better-supabase 0.11.0 → 0.13.0

package/dist/read-set-DeesfeL_.js

@@ -1,314 +0,0 @@
-import { n as dbError } from "./errors-BV1SKTVs.js";
-import { i as tableMeta, t as builderFor } from "./build-C-D_vn0U.js";
-import { n as touchedTables } from "./tables-Cb-3_VWc.js";
-//#region src/core/spec.ts
-const READ_METHODS = [
-	"findMany",
-	"findFirst",
-	"findOnly",
-	"findUnique",
-	"findById",
-	"count",
-	"aggregate",
-	"exists",
-	"paginate"
-];
-function createSpecs(meta) {
-	const specs = {};
-	for (const table of Object.keys(meta.tables)) {
-		const methods = {};
-		for (const method of READ_METHODS) methods[method] = (...args) => ({
-			v: 1,
-			table,
-			method,
-			args: trimUndefined(args)
-		});
-		specs[table] = methods;
-	}
-	return specs;
-}
-function trimUndefined(args) {
-	const out = [...args];
-	while (out.length > 0 && out.at(-1) === void 0) out.pop();
-	return out;
-}
-function isQuerySpec(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const spec = value;
-	return spec.v === 1 && typeof spec.table === "string" && READ_METHODS.includes(spec.method) && Array.isArray(spec.args);
-}
-/** The argument object of a spec's method (`findById` takes it second). */
-function specOptions(spec) {
-	const value = spec.method === "findById" ? spec.args[1] : spec.args[0];
-	return typeof value === "object" && value !== null ? value : void 0;
-}
-/**
-* App keys of every table a spec reads: its table, included relations and
-* relations used in `where`. Queries keyed by a spec go stale when any of
-* them changes. Invalid arguments yield just the spec's table; running the
-* spec reports the error.
-*/
-function specTables(meta, spec) {
-	const table = meta.tables[spec.table];
-	const args = specOptions(spec);
-	if (table && args?.["include"] === void 0 && !touchesRelations(table, args?.["where"])) return [spec.table];
-	const key = specKey(spec);
-	let byKey = tablesByMeta.get(meta);
-	if (!byKey) {
-		byKey = /* @__PURE__ */ new Map();
-		tablesByMeta.set(meta, byKey);
-	}
-	const known = key === void 0 ? void 0 : byKey.get(key);
-	if (known) return [...known];
-	let tables;
-	try {
-		tables = readTables(meta, spec);
-	} catch {
-		tables = [spec.table];
-	}
-	if (key !== void 0) {
-		if (byKey.size >= SPEC_CACHE_SIZE) byKey.clear();
-		byKey.set(key, tables);
-	}
-	return [...tables];
-}
-const SPEC_CACHE_SIZE = 500;
-const tablesByMeta = /* @__PURE__ */ new WeakMap();
-/** A text key for the spec, or `undefined` when its arguments do not serialize. */
-function specKey(spec) {
-	try {
-		return JSON.stringify([
-			spec.table,
-			spec.method,
-			spec.args
-		], (_key, value) => typeof value === "bigint" ? `${value}n` : value);
-	} catch {
-		return;
-	}
-}
-function touchesRelations(table, where) {
-	if (typeof where !== "object" || where === null) return false;
-	if (Array.isArray(where)) return where.some((item) => touchesRelations(table, item));
-	for (const [key, value] of Object.entries(where)) {
-		if (key in table.relations) return true;
-		if ((key === "AND" || key === "OR" || key === "NOT") && touchesRelations(table, value)) return true;
-	}
-	return false;
-}
-function readTables(meta, spec) {
-	const builder = builderFor(meta);
-	const table = tableMeta(meta, spec.table);
-	const args = specOptions(spec);
-	const counts = spec.method === "count" || spec.method === "exists" || spec.method === "aggregate";
-	return touchedTables({
-		kind: "select",
-		table,
-		selection: counts ? {
-			columns: [],
-			includes: []
-		} : builder.selection(table, args?.["select"], args?.["include"]),
-		where: builder.where(table, args?.["where"]),
-		orderBy: [],
-		limit: void 0,
-		offset: void 0,
-		count: void 0,
-		head: counts,
-		single: void 0
-	});
-}
-//#endregion
-//#region src/core/read-set.ts
-const NAME = /^[a-z][a-z0-9_]{0,59}$/;
-const PARAM = /^[a-z_][a-z0-9_]*$/i;
-const TYPE = /^(?:[a-z_][a-z0-9_]*\.)?[a-z_][a-z0-9_]*(?:\[\])?$/;
-/** `jsonb_build_object` takes at most 100 arguments. */
-const MAX_ENTRIES = 50;
-/**
-* Placeholders are `NUL bs:<name> NUL`: no real parameter value holds a NUL.
-* Auth placeholders start with `@`, which no parameter name can.
-*/
-const NUL = "\0";
-const SENTINEL = /* @__PURE__ */ new RegExp(`${NUL}bs:(@?[a-z_][a-z0-9_]*)${NUL}`, "gi");
-const EXACT = /* @__PURE__ */ new RegExp(`^${NUL}bs:(@?[a-z_][a-z0-9_]*)${NUL}$`, "i");
-function sentinel(name) {
-	return `${NUL}bs:${name}${NUL}`;
-}
-const AUTH = { uid: sentinel("@uid") };
-function tagged(name, array) {
-	if (!name.startsWith("@")) return {
-		kind: "param",
-		name,
-		array
-	};
-	return name === "@uid" ? {
-		kind: "auth",
-		name: "uid",
-		array
-	} : void 0;
-}
-/**
-* Registers reads that run as one round trip:
-*
-* ```ts
-* export const appChrome = defineReadSet(
-*   betterSupabase,
-*   'app_chrome',
-*   { params: { userId: 'uuid' } },
-*   (s, p) => ({
-*     unread: s.notifications.count({ where: { userId: p.userId, readAt: null } }),
-*     me: s.profiles.findFirst({ where: { id: p.userId } }),
-*   }),
-* );
-* ```
-*
-* `p` holds placeholders, not values: pass them straight into `where` (or
-* `in`), where the function reads them from its `p jsonb` argument.
-*/
-function defineReadSet(betterSupabase, name, options, build) {
-	if (!NAME.test(name)) throw new TypeError(`better-supabase: read set name "${name}" must be snake_case and at most 60 characters`);
-	const params = options.params ?? {};
-	const placeholders = {};
-	for (const [key, type] of Object.entries(params)) {
-		if (!PARAM.test(key)) throw new TypeError(`better-supabase: read set "${name}" has an invalid parameter name "${key}"`);
-		if (!TYPE.test(type)) throw new TypeError(`better-supabase: read set "${name}" parameter "${key}" has an invalid type "${type}"`);
-		placeholders[key] = type.endsWith("[]") ? [sentinel(key)] : sentinel(key);
-	}
-	const specs = build(betterSupabase.spec, placeholders, AUTH);
-	const entries = Object.entries(specs);
-	if (entries.length === 0 || entries.length > MAX_ENTRIES) throw new TypeError(`better-supabase: read set "${name}" needs between 1 and ${MAX_ENTRIES} reads`);
-	for (const [key, spec] of entries) if (!isQuerySpec(spec)) throw new TypeError(`better-supabase: read set "${name}" entry "${key}" is not a spec from betterSupabase.spec`);
-	warnUnscopedReads(betterSupabase, name, specs);
-	return {
-		kind: "read-set",
-		name,
-		functionName: `rs_${name}`,
-		params,
-		roles: options.roles ?? ["authenticated"],
-		specs,
-		definition: betterSupabase
-	};
-}
-/**
-* The generated function runs the reads as compiled at `gen` time, without
-* the runtime's `transformQuery` plugins, so tenant and soft-delete filters
-* that only those plugins add never reach it.
-*/
-function warnUnscopedReads(betterSupabase, name, specs) {
-	const filtering = betterSupabase.plugins.filter((plugin) => plugin.transformQuery !== void 0 && plugin.scopes?.length !== 0);
-	if (filtering.length === 0) return;
-	const { meta } = betterSupabase;
-	const filters = (plugin, key) => {
-		const flags = meta.tables[key]?.flags;
-		return plugin.scopes === void 0 || plugin.scopes.some((flag) => flags?.[flag] !== void 0);
-	};
-	const tables = [...new Set(Object.values(specs).flatMap((spec) => specTables(meta, spec)))].filter((key) => filtering.some((plugin) => filters(plugin, key)));
-	if (tables.length === 0) return;
-	const scoping = filtering.filter((plugin) => tables.some((key) => filters(plugin, key))).map((plugin) => plugin.name);
-	betterSupabase.events.logger.warn(`read set "${name}" reads ${tables.join(", ")}, which ${scoping.join(", ")} scope at runtime; its generated function only sees those filters when the specs spell them out (or RLS enforces them)`, {
-		readSet: name,
-		tables,
-		plugins: scoping
-	});
-}
-function isReadSet(value) {
-	return typeof value === "object" && value !== null && value.kind === "read-set" && typeof value.name === "string";
-}
-/** The placeholder a string or array carries, if it is exactly one. */
-function placeholderOf(value) {
-	if (typeof value === "string") {
-		const match = EXACT.exec(value);
-		return match ? tagged(match[1], false) : void 0;
-	}
-	if (Array.isArray(value) && value.length === 1) {
-		const inner = placeholderOf(value[0]);
-		return inner && !inner.array ? {
-			...inner,
-			array: true
-		} : inner;
-	}
-}
-/** Splits a string around the placeholders inside it. */
-function splitPlaceholders(value) {
-	const parts = [];
-	let last = 0;
-	for (const match of value.matchAll(SENTINEL)) {
-		if (match.index > last) parts.push({ text: value.slice(last, match.index) });
-		const placeholder = tagged(match[1], false);
-		parts.push(placeholder ?? { text: match[0] });
-		last = match.index + match[0].length;
-	}
-	if (last < value.length) parts.push({ text: value.slice(last) });
-	return parts;
-}
-function hasPlaceholder(value) {
-	return value.includes(`${NUL}bs:`);
-}
-/** Whether any string inside `value` is (or holds) a placeholder. */
-function containsPlaceholder(value) {
-	if (typeof value === "string") return hasPlaceholder(value);
-	if (Array.isArray(value)) return value.some(containsPlaceholder);
-	if (typeof value === "object" && value !== null) return Object.values(value).some(containsPlaceholder);
-	return false;
-}
-/** Whether the set's specs read the caller's identity. */
-function readSetUsesAuth(set) {
-	return Object.values(set.specs).some((spec) => usesAuth(spec.args));
-}
-function usesAuth(value) {
-	if (typeof value === "string") return [...value.matchAll(SENTINEL)].some((match) => match[1].startsWith("@"));
-	if (Array.isArray(value)) return value.some(usesAuth);
-	if (typeof value === "object" && value !== null) return Object.values(value).some(usesAuth);
-	return false;
-}
-/** Missing or wrongly typed parameters, as messages. */
-function checkParams(set, values) {
-	const problems = [];
-	for (const [key, type] of Object.entries(set.params)) {
-		const value = values?.[key];
-		if (value === void 0 || value === null) problems.push(`missing parameter "${key}"`);
-		else if (type.endsWith("[]") !== Array.isArray(value)) problems.push(`parameter "${key}" must be ${type.endsWith("[]") ? "an array" : "a single value"}`);
-	}
-	return problems;
-}
-/**
-* The specs with every placeholder replaced by its value; `auth.uid` takes
-* the `sub` claim, which must be verified. `noCaller` is set when the set
-* reads `auth.uid` and there is no `sub`: the specs then match no user, and
-* only the function, which reads `auth.uid()` itself, can run the set.
-*/
-function bindParams(set, values, context) {
-	const sub = context.claims?.["sub"];
-	const uid = typeof sub === "string" && sub !== "" ? sub : null;
-	const valueOf = (placeholder) => placeholder.kind === "auth" ? uid : values?.[placeholder.name];
-	const bind = (value) => {
-		const placeholder = placeholderOf(value);
-		if (placeholder) {
-			const bound = valueOf(placeholder);
-			return placeholder.kind === "auth" && placeholder.array ? [bound] : bound;
-		}
-		if (typeof value === "string") {
-			if (!hasPlaceholder(value)) return value;
-			return splitPlaceholders(value).map((part) => "text" in part ? part.text : String(valueOf(part) ?? "")).join("");
-		}
-		if (Array.isArray(value)) return value.map(bind);
-		if (typeof value === "object" && value !== null) {
-			if (Object.getPrototypeOf(value) !== Object.prototype) return value;
-			return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, bind(entry)]));
-		}
-		return value;
-	};
-	return {
-		specs: Object.fromEntries(Object.entries(set.specs).map(([key, spec]) => [key, {
-			...spec,
-			args: spec.args.map(bind)
-		}])),
-		noCaller: uid === null && readSetUsesAuth(set) ? dbError("invalid_request", `db.$many(${set.name}): the read set reads auth.uid, but this connection has no user claims. Connect with the user's verified claims ({ claims: { sub } }), or call it over PostgREST, where the function reads auth.uid().`) : void 0
-	};
-}
-/** App keys of every table the set reads. */
-function readSetTables(set, meta) {
-	const schema = meta ?? set.definition.meta;
-	return [...new Set(Object.values(set.specs).flatMap((spec) => specTables(schema, spec)))];
-}
-//#endregion
-export { hasPlaceholder as a, readSetTables as c, isQuerySpec as d, specTables as f, defineReadSet as i, splitPlaceholders as l, checkParams as n, isReadSet as o, containsPlaceholder as r, placeholderOf as s, bindParams as t, createSpecs as u };

package/dist/realtime-status-D2dw1hOE.js

@@ -1,12 +0,0 @@
-//#region src/core/realtime-status.ts
-/**
-* The status of the Realtime features a topic relies on. A private topic
-* needs Realtime Authorization for broadcast and presence, which is in
-* public beta; public broadcast, presence and Postgres changes are
-* generally available.
-*/
-function topicStatus(topic) {
-	return topic.private ?? true ? "beta" : "ga";
-}
-//#endregion
-export { topicStatus as t };

package/dist/realtime-status-DcsO00Gw.d.ts

@@ -1,8 +0,0 @@
-//#region src/core/realtime-status.d.ts
-/**
- * Supabase's release status for a Realtime feature: `beta` (public beta on
- * the platform) or `ga`.
- */
-type RealtimeStatus = "beta" | "ga";
-//#endregion
-export { RealtimeStatus as t };

package/dist/refusal-CFpfmjcS.js

@@ -1,61 +0,0 @@
-import { r as dbErrorOf } from "./errors-BV1SKTVs.js";
-import { o as problemResponse } from "./problem-JRCohp1j.js";
-import { t as defaultExpose } from "./respond-Bhp3G__q.js";
-import { i as requireCaller } from "./kit-LTbHrWWD.js";
-//#region src/server/refusal.ts
-function isAalRefusal(error) {
-	return error.kind === "forbidden" && "required" in error && error.required === "aal2";
-}
-/** The page a refused caller is sent to, with `?next=`, when one is configured. */
-function refusalTarget(error, request, redirects) {
-	const page = error.kind === "unauthorized" ? redirects.signIn : isAalRefusal(error) ? redirects.mfa : void 0;
-	if (page === void 0) return;
-	const url = new URL(request.url);
-	const target = new URL(page, url);
-	if (target.pathname === url.pathname) return;
-	target.searchParams.set("next", `${url.pathname}${url.search}`);
-	return target;
-}
-/** A refusal as a redirect to `signIn` or `mfa`, else Problem Details. */
-function refusalResponse(error, request, redirects, expose) {
-	const target = refusalTarget(error, request, redirects);
-	if (target) return new Response(null, {
-		status: 303,
-		headers: { location: target.href }
-	});
-	return problemResponse(error, {
-		instance: new URL(request.url).pathname,
-		expose
-	});
-}
-/** The refusal for a caller `options` refuses, or `undefined` to let it through. */
-async function routeRefusal(locals, request, options) {
-	const caller = await requireCaller(locals.bs.auth, options, locals.tenant, options.authorizer);
-	if (!("kind" in caller)) return;
-	return refusalResponse(caller, request, options, options.expose ?? defaultExpose());
-}
-/**
-* An `onError` mapper: a thrown `DbException` (or an error caused by a
-* `DbError`) becomes Problem Details; anything else is `undefined`, so the
-* framework's own handling stays.
-*/
-function errorResponse(cause, request, options = {}) {
-	const found = dbErrorOf(cause);
-	if (!found) return;
-	return problemResponse(found, {
-		instance: new URL(request.url).pathname,
-		expose: options.expose ?? defaultExpose()
-	});
-}
-/** Reads the guard's view of a request's contributions; throws without `withBetterSupabase`. */
-function guardedLocals(contributions) {
-	const bs = "bs" in contributions ? contributions.bs : void 0;
-	if (typeof bs !== "object" || bs === null || !("auth" in bs)) throw new Error("better-supabase: the route guard needs withBetterSupabase(server) in the entries");
-	const tenant = "tenant" in contributions ? contributions.tenant : void 0;
-	return {
-		bs,
-		tenant: typeof tenant === "string" ? tenant : void 0
-	};
-}
-//#endregion
-export { routeRefusal as a, refusalTarget as i, guardedLocals as n, refusalResponse as r, errorResponse as t };

package/dist/refusal-CufncwaN.d.ts

@@ -1,18 +0,0 @@
-import { t as AnyAuthorizer } from "./authorizer-eiOjo-3l.js";
-import { s as BlockRequireOptions } from "./kit-BeZX2pR_.js";
-//#region src/server/refusal.d.ts
-/** Where refused callers go instead of a Problem Details response. */
-interface RefusalRedirects {
-  /** Sign-in page for callers without a session; gets `?next=<path>`. */
-  readonly signIn?: string;
-  /** Second-factor page for users below the route's `aal`; gets `?next=<path>`. */
-  readonly mfa?: string;
-}
-interface RouteGuardOptions<C = unknown, P = unknown> extends BlockRequireOptions<C, P>, RefusalRedirects {
-  /** Include internal error messages in Problem Details. Defaults to development only. */
-  readonly expose?: boolean;
-  /** Decides `permission`; without one, a route with a `permission` refuses every caller. */
-  readonly authorizer?: AnyAuthorizer;
-}
-//#endregion
-export { RouteGuardOptions as n, RefusalRedirects as t };

package/dist/resolve-Bqb8TMTt.d.ts

@@ -1,266 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { b as DbError } from "./result-BREt7qOh.js";
-import { n as AuthOutageEvent, u as RefreshEvent } from "./events-P3raDX2E.js";
-import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as StandardSchemaV1 } from "./standard-BcUQuUgu.js";
-import { t as BetterSupabaseEnv } from "./index-CxmVzT-3.js";
-import { CookieOptions } from "@supabase/ssr";
-import { JWTClaims, SupabaseEnv, UserClaims } from "@supabase/server";
-//#region src/auth/session.d.ts
-/**
- * The session object auth-js persists (`sb-<ref>-auth-token`). A
- * `tokens-only` cookie has no `user`: auth-js keeps it in `auth.userStorage`.
- */
-interface StoredSession {
-  readonly access_token: string;
-  readonly refresh_token: string;
-  readonly expires_at?: number;
-  readonly expires_in?: number;
-  readonly token_type?: string;
-  readonly user?: unknown;
-  readonly [key: string]: unknown;
-}
-/**
- * `cookies.encode` in `@supabase/ssr`: `user-and-tokens` stores the user
- * object in the cookie, `tokens-only` stores the access and refresh tokens
- * alone. The server and the browser client must use the same value.
- */
-type SessionEncoding = "user-and-tokens" | "tokens-only";
-declare const DEFAULT_SESSION_ENCODING: SessionEncoding;
-interface WriteSessionOptions {
-  /** Defaults to `user-and-tokens`, the `@supabase/ssr` default. */
-  readonly encode?: SessionEncoding;
-}
-/** A cookie scope an earlier deploy wrote the session at. */
-interface CookieScope {
-  readonly domain?: string;
-  readonly path?: string;
-}
-interface CookieRecord {
-  readonly name: string;
-  readonly value: string;
-}
-interface CookieWrite {
-  readonly name: string;
-  readonly value: string;
-  readonly options: CookieOptions;
-}
-/** Headers that keep responses carrying session cookies out of shared caches. */
-declare const AUTH_CACHE_HEADERS: Readonly<Record<string, string>>;
-/** `sb-<first label of the hostname>-auth-token`, the supabase-js default. */
-declare function sessionCookieName(url: string): string;
-declare function parseCookies(header: string | null | undefined): CookieRecord[];
-declare function serializeCookie(write: CookieWrite): string;
-/**
- * Reads the session written by `@supabase/ssr` (plain or `base64-`, whole or
- * chunked, `user-and-tokens` or `tokens-only`). Trailing chunks a shorter
- * session no longer uses are ignored; chunks that never form a session read
- * as no session.
- */
-declare function readSession(cookies: readonly CookieRecord[], name: string): StoredSession | null;
-/**
- * `Max-Age=0` writes for the session's chunk-like cookies that the readable
- * session doesn't use: a leftover `.2` after a shorter rewrite, chunks next
- * to a whole cookie, or chunks past a gap. Empty when no session reads.
- */
-declare function pruneSessionChunks(cookies: readonly CookieRecord[], name: string, options?: CookieOptions): CookieWrite[];
-/** The encoding a stored session was written with: `tokens-only` without a `user`. */
-declare function sessionEncoding(session: StoredSession): SessionEncoding;
-/**
- * Cookie writes that store `session` (or clear it with `null`) exactly like
- * `@supabase/ssr` with the same `encode`, and expire chunks the new value no
- * longer uses.
- */
-declare function writeSession(existing: readonly CookieRecord[], name: string, session: StoredSession | null, options?: CookieOptions, { encode }?: WriteSessionOptions): CookieWrite[];
-/**
- * `Max-Age=0` writes for every chunk of the session cookie at each of
- * `scopes`, like `clearAuthCookiesAtScopes` from `@supabase/ssr`. Use it once
- * the cookie `domain` or `path` changed, for the scopes earlier deploys
- * wrote: browsers ignore writes for scopes the host doesn't own, but a scope
- * equal to the current one clears the live session.
- */
-declare function clearSessionAtScopes(existing: readonly CookieRecord[], name: string, scopes: readonly CookieScope[]): CookieWrite[];
-/** Applies cookie writes to a cookie list, as the next request would see it. */
-declare function applyCookieWrites(cookies: readonly CookieRecord[], writes: readonly CookieWrite[]): CookieRecord[];
-//#endregion
-//#region src/auth/resolve.d.ts
-/**
- * Who is calling. `C` is the claims type from `betterSupabase.claims(schema)`; the
- * verified payload keeps every JWT claim and adds the schema's output. `P`
- * is the `user_metadata` type from `betterSupabase.userMetadata(schema)`.
- */
-type AuthState<C = unknown, P = unknown> = {
-  readonly kind: "user";
-  readonly token: string;
-  readonly claims: JWTClaims & C;
-  readonly user: UserClaims;
-  /**
-   * Where the token came from: `oauth` for an RFC 9068 access token
-   * from `accessTokenResolver`, which never has a cookie session.
-   */
-  readonly source: "bearer" | "cookie" | "oauth" | (string & {});
-  /** Seconds since epoch, from the token's `exp`. */
-  readonly expiresAt: number | null;
-  /**
-   * `user_metadata` parsed by `betterSupabase.userMetadata(schema)`; `undefined`
-   * without a schema or when the metadata fails it. Users can write this
-   * data themselves: use it for display, never for access.
-   */
-  readonly profile?: P;
-} | {
-  readonly kind: "service";
-  readonly keyName: string;
-} | {
-  readonly kind: "apiKey";
-  readonly keyId: string;
-  readonly name: string;
-  readonly organizationId?: string;
-  readonly userId?: string;
-  readonly scopes: readonly string[];
-  /** When the key was created. */
-  readonly createdAt?: Temporal.Instant;
-  /** The user who created the key, when the row records one. */
-  readonly createdBy?: string;
-  /** `sub` (the user, or the key for an organization key), `role: authenticated` and `api_key`. */
-  readonly claims: JWTClaims;
-} | {
-  readonly kind: "anon";
-  /** `expired`: the cookie session needs a refresh that was not allowed here (run the proxy). */
-  readonly reason: "none" | "expired" | "signed_out" | "refresh_failed";
-} | {
-  readonly kind: "invalid";
-  readonly reason: InvalidReason;
-  readonly error: DbError;
-};
-type InvalidReason = "token" | "claims" | "actor";
-/**
- * What an `AuthResolver` returns. `reason` may be left out of an `invalid`
- * state; it then counts as `token`.
- */
-type ResolvedState = Exclude<AuthState, {
-  kind: "invalid";
-}> | {
-  readonly kind: "invalid";
-  readonly reason?: InvalidReason;
-  readonly error: DbError;
-};
-/**
- * Extension point for other credentials (API keys, third-party auth, custom
- * tokens). Return `undefined` when the request carries nothing this resolver
- * understands; the built-in Bearer and cookie resolution runs next.
- */
-interface AuthResolver {
-  readonly name: string;
-  resolve(request: Request): Promise<ResolvedState | undefined> | ResolvedState | undefined;
-}
-interface ResolveAuthOptions {
-  readonly env: BetterSupabaseEnv;
-  /** Allow refreshing an expiring cookie session. Only where cookies can be written (proxy). */
-  readonly refresh?: boolean;
-  /**
-   * With `refresh`, refresh when the token expires within this many seconds.
-   * Defaults to 60. Without `refresh` a token stays valid until its `exp`.
-   */
-  readonly leeway?: number;
-  /** Milliseconds before a refresh counts as a network failure. Defaults to 5000. */
-  readonly refreshTimeoutMs?: number;
-  readonly checkSession?: boolean;
-  /**
-   * Accept `sb_secret_` keys (`apikey` header) as service callers: `true` for
-   * any configured key, or the key names allowed (`['cron']`). Defaults to false.
-   */
-  readonly secret?: boolean | readonly string[];
-  readonly audience?: string | string[];
-  readonly issuer?: string | string[];
-  readonly cookie?: {
-    readonly name?: string;
-    readonly options?: CookieOptions;
-    /**
-     * The shape refreshed sessions are written in, `cookies.encode` in
-     * `@supabase/ssr`. Use the browser client's value. Defaults to
-     * `user-and-tokens`.
-     */
-    readonly encode?: SessionEncoding;
-  };
-  /**
-   * Read the session cookie. Defaults to true. `false` suits endpoints only
-   * bearer clients call (MCP): a browser's cookie then can't authorize a
-   * request another site makes it send.
-   */
-  readonly cookies?: boolean;
-  /** Inline JWKS instead of fetching `env.jwksUrl` (tests, air-gapped). */
-  readonly jwks?: SupabaseEnv["jwks"];
-  /**
-   * Verify HS256 tokens without a `kid` locally with this shared secret, the
-   * tokens Supabase Lite issues (`auth.jwt_secret`). Tokens with a `kid`
-   * still verify against the JWKS. `createServer` sets it from
-   * `SUPABASE_JWT_SECRET` with `backend: "lite"`.
-   */
-  readonly jwtSecret?: string;
-  /**
-   * Validates the verified claims (`betterSupabase.claims(schema)` sets it). A failure
-   * resolves to `{ kind: 'invalid', reason: 'claims' }`.
-   */
-  readonly claims?: StandardSchemaV1;
-  /**
-   * Parses `user_metadata` into `profile` (`betterSupabase.userMetadata(schema)` sets
-   * it). A failure leaves `profile` undefined and warns once; the session
-   * stays valid.
-   */
-  readonly userMetadata?: StandardSchemaV1;
-  /** Receives the `userMetadata` warning. Defaults to `console`. */
-  readonly logger?: Logger;
-  readonly resolvers?: readonly AuthResolver[];
-  /**
-   * The caller's IP, sent to Auth as `Sb-Forwarded-For` on refreshes so its
-   * per-IP rate limit counts users, not your server. Only with a secret key
-   * (`env.secretKey`), which Auth requires for the header. Defaults to
-   * `clientIp` (the last `x-forwarded-for` hop); `false` turns it off.
-   */
-  readonly clientIp?: ((request: Request) => string | undefined) | false;
-  /** Called after every refresh attempt (metrics, logging). */
-  readonly onRefresh?: (event: RefreshEvent) => void;
-  /**
-   * With `refresh`, expire session chunks the readable session doesn't use
-   * (a leftover `.2` after a shorter rewrite) on every request, not only
-   * when the session is rewritten. Defaults to true.
-   */
-  readonly pruneChunks?: boolean;
-  readonly fetch?: typeof fetch;
-  /** Epoch milliseconds, the unit JWT `exp` and `iat` math needs. */
-  readonly now?: () => number;
-}
-interface AuthResolution<C = unknown, P = unknown> {
-  readonly auth: AuthState<C, P>;
-  /** Cookie writes for the response. Empty unless the session was refreshed or cleared. */
-  readonly cookies: readonly CookieWrite[];
-  /** No-store headers, set whenever `cookies` is not empty. */
-  readonly headers: Readonly<Record<string, string>>;
-  /** Cookies the rest of this request should see, including a refreshed session. */
-  readonly requestCookies: readonly CookieRecord[];
-  /** Adds `cookies` and `headers` to a response. */
-  apply(response: Response): Response;
-  /** The session was ended server-side (revoked, deleted or banned); the cookies are cleared. */
-  readonly sessionEnded?: boolean;
-  /** Why `sessionEnded` is set: `banned` when Auth rejected the user as banned. */
-  readonly sessionEndedReason?: "ended" | "banned";
-  /** Set when a refresh failed because the Auth server was unreachable. */
-  readonly outage?: AuthOutageEvent;
-}
-/**
- * The last `x-forwarded-for` hop, the one your own edge appended. Hops to its
- * left come from the client and can be forged. Behind more than one proxy,
- * pass your own reader to `clientIp`.
- */
-declare function clientIp(request: Request): string | undefined;
-/**
- * Resolves who is calling: custom resolvers, then `Authorization: Bearer`
- * (APIs, MCP, mobile), then the `@supabase/ssr` session cookie (browsers).
- *
- * A valid token costs no network call: it is verified locally against the
- * cached JWKS. An expiring cookie session is refreshed only when `refresh` is
- * set, through a single-flight request, and only then are cookies written.
- */
-declare function resolveAuth(request: Request, options: ResolveAuthOptions): Promise<AuthResolution>;
-//#endregion
-export { serializeCookie as C, writeSession as E, readSession as S, sessionEncoding as T, WriteSessionOptions as _, ResolveAuthOptions as a, parseCookies as b, resolveAuth as c, CookieRecord as d, CookieScope as f, StoredSession as g, SessionEncoding as h, InvalidReason as i, AUTH_CACHE_HEADERS as l, DEFAULT_SESSION_ENCODING as m, AuthResolver as n, ResolvedState as o, CookieWrite as p, AuthState as r, clientIp as s, AuthResolution as t, CookieOptions as u, applyCookieWrites as v, sessionCookieName as w, pruneSessionChunks as x, clearSessionAtScopes as y };