEvents = defineEvents({
 	"support.started": event(),
 	"support.ended": event(),
@@ -90,8 +93,8 @@ function contextFromSupabase(ctx) {
 /**
 * Entry contributing `ctx.db`: repositories bound to `ctx.supabase`, the
 * caller-scoped client from `withSupabase`. Use it when `withSupabase`
-* authenticates the request (bearer tokens only); `withBetterSupabase`
-* covers cookie sessions too.
+* authenticates the request (bearer tokens only); `withBetterSupabase` covers
+* cookie sessions too.
 *
 * ```ts
 * pipeline([withSupabase({ auth: 'user' }), withBetterDb(betterSupabase)()], (req, ctx) => ...)
@@ -124,9 +127,15 @@ function withBetterPostgres(betterSupabase) {
 *
 * ```ts
 * pipeline(
-*   [withBetterSupabase(bs), withPostgresAdminClient(), withBlock('jobs', (ctx) => createJobs({ sql: ctx.postgresAdmin, queues }))],
+*   [
+*     withBetterSupabase(bs),
+*     withPostgresAdminClient(),
+*     withBlock("jobs", (ctx) =>
+*       createJobs({ sql: ctx.postgresAdmin, queues }),
+*     ),
+*   ],
 *   (req, ctx) => ctx.jobs.drainRoute({ secret, handlers })(req),
-* )
+* );
 * ```
 */
 function withBlock(key, create) {
@@ -242,18 +251,18 @@ function revocationError(error) {
 	};
 }
 /**
-* Resolves an OAuth 2.0 access token in the JWT format of RFC 9068, issued
-* by an authorization server the app trusts, to a `user` auth state with
-* `source: "oauth"`. Its claims keep `sub`, `client_id` and `scope`, so
-* queries run as the user under RLS and the access functions narrow the
-* token to the permissions its scopes map to.
+* Resolves an OAuth 2.0 access token in the JWT format of RFC 9068, issued by
+* an authorization server the app trusts, to a `user` auth state with `source:
+* "oauth"`. Its claims keep `sub`, `client_id` and `scope`, so queries run as
+* the user under RLS and the access functions narrow the token to the
+* permissions its scopes map to.
 *
 * Only `Authorization: Bearer` tokens with the `typ` header `at+jwt` are
 * claimed; others fall through to the next resolver and the Supabase token
 * check. A claimed token that fails a check answers 401, never anon.
 *
-* `ctx.supabase` forwards the token to PostgREST, which accepts it only
-* when the issuer is registered as Supabase third-party auth.
+* `ctx.supabase` forwards the token to PostgREST, which accepts it only when
+* the issuer is registered as Supabase third-party auth.
 */
 function accessTokenResolver(options) {
 	if (listOf(options.issuer).length === 0) throw new TypeError("accessTokenResolver: issuer is required");
@@ -361,9 +370,9 @@ const ACTIVE = `select exists (
 * `undefined` when the user token's session still exists in `auth.sessions`;
 * otherwise an `unauthorized` error with code `SESSION_REVOKED`. A verified
 * access token stays valid until it expires, even after sign-out; call this
-* before sensitive actions (deleting the account, changing the email) to
-* reject tokens of ended sessions. It costs one query, so nothing calls it
-* by default. Non-user callers pass: `guard` decides about them.
+* before sensitive actions (deleting the account, changing the email) to reject
+* tokens of ended sessions. It costs one query, so nothing calls it by default.
+* Non-user callers pass: `guard` decides about them.
 */
 async function checkSession(sql, auth) {
 	if (auth.kind !== "user" || !("claims" in auth)) return;