better-supabase 0.11.0 → 0.13.0

package/dist/adapter-D8dW6p2A.js

@@ -0,0 +1,2190 @@
+import { c as mapDbError, n as dbError, o as isDbError, r as dbErrorOf } from "./errors-D7u24ZJH.js";
+import { t as temporal } from "./temporal-required-Dt4mcPsi.js";
+import { a as ok, r as err, s as toDbError, t as AsyncResult } from "./result-DIT_qp4G.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { a as postgrestExecutor, n as StatsRecorder } from "./stats-Bt1RyT-F.js";
+import { o as problemResponse } from "./problem-D0KDiYPk.js";
+import { loadEnv } from "./env/index.js";
+import { i as userContext, t as actClaim } from "./impersonation-DFfDVJHk.js";
+import { t as fromPgError } from "./pg-error-B5QLDcbG.js";
+import { i as forwardBlockEvents, t as DEFAULT_TYPE_PREFIX } from "./cloud-event-XsM53POL.js";
+import { a as replicaState, i as primaryCookieWrite, o as routedExecutor, r as pinnedUntil, s as withPrimaryPin } from "./replicas-BvIL4_jL.js";
+import { t as authContext } from "./context-CrojkPNC.js";
+import { a as narrowCap, i as delegatedClaims, r as contextClaims } from "./delegation-DeAJehLk.js";
+import { d as parseCookies, h as sessionCookieName, m as serializeCookie, n as prefetchJwks, r as resolveAuth, s as AUTH_CACHE_HEADERS, u as clearSessionAtScopes } from "./resolve-sy3_Gz0i.js";
+import { t as credentialProviderOf } from "./provider-BhIkKBOh.js";
+import { a as respond, n as defaultPrefetchJwks, r as guard, t as defaultExpose } from "./respond-DjEmE_DN.js";
+import { createClient } from "@supabase/supabase-js";
+import { defineMiddleware, getEnv, pipeline, seedContext } from "@supabase/middleware";
+import { PostgrestClient } from "@supabase/postgrest-js";
+//#region src/server/delete-account.ts
+const REMOVE_BATCH = 1e3;
+/** Maps an `AuthApiError` from `auth.admin.deleteUser` to a `DbError`. */
+function fromAuthError(raw) {
+	if (isDbError(raw)) return raw;
+	const failure = typeof raw === "object" && raw !== null ? raw : {};
+	const message = failure.message ?? "Auth request failed";
+	const base = {
+		table: "auth.users",
+		...failure.code ? { code: failure.code } : {}
+	};
+	if (failure.code === "user_not_found" || failure.status === 404) return dbError("not_found", message, base);
+	if (/database error deleting user/i.test(message)) return dbError("conflict", message, {
+		...base,
+		hint: "A foreign key to auth.users without on delete cascade or set null blocks the delete (doctor BS406)"
+	});
+	if (failure.status === 401) return dbError("unauthorized", message, base);
+	if (failure.status === 403) return dbError("forbidden", message, base);
+	return failure.name === "AuthRetryableFetchError" || (failure.status ?? 0) >= 500 ? dbError("network", message, base) : dbError("unexpected", message, base);
+}
+const UUID$2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const PROBE = "better_supabase.delete_account_probe";
+/**
+* The database error that refuses deleting `userId`, from the delete and its
+* deferred checks run in a `do` block that always fails, so nothing is deleted.
+* Undefined when the delete itself would pass.
+*/
+async function databaseRefusal(sql, userId) {
+	if (!UUID$2.test(userId)) return;
+	try {
+		await sql.queryRaw(`do $$
+begin
+  delete from auth.users where id = '${userId}';
+  set constraints all immediate;
+  raise exception '${PROBE}';
+end;
+$$`);
+	} catch (cause) {
+		const raw = isDbError(cause) ? void 0 : fromPgError(cause);
+		const error = isDbError(cause) ? cause : raw && mapDbError(raw);
+		if (!error || error.message === PROBE) return;
+		return {
+			...error,
+			table: "auth.users"
+		};
+	}
+}
+/**
+* Deletes the Auth user, then removes their Storage objects, then announces the
+* delete. Rows referencing `auth.users` follow their foreign keys. The objects
+* are listed first and removed only once the user is gone, so a delete the
+* database refuses leaves them in place.
+*
+* `server.deleteAccount` calls it with the server's service client. Apps on the
+* `@supabase/server` pipeline call it with theirs:
+* `deleteAccount(betterSupabase, ctx.supabaseAdmin, userId)`.
+*/
+function deleteAccount(betterSupabase, service, userId, options = {}) {
+	return AsyncResult.from(async () => {
+		const client = typeof service === "function" ? service() : service;
+		const listedPaths = [];
+		for (const bucket of options.buckets ?? []) {
+			const param = bucket.owner;
+			if (!param) continue;
+			options.signal?.throwIfAborted();
+			const listed = await bucket.connect(client, { allTenants: true }).list({ [param]: userId }, options.signal ? { signal: options.signal } : {});
+			if (!listed.ok) return listed;
+			listedPaths.push([bucket, listed.data.map((object) => object.path).filter((path) => {
+				return bucket.match(path)?.[param] === userId;
+			})]);
+		}
+		options.signal?.throwIfAborted();
+		let alreadyGone = false;
+		try {
+			const { error } = await client.auth.admin.deleteUser(userId);
+			const failure = error ? fromAuthError(error) : void 0;
+			if (failure?.kind === "not_found") alreadyGone = true;
+			else if (failure) {
+				const refusal = options.sql && (failure.kind === "conflict" || failure.kind === "network" || failure.kind === "unexpected") ? await databaseRefusal(options.sql, userId) : void 0;
+				return err(refusal ?? failure);
+			}
+		} catch (cause) {
+			return err(fromAuthError(cause));
+		}
+		const removed = {};
+		for (const [bucket, paths] of listedPaths) {
+			const storage = bucket.connect(client, { allTenants: true });
+			for (let start = 0; start < paths.length; start += REMOVE_BATCH) {
+				const batch = await storage.remove(paths.slice(start, start + REMOVE_BATCH));
+				if (!batch.ok) return batch;
+			}
+			removed[bucket.id] = paths.length;
+		}
+		if (alreadyGone) return ok({
+			userId,
+			removed
+		});
+		const context = options.context ?? {};
+		betterSupabase.events.emit("mutation", {
+			table: "auth.users",
+			kind: "delete",
+			rows: [{ id: userId }],
+			context
+		});
+		for (const table of options.cascades ?? []) betterSupabase.events.emit("mutation", {
+			table,
+			kind: "delete",
+			rows: [],
+			context
+		});
+		return ok({
+			userId,
+			removed
+		});
+	});
+}
+//#endregion
+//#region src/server/suspend-account.ts
+const UUID$1 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const FOREVER = "876000h";
+const END_SESSIONS = `with ended as (
+  delete from auth.sessions where user_id = $1::uuid returning id
+), tokens as (
+  delete from auth.refresh_tokens where user_id = $1::text
+)
+select count(*)::int as ended from ended`;
+function invalidUser(userId) {
+	return dbError("invalid_request", `"${userId}" is not a user id`, { table: "auth.users" });
+}
+function fromSqlError(cause) {
+	const known = dbErrorOf(cause);
+	if (known) return known;
+	const raw = fromPgError(cause);
+	if (raw) return {
+		...mapDbError(raw),
+		table: "auth.sessions"
+	};
+	return dbError("unexpected", cause instanceof Error ? cause.message : "Ending the sessions failed", { table: "auth.sessions" });
+}
+async function deleteSessions(sql, userId) {
+	const [row] = await sql.queryRaw(END_SESSIONS, [userId]);
+	return row?.ended ?? 0;
+}
+function endSessions(sql, userId) {
+	return AsyncResult.from(async () => {
+		if (!UUID$1.test(userId)) return err(invalidUser(userId));
+		try {
+			return ok({
+				userId,
+				ended: await deleteSessions(sql, userId)
+			});
+		} catch (cause) {
+			return err(fromSqlError(cause));
+		}
+	});
+}
+const LAST_SIGN_INS = `select user_id, last_sign_in_at
+from better_supabase.last_sign_ins($1::uuid[])`;
+/**
+* The last sign-in of each user, in one query (`better_supabase.last_sign_ins`
+* from the `sessions` module, which only the service role may call). Users that
+* don't exist are missing from the map.
+*/
+function lastSignIns(sql, userIds) {
+	return AsyncResult.from(async () => {
+		const invalid = userIds.find((userId) => !UUID$1.test(userId));
+		if (invalid !== void 0) return err(invalidUser(invalid));
+		if (userIds.length === 0) return ok(/* @__PURE__ */ new Map());
+		try {
+			const rows = await sql.queryRaw(LAST_SIGN_INS, [[...new Set(userIds)]]);
+			return ok(new Map(rows.map((row) => [row.user_id, {
+				userId: row.user_id,
+				lastSignInAt: row.last_sign_in_at === null ? null : temporal().Instant.from(row.last_sign_in_at instanceof Date ? row.last_sign_in_at.toISOString() : row.last_sign_in_at)
+			}])));
+		} catch (cause) {
+			return err(fromSqlError(cause));
+		}
+	});
+}
+async function ban(client, userId, duration) {
+	try {
+		const { error } = await client.auth.admin.updateUserById(userId, { ban_duration: duration });
+		return error ? fromAuthError(error) : void 0;
+	} catch (cause) {
+		return fromAuthError(cause);
+	}
+}
+function suspendAccount(service, sql, userId, options) {
+	return AsyncResult.from(async () => {
+		if (!UUID$1.test(userId)) return err(invalidUser(userId));
+		const client = typeof service === "function" ? service() : service;
+		const { suspended } = options;
+		if (suspended) {
+			const refused = await ban(client, userId, options.duration ?? FOREVER);
+			if (refused) return err(refused);
+			if (options.endSessions !== true) return ok({
+				userId,
+				suspended,
+				ended: 0
+			});
+		}
+		let ended;
+		try {
+			ended = await deleteSessions(sql, userId);
+		} catch (cause) {
+			return err(fromSqlError(cause));
+		}
+		if (!suspended) {
+			const refused = await ban(client, userId, "none");
+			if (refused) return err(refused);
+		}
+		return ok({
+			userId,
+			suspended,
+			ended
+		});
+	});
+}
+//#endregion
+//#region src/server/audit.ts
+/** The CloudEvents `source` of the events the server sends to its `audit` sink. */
+const SERVER_EVENT_SOURCE = "/better-supabase/server";
+const OFF = { account: () => void 0 };
+/**
+* The server's audit trail: account actions are sent to `sink` as CloudEvents
+* typed `dev.better-supabase.account.*` with subject `users/<id>`, and
+* `support.denied` block events are forwarded to it.
+*/
+function serverAudit(betterSupabase, sink) {
+	if (sink === void 0) return OFF;
+	const { events } = betterSupabase;
+	forwardBlockEvents(betterSupabase, sink, {
+		source: SERVER_EVENT_SOURCE,
+		types: ["support.denied"]
+	});
+	const report = (cause) => {
+		events.logger.error("audit sink failed", { cause });
+	};
+	return { account(type, userId, data) {
+		const event = {
+			specversion: "1.0",
+			id: crypto.randomUUID(),
+			source: SERVER_EVENT_SOURCE,
+			type: `${DEFAULT_TYPE_PREFIX}.${type}`,
+			subject: `users/${userId}`,
+			time: (/* @__PURE__ */ new Date()).toISOString(),
+			datacontenttype: "application/json",
+			data: {
+				userId,
+				...data
+			}
+		};
+		try {
+			events.track(Promise.resolve(sink.send([event])).catch(report));
+		} catch (cause) {
+			report(cause);
+		}
+	} };
+}
+//#endregion
+//#region src/core/contracts/authorization-hooks.ts
+/** Types `hooks` and freezes it; better-supabase never mutates a provider. */
+function defineAuthorizationHooks(hooks) {
+	return Object.freeze(hooks);
+}
+/** The error for hooks built for another API version, or `undefined` for version 1. */
+function hooksApiProblem(hooks) {
+	if (hooks.apiVersion === 1) return;
+	return `authorization hooks "${typeof hooks.name === "string" ? hooks.name : "provider"}" target API ${String(hooks.apiVersion)}; this better-supabase supports 1.`;
+}
+//#endregion
+//#region src/server/clients.ts
+const STATELESS = {
+	persistSession: false,
+	autoRefreshToken: false,
+	detectSessionInUrl: false
+};
+/**
+* The Supabase and PostgREST clients of one server: shared service and anon
+* clients, per-request user clients.
+*/
+function createClients(input) {
+	const { options, env, definitionExecutor, lite, createClient } = input;
+	let adminClient;
+	let anonClient;
+	const secretKey = () => {
+		const key = env().secretKey;
+		if (!key) throw new TypeError("admin() needs SUPABASE_SECRET_KEY; it is not set");
+		return key;
+	};
+	const customFetch = options.fetch ? { fetch: options.fetch } : void 0;
+	const urlLengthLimit = options.db?.urlLengthLimit ?? definitionExecutor.urlLengthLimit;
+	const db = {
+		...options.db?.timeout === void 0 ? {} : { timeout: options.db.timeout },
+		...options.db?.retry === void 0 ? {} : { retry: options.db.retry },
+		...urlLengthLimit === void 0 ? {} : { urlLengthLimit }
+	};
+	const dbOptions = Object.keys(db).length > 0 ? { db } : {};
+	const sharedGlobal = {
+		...customFetch ? { global: customFetch } : {},
+		...dbOptions
+	};
+	/**
+	* Postgrest-js options a bare `PostgrestClient` takes; `timeout` is the
+	* executor's.
+	*/
+	const restOptions = {
+		...db.retry === void 0 ? {} : { retry: db.retry },
+		...urlLengthLimit === void 0 ? {} : { urlLengthLimit }
+	};
+	const rpcUnavailable = lite?.rpcUnavailable;
+	const executorOptions = {
+		...definitionExecutor,
+		...urlLengthLimit === void 0 ? {} : { urlLengthLimit },
+		...db.timeout === void 0 ? {} : { timeout: db.timeout },
+		...db.retry === void 0 ? {} : { retry: db.retry },
+		...rpcUnavailable === void 0 ? {} : { rpcUnavailable }
+	};
+	/** Set when `db` options or the backend need an executor built with them. */
+	const tunedExecutor = options.db !== void 0 || rpcUnavailable !== void 0;
+	const serviceClient = () => {
+		adminClient ??= createClient(env().url, secretKey(), {
+			auth: STATELESS,
+			...sharedGlobal
+		});
+		return adminClient;
+	};
+	const readUrl = () => options.readUrl === false ? void 0 : options.readUrl?.replace(/\/+$/, "") ?? env().readUrl;
+	const apiKeyClient = () => {
+		throw new TypeError("ctx.supabase and ctx.db.$client are not available for an API key: ctx.db and ctx.sql run over direct Postgres with the key's claims");
+	};
+	/** Clients for the primary share the service and anon clients; others don't. */
+	const supabaseAt = (url, auth, headers = {}) => {
+		const custom = Object.keys(headers).length > 0;
+		const global = custom ? {
+			global: {
+				headers,
+				...customFetch
+			},
+			...dbOptions
+		} : sharedGlobal;
+		const shared = !custom && url === env().url;
+		switch (auth.kind) {
+			case "user": return createClient(url, env().publishableKey, {
+				accessToken: () => Promise.resolve(auth.token),
+				...global
+			});
+			case "service": return shared ? serviceClient() : createClient(url, secretKey(), {
+				auth: STATELESS,
+				...global
+			});
+			case "anon":
+			case "invalid":
+				if (!shared) return createClient(url, env().publishableKey, {
+					auth: STATELESS,
+					...global
+				});
+				anonClient ??= createClient(url, env().publishableKey, {
+					auth: STATELESS,
+					...sharedGlobal
+				});
+				return anonClient;
+			case "apiKey": return apiKeyClient();
+			default: return auth;
+		}
+	};
+	const supabaseFor = (auth, headers = {}) => supabaseAt(env().url, auth, headers);
+	const restUrls = /* @__PURE__ */ new Map();
+	const restUrl = (url) => {
+		let rest = restUrls.get(url);
+		if (rest === void 0) {
+			rest = new URL("rest/v1", url.endsWith("/") ? url : `${url}/`).href;
+			restUrls.set(url, rest);
+		}
+		return rest;
+	};
+	/**
+	* The client queries run on. Requests need only PostgREST, so they skip
+	* building Realtime, Storage and Auth clients per request; the shared service
+	* and anon clients for the primary are built once anyway.
+	*/
+	const restAt = (url, auth, headers = {}) => {
+		let key;
+		let bearer;
+		switch (auth.kind) {
+			case "user":
+				key = env().publishableKey;
+				bearer = auth.token;
+				break;
+			case "service":
+			case "anon":
+			case "invalid":
+				if (Object.keys(headers).length === 0 && url === env().url) return supabaseAt(url, auth, headers);
+				key = auth.kind === "service" ? secretKey() : env().publishableKey;
+				bearer = key;
+				break;
+			case "apiKey": return apiKeyClient();
+			default: return auth;
+		}
+		return new PostgrestClient(restUrl(url), {
+			headers: {
+				...headers,
+				apikey: key,
+				Authorization: `Bearer ${bearer}`
+			},
+			...customFetch,
+			...restOptions
+		});
+	};
+	return {
+		executorOptions,
+		tunedExecutor,
+		serviceClient,
+		readUrl,
+		apiKeyClient,
+		supabaseFor,
+		restAt
+	};
+}
+//#endregion
+//#region src/server/entries/core.ts
+const cores = /* @__PURE__ */ new WeakMap();
+/** Records the core behind `server`, so `serverCore` finds it on copies too. */
+function registerCore(server, core) {
+	cores.set(server, core);
+}
+/**
+* Copies the registration from `from` to `to` (`extendServer` builds a new
+* object).
+*/
+function shareCore(from, to) {
+	const core = cores.get(from);
+	if (core) cores.set(to, core);
+}
+/** The core of a server built by `createServer` or one of the adapter factories. */
+function serverCore(server) {
+	const core = cores.get(server);
+	if (!core) throw new TypeError("better-supabase: this server was not built by createServer(); pass the definition or a server from createServer");
+	return core;
+}
+const CALL = Symbol("better-supabase.call");
+const supportLookups = /* @__PURE__ */ new WeakMap();
+/**
+* Starts the support lookup for a signed-in caller, so `withTenant` can run the
+* tenant resolver while the support store answers. Other callers never have a
+* support session, so they skip it.
+*/
+function startSupportLookup(core, request, session) {
+	if (session.auth.kind !== "user" || supportLookups.has(session)) return;
+	const lookup = core.support(request, session.auth);
+	lookup.catch(() => void 0);
+	supportLookups.set(session, lookup);
+}
+/**
+* The support session of a resolved request: the started lookup, else a new
+* one.
+*/
+function supportLookup(core, request, session) {
+	return supportLookups.get(session) ?? core.support(request, session.auth);
+}
+/** The call state on a context seeded by `server.context()`, if any. */
+function callOf(ctx) {
+	return ctx[CALL];
+}
+//#endregion
+//#region src/server/entries/context.ts
+/**
+* Entry contributing `ctx.bs`, the request's `ServerContext`: `auth`, `db`,
+* `sql`, `supabase`, `replica`, `stats()` and the rest, each built on first
+* read. In a support session `auth`, `db` and `sql` are the target's.
+*/
+function withServerContext(core) {
+	return defineMiddleware({
+		key: "bs",
+		run: () => (request, ctx) => {
+			const options = callOf(ctx)?.options ?? {};
+			const bs = core.context(ctx.session, request, ctx.support ? {
+				...options,
+				support: ctx.support
+			} : options, ctx.tenant);
+			return Promise.resolve({ bs });
+		}
+	})();
+}
+//#endregion
+//#region src/server/refresh.ts
+/** A router or browser prefetch, by its request headers. */
+function isPrefetch(request) {
+	const h = request.headers;
+	return h.has("next-router-prefetch") || h.get("purpose") === "prefetch" || (h.get("sec-purpose")?.includes("prefetch") ?? false);
+}
+const FORM_TYPES = ["application/x-www-form-urlencoded", "multipart/form-data"];
+/**
+* Whether a request should refresh an expired session cookie: page loads,
+* client navigations (`rsc`, `x-sveltekit-*`, `_data` loaders), form posts and
+* Server Actions. Prefetches, assets and `fetch` calls from scripts read the
+* session as it is, so a burst of parallel requests never races on the
+* single-use refresh token.
+*/
+function shouldRefresh(request) {
+	const h = request.headers;
+	if (request.method !== "GET" && request.method !== "HEAD") {
+		if (h.has("next-action") || h.has("x-sveltekit-action")) return true;
+		if (h.get("sec-fetch-dest") === "document") return true;
+		const type = h.get("content-type") ?? "";
+		return FORM_TYPES.some((form) => type.startsWith(form));
+	}
+	if (isPrefetch(request)) return false;
+	if (h.get("rsc") === "1") return true;
+	const dest = h.get("sec-fetch-dest");
+	if (dest) return dest === "document";
+	return h.get("accept")?.includes("text/html") ?? false;
+}
+/**
+* Whether a request should ask the Auth server if the session still exists
+* (`checkSession`): full page loads, and `paths` you list for client
+* navigations. Never prefetches or mutations.
+*/
+function shouldCheckSession(request, paths) {
+	if (request.method !== "GET" && request.method !== "HEAD") return false;
+	if (isPrefetch(request)) return false;
+	if (request.headers.get("sec-fetch-dest") === "document") return true;
+	return paths?.includes(new URL(request.url).pathname) ?? false;
+}
+/** `policy` for one request. */
+function refreshFor(policy, request) {
+	if (policy === void 0 || typeof policy === "boolean") return policy;
+	return policy === "navigation" ? shouldRefresh(request) : policy(request);
+}
+//#endregion
+//#region src/server/entries/session.ts
+function checkFor(policy, request) {
+	if (policy === void 0 || typeof policy === "boolean") return policy ?? false;
+	return policy === "navigation" ? shouldCheckSession(request) : policy(request);
+}
+/**
+* Runs `hook` for a resolution with an outage and returns its response when the
+* session couldn't be kept.
+*/
+async function outageResponse(hook, resolution, request, logger) {
+	const outage = resolution.outage;
+	if (!hook || !outage) return;
+	try {
+		const response = await hook(outage, request);
+		return outage.kept || !(response instanceof Response) ? void 0 : response;
+	} catch (cause) {
+		logger.warn("onAuthOutage threw", { cause });
+		return;
+	}
+}
+/**
+* Appends `Max-Age=0` writes for the session cookie at the old scopes, and the
+* no-store headers.
+*/
+function clearOldScopes(response, request, name, scopes) {
+	const writes = clearSessionAtScopes(parseCookies(request.headers.get("cookie")), name, scopes);
+	if (writes.length === 0) return response;
+	const headers = new Headers(response.headers);
+	for (const write of writes) headers.append("set-cookie", serializeCookie(write));
+	for (const [key, value] of Object.entries(AUTH_CACHE_HEADERS)) headers.set(key, value);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+/**
+* Entry contributing `ctx.session`, the request's `AuthResolution`: a bearer
+* token first, the session cookie second. It is the only entry with a response
+* seam for cookies: on the way out it adds the refreshed session cookies and
+* the no-store headers, and hands pending event sends to `waitUntil`.
+*/
+function withSession(core, config = {}) {
+	return defineMiddleware({
+		key: "session",
+		run: () => async function* run(request, ctx) {
+			const call = callOf(ctx)?.options;
+			const refresh = call ? call.refresh ?? false : refreshFor(config.refresh, request);
+			const cookies = call ? call.cookies : config.cookies;
+			const checkSession = !call && checkFor(config.checkSession, request);
+			const session = await core.resolve(request, {
+				...refresh === void 0 ? {} : { refresh },
+				...cookies === void 0 ? {} : { cookies },
+				...checkSession ? { checkSession } : {},
+				...config.encode === void 0 ? {} : { encode: config.encode }
+			});
+			const outage = await outageResponse(config.onAuthOutage, session, request, core.events.logger);
+			if (outage) return session.apply(outage);
+			try {
+				const response = yield { session };
+				const applied = session.apply(response);
+				return config.cookieScopes?.length ? clearOldScopes(applied, request, core.sessionCookie(), config.cookieScopes) : applied;
+			} finally {
+				if (config.waitUntil && core.events.pending) config.waitUntil(core.events.settled());
+			}
+		}
+	})();
+}
+//#endregion
+//#region src/server/entries/support.ts
+/**
+* Entry contributing `ctx.support`: the support session ("view as user") the
+* request's support cookie names, when `ServerOptions.support` is set and the
+* caller is the admin who started it. `undefined` otherwise.
+*/
+function withSupport(core) {
+	return defineMiddleware({
+		key: "support",
+		run: () => async (request, ctx) => {
+			return { support: callOf(ctx)?.options.support ?? await supportLookup(core, request, ctx.session) };
+		}
+	})();
+}
+//#endregion
+//#region src/server/entries/tenant.ts
+/**
+* Entry contributing `ctx.tenant`: the active tenant from
+* `ServerOptions.tenant` (a URL slug, a header), or `undefined`. It becomes
+* `context.tenant` for the `tenant()` plugin, the `better_supabase.tenant`
+* setting over Postgres and the `x-bs-tenant` header over PostgREST. It starts
+* the support lookup that `withSupport` awaits, so both run at once.
+*/
+function withTenant(core) {
+	return defineMiddleware({
+		key: "tenant",
+		run: () => async (request, ctx) => {
+			const options = callOf(ctx)?.options;
+			if (options?.support === void 0) startSupportLookup(core, request, ctx.session);
+			return { tenant: options?.tenant ?? await core.tenant(request, ctx.session.auth) };
+		}
+	})();
+}
+//#endregion
+//#region src/server/lite.ts
+/** Lite's default driver, the one `lite init` scaffolds. */
+const DEFAULT_LITE_DRIVER = "sqlite-postgres";
+/**
+* Whether the driver stores data in SQLite, where Lite has no database
+* functions.
+*/
+function isSqliteDriver(driver) {
+	switch (driver) {
+		case "sqlite-postgres":
+		case "sqlite": return true;
+		case "pglite":
+		case "postgres": return false;
+		default: return driver;
+	}
+}
+function liteRpcUnavailable(driver) {
+	return `rpc() is not available on Supabase Lite with the ${driver} driver. Set [db] driver = "pglite" or "postgres" in supabase/config.toml, or call an HTTP endpoint instead.`;
+}
+/** What `backend: "lite"` changes in `createServer`; `undefined` for Supabase. */
+function liteBackend(options, env) {
+	if (options.backend !== "lite") return;
+	const driver = options.liteDriver ?? DEFAULT_LITE_DRIVER;
+	if (options.postgres && driver !== "postgres") throw new TypeError(`Supabase Lite with the ${driver} driver has no Postgres connection for ctx.sql. Remove the postgres option, or run Lite with [db] driver = "postgres".`);
+	return {
+		auth() {
+			if (options.auth?.jwtSecret !== void 0) return options.auth;
+			const jwtSecret = env().jwtSecret;
+			if (jwtSecret === void 0) throw new TypeError("backend: \"lite\" needs SUPABASE_JWT_SECRET, the auth.jwt_secret Supabase Lite signs user tokens with");
+			return {
+				...options.auth,
+				jwtSecret
+			};
+		},
+		rpcUnavailable: isSqliteDriver(driver) ? liteRpcUnavailable(driver) : void 0
+	};
+}
+//#endregion
+//#region src/server/refusing-executor.ts
+/**
+* An executor for credentials that did not verify: every query, function call
+* and batch answers `error`, so a handler that skips the route guard gets a 401
+* `Result` and never queries as anon.
+*/
+function refusingExecutor(error) {
+	const refuse = () => err(error);
+	return {
+		name: "refused",
+		functionSources: true,
+		execute: () => Promise.resolve(refuse()),
+		rpc: () => Promise.resolve(refuse()),
+		batch: (ops) => Promise.resolve(ops.map(() => refuse()))
+	};
+}
+//#endregion
+//#region src/server/request-ids.ts
+const REQUEST_ID_PATTERN = /^[A-Za-z0-9._:;,@/+=-]{1,128}$/;
+function requestIdOrUndefined(value) {
+	return typeof value === "string" && REQUEST_ID_PATTERN.test(value) ? value : void 0;
+}
+function sessionWith(ids, tenant, readOnly = false) {
+	const settings = {
+		...ids.requestId === void 0 ? {} : { "better_supabase.request_id": ids.requestId },
+		...ids.correlationId === void 0 ? {} : { "better_supabase.correlation_id": ids.correlationId },
+		...tenant === void 0 ? {} : { "better_supabase.tenant": tenant }
+	};
+	const hasSettings = Object.keys(settings).length > 0;
+	if (!hasSettings && !readOnly) return;
+	return {
+		...readOnly ? { readOnly: true } : {},
+		...hasSettings ? { settings } : {}
+	};
+}
+function requestIdPolicy(options = {}) {
+	const on = options !== false;
+	const settings = on ? options : {};
+	const requestHeader = (settings.requestHeader ?? "x-request-id").toLowerCase();
+	const correlationHeader = (settings.correlationHeader ?? "x-correlation-id").toLowerCase();
+	const incoming = on && (settings.incoming ?? true);
+	const generate = on && (settings.generate ?? true);
+	const generated = /* @__PURE__ */ new WeakMap();
+	const fromHeader = (request, name) => incoming && request ? requestIdOrUndefined(request.headers.get(name)) : void 0;
+	const generatedFor = (request) => {
+		if (!generate || !request) return;
+		const known = generated.get(request);
+		if (known !== void 0) return known;
+		const id = crypto.randomUUID();
+		generated.set(request, id);
+		return id;
+	};
+	return {
+		forRequest(request, explicit) {
+			const requestId = requestIdOrUndefined(explicit.requestId) ?? fromHeader(request, requestHeader) ?? generatedFor(request);
+			const correlationId = requestIdOrUndefined(explicit.correlationId) ?? fromHeader(request, correlationHeader) ?? requestId;
+			return {
+				...requestId === void 0 ? {} : { requestId },
+				...correlationId === void 0 ? {} : { correlationId }
+			};
+		},
+		headers: (ids) => ({
+			...ids.requestId === void 0 ? {} : { [requestHeader]: ids.requestId },
+			...ids.correlationId === void 0 ? {} : { [correlationHeader]: ids.correlationId }
+		})
+	};
+}
+//#endregion
+//#region src/server/server-types.ts
+/** The header `current_tenant_id()` reads over the Data API. */
+const TENANT_HEADER = "x-bs-tenant";
+//#endregion
+//#region src/auth/support-cookie.ts
+/** The cookie that carries the support session id. */
+const SUPPORT_COOKIE = "bs-support";
+/**
+* Seconds until the session expires, rounded up so the cookie never outlives it
+* by less than a second.
+*/
+function supportCookieMaxAge(session, now = Date.now()) {
+	return Math.max(0, Math.ceil((session.expiresAt.epochMilliseconds - now) / 1e3));
+}
+/**
+* `Set-Cookie` for a session: HttpOnly, SameSite=Lax, gone when the session
+* expires.
+*/
+function supportCookie(session, options = {}, now = Date.now()) {
+	return cookieLine(options, encodeURIComponent(session.id), supportCookieMaxAge(session, now));
+}
+/** `Set-Cookie` that removes the support cookie. */
+function clearSupportCookie(options = {}) {
+	return cookieLine(options, "", 0);
+}
+function cookieLine(options, value, maxAge) {
+	return [
+		`${options.name ?? "bs-support"}=${value}`,
+		`Path=${options.path ?? "/"}`,
+		`Max-Age=${String(maxAge)}`,
+		"HttpOnly",
+		"SameSite=Lax",
+		...options.secure === false ? [] : ["Secure"]
+	].join("; ");
+}
+/** The support session id in a `Cookie` header, or `undefined`. */
+function supportCookieValue(cookieHeader, name = SUPPORT_COOKIE) {
+	if (!cookieHeader) return;
+	for (const part of cookieHeader.split(";")) {
+		const index = part.indexOf("=");
+		if (index === -1 || part.slice(0, index).trim() !== name) continue;
+		let value;
+		try {
+			value = decodeURIComponent(part.slice(index + 1).trim());
+		} catch {
+			return;
+		}
+		return value === "" ? void 0 : value;
+	}
+}
+//#endregion
+//#region src/server/support-off.ts
+const NOT_CONFIGURED = "Support sessions need createServer(betterSupabase, { support: supportSessions({ store }) })";
+const notConfigured = () => AsyncResult.err(dbError("unexpected", NOT_CONFIGURED));
+/** `bs.support` without `ServerOptions.support`: every call fails. */
+const supportOff = {
+	start: notConfigured,
+	request: notConfigured,
+	approve: notConfigured,
+	stop: notConfigured,
+	revoke: notConfigured,
+	current: () => Promise.resolve(void 0),
+	resolve: () => Promise.resolve(void 0),
+	list: notConfigured,
+	expire: notConfigured,
+	expireRoute: () => () => Promise.resolve(problemResponse(dbError("unexpected", NOT_CONFIGURED))),
+	sessionIdOf: () => void 0,
+	clearCookie: () => clearSupportCookie()
+};
+//#endregion
+//#region src/server/support-storage.ts
+const VISIBLE_OBJECT = "select exists (select 1 from storage.objects o where o.bucket_id = $1 and o.name = $2) as visible";
+const VISIBLE_OBJECTS = `select n.path from unnest($2::text[]) as n(path)
+where exists (select 1 from storage.objects o where o.bucket_id = $1 and o.name = n.path)`;
+const OBJECT_INFO = "select to_jsonb(o) as object from storage.objects o where o.bucket_id = $1 and o.name = $2";
+const SEARCH = `select s.name, s.id::text as id, s.updated_at, s.created_at, s.last_accessed_at, s.metadata
+from storage.search($1::text, $2::text, $3::int, $4::int, $5::int, $6::text, $7::text, $8::text) s`;
+const SEARCH_V2 = `select s.key, s.name, s.id::text as id, s.updated_at, s.created_at, s.last_accessed_at, s.metadata
+from storage.search_v2($1::text, $2::text, $3::int, $4::int, $5::text, $6::text, $7::text, $8::text) s`;
+const SAVEPOINT = "better_supabase_support_write";
+const INSERT_OBJECT = `insert into storage.objects (bucket_id, name, owner, owner_id, user_metadata)
+values ($1, $2, $3::uuid, $4, $5::jsonb)`;
+const CURRENT_VERSION_INDEX = `select exists (select 1 from pg_indexes
+where schemaname = 'storage' and tablename = 'objects' and indexname = 'idx_objects_current_version') as versioned`;
+const upsertObject = (versioned) => `${INSERT_OBJECT}
+on conflict ${versioned ? "(bucket_id, name collate \"C\") where archived_at is null" : "(bucket_id, name)"} do update
+set owner = excluded.owner, owner_id = excluded.owner_id, user_metadata = excluded.user_metadata`;
+const SOURCE_OBJECT = "select name, owner_id from storage.objects where bucket_id = $1 and name = $2";
+const MOVE_OBJECT = `update storage.objects
+set bucket_id = $3, name = $4, owner = $5::uuid, owner_id = $6
+where bucket_id = $1 and name = $2
+returning name`;
+const ALLOW_DELETE = "select set_config('storage.allow_delete_query', 'true', true)";
+const DELETE_OBJECTS = "delete from storage.objects where bucket_id = $1 and name = any($2::text[]) returning name";
+const OWN_UPLOAD = `update storage.objects set owner = $3::uuid, owner_id = $4
+where bucket_id = $1 and name = $2 and user_metadata ->> 'supportSessionId' = $5`;
+const OWN_COPY = `update storage.objects
+set owner = $3::uuid, owner_id = $4, user_metadata = coalesce(user_metadata, '{}'::jsonb) || $5::jsonb
+where bucket_id = $1 and name = $2 and owner_id is null`;
+const ownSignedUpload = (versioned) => `update storage.objects
+set owner = $3::uuid, owner_id = $4, user_metadata = coalesce(user_metadata, '{}'::jsonb) || $5::jsonb
+where bucket_id = $1 and name = $2 and owner_id is null and updated_at >= $6::timestamptz${versioned ? " and archived_at is null" : ""}
+returning name`;
+const signedUploadOwner = (versioned) => `select owner_id, updated_at >= $3::timestamptz as recent
+from storage.objects where bucket_id = $1 and name = $2${versioned ? " and archived_at is null" : ""}`;
+const OWN_MOVE = `update storage.objects
+set owner = $3::uuid, owner_id = $4, user_metadata = coalesce(user_metadata, '{}'::jsonb) || $5::jsonb
+where bucket_id = $1 and name = $2 and owner_id is not distinct from $6`;
+const UUID = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
+const STALE = {
+	name: "StorageApiError",
+	message: "The object was stored before the support session started",
+	status: 403,
+	statusCode: "403",
+	code: "AccessDenied"
+};
+const OWNED = {
+	name: "StorageApiError",
+	message: "The object belongs to another user",
+	status: 403,
+	statusCode: "403",
+	code: "AccessDenied"
+};
+const HIDDEN_URL = "Either the object does not exist or you do not have access to it";
+const LIST_SORT_COLUMNS = /* @__PURE__ */ new Set([
+	"name",
+	"updated_at",
+	"created_at",
+	"last_accessed_at"
+]);
+const LIST_V2_SORT_COLUMNS = /* @__PURE__ */ new Set([
+	"name",
+	"updated_at",
+	"created_at"
+]);
+const FLAT_SORT_COLUMNS = /* @__PURE__ */ new Set(["updated_at", "created_at"]);
+const SORT_ORDERS = /* @__PURE__ */ new Set(["asc", "desc"]);
+const CURSOR_PARTS = {
+	l: "startAfter",
+	o: "sortOrder",
+	c: "sortColumn",
+	a: "sortColumnAfter"
+};
+const isCursorKey = (key) => Object.hasOwn(CURSOR_PARTS, key);
+/**
+* The path storage-js sends for an upload: no leading or trailing `/`, and no
+* empty folders.
+*/
+function normalizePath(path) {
+	return path.replaceAll(/^\/|\/$/g, "").replaceAll(/\/+/g, "/");
+}
+/** `undefined` for an empty string, which storage-api treats as absent. */
+const filled = (value) => value === "" ? void 0 : value;
+/** `LIKE` escaping as storage-api applies it. */
+function escapeLike(text) {
+	return text.replaceAll("\\", "\\\\").replaceAll(/([%_])/g, "\\$1");
+}
+function iso(value) {
+	if (value instanceof Date) return value.toISOString();
+	if (typeof value !== "string") return value;
+	const time = Date.parse(value);
+	return Number.isNaN(time) ? value : new Date(time).toISOString();
+}
+/** Storage-api's continuation token: `key:value` lines, base64 encoded. */
+function encodeCursor(cursor) {
+	const text = Object.entries(CURSOR_PARTS).flatMap(([key, part]) => cursor[part] ? [`${key}:${cursor[part]}`] : []).join("\n");
+	let binary = "";
+	for (const byte of new TextEncoder().encode(text)) binary += String.fromCodePoint(byte);
+	return btoa(binary);
+}
+function decodeCursor(token) {
+	let text;
+	try {
+		text = new TextDecoder().decode(Uint8Array.from(atob(token), (char) => char.codePointAt(0) ?? 0));
+	} catch {
+		return;
+	}
+	const cursor = {
+		startAfter: "",
+		sortOrder: "asc"
+	};
+	for (const part of text.split("\n")) {
+		const match = /^(\S):(.*)/.exec(part);
+		const key = match?.[1];
+		if (!key || !isCursorKey(key)) return;
+		cursor[CURSOR_PARTS[key]] = match[2] ?? "";
+	}
+	return cursor;
+}
+const apiError = (status, message, code) => ({
+	name: "StorageApiError",
+	message,
+	status,
+	statusCode: String(status),
+	code
+});
+const ownerOf = (userId) => UUID.test(userId) ? userId : null;
+const stampOf = (session) => ({
+	supportSessionId: session.id,
+	supportAdminId: session.adminId
+});
+const failed = (error) => ({
+	data: null,
+	error
+});
+/**
+* Storage answers a hidden object like a missing one: HTTP 400 with
+* `statusCode` 404.
+*/
+const NOT_FOUND = {
+	name: "StorageApiError",
+	message: "Object not found",
+	status: 400,
+	statusCode: "404",
+	code: "NoSuchKey"
+};
+const invalid = (message) => apiError(400, message, "InvalidRequest");
+/**
+* A database failure as a Storage `error` that `fromStorageError` passes
+* through unchanged.
+*/
+function sqlFailure(cause) {
+	const raw = fromPgError(cause);
+	return {
+		name: "DbError",
+		...raw ? mapDbError(raw) : toDbError(cause)
+	};
+}
+/**
+* An RLS or duplicate failure of a dry run, as Storage reports it for the
+* target's own request.
+*/
+function refusedWrite(cause) {
+	const raw = fromPgError(cause);
+	if (raw?.code === "42501") return apiError(403, raw.message === void 0 || raw.message.includes("row-level security") ? "new row violates row-level security policy" : raw.message, "AccessDenied");
+	if (raw?.code === "23505") return apiError(409, "The resource already exists", "Duplicate");
+}
+async function settled(run) {
+	try {
+		return await run();
+	} catch (cause) {
+		return failed(sqlFailure(cause));
+	}
+}
+function listProblem(options) {
+	const { limit, offset, sortBy } = options;
+	if (limit !== void 0 && (!Number.isInteger(limit) || limit < 1)) return "body/limit must be an integer of at least 1";
+	if (offset !== void 0 && (!Number.isInteger(offset) || offset < 0)) return "body/offset must be an integer of at least 0";
+	if (sortBy?.column !== void 0 && !LIST_SORT_COLUMNS.has(sortBy.column)) return "body/sortBy/column must be name, updated_at, created_at or last_accessed_at";
+	if (sortBy?.order !== void 0 && !SORT_ORDERS.has(sortBy.order)) return "body/sortBy/order must be asc or desc";
+}
+function listV2Problem(options) {
+	const { limit, sortBy } = options;
+	if (limit !== void 0 && (!Number.isInteger(limit) || limit < 1)) return "body/limit must be an integer of at least 1";
+	if (sortBy !== void 0 && !LIST_V2_SORT_COLUMNS.has(sortBy.column)) return "body/sortBy/column must be name, updated_at or created_at";
+	if (sortBy?.order !== void 0 && !SORT_ORDERS.has(sortBy.order)) return "body/sortBy/order must be asc or desc";
+}
+/** The query storage-api runs for a `list-v2` page without a delimiter. */
+function flatPage(bucket, prefix, maxKeys, cursor, column, order) {
+	const values = [bucket, maxKeys];
+	const conditions = ["bucket_id = $1"];
+	const sortColumn = column && FLAT_SORT_COLUMNS.has(column) ? column : void 0;
+	const sortOrder = order && SORT_ORDERS.has(order) ? order : "asc";
+	const operator = sortOrder === "asc" ? ">" : "<";
+	const param = () => `$${String(values.length)}`;
+	if (prefix) {
+		values.push(`${escapeLike(prefix)}%`);
+		conditions.push(`name like ${param()}`);
+	}
+	const startAfter = cursor?.startAfter;
+	if (startAfter && sortColumn && cursor.sortColumnAfter) {
+		values.push(cursor.sortColumnAfter);
+		const afterParam = param();
+		values.push(startAfter);
+		conditions.push(`row(date_trunc('milliseconds', ${sortColumn}), name collate "C") ${operator} row(coalesce(nullif(${afterParam}, '')::timestamptz, 'epoch'::timestamptz), ${param()})`);
+	} else if (startAfter) {
+		values.push(startAfter);
+		conditions.push(`name collate "C" ${operator} ${param()}`);
+	}
+	return {
+		text: `select id::text as id, name, metadata, updated_at, created_at, last_accessed_at
+from storage.objects
+where ${conditions.join(" and ")}
+order by ${sortColumn ? `${sortColumn} ${sortOrder}, ` : ""}name collate "C" ${sortOrder}
+limit $2::int`,
+		values
+	};
+}
+/**
+* Groups the entries below the next delimiter into folders, as storage-api
+* does.
+*/
+function delimited(entries, prefix) {
+	const grouped = [];
+	let previous = "";
+	for (const entry of entries) {
+		const name = String(entry["name"]);
+		const index = name.replace(prefix, "").indexOf("/");
+		if (index === -1) {
+			grouped.push(entry);
+			continue;
+		}
+		const folder = name.slice(0, prefix.length + index + 1);
+		if (folder === previous) continue;
+		previous = folder;
+		grouped.push({
+			id: null,
+			name: folder
+		});
+	}
+	return grouped;
+}
+const text = (value) => typeof value === "string" ? value : void 0;
+const metadataOf = (value) => isRecord(value) ? value : null;
+function listEntryOf(row) {
+	return {
+		name: String(row["name"]),
+		id: text(row["id"]) ?? null,
+		updated_at: text(iso(row["updated_at"])) ?? null,
+		created_at: text(iso(row["created_at"])) ?? null,
+		last_accessed_at: text(iso(row["last_accessed_at"])) ?? null,
+		metadata: metadataOf(row["metadata"])
+	};
+}
+function folderOf(row) {
+	const name = String(row["name"]);
+	const key = text(row["key"]);
+	return {
+		name: name.endsWith("/") ? name : `${name}/`,
+		...key === void 0 ? {} : { key }
+	};
+}
+function objectOf(row) {
+	const key = text(row["key"]);
+	const lastAccessed = text(iso(row["last_accessed_at"]));
+	return {
+		name: String(row["name"]),
+		...key === void 0 ? {} : { key },
+		id: text(row["id"]) ?? "",
+		updated_at: text(iso(row["updated_at"])) ?? "",
+		created_at: text(iso(row["created_at"])) ?? "",
+		...lastAccessed === void 0 ? {} : { last_accessed_at: lastAccessed },
+		metadata: metadataOf(row["metadata"])
+	};
+}
+function infoOf(row) {
+	const metadata = isRecord(row["metadata"]) ? row["metadata"] : {};
+	const size = metadata["size"];
+	const contentType = text(metadata["mimetype"]);
+	const cacheControl = text(metadata["cacheControl"]);
+	const etag = text(metadata["eTag"]);
+	const lastModified = text(iso(row["updated_at"]));
+	const userMetadata = row["user_metadata"];
+	const archivedAt = row["archived_at"];
+	const deleteMarker = row["is_delete_marker"];
+	const versioned = row["is_versioned"];
+	return {
+		id: text(row["id"]) ?? "",
+		name: text(row["name"]) ?? "",
+		version: text(row["version"]) ?? "",
+		bucketId: text(row["bucket_id"]) ?? "",
+		createdAt: text(iso(row["created_at"])) ?? "",
+		...typeof size === "number" ? { size } : {},
+		...contentType === void 0 ? {} : { contentType },
+		...cacheControl === void 0 ? {} : { cacheControl },
+		...etag === void 0 ? {} : { etag },
+		...lastModified === void 0 ? {} : { lastModified },
+		...isRecord(userMetadata) ? { metadata: userMetadata } : {},
+		...archivedAt === void 0 ? {} : { archivedAt: text(iso(archivedAt)) ?? null },
+		...typeof deleteMarker === "boolean" ? { isDeleteMarker: deleteMarker } : {},
+		...typeof versioned === "boolean" ? { isVersioned: versioned } : {}
+	};
+}
+/**
+* Storage for a support session, with the same `from(bucket)` file API as
+* `supabase.storage`, so `bucket.connect()` and the blocks take it.
+*
+* Storage policies read `auth.uid()` from the request's token, and there is no
+* token for the target, so reads go through Postgres as the target. `exists`,
+* `info`, `list` and `listV2` run entirely there: the listings call the
+* invoker-rights `storage.search` functions storage-api calls, so RLS filters
+* each page as it would for the target's own request. `download` and the signed
+* URLs first check there that the target may see the object, then the service
+* client serves it. A hidden object answers like a missing one. `getPublicUrl`
+* is built without a check, as it is built without a request.
+*
+* In a writable session, `upload`, `update`, `remove`, `copy` and `move` first
+* run the row change Storage would make as the target, inside a savepoint that
+* is rolled back, so the policies on `storage.objects` decide as for the
+* target's own request. Then the service client writes, the admin connection
+* makes the target the owner of the stored object, and its `user_metadata`
+* records the session id and the admin's id. A refused dry run resolves to
+* Storage's `403`.
+*
+* `createSignedUploadUrl` runs the same dry run as `upload` before the service
+* client signs the URL. The object a browser uploads there has no owner, so
+* `claimSignedUpload(bucket, path)` finishes the upload: it checks again that
+* the target may insert at the path, then makes the target the owner of an
+* object without one that was stored after `session.startedAt`, and stamps the
+* session on its `user_metadata`. An older object, or one another user owns, is
+* refused with a `403`. `uploadToSignedUrl` claims what it stores and removes
+* it when the claim fails. Every write in a read-only session resolves to a
+* `403` `SUPPORT_READ_ONLY` error, and without `adminSql`, `session` or a `sql`
+* client with `transaction` to a `403` `SUPPORT_STORAGE_WRITES` error.
+*/
+function supportStorage(options) {
+	const readOnly = options.readOnly ?? true;
+	const { adminSql, session, sql } = options;
+	const writer = !readOnly && adminSql && session && sql.transaction ? {
+		adminSql,
+		session
+	} : void 0;
+	const refusal = readOnly ? apiError(403, "The support session is read-only", "SUPPORT_READ_ONLY") : apiError(403, "Storage writes in a support session need adminSql, session and a sql client with transaction", "SUPPORT_STORAGE_WRITES");
+	const refuse = () => Promise.resolve(failed(refusal));
+	const rows = (query, values) => sql.queryRaw(query, values);
+	let versioned;
+	const isVersioned = () => versioned ??= rows(CURRENT_VERSION_INDEX, []).then(([row]) => row?.["versioned"] === true).catch((cause) => {
+		versioned = void 0;
+		throw cause;
+	});
+	const upsertStatement = () => isVersioned().then(upsertObject);
+	const rehearse = async (run) => {
+		if (!sql.transaction) return refusal;
+		try {
+			return await sql.transaction(async (client) => {
+				await client.queryRaw(`savepoint ${SAVEPOINT}`);
+				try {
+					return await run(client);
+				} finally {
+					await client.queryRaw(`rollback to savepoint ${SAVEPOINT}`);
+				}
+			});
+		} catch (cause) {
+			const refused = refusedWrite(cause);
+			if (refused) return refused;
+			throw cause;
+		}
+	};
+	const rehearseStore = (bucket, active, name, statement, metadata) => rehearse(async (client) => {
+		await client.queryRaw(statement, [
+			bucket,
+			name,
+			ownerOf(active.targetUserId),
+			active.targetUserId,
+			JSON.stringify(metadata)
+		]);
+		return null;
+	});
+	const claimFor = async (bucket, { adminSql: ownerSql, session: active }, name) => {
+		const objectVersioned = await isVersioned();
+		const since = active.startedAt.toString();
+		const own = async () => {
+			const [claimed] = await ownerSql.queryRaw(ownSignedUpload(objectVersioned), [
+				bucket,
+				name,
+				ownerOf(active.targetUserId),
+				active.targetUserId,
+				JSON.stringify(stampOf(active)),
+				since
+			]);
+			return claimed !== void 0;
+		};
+		const inspect = async () => {
+			const [found] = await ownerSql.queryRaw(signedUploadOwner(objectVersioned), [
+				bucket,
+				name,
+				since
+			]);
+			return found;
+		};
+		if (await own()) return {
+			data: { path: name },
+			error: null
+		};
+		let found = await inspect();
+		if (found?.["owner_id"] === null && found["recent"] === true) {
+			if (await own()) return {
+				data: { path: name },
+				error: null
+			};
+			found = await inspect();
+		}
+		if (!found) return failed(NOT_FOUND);
+		if (found["owner_id"] === active.targetUserId) return {
+			data: { path: name },
+			error: null
+		};
+		return found["recent"] === true ? failed(OWNED) : failed(STALE);
+	};
+	const claimSignedUpload = (bucket, path) => {
+		if (!writer) return refuse();
+		return settled(async () => {
+			const name = normalizePath(path);
+			const active = writer.session;
+			const refused = await rehearse(async (client) => {
+				try {
+					await client.queryRaw(INSERT_OBJECT, [
+						bucket,
+						name,
+						ownerOf(active.targetUserId),
+						active.targetUserId,
+						JSON.stringify(stampOf(active))
+					]);
+				} catch (cause) {
+					if (fromPgError(cause)?.code === "23505") return null;
+					throw cause;
+				}
+				return NOT_FOUND;
+			});
+			if (refused) return failed(refused);
+			return claimFor(bucket, writer, name);
+		});
+	};
+	return {
+		claimSignedUpload,
+		from(bucket) {
+			const admin = () => options.admin.from(bucket);
+			const visible = async (path) => {
+				const [row] = await rows(VISIBLE_OBJECT, [bucket, path]);
+				return row?.["visible"] === true;
+			};
+			const checked = (path, read) => settled(async () => {
+				const name = normalizePath(path);
+				if (!await visible(name)) return failed(NOT_FOUND);
+				return read(name);
+			});
+			const list = (path, listOptions = {}) => settled(async () => {
+				const problem = listProblem(listOptions);
+				if (problem) return failed(invalid(problem));
+				let prefix = path ?? "";
+				if (prefix.length > 0 && !prefix.endsWith("/")) prefix = `${prefix}/`;
+				const column = listOptions.sortBy?.column ?? "name";
+				const escape = column !== "name";
+				const safePrefix = escape ? escapeLike(prefix) : prefix;
+				const search = listOptions.search ?? "";
+				const safeSearch = escape ? escapeLike(search) : search;
+				return {
+					data: (await rows(SEARCH, [
+						safePrefix,
+						bucket,
+						listOptions.limit ?? 100,
+						(safePrefix + safeSearch).split("/").length,
+						listOptions.offset ?? 0,
+						safeSearch,
+						column,
+						listOptions.sortBy?.order ?? "asc"
+					])).map(listEntryOf),
+					error: null
+				};
+			});
+			const listV2 = (listOptions = {}) => settled(async () => {
+				const problem = listV2Problem(listOptions);
+				if (problem) return failed(invalid(problem));
+				const limit = Math.min(listOptions.limit ?? 1e3, 1e3);
+				const prefix = listOptions.prefix ?? "";
+				const cursor = listOptions.cursor ? decodeCursor(listOptions.cursor) : void 0;
+				if (listOptions.cursor && !cursor) return failed(apiError(400, "Invalid continuation token", "InvalidParameter"));
+				const sortOrder = filled(cursor?.sortOrder) ?? listOptions.sortBy?.order;
+				const sortColumn = filled(cursor?.sortColumn) ?? listOptions.sortBy?.column;
+				let found;
+				if (listOptions.with_delimiter) found = await rows(SEARCH_V2, [
+					prefix,
+					bucket,
+					limit + 1,
+					prefix ? prefix.split("/").length : 1,
+					cursor?.startAfter ?? "",
+					sortOrder ?? "asc",
+					sortColumn ?? "name",
+					filled(cursor?.sortColumnAfter) ?? null
+				]);
+				else {
+					const page = flatPage(bucket, listOptions.prefix, limit + 1, cursor, sortColumn, sortOrder);
+					found = await rows(page.text, page.values);
+				}
+				const entries = listOptions.with_delimiter ? delimited(found, prefix) : found;
+				const hasNext = entries.length > limit;
+				const count = hasNext ? limit : entries.length;
+				const folders = [];
+				const objects = [];
+				for (const entry of entries.slice(0, count)) if (entry["id"] === null || entry["id"] === void 0) folders.push(folderOf(entry));
+				else objects.push(objectOf(entry));
+				const last = entries[count - 1];
+				const after = last && sortColumn && sortColumn !== "name" ? iso(last[sortColumn]) : void 0;
+				const nextCursor = hasNext && last ? encodeCursor({
+					startAfter: String(last["name"]),
+					...sortOrder ? { sortOrder } : {},
+					...sortColumn ? { sortColumn } : {},
+					...typeof after === "string" ? { sortColumnAfter: new Date(after).toISOString() } : {}
+				}) : void 0;
+				return {
+					data: {
+						hasNext,
+						...nextCursor === void 0 ? {} : { nextCursor },
+						folders,
+						objects
+					},
+					error: null
+				};
+			});
+			const createSignedUploadUrl = (path, uploadOptions) => {
+				if (!writer) return refuse();
+				return settled(async () => {
+					const name = normalizePath(path);
+					const statement = uploadOptions?.upsert === true ? await upsertStatement() : INSERT_OBJECT;
+					const refused = await rehearseStore(bucket, writer.session, name, statement, stampOf(writer.session));
+					if (refused) return failed(refused);
+					return admin().createSignedUploadUrl(name, uploadOptions);
+				});
+			};
+			const uploadToSignedUrl = (path, token, body, fileOptions = {}) => {
+				if (!writer) return refuse();
+				return settled(async () => {
+					const name = normalizePath(path);
+					const metadata = {
+						...fileOptions.metadata,
+						...stampOf(writer.session)
+					};
+					const statement = fileOptions.upsert === true ? await upsertStatement() : INSERT_OBJECT;
+					const refused = await rehearseStore(bucket, writer.session, name, statement, metadata);
+					if (refused) return failed(refused);
+					const reply = await admin().uploadToSignedUrl(name, token, body, {
+						...fileOptions,
+						metadata
+					});
+					if (reply.error) return reply;
+					const claimed = await claimFor(bucket, writer, name).catch((cause) => failed(sqlFailure(cause)));
+					if (claimed.error) {
+						await admin().remove([name]);
+						return claimed;
+					}
+					return reply;
+				});
+			};
+			const store = (method) => (path, body, fileOptions = {}) => {
+				if (!writer) return refuse();
+				const { adminSql: ownerSql, session: active } = writer;
+				return settled(async () => {
+					const name = normalizePath(path);
+					const owner = ownerOf(active.targetUserId);
+					const metadata = {
+						...fileOptions.metadata,
+						...stampOf(active)
+					};
+					const statement = method === "update" || fileOptions.upsert === true ? await upsertStatement() : INSERT_OBJECT;
+					const refused = await rehearseStore(bucket, active, name, statement, metadata);
+					if (refused) return failed(refused);
+					const reply = await admin()[method](name, body, {
+						...fileOptions,
+						metadata
+					});
+					if (reply.error) return reply;
+					try {
+						await ownerSql.queryRaw(OWN_UPLOAD, [
+							bucket,
+							name,
+							owner,
+							active.targetUserId,
+							active.id
+						]);
+					} catch (cause) {
+						await admin().remove([name]);
+						return failed(sqlFailure(cause));
+					}
+					return reply;
+				});
+			};
+			const relocate = (method) => (from, to, destination = {}) => {
+				if (!writer) return refuse();
+				const { adminSql: ownerSql, session: active } = writer;
+				return settled(async () => {
+					const source = normalizePath(from);
+					const name = normalizePath(to);
+					const target = destination.destinationBucket ?? bucket;
+					const owner = ownerOf(active.targetUserId);
+					const stamp = JSON.stringify(stampOf(active));
+					let previousOwner = null;
+					const refused = await rehearse(async (client) => {
+						const [found] = await client.queryRaw(SOURCE_OBJECT, [bucket, source]);
+						if (!found) return NOT_FOUND;
+						previousOwner = text(found["owner_id"]) ?? null;
+						if (method === "copy") {
+							await client.queryRaw(INSERT_OBJECT, [
+								target,
+								name,
+								owner,
+								active.targetUserId,
+								stamp
+							]);
+							return null;
+						}
+						const [moved] = await client.queryRaw(MOVE_OBJECT, [
+							bucket,
+							source,
+							target,
+							name,
+							owner,
+							active.targetUserId
+						]);
+						return moved ? null : NOT_FOUND;
+					});
+					if (refused) return failed(refused);
+					const reply = await admin()[method](source, name, destination);
+					if (reply.error) return reply;
+					try {
+						await (method === "copy" ? ownerSql.queryRaw(OWN_COPY, [
+							target,
+							name,
+							owner,
+							active.targetUserId,
+							stamp
+						]) : ownerSql.queryRaw(OWN_MOVE, [
+							target,
+							name,
+							owner,
+							active.targetUserId,
+							stamp,
+							previousOwner
+						]));
+					} catch (cause) {
+						const written = options.admin.from(target);
+						await (method === "copy" ? written.remove([name]) : written.move(name, source, { destinationBucket: bucket }));
+						return failed(sqlFailure(cause));
+					}
+					return reply;
+				});
+			};
+			const remove = (paths) => {
+				if (!writer) return refuse();
+				return settled(async () => {
+					const entries = paths.map((entry) => typeof entry === "string" ? normalizePath(entry) : {
+						...entry,
+						path: normalizePath(entry.path)
+					});
+					const names = entries.map((entry) => typeof entry === "string" ? entry : entry.path);
+					const removable = /* @__PURE__ */ new Set();
+					const refused = await rehearse(async (client) => {
+						await client.queryRaw(ALLOW_DELETE);
+						const deleted = await client.queryRaw(DELETE_OBJECTS, [bucket, [...new Set(names)]]);
+						for (const row of deleted) removable.add(String(row["name"]));
+						return null;
+					});
+					if (refused) return failed(refused);
+					const permitted = entries.filter((_, index) => removable.has(names[index] ?? ""));
+					if (permitted.length === 0) return {
+						data: [],
+						error: null
+					};
+					return admin().remove(permitted);
+				});
+			};
+			return {
+				exists: (path) => settled(async () => ({
+					data: await visible(normalizePath(path)),
+					error: null
+				})).then((reply) => reply.error === null ? reply : {
+					data: false,
+					error: reply.error
+				}),
+				info: (path, infoOptions) => settled(async () => {
+					const versionId = infoOptions?.versionId;
+					const name = normalizePath(path);
+					const [row] = await rows(versionId === void 0 ? OBJECT_INFO : `${OBJECT_INFO} and o.version = $3`, versionId === void 0 ? [bucket, name] : [
+						bucket,
+						name,
+						versionId
+					]);
+					const object = row?.["object"];
+					return isRecord(object) ? {
+						data: infoOf(object),
+						error: null
+					} : failed(NOT_FOUND);
+				}),
+				download: (path, downloadOptions, parameters) => checked(path, (name) => admin().download(name, downloadOptions, parameters)),
+				createSignedUrl: (path, expiresIn, urlOptions) => checked(path, (name) => admin().createSignedUrl(name, expiresIn, urlOptions)),
+				createSignedUrls: (paths, expiresIn, urlOptions) => settled(async () => {
+					const names = paths.map(normalizePath);
+					const seen = new Set((await rows(VISIBLE_OBJECTS, [bucket, names])).map((row) => String(row["path"])));
+					const shown = [...new Set(names.filter((name) => seen.has(name)))];
+					const signed = /* @__PURE__ */ new Map();
+					if (shown.length > 0) {
+						const reply = await admin().createSignedUrls(shown, expiresIn, urlOptions);
+						if (reply.error) return failed(reply.error);
+						for (const entry of reply.data) if (entry.path !== null) signed.set(entry.path, entry);
+					}
+					return {
+						data: names.map((name) => signed.get(name) ?? {
+							error: HIDDEN_URL,
+							path: name,
+							signedUrl: null
+						}),
+						error: null
+					};
+				}),
+				getPublicUrl: (path, urlOptions) => admin().getPublicUrl(path, urlOptions),
+				list,
+				listV2,
+				upload: store("upload"),
+				update: store("update"),
+				createSignedUploadUrl,
+				uploadToSignedUrl,
+				remove,
+				copy: relocate("copy"),
+				move: relocate("move"),
+				purgeCache: (path, cacheOptions, parameters) => writer ? checked(path, (name) => admin().purgeCache(name, cacheOptions, parameters)) : refuse()
+			};
+		}
+	};
+}
+//#endregion
+//#region src/server/server.ts
+/** The header `better_supabase.acting_member()` reads for a service caller. */
+const ACTOR_HEADER = "x-bs-actor";
+/** The environment as `getEnv` resolves it, one variable at a time. */
+const RUNTIME_ENV = new Proxy({}, { get: (_target, key) => typeof key === "string" ? getEnv(key) : void 0 });
+/**
+* `options.env` as given when it is loaded already, parsed when it is a
+* variable map (never merged with the runtime's), else the runtime's.
+*/
+function envOf(env) {
+	if (env === void 0) return loadEnv(RUNTIME_ENV);
+	return isLoadedEnv(env) ? env : loadEnv(env);
+}
+/**
+* An `EnvSource` holds only strings, so a `URL` in `jwksUrl` means a loaded
+* env.
+*/
+function isLoadedEnv(env) {
+	return env.jwksUrl instanceof URL;
+}
+const needsPostgres = (method) => dbError("invalid_request", `${method} needs createServer(betterSupabase, { postgres: createPostgres() })`);
+/**
+* A framework adapter's server: `server` plus the adapter's own methods,
+* without reading the lazy `env` getter. `extra` can't replace a `BetterServer`
+* method.
+*/
+function extendServer(server, extra) {
+	const extended = Object.defineProperties({}, {
+		...Object.getOwnPropertyDescriptors(server),
+		...Object.getOwnPropertyDescriptors(extra)
+	});
+	shareCore(server, extended);
+	return extended;
+}
+/**
+* Server-side entry point for APIs, jobs, MCP servers and framework adapters.
+* Holds the secrets; `betterSupabase` stays isomorphic.
+*/
+function createServer(betterSupabase, options = {}) {
+	const credentials = options.credentials === void 0 ? {} : { credentials: credentialProviderOf(options.credentials) };
+	let loaded;
+	const env = () => loaded ??= envOf(options.env);
+	const lite = liteBackend(options, env);
+	if (lite === void 0 && (options.prefetchJwks ?? defaultPrefetchJwks()) && options.auth?.jwks === void 0) try {
+		prefetchJwks({
+			...options.auth,
+			env: env()
+		});
+	} catch {}
+	const { executorOptions, tunedExecutor, serviceClient, readUrl, apiKeyClient, supabaseFor, restAt } = createClients({
+		options,
+		env,
+		definitionExecutor: betterSupabase.executorOptions(),
+		lite,
+		createClient
+	});
+	/** `$client` stays the full Supabase client, built when first read. */
+	const withLazyClient = (db, client) => Object.defineProperty(db, "$client", {
+		get: client,
+		enumerable: true,
+		configurable: true
+	});
+	const dbFor = (auth, context = {}) => {
+		let supabase;
+		const rest = restAt(env().url, auth);
+		const storage = { from: (bucket) => (supabase ??= supabaseFor(auth)).storage.from(bucket) };
+		const db = betterSupabase.connect(rest, {
+			...authContext(auth),
+			...context
+		}, auth.kind === "invalid" ? {
+			executor: refusingExecutor(auth.error),
+			storage
+		} : tunedExecutor ? {
+			executor: postgrestExecutor(rest, executorOptions),
+			storage
+		} : { storage });
+		return withLazyClient(db, () => supabase ??= supabaseFor(auth));
+	};
+	const sqlFor = (claims, context, stats, session, storage) => {
+		if (!options.postgres) throw new TypeError("Direct Postgres access needs createServer(betterSupabase, { postgres: createPostgres() })");
+		return betterSupabase.connect(session ? options.postgres.executorFor(claims, session) : options.postgres.executorFor(claims), context, {
+			...stats ? { stats } : {},
+			...storage ? { storage } : {}
+		});
+	};
+	/** `ServerOptions.tenant` outside `context()`, where it can't be awaited. */
+	const syncTenant = (request, auth) => {
+		const tenant = options.tenant?.(request, auth);
+		if (tenant !== void 0 && typeof tenant !== "string") throw new TypeError("ServerOptions.tenant returned a promise: use context(request), or pass { tenant } to contextFromResolution");
+		return tenant;
+	};
+	const pinMs = options.replicas?.pinMs ?? 5e3;
+	const idPolicy = requestIdPolicy(options.requestIds);
+	if (options.support && !options.postgres) throw new TypeError("Support sessions need createServer(betterSupabase, { postgres: createPostgres(), support })");
+	const hooksProblem = options.authorization === void 0 ? void 0 : hooksApiProblem(options.authorization);
+	if (hooksProblem !== void 0) throw new TypeError(hooksProblem);
+	const audit = serverAudit(betterSupabase, options.audit);
+	const support = options.support ? options.support.create(betterSupabase.events, options.auth?.claims ?? betterSupabase.claimsSchema, betterSupabase.temporal, options.authorization) : supportOff;
+	/**
+	* The target's context in a support session. Queries run over direct Postgres
+	* with the target's claims plus `act`, read-only unless the session allows
+	* writes; nothing reaches Supabase with the admin's token.
+	*/
+	const supportContextFor = (resolution, active, parent, tenant, ids) => {
+		const { session, claims } = active;
+		const record = (key) => {
+			const value = claims[key];
+			return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : void 0;
+		};
+		const appMetadata = record("app_metadata");
+		const userMetadata = record("user_metadata");
+		const user = {
+			id: session.targetUserId,
+			role: typeof claims["role"] === "string" ? claims["role"] : "authenticated",
+			...typeof claims["email"] === "string" ? { email: claims["email"] } : {},
+			...appMetadata ? { appMetadata } : {},
+			...userMetadata ? { userMetadata } : {}
+		};
+		const auth = {
+			kind: "user",
+			token: "",
+			claims,
+			user,
+			source: "support",
+			expiresAt: Math.floor(session.expiresAt.epochMilliseconds / 1e3)
+		};
+		const scope = tenant ?? session.tenant;
+		const base = userContext(user, claims);
+		const context = scope === void 0 ? base : {
+			...base,
+			tenant: scope
+		};
+		const sessionOptions = sessionWith(ids, scope, session.readOnly);
+		const recorder = new StatsRecorder(parent);
+		const sqlClaims = claims;
+		const unavailable = () => {
+			throw new TypeError("ctx.supabase and ctx.db.$client are not available in a support session; ctx.db and ctx.sql run as the target");
+		};
+		let db;
+		let sql;
+		let storage;
+		const targetStorage = () => {
+			const postgres = options.postgres;
+			if (!postgres) throw new TypeError("Support sessions need createServer(betterSupabase, { postgres: createPostgres(), support })");
+			let asTarget;
+			const target = () => asTarget ??= postgres.asUser(sqlClaims, sessionOptions);
+			storage ??= supportStorage({
+				admin: { from: (bucket) => serviceClient().storage.from(bucket) },
+				sql: {
+					queryRaw: (text, params) => target().queryRaw(text, params),
+					transaction: (fn) => target().transaction?.(fn) ?? Promise.reject(/* @__PURE__ */ new TypeError("The target's SQL client has no transaction"))
+				},
+				adminSql: postgres.admin,
+				session,
+				readOnly: session.readOnly
+			});
+			return storage;
+		};
+		return {
+			...credentials,
+			...ids,
+			auth,
+			resolution,
+			support: active,
+			get storage() {
+				return targetStorage();
+			},
+			get supabase() {
+				return unavailable();
+			},
+			get db() {
+				db ??= Object.defineProperty(sqlFor(sqlClaims, context, recorder, sessionOptions, targetStorage()), "$client", {
+					get: unavailable,
+					enumerable: true,
+					configurable: true
+				});
+				return db;
+			},
+			get sql() {
+				sql ??= sqlFor(sqlClaims, context, recorder, sessionOptions, targetStorage());
+				return sql;
+			},
+			replica: void 0,
+			stats: () => recorder.snapshot(),
+			apply: (response) => resolution.apply(response),
+			cookies: () => resolution.cookies
+		};
+	};
+	/**
+	* An API key's context. There is no JWT for PostgREST, so `ctx.db` and
+	* `ctx.sql` run over direct Postgres with the key's synthesized claims,
+	* scoped to its organization unless the tenant option names another.
+	*/
+	const apiKeyContextFor = (resolution, auth, parent, tenant, ids) => {
+		const scope = tenant ?? auth.organizationId;
+		const base = authContext(auth);
+		const context = scope === void 0 ? base : {
+			...base,
+			tenant: scope
+		};
+		const session = sessionWith(ids, scope);
+		const recorder = new StatsRecorder(parent);
+		let db;
+		let sql;
+		return {
+			...credentials,
+			...ids,
+			auth: resolution.auth,
+			resolution,
+			get supabase() {
+				return apiKeyClient();
+			},
+			get db() {
+				db ??= Object.defineProperty(sqlFor(auth.claims, context, recorder, session), "$client", {
+					get: apiKeyClient,
+					enumerable: true,
+					configurable: true
+				});
+				return db;
+			},
+			get sql() {
+				sql ??= sqlFor(auth.claims, context, recorder, session);
+				return sql;
+			},
+			replica: void 0,
+			stats: () => recorder.snapshot(),
+			apply: (response) => resolution.apply(response),
+			cookies: () => resolution.cookies
+		};
+	};
+	/**
+	* Clients and repositories are built on first access: most scopes use one of
+	* them.
+	*/
+	const contextFor = (resolution, requestHeaders, parent, until = 0, tenant, active, ids = {}) => {
+		if (active) return supportContextFor(resolution, active, parent, tenant, ids);
+		const { auth } = resolution;
+		if (auth.kind === "apiKey") return apiKeyContextFor(resolution, auth, parent, tenant, ids);
+		const context = tenant === void 0 ? authContext(auth) : {
+			...authContext(auth),
+			tenant
+		};
+		const clientHeaders = tenant === void 0 ? requestHeaders : {
+			...requestHeaders,
+			[TENANT_HEADER]: tenant
+		};
+		const headers = {
+			...idPolicy.headers(ids),
+			...clientHeaders
+		};
+		const sharesClient = auth.kind !== "user";
+		const session = sessionWith(ids, tenant);
+		const recorder = new StatsRecorder(parent);
+		let supabase;
+		let db;
+		let sql;
+		const sqlClaims = auth.kind === "user" ? auth.claims : auth.kind === "anon" ? { role: "anon" } : void 0;
+		const client = () => supabase ??= supabaseFor(auth, sharesClient ? clientHeaders : headers);
+		let replica;
+		const replicaUrl = () => {
+			const url = readUrl();
+			if (url) replica ??= replicaState(until);
+			return url;
+		};
+		return {
+			...credentials,
+			...ids,
+			auth,
+			resolution,
+			get supabase() {
+				return client();
+			},
+			get db() {
+				if (db) return db;
+				const url = replicaUrl();
+				const rest = (sharesClient ? void 0 : supabase) ?? restAt(env().url, auth, headers);
+				const connected = betterSupabase.connect(rest, context, {
+					stats: recorder,
+					storage: { from: (bucket) => client().storage.from(bucket) },
+					...auth.kind === "invalid" ? { executor: refusingExecutor(auth.error) } : url && replica ? { executor: routedExecutor(postgrestExecutor(rest, executorOptions), postgrestExecutor(restAt(url, auth, headers), executorOptions), replica) } : tunedExecutor ? { executor: postgrestExecutor(rest, executorOptions) } : {}
+				});
+				db = withLazyClient(connected, client);
+				return db;
+			},
+			get replica() {
+				replicaUrl();
+				return replica;
+			},
+			get sql() {
+				if (!options.postgres || !sqlClaims) return;
+				sql ??= sqlFor(sqlClaims, context, recorder, session);
+				return sql;
+			},
+			stats: () => recorder.snapshot(),
+			apply: (response) => withPrimaryPin(resolution.apply(response), replica, pinMs),
+			cookies: () => {
+				const pin = primaryCookieWrite(replica, pinMs);
+				return pin ? [...resolution.cookies, pin] : resolution.cookies;
+			}
+		};
+	};
+	const fromResolution = (resolution, request, contextOptions, tenant) => contextFor(resolution, options.headers?.(request) ?? {}, contextOptions.stats, contextOptions.pinnedUntil ?? (readUrl() ? pinnedUntil(resolution.requestCookies) : 0), tenant, contextOptions.support, idPolicy.forRequest(request, contextOptions));
+	const resolve = async (request, resolveOptions = {}) => {
+		const claims = options.auth?.claims ?? betterSupabase.claimsSchema;
+		const userMetadata = betterSupabase.userMetadataSchema;
+		const resolution = await resolveAuth(request, {
+			logger: betterSupabase.events.logger,
+			...lite ? lite.auth() : options.auth,
+			...claims ? { claims } : {},
+			...userMetadata ? { userMetadata } : {},
+			env: env(),
+			...resolveOptions.refresh === void 0 ? {} : { refresh: resolveOptions.refresh },
+			...resolveOptions.cookies === void 0 ? {} : { cookies: resolveOptions.cookies },
+			...resolveOptions.checkSession ? { checkSession: true } : {},
+			...resolveOptions.encode === void 0 ? {} : { cookie: {
+				...options.auth?.cookie,
+				encode: resolveOptions.encode
+			} },
+			onRefresh: (event) => {
+				options.auth?.onRefresh?.(event);
+				betterSupabase.events.emit("refresh", event);
+			}
+		});
+		if (betterSupabase.events.has("auth")) {
+			const { auth } = resolution;
+			betterSupabase.events.emit("auth", {
+				source: auth.kind === "user" ? auth.source === "cookie" ? "cookie" : "bearer" : auth.kind === "service" || auth.kind === "apiKey" ? "bearer" : "none",
+				ok: auth.kind !== "invalid",
+				...auth.kind === "user" ? {
+					userId: auth.user.id,
+					rawSource: auth.source
+				} : {},
+				...auth.kind === "anon" || auth.kind === "invalid" ? { reason: auth.reason } : {}
+			});
+		}
+		return resolution;
+	};
+	/**
+	* One context per request and `refresh`/`cookies` pair: Server Components ask
+	* repeatedly.
+	*/
+	const contextMemo = /* @__PURE__ */ new WeakMap();
+	const server = {
+		get env() {
+			return env();
+		},
+		events: betterSupabase.events,
+		authorizer: options.authorizer,
+		authorization: options.authorization,
+		resolve,
+		supabaseFor,
+		dbFor: (auth, context, dbOptions) => dbOptions?.support ? supportContextFor({
+			auth,
+			cookies: [],
+			headers: {},
+			requestCookies: [],
+			apply: (response) => response
+		}, dbOptions.support, void 0, context?.tenant, {}).db : dbFor(auth, context),
+		contextFor: (auth, contextOptions = {}) => contextFor({
+			auth,
+			cookies: [],
+			headers: {},
+			requestCookies: [],
+			apply: (response) => response
+		}, {}, contextOptions.stats, contextOptions.pinnedUntil, contextOptions.tenant, contextOptions.support, idPolicy.forRequest(void 0, contextOptions)),
+		context(request, contextOptions = {}) {
+			const { refresh, cookies, ...rest } = contextOptions;
+			const key = Object.keys(rest).length === 0 ? `${String(refresh ?? false)}:${String(cookies ?? true)}` : void 0;
+			let byOptions = key ? contextMemo.get(request) : void 0;
+			const known = key ? byOptions?.get(key) : void 0;
+			if (known) return known;
+			const resolving = (async () => {
+				const call = { options: contextOptions };
+				await fold(request, {
+					...seedContext(),
+					[CALL]: call
+				});
+				return call.context;
+			})();
+			if (key) {
+				if (!byOptions) {
+					byOptions = /* @__PURE__ */ new Map();
+					contextMemo.set(request, byOptions);
+				}
+				const memo = byOptions;
+				memo.set(key, resolving);
+				resolving.catch(() => {
+					if (memo.get(key) === resolving) memo.delete(key);
+				});
+			}
+			return resolving;
+		},
+		contextFromResolution: (resolution, request, contextOptions = {}) => fromResolution(resolution, request, contextOptions, contextOptions.tenant ?? syncTenant(request, resolution.auth)),
+		admin: (context = {}, adminOptions = {}) => {
+			const client = adminOptions.as === void 0 ? serviceClient() : supabaseFor({
+				kind: "service",
+				keyName: "secret"
+			}, { [ACTOR_HEADER]: adminOptions.as });
+			const db = betterSupabase.connect(client, {
+				actor: {
+					id: "service",
+					kind: "service",
+					role: "service_role"
+				},
+				claims: { role: "service_role" },
+				...context
+			}, tunedExecutor ? { executor: postgrestExecutor(client, executorOptions) } : {});
+			return Object.defineProperty(db, "$authAdmin", { get: () => client.auth.admin });
+		},
+		support,
+		deleteAccount: (userId, deleteOptions) => deleteAccount(betterSupabase, serviceClient, userId, {
+			...options.postgres ? { sql: options.postgres.admin } : {},
+			...deleteOptions
+		}).map((deleted) => {
+			audit.account("account.deleted", userId, { removed: deleted.removed });
+			return deleted;
+		}),
+		endSessions: (userId) => options.postgres ? endSessions(options.postgres.admin, userId).map((ended) => {
+			audit.account("account.sessions_ended", userId, { ended: ended.ended });
+			return ended;
+		}) : AsyncResult.err(needsPostgres("endSessions")),
+		suspendAccount: (userId, suspendOptions) => options.postgres ? suspendAccount(serviceClient, options.postgres.admin, userId, suspendOptions).map((suspended) => {
+			audit.account(suspended.suspended ? "account.suspended" : "account.unsuspended", userId, {
+				ended: suspended.ended,
+				...suspendOptions.duration === void 0 ? {} : { duration: suspendOptions.duration }
+			});
+			return suspended;
+		}) : AsyncResult.err(needsPostgres("suspendAccount")),
+		actingAs: (userId, claims = {}, impersonation) => {
+			const full = {
+				role: "authenticated",
+				...claims,
+				sub: userId,
+				...impersonation ? { act: actClaim(impersonation) } : {}
+			};
+			return sqlFor(full, {
+				actor: {
+					id: userId,
+					kind: "user",
+					role: full.role ?? "authenticated",
+					...impersonation ? { impersonator: impersonation.actor } : {}
+				},
+				claims: full
+			});
+		},
+		forContext: (context, forOptions = {}) => AsyncResult.from(async () => {
+			const subject = await ticketSubject(context, forOptions.ticket ?? options.authorization?.tickets?.subject);
+			if (!subject.ok) return subject;
+			const target = subject.data;
+			const { tenant } = target;
+			const checked = contextClaims(target);
+			if (!checked.ok) return err(dbError("forbidden", checked.message));
+			if (!options.postgres) return err(dbError("invalid_request", "Direct Postgres access needs createServer(betterSupabase, { postgres: createPostgres() })"));
+			const userId = checked.claims.sub;
+			const extra = await options.claimsFor?.(userId, target) ?? {};
+			const permissions = narrowCap(await delegationCap(target, userId, options.authorization?.delegation?.permissions), forOptions.permissions);
+			const built = contextClaims(target, {
+				extra,
+				...forOptions.reason === void 0 ? {} : { reason: forOptions.reason },
+				...permissions === void 0 ? {} : { permissions }
+			});
+			if (!built.ok) return err(dbError("forbidden", built.message));
+			const { claims, impersonator, readOnly } = built;
+			const session = sessionWith({}, tenant, readOnly);
+			return ok(sqlFor(claims, {
+				actor: {
+					id: userId,
+					kind: "user",
+					role: "authenticated",
+					...impersonator ? { impersonator } : {}
+				},
+				claims,
+				...tenant === void 0 ? {} : { tenant }
+			}, void 0, session));
+		})
+	};
+	const core = {
+		events: betterSupabase.events,
+		pinMs,
+		resolve,
+		sessionCookie: () => options.auth?.cookie?.name ?? sessionCookieName(env().url),
+		tenant: (request, auth) => options.tenant?.(request, auth),
+		support: (request, auth) => support.current(request, auth),
+		context: (resolution, request, contextOptions, tenant) => fromResolution(resolution, request, contextOptions, tenant)
+	};
+	registerCore(server, core);
+	const fold = pipeline([
+		withSession(core),
+		withTenant(core),
+		withSupport(core),
+		withServerContext(core)
+	], (_request, ctx) => {
+		const call = callOf(ctx);
+		if (call) call.context = ctx.bs;
+		return Promise.resolve(new Response(null, { status: 204 }));
+	});
+	return server;
+}
+/**
+* The permission keys the provider's `delegation.permissions` hook grants a
+* delegated context, `undefined` for a context that is not delegated or without
+* the hook. A throw or an answer that is not a list of strings grants nothing.
+*/
+async function delegationCap(context, userId, permissions) {
+	if (permissions === void 0) return;
+	const delegated = delegatedClaims(context.claims ?? {});
+	if (!delegated.ok || delegated.delegation === void 0) return;
+	const { client_id, scope, authorization_details } = delegated.delegation;
+	try {
+		const keys = await permissions({
+			userId,
+			...context.tenant === void 0 ? {} : { tenant: context.tenant },
+			...client_id === void 0 ? {} : { clientId: client_id },
+			scopes: scope === void 0 ? [] : scope.split(" "),
+			...authorization_details === void 0 ? {} : { authorizationDetails: authorization_details }
+		});
+		return Array.isArray(keys) && keys.every((key) => typeof key === "string") ? keys : [];
+	} catch {
+		return [];
+	}
+}
+/**
+* The context `forContext` runs as: `context` itself, or for a context with a
+* ticket, the context `resolve` returns for it. A ticket without a resolver, a
+* `null` answer and a throw are `forbidden`; none of them fall back to the
+* recorded actor.
+*/
+async function ticketSubject(context, resolve) {
+	const ticket = context["ticket"];
+	if (ticket === void 0) return ok(context);
+	if (typeof ticket !== "string" || ticket === "") return err(dbError("forbidden", "forContext got an invalid ticket"));
+	if (resolve === void 0) return err(dbError("forbidden", "forContext got a ticket but no ticket resolver: pass { ticket } or authorization.tickets.subject"));
+	let resolved;
+	try {
+		resolved = await resolve(ticket);
+	} catch {
+		resolved = null;
+	}
+	if (typeof resolved !== "object" || resolved === null) return err(dbError("forbidden", "The ticket resolver refused the ticket"));
+	return ok(resolved);
+}
+//#endregion
+//#region src/server/adapter.ts
+/** Hands event sink sends still running to `waitUntil`; a no-op without either. */
+function flushEvents(server, waitUntil) {
+	if (waitUntil && server.events.pending) waitUntil(server.events.settled());
+}
+/**
+* Runs `run`, then hands pending event sink sends to `waitUntil` even when it
+* throws.
+*/
+async function withFlush(server, waitUntil, run) {
+	try {
+		return await run();
+	} finally {
+		flushEvents(server, waitUntil);
+	}
+}
+/** The 500 for an error a handler threw; the message only when `expose` is set. */
+function unexpectedResponse(cause, options) {
+	return problemResponse(dbError("unexpected", options.expose && cause instanceof Error ? cause.message : "Internal server error"), options);
+}
+/**
+* Runs `run` as the request's caller, the way every built-in adapter does:
+* resolves the context, applies the guard (401/403 Problem Details), turns the
+* return value into a response with `respond()`, turns other thrown errors into
+* a 500, adds the context's cookies with `ctx.apply()` and hands pending event
+* sink sends to `waitUntil`.
+*
+* ```ts
+* export default {
+*   fetch: (request, env, ctx) =>
+*     handle(server, request, (c) => c.db.notes.findMany(), {
+*       waitUntil: (p) => ctx.waitUntil(p),
+*     }),
+* };
+* ```
+*/
+async function handle(server, request, run, options = {}) {
+	const expose = options.expose ?? defaultExpose();
+	const instance = options.instance ?? new URL(request.url).pathname;
+	const ctx = await server.context(request, {
+		...options.context,
+		refresh: refreshFor(options.refresh, request) ?? false
+	});
+	const denied = guard(ctx.auth, options.allow, options.aal, options.scopes);
+	try {
+		let response;
+		try {
+			response = denied ? problemResponse(denied, {
+				instance,
+				expose
+			}) : await respond(() => run(ctx), {
+				instance,
+				expose,
+				...options.status === void 0 ? {} : { status: options.status }
+			});
+		} catch (cause) {
+			options.rethrow?.(cause);
+			response = unexpectedResponse(cause, {
+				instance,
+				expose
+			});
+		}
+		return ctx.apply(response);
+	} finally {
+		flushEvents(server, options.waitUntil);
+	}
+}
+/** A request carrying only `token` as a bearer, for resolvers that read headers. */
+function bearerRequest(token) {
+	return new Request("http://localhost/", { headers: token ? { authorization: `Bearer ${token}` } : {} });
+}
+/**
+* Verifies a bare access token (an MCP transport's, a WebSocket's) without
+* cookies or a refresh. An empty token resolves to `anon`.
+*/
+async function resolveToken(server, token) {
+	const { auth } = await server.resolve(bearerRequest(token), { cookies: false });
+	return auth;
+}
+//#endregion
+export { suspendAccount as A, shouldRefresh as C, SERVER_EVENT_SOURCE as D, defineAuthorizationHooks as E, endSessions as O, shouldCheckSession as S, serverCore as T, withSupport as _, unexpectedResponse as a, isPrefetch as b, extendServer as c, clearSupportCookie as d, supportCookie as f, withTenant as g, TENANT_HEADER as h, resolveToken as i, deleteAccount as j, lastSignIns as k, supportStorage as l, supportCookieValue as m, flushEvents as n, withFlush as o, supportCookieMaxAge as p, handle as r, createServer as s, bearerRequest as t, SUPPORT_COOKIE as u, outageResponse as v, withServerContext as w, refreshFor as x, withSession as y };