better-supabase 0.12.0 → 0.13.0

package/dist/chat-sdk/index.js

@@ -1,8 +1,8 @@
-import { s as nowInstant } from "../temporal-CB5Fpo5d.js";
+import { s as nowInstant } from "../temporal-DLZlWbOi.js";
 import { n as isRecord } from "../guards-6F2bCtQR.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-J7ZepTq2.js";
-import { C as optionalText, I as textOf, R as toInstant, T as randomToken, f as errorText, j as run, o as blockCall } from "../block-helpers-DkVZNDrj.js";
-import { r as writeToStore } from "../tee-Cw-iJAWL.js";
+import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-Ds0C2mUf.js";
+import { C as optionalText, I as textOf, R as toInstant, T as randomToken, f as errorText, j as run, o as blockCall } from "../block-helpers-DwE32_gT.js";
+import { r as writeToStore } from "../tee-1fsH3bEz.js";
 import { BaseFormatConverter, Message, defaultEmojiResolver, parseMarkdown, stringifyMarkdown } from "chat";
 //#region src/chat-sdk/delivery.ts
 const STATUSES = {
@@ -55,7 +55,10 @@ const whatsappDeliveries = ({ body }) => {
 		only: updates.length > 0 && !other
 	};
 };
-/** Messenger and Instagram: `entry[].messaging[].delivery.mids`. Read receipts carry no ids and are skipped. */
+/**
+* Messenger and Instagram: `entry[].messaging[].delivery.mids`. Read receipts
+* carry no ids and are skipped.
+*/
 const messengerDeliveries = ({ body }) => {
 	const payload = json(body);
 	if (!isRecord(payload) || payload["object"] !== "page" && payload["object"] !== "instagram") return null;
@@ -72,7 +75,10 @@ const messengerDeliveries = ({ body }) => {
 		only: receipts.length > 0 && receipts.length === events.length
 	};
 };
-/** Twilio status callbacks: a form body with `MessageSid` and `MessageStatus` and no `Body`. */
+/**
+* Twilio status callbacks: a form body with `MessageSid` and `MessageStatus`
+* and no `Body`.
+*/
 const twilioDeliveries = ({ body, headers }) => {
 	if (!(headers["content-type"] ?? "").includes("application/x-www-form-urlencoded")) return null;
 	const form = new URLSearchParams(body);
@@ -102,7 +108,10 @@ const DELIVERY_PARSERS = {
 const APP$1 = { type: "app" };
 const ECHO_TTL_MS = 864e5;
 const echoKey = (adapter, id) => `better-supabase:inbox:echo:${adapter}:${id}`;
-/** A platform adapter built from the token the credential provider holds, so no secret sits in env. */
+/**
+* A platform adapter built from the token the credential provider holds, so no
+* secret sits in env.
+*/
 async function channelAdapter(options) {
 	const token = await options.credentials.getToken(options.ref, { subject: options.subject ?? APP$1 }).orThrow();
 	return options.create(token);
@@ -114,10 +123,9 @@ const DROPPED_HEADERS = /* @__PURE__ */ new Set([
 ]);
 const defaultPassthrough = (request, body) => request.method === "GET" || body.includes("\"type\":\"url_verification\"");
 /**
-* A route handler that verifies a channel webhook, stores the raw event in
-* the inbox's `inbound_events` and answers 200 at once. `inboundHandler`
-* replays it into Chat SDK later, so a slow bot never makes the platform
-* retry.
+* A route handler that verifies a channel webhook, stores the raw event in the
+* inbox's `inbound_events` and answers 200 at once. `inboundHandler` replays it
+* into Chat SDK later, so a slow bot never makes the platform retry.
 */
 function webhook(options) {
 	const passthrough = options.passthrough ?? defaultPassthrough;
@@ -131,9 +139,7 @@ function webhook(options) {
 			if (!verified.ok || !verified.data) return new Response("unauthorized", { status: 401 });
 		} else if (options.verify && !await options.verify(request, body)) return new Response("unauthorized", { status: 401 });
 		const headers = {};
-		request.headers.forEach((value, key) => {
-			if (!DROPPED_HEADERS.has(key)) headers[key] = value;
-		});
+		for (const [key, value] of request.headers.entries()) if (!DROPPED_HEADERS.has(key)) headers[key] = value;
 		const externalId = options.externalId?.(body, request);
 		const stored = await options.inbox.inbound.store({
 			adapter: options.adapter,
@@ -251,16 +257,19 @@ function inboundHandler(options) {
 }
 const CHANNELS = { twilio: "sms" };
 const channelFor = (adapter) => CHANNELS[adapter] ?? adapter;
-/** True while WhatsApp's customer service window is open: within 24 hours of the contact's last message. */
+/**
+* True while WhatsApp's customer service window is open: within 24 hours of the
+* contact's last message.
+*/
 async function whatsappWindowOpen(inbox, conversationId, now = nowInstant()) {
 	const last = (await inbox.messages.list(conversationId, { limit: 200 }).orThrow()).findLast((message) => message.direction === "inbound" && message.kind === "message");
 	return last !== void 0 && last.createdAt.add({ hours: 24 }).epochMilliseconds > now.epochMilliseconds;
 }
 /**
-* Posts a staff reply the `inbox` module queued on its channel, records
-* the delivery with the platform's message id, and remembers the id so
-* `mirror` skips the platform's echo. A failed post is recorded and thrown,
-* so the job retries.
+* Posts a staff reply the `inbox` module queued on its channel, records the
+* delivery with the platform's message id, and remembers the id so `mirror`
+* skips the platform's echo. A failed post is recorded and thrown, so the job
+* retries.
 */
 function deliver(options) {
 	const { chat, inbox } = options;
@@ -299,7 +308,10 @@ function deliver(options) {
 		}
 	};
 }
-/** The inbox's periodic work: wake snoozed conversations, replay and purge webhook events, sweep state. Run it from a cron job. */
+/**
+* The inbox's periodic work: wake snoozed conversations, replay and purge
+* webhook events, sweep state. Run it from a cron job.
+*/
 async function maintain(options) {
 	const woken = await options.inbox.wakeSnoozed().orThrow();
 	const replayed = options.handler ? await options.handler.drain() : {
@@ -316,9 +328,9 @@ async function maintain(options) {
 //#endregion
 //#region src/chat-sdk/identity.ts
 /**
-* The `IdentityRef` of a Chat SDK author: `kind: "chat"`, the adapter name
-* as the provider and the platform's user id. Pass `workspace` (a Slack
-* team id) when one app serves several workspaces.
+* The `IdentityRef` of a Chat SDK author: `kind: "chat"`, the adapter name as
+* the provider and the platform's user id. Pass `workspace` (a Slack team id)
+* when one app serves several workspaces.
 */
 function chatIdentityOf(author, adapter, workspace) {
 	return {
@@ -328,7 +340,10 @@ function chatIdentityOf(author, adapter, workspace) {
 		...workspace === void 0 ? {} : { workspace }
 	};
 }
-/** The user or contact `identity` is linked to; `null` without a resolver or a link. */
+/**
+* The user or contact `identity` is linked to; `null` without a resolver or a
+* link.
+*/
 async function resolveChatAuthor(identity, options) {
 	const resolve = options.principalByIdentity ?? options.server?.authorization?.identities?.principalByIdentity;
 	return resolve ? await resolve(identity) ?? null : null;
@@ -358,10 +373,10 @@ function chatActionOf(event, workspace) {
 	};
 }
 /**
-* Decides a chat button press through the provider: the author is
-* resolved, then `onAction(action, author)` runs. Everything but
-* `allowed: true` refuses, and an unlinked author is refused before the
-* hook runs. Act on the decision, never on the button alone.
+* Decides a chat button press through the provider: the author is resolved,
+* then `onAction(action, author)` runs. Everything but `allowed: true` refuses,
+* and an unlinked author is refused before the hook runs. Act on the decision,
+* never on the button alone.
 */
 function chatActions(options) {
 	return async (action) => {
@@ -423,8 +438,8 @@ function chatActions(options) {
 }
 /**
 * The approval page URL for `request`, with `kind` and `subject` as query
-* parameters. Opening it approves nothing: the signed-in approver decides
-* on the page, and the page's server action or POST route checks them.
+* parameters. Opening it approves nothing: the signed-in approver decides on
+* the page, and the page's server action or POST route checks them.
 */
 function approvalLink(page, request) {
 	const url = new URL(page);
@@ -450,7 +465,10 @@ var MarkdownConverter = class extends BaseFormatConverter {
 	}
 };
 const converter = new MarkdownConverter();
-/** The `IdentityRef` of an inbox contact: `kind: "chat"`, `provider: "inbox"` and the contact id. */
+/**
+* The `IdentityRef` of an inbox contact: `kind: "chat"`, `provider: "inbox"`
+* and the contact id.
+*/
 function inboxIdentityOf(contactId) {
 	return {
 		kind: "chat",
@@ -500,10 +518,10 @@ async function* textOnly(source) {
 	else if (chunk.type === "markdown_text") yield chunk.text;
 }
 /**
-* A Chat SDK adapter for the in-app inbox: the bot reads and writes the
-* `inbox` module's conversations, so one `Chat` instance answers the
-* widget and the other channels. Contact messages reach the bot as jobs
-* on the module's bot queue; pass them to `dispatch`.
+* A Chat SDK adapter for the in-app inbox: the bot reads and writes the `inbox`
+* module's conversations, so one `Chat` instance answers the widget and the
+* other channels. Contact messages reach the bot as jobs on the module's bot
+* queue; pass them to `dispatch`.
 */
 function inboxAdapter(options) {
 	const { inbox } = options;
@@ -726,8 +744,8 @@ function installationOf(value) {
 const APP = { type: "app" };
 const sameRef = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 /**
-* The `chat_installations` registry with the credential lifecycle: every
-* ref an install drops is revoked through the `CredentialProvider`.
+* The `chat_installations` registry with the credential lifecycle: every ref an
+* install drops is revoked through the `CredentialProvider`.
 */
 function createChatInstallations(options) {
 	const call = blockCall(options.transport, options.schema ?? "better_supabase", options.mappers);
@@ -806,8 +824,8 @@ function queueEntryOf(value) {
 const ms = (value) => value === void 0 || value <= 0 ? void 0 : Math.ceil(value);
 /**
 * A Chat SDK `StateAdapter` on the `chat-sdk-state` SQL module: thread
-* subscriptions, locks, the cache, lists and the per-thread queue in
-* Postgres, so a bot needs no Redis. Service role only.
+* subscriptions, locks, the cache, lists and the per-thread queue in Postgres,
+* so a bot needs no Redis. Service role only.
 */
 function createSupabaseState(options) {
 	const prefix = options.keyPrefix ?? "chat-sdk";

package/dist/chat-sdk/react/index.d.ts

@@ -1,3 +1,3 @@
-import { l as InboxSource } from "../../client-BONsuFYf.js";
-import { a as UseInboxOptions, c as useInbox, i as UseConversationOptions, l as useInboxWidget, n as InboxListState, o as UseInboxWidgetOptions, r as InboxWidgetState, s as useConversation, t as ConversationState } from "../../index-1Vsg-7YV.js";
+import { l as InboxSource } from "../../client-BU5Yd0yO.js";
+import { a as UseInboxOptions, c as useInbox, i as UseConversationOptions, l as useInboxWidget, n as InboxListState, o as UseInboxWidgetOptions, r as InboxWidgetState, s as useConversation, t as ConversationState } from "../../index-DLjs7j_z.js";
 export { type ConversationState, type InboxListState, type InboxSource, type InboxWidgetState, type UseConversationOptions, type UseInboxOptions, type UseInboxWidgetOptions, useConversation, useInbox, useInboxWidget };

package/dist/chat-sdk/react/server.d.ts

@@ -1,4 +1,4 @@
-import { l as InboxSource } from "../../client-BONsuFYf.js";
-import { a as UseInboxOptions, i as UseConversationOptions, n as InboxListState, o as UseInboxWidgetOptions, r as InboxWidgetState, t as ConversationState } from "../../index-1Vsg-7YV.js";
+import { l as InboxSource } from "../../client-BU5Yd0yO.js";
+import { a as UseInboxOptions, i as UseConversationOptions, n as InboxListState, o as UseInboxWidgetOptions, r as InboxWidgetState, t as ConversationState } from "../../index-DLjs7j_z.js";
 import { useConversation, useInbox, useInboxWidget } from "../../blocks/inbox/react/server.js";
 export { type ConversationState, type InboxListState, type InboxSource, type InboxWidgetState, type UseConversationOptions, type UseInboxOptions, type UseInboxWidgetOptions, useConversation, useInbox, useInboxWidget };

package/dist/claims-Bp9My7XP.js

@@ -0,0 +1,88 @@
+//#region src/core/claims.ts
+const DEFAULT_CLAIMS = {
+	tenant: "tenant_id",
+	scope: "tenant",
+	features: "features",
+	memberships: "memberships"
+};
+/**
+* The claim paths for `config.claims`, with defaults. For a generated schema,
+* pass `claimsOf(meta)`.
+*/
+function claimPaths(claims) {
+	const resolved = {
+		...DEFAULT_CLAIMS,
+		...claims
+	};
+	return {
+		tenant: tenantClaimPaths(resolved.tenant),
+		features: resolved.features,
+		memberships: resolved.memberships,
+		scope: resolved.scope
+	};
+}
+/** The configured claim names, with defaults for the ones codegen left out. */
+function claimsOf(meta) {
+	if (!meta?.claims) return DEFAULT_CLAIMS;
+	let claims = claimsByMeta.get(meta);
+	if (!claims) {
+		claims = {
+			...DEFAULT_CLAIMS,
+			...meta.claims
+		};
+		claimsByMeta.set(meta, claims);
+	}
+	return claims;
+}
+const claimsByMeta = /* @__PURE__ */ new WeakMap();
+/**
+* Where the active tenant is read from: the top-level claim, then
+* `app_metadata`.
+*/
+function tenantClaimPaths(tenant = DEFAULT_CLAIMS.tenant) {
+	let paths = tenantPaths.get(tenant);
+	if (!paths) {
+		paths = [tenant, `app_metadata.${tenant}`];
+		tenantPaths.set(tenant, paths);
+	}
+	return paths;
+}
+const tenantPaths = /* @__PURE__ */ new Map();
+/**
+* The claim paths a tenant option names: one path, a list, or the configured
+* default (`config.claims.tenant`, then the same key in `app_metadata`).
+*/
+function tenantPathsFor(claim, meta) {
+	if (typeof claim === "string") return [claim];
+	return claim ?? tenantClaimPaths(claimsOf(meta).tenant);
+}
+/**
+* The tenant of a request: `context.tenant`, then the first of `paths` that
+* holds a non-empty string. Every tenant-aware module resolves through this, so
+* they agree on precedence.
+*/
+function tenantFrom(context, paths) {
+	if (typeof context.tenant === "string") return context.tenant;
+	for (const path of paths) {
+		const value = claimAt(context.claims, path);
+		if (value !== void 0) return value;
+	}
+}
+/** Claim paths come from configuration, so this stays small. */
+const segmentsByPath = /* @__PURE__ */ new Map();
+function segmentsOf(path) {
+	let segments = segmentsByPath.get(path);
+	if (!segments) {
+		segments = path.split(".");
+		if (segmentsByPath.size < 256) segmentsByPath.set(path, segments);
+	}
+	return segments;
+}
+/** The string at a dotted claim path, if any. */
+function claimAt(claims, path) {
+	let value = claims;
+	for (const segment of segmentsOf(path)) value = typeof value === "object" && value !== null ? value[segment] : void 0;
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+//#endregion
+export { tenantClaimPaths as a, claimsOf as i, claimAt as n, tenantFrom as o, claimPaths as r, tenantPathsFor as s, DEFAULT_CLAIMS as t };

package/dist/claims-T8TWZ53E.js

@@ -0,0 +1,63 @@
+import { defineMiddleware } from "@supabase/middleware";
+//#region src/auth/claims.ts
+/** Entry contributing `ctx.auth`, the typed caller, from `ctx.bs`. */
+function withAuth() {
+	return defineMiddleware({
+		key: "auth",
+		run: () => (_request, ctx) => Promise.resolve({ auth: ctx.bs.auth })
+	})();
+}
+/**
+* `jwtClaims` as `withSupabase` contributes it: the verified token's payload,
+* or `null`.
+*/
+function jwtClaimsOf(auth) {
+	if (auth.kind === "user") return auth.claims;
+	if (auth.kind === "apiKey") return auth.claims;
+	return null;
+}
+/** `userClaims` as `withSupabase` contributes it, or `null` without a user. */
+function userClaimsOf(auth) {
+	return auth.kind === "user" ? auth.user : null;
+}
+/**
+* `authMode` as `withSupabase` names it: `user` for a verified user token or a
+* user's API key, `secret` for a secret key or an organization's API key,
+* `none` otherwise (no credentials, or ones a guard refuses).
+*/
+function authModeOf(auth) {
+	switch (auth.kind) {
+		case "user": return "user";
+		case "service": return "secret";
+		case "apiKey": return auth.userId ? "user" : "secret";
+		case "anon":
+		case "invalid": return "none";
+		default: return auth;
+	}
+}
+/**
+* Entry contributing `ctx.jwtClaims` under the `withSupabase` key, so
+* `withPostgresClient` and `withOpenFeature` compose downstream.
+*/
+function withJwtClaims() {
+	return defineMiddleware({
+		key: "jwtClaims",
+		run: () => (_request, ctx) => Promise.resolve({ jwtClaims: jwtClaimsOf(ctx.auth) })
+	})();
+}
+/** Entry contributing `ctx.userClaims` under the `withSupabase` key. */
+function withUserClaims() {
+	return defineMiddleware({
+		key: "userClaims",
+		run: () => (_request, ctx) => Promise.resolve({ userClaims: userClaimsOf(ctx.auth) })
+	})();
+}
+/** Entry contributing `ctx.authMode` under the `withSupabase` key. */
+function withAuthMode() {
+	return defineMiddleware({
+		key: "authMode",
+		run: () => (_request, ctx) => Promise.resolve({ authMode: authModeOf(ctx.auth) })
+	})();
+}
+//#endregion
+export { withAuthMode as a, withAuth as i, jwtClaimsOf as n, withJwtClaims as o, userClaimsOf as r, withUserClaims as s, authModeOf as t };

package/dist/cli/add-BRjL7LuG.js

@@ -0,0 +1 @@
+export { t as addCommand } from "./add-Cf0uxfZ2.js";