better-supabase 0.13.0 → 0.15.0

package/dist/gateway-TD1pRfTP.d.ts

@@ -0,0 +1,115 @@
+/// <reference lib="esnext.temporal" />
+import { b as DbError } from "./result-DZeA5KS6.js";
+import { g as JobHandler } from "./types-SFRomQF7.js";
+import { g as AiModelInput, i as AiChat } from "./ai-chat-D1GuRnke.js";
+import { a as Usage, c as UsageEntry, h as UsageStatus } from "./usage-D7QkrwzV.js";
+import { LanguageModelUsage } from "ai";
+//#region src/ai-sdk/gateway.d.ts
+/** Token counts and the gateway's cost of one generation. */
+interface AiUsage {
+  readonly inputTokens: number;
+  readonly outputTokens: number;
+  readonly totalTokens: number;
+  readonly cachedInputTokens: number;
+  readonly reasoningTokens: number;
+  /**
+   * The gateway's generation id, for `costBackfill` when the cost isn't known
+   * yet.
+   */
+  readonly generationId: string | undefined;
+  /** The cost in millionths of a US dollar, when the gateway reported it. */
+  readonly costMicroUsd: number | undefined;
+}
+/** What `usageOf` reads: a `streamText` or `generateText` result, awaited. */
+interface UsageSource {
+  readonly totalUsage?: Partial<LanguageModelUsage> | undefined;
+  readonly usage?: Partial<LanguageModelUsage> | undefined;
+  readonly providerMetadata?: unknown;
+}
+/** The usage of a finished generation, with the gateway's cost when it has one. */
+declare function usageOf(source: UsageSource): AiUsage;
+/**
+ * The usage meters `usageEntries` writes, by default `ai.input_tokens` and
+ * `ai.output_tokens`.
+ */
+interface AiUsageMeters {
+  readonly input?: string;
+  readonly output?: string;
+  /** Micro-USD; left out unless named. */
+  readonly cost?: string;
+}
+/** The entries to pass to `usage.recordMany` for a generation. */
+declare function usageEntries(usage: AiUsage, meters?: AiUsageMeters): UsageEntry[];
+/**
+ * A 429 Problem Details response for a quota or rate limit: pass the
+ * `quota_exceeded` or `rate_limited` error a block returned, or the
+ * `UsageStatus` of a meter with nothing left. It carries `Retry-After`.
+ */
+declare function problem429(decision: DbError | UsageStatus, now?: Temporal.Instant): Response;
+/**
+ * The quota check `createAssistant` runs before a generation: the error when
+ * `meter` has nothing left for the tenant, otherwise `undefined`.
+ */
+declare function usageQuota(usage: Pick<Usage, "current">, meter: string): (organizationId: string) => Promise<DbError | undefined>;
+/** The AI Gateway calls the job handlers make (`gateway` from `ai`). */
+interface GatewayClient {
+  getGenerationInfo(params: {
+    id: string;
+  }): PromiseLike<{
+    readonly totalCost: number;
+    readonly model?: string;
+    readonly promptTokens?: number;
+    readonly completionTokens?: number;
+  }>;
+  getAvailableModels(): PromiseLike<{
+    readonly models: readonly GatewayModelEntry[];
+  }>;
+}
+/** One model of `gateway.getAvailableModels()`. */
+interface GatewayModelEntry {
+  readonly id: string;
+  readonly name: string;
+  readonly description?: string | null;
+  readonly pricing?: Readonly<Record<string, string | undefined>> | null;
+  readonly modelType?: string | null;
+}
+/** The payload of a cost backfill job. */
+interface CostBackfillPayload {
+  readonly generationId: string;
+  /** With `usage` and `meter`, the cost is also recorded on the tenant's meter. */
+  readonly organizationId?: string;
+}
+interface CostBackfillOptions {
+  /** The chat block with a service transport. */
+  readonly chats: Pick<AiChat, "runs">;
+  readonly gateway: Pick<GatewayClient, "getGenerationInfo">;
+  readonly usage?: Pick<Usage, "record">;
+  /** The micro-USD meter, such as `ai.cost`. */
+  readonly meter?: string;
+}
+/**
+ * A job handler that looks up a generation's cost in the AI Gateway and writes
+ * it to the run (`runs.setCost`). Enqueue it when `usageOf` found no cost; it
+ * throws so the queue retries while the gateway doesn't know it yet.
+ */
+declare function costBackfill(options: CostBackfillOptions): JobHandler<CostBackfillPayload>;
+interface ModelCatalogRefreshOptions {
+  /** The chat block with a service transport. */
+  readonly chats: Pick<AiChat, "models">;
+  readonly gateway: Pick<GatewayClient, "getAvailableModels">;
+  /** Keeps a model; defaults to language models. */
+  readonly filter?: (model: GatewayModelEntry) => boolean;
+  /** Plans per model id, for models only some plans may use. */
+  readonly plans?: (model: GatewayModelEntry) => readonly string[] | undefined;
+  /** Deletes catalog rows the gateway no longer lists. Defaults to false. */
+  readonly prune?: boolean;
+}
+/** The catalog row for a gateway model. */
+declare function modelInputOf(model: GatewayModelEntry, plans?: readonly string[]): AiModelInput;
+/**
+ * A job handler that copies the AI Gateway's model list into the chat block's
+ * catalog (`models.upsert`); schedule it daily.
+ */
+declare function modelCatalogRefresh(options: ModelCatalogRefreshOptions): JobHandler<unknown>;
+//#endregion
+export { GatewayClient as a, UsageSource as c, modelInputOf as d, problem429 as f, usageQuota as h, CostBackfillPayload as i, costBackfill as l, usageOf as m, AiUsageMeters as n, GatewayModelEntry as o, usageEntries as p, CostBackfillOptions as r, ModelCatalogRefreshOptions as s, AiUsage as t, modelCatalogRefresh as u };

package/dist/guest-actions-1T1DeS5Y.d.ts

@@ -0,0 +1,5 @@
+//#region src/core/guest-actions.d.ts
+/** What a guest grant allows on a record. */
+type GuestAction = "read" | "comment" | "upload";
+//#endregion
+export { GuestAction as t };

package/dist/guest-actions-B7zdhfnh.js

@@ -0,0 +1,9 @@
+//#region src/core/guest-actions.ts
+/** Every guest action, in the order the grants store them. */
+const GUEST_ACTIONS = [
+	"read",
+	"comment",
+	"upload"
+];
+//#endregion
+export { GUEST_ACTIONS as t };

package/dist/h3/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../refusal-BEyNVFy7.js";
+import { n as RouteGuardOptions } from "../refusal-CSntB_x8.js";
 import { t as Validated } from "../shared-CRRfQAKG.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 //#region src/bridges/h3.d.ts
@@ -39,9 +39,7 @@ type H3Middleware<Context extends object> = (event: H3Event<Context>, next: () =
  *
  * ```ts
  * app.use(toH3([withBetterSupabase(server)]));
- * app.get("/notes", (event) =>
- *   event.context.db.notes.findMany().orThrow(),
- * );
+ * app.get("/notes", (event) => event.context.db.notes.list().orThrow());
  * ```
  */
 export declare function toH3<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, options?: ToH3Options<Partial<Contributions<Entries>>>): H3Middleware<Partial<Contributions<Entries>>>;

package/dist/h3/index.js

@@ -1,5 +1,5 @@
 import { a as toResponse, i as nitroCloudflareEnv, n as bufferInPlace, t as around } from "../shared-Bf-I13Ht.js";
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-Ce2p81VW.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-ByBZcm0V.js";
 //#region src/bridges/h3.ts
 /**
 * Runs an entry array as H3 2 middleware (`app.use(...)`, Nitro and Nuxt server
@@ -9,9 +9,7 @@ import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../re
 *
 * ```ts
 * app.use(toH3([withBetterSupabase(server)]));
-* app.get("/notes", (event) =>
-*   event.context.db.notes.findMany().orThrow(),
-* );
+* app.get("/notes", (event) => event.context.db.notes.list().orThrow());
 * ```
 */
 function toH3(entries, options = {}) {

package/dist/h3/v1/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../../refusal-BEyNVFy7.js";
+import { n as RouteGuardOptions } from "../../refusal-CSntB_x8.js";
 import { t as Validated } from "../../shared-CRRfQAKG.js";
 import { n as NodeRequestHead, t as NodeHeaderTarget } from "../../node-headers-BPtMP4_V.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
@@ -55,8 +55,7 @@ export declare function toH3V1<const Entries extends readonly AnyEntry[]>(entrie
  * const admins = guard({ roles: ["admin"] });
  * export default defineEventHandler(
  *   async (event) =>
- *     (await admins(event)) ??
- *     event.context.db.members.findMany().orThrow(),
+ *     (await admins(event)) ?? event.context.db.members.list().orThrow(),
  * );
  * ```
  */

package/dist/h3/v1/index.js

@@ -1,4 +1,4 @@
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../../refusal-Ce2p81VW.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../../refusal-ByBZcm0V.js";
 import { t as beforeRoute } from "../../before-route-B23K2zYU.js";
 import { n as headRequest, t as applyWebHeaders } from "../../node-headers-C71zNQHe.js";
 //#region src/h3/v1/index.ts
@@ -33,8 +33,7 @@ function toH3V1(entries, options = {}) {
 * const admins = guard({ roles: ["admin"] });
 * export default defineEventHandler(
 *   async (event) =>
-*     (await admins(event)) ??
-*     event.context.db.members.findMany().orThrow(),
+*     (await admins(event)) ?? event.context.db.members.list().orThrow(),
 * );
 * ```
 */

package/dist/hono/index.d.ts

@@ -1,15 +1,15 @@
-import { B as TableKey, a as AnyModels, i as AnyFunctions } from "../types-DmshMaXz.js";
-import { r as AuthState } from "../resolve-D57oDWNr.js";
-import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-DFP3gHv8.js";
-import { t as BetterSupabase } from "../define-D0LSXmUP.js";
-import { t as AuthSession } from "../view-CKzCp8FW.js";
-import { a as ServerContext, c as ServerOptions, l as SharedServer, n as BetterServer } from "../server-types-D_cQ6OxZ.js";
-import { i as MiddlewareOptions, r as GuardOptions } from "../respond-QW-f1yio.js";
-import { c as ResourceLoaderContext, s as BlockRequireOptions } from "../kit-LeQGMzLH.js";
+import { O as AnyFunctions, k as AnyModels, ut as TableKey } from "../types-DFdg_4yN.js";
+import { r as AuthState } from "../resolve-CXX6DHv3.js";
+import { l as PermissionRef, t as AnyAuthorizer } from "../authorizer-B6X09otb.js";
+import { t as BetterSupabase } from "../define-DFBnQyYg.js";
+import { a as ServerContext, c as ServerOptions, et as SessionSnapshot, l as SharedServer, n as BetterServer } from "../server-types-CFtehAsr.js";
+import { t as AuthSession } from "../view-DyFdMCqg.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-Dn1_YhC1.js";
+import { c as ResourceLoaderContext, s as BlockRequireOptions } from "../kit-DOwKpSkA.js";
 import { t as CorsOptions } from "../cors-kLq6VM06.js";
-import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-NXau9LJE.js";
-import { t as defineAction } from "../resource-execute-BbjuiXwD.js";
-import { i as RouteRateLimitRule, n as RateLimitVerdict, r as RateLimiter, t as RateLimitRouteOptions } from "../rate-limit-B7N1ZGl6.js";
+import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-DnKiH4G2.js";
+import { t as defineAction } from "../resource-execute-CzHuDsil.js";
+import { i as RouteRateLimitRule, n as RateLimitVerdict, r as RateLimiter, t as RateLimitRouteOptions } from "../rate-limit-Bztf32cl.js";
 import { AnyEntry, Contributions, ValidateEntries } from "@supabase/middleware";
 import { Context, ErrorHandler, Hono, MiddlewareHandler } from "hono";
 //#region src/bridges/hono.d.ts
@@ -40,11 +40,16 @@ export declare function toHono<const Entries extends readonly AnyEntry[]>(entrie
 /** Hono `Env` with the request's better-supabase context in `c.var`. */
 export interface HonoEnv<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> {
   Variables: {
-    readonly bs: ServerContext<M, F, E, C, P, B>;
+    readonly bsb: ServerContext<M, F, E, C, P, B>;
     readonly db: ServerContext<M, F, E, C, P, B>["db"];
     readonly auth: AuthState<C, P>;
     /** The caller as plain data, safe to return in a response. */
     readonly session: AuthSession<C, P>;
+    /**
+     * The verified user for `bsb.contextFromSession()`. Holds the access token:
+     * never return it in a response.
+     */
+    readonly snapshot: SessionSnapshot<C> | null;
     /** The active tenant: `ServerOptions.tenant`, then the tenant claim. */
     readonly tenant: string | undefined;
   };
@@ -74,25 +79,26 @@ export interface HonoOptions extends ServerOptions {
 }
 export interface BetterHono<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Ref = string, B = unknown> extends BetterServer<M, F, E, C, P, B> {
   /**
-   * The app's Hono `Env`, for `new Hono<typeof bs.Env>()` and `Context<typeof
-   * bs.Env>`. Type only: `undefined` at runtime.
+   * The app's Hono `Env`, for `new Hono<typeof bsb.Env>()` and `Context<typeof
+   * bsb.Env>`. Type only: `undefined` at runtime.
    */
   readonly Env: HonoEnv<M, F, E, C, P, B>;
-  /** `new Hono<typeof bs.Env>()` with `onError(bs.onError)` installed. */
+  /** `new Hono<typeof bsb.Env>()` with `onError(bsb.onError)` installed. */
   app(): Hono<HonoEnv<M, F, E, C, P, B>>;
   /**
-   * Resolves the caller, enforces `allow` and sets `c.var.bs`, `c.var.db`,
+   * Resolves the caller, enforces `allow` and sets `c.var.bsb`, `c.var.db`,
    * `c.var.auth`.
    */
   middleware(options?: MiddlewareOptions): MiddlewareHandler<HonoEnv<M, F, E, C, P, B>>;
   /**
    * A route guard after `middleware()`: `allow`, `aal`, `scopes`,
-   * `requireTenant` and `authorize`. A refused caller gets Problem Details.
+   * `requireOrganization` and `authorize`. A refused caller gets Problem
+   * Details.
    *
    * ```ts
    * app.post(
    *   "/invites",
-   *   bs.require({ requireTenant: true, roles: ["admin"] }),
+   *   bsb.require({ requireOrganization: true, roles: ["admin"] }),
    *   handler,
    * );
    * ```
@@ -106,7 +112,7 @@ export interface BetterHono<M extends AnyModels, F extends AnyFunctions, E, C =
    * ```ts
    * app.use(
    *   "/api/*",
-   *   bs.rateLimit({
+   *   bsb.rateLimit({
    *     limiter,
    *     scope: "api",
    *     rule: { max: 100, period: "1 minute" },
@@ -124,7 +130,7 @@ export interface BetterHono<M extends AnyModels, F extends AnyFunctions, E, C =
     readonly status?: number;
   }): (c: Context<HonoEnv<M, F, E, C, P, B>>) => Promise<Response>;
   /**
-   * `app.onError(bs.onError)`: `DbException`s (and errors caused by a
+   * `app.onError(bsb.onError)`: `DbException`s (and errors caused by a
    * `DbError`) become Problem Details, Hono's `HTTPException`s keep their own
    * response, and anything else is a 500.
    */
@@ -132,7 +138,7 @@ export interface BetterHono<M extends AnyModels, F extends AnyFunctions, E, C =
   /**
    * REST routes for a table matching the API model: the collection, the item
    * and each action's path. Mount with `app.route('/customers',
-   * bs.resource('customers'))` behind `middleware()`.
+   * bsb.resource('customers'))` behind `middleware()`.
    */
   resource<T extends TableKey<M>>(table: T, options?: ResourceRouteOptions<M, T, Ref, ServerContext<M, F, E, C, P, B>["db"]>): Hono<HonoEnv<M, F, E, C, P, B>>;
 }

package/dist/hono/index.js

@@ -1,15 +1,15 @@
-import { r as dbErrorOf } from "../errors-D7u24ZJH.js";
-import { o as problemResponse } from "../problem-D0KDiYPk.js";
-import { a as unexpectedResponse, c as extendServer, n as flushEvents, s as createServer } from "../adapter-D8dW6p2A.js";
-import { n as toSession } from "../view-CfUd5vI9.js";
-import { a as respond, t as defaultExpose } from "../respond-DjEmE_DN.js";
-import { t as withBetterSupabase } from "../composite-BgSdL5tk.js";
-import { r as defineAction, t as defineResource } from "../resource-BVvIiuX_.js";
-import { i as requireCaller } from "../kit-BeXTrlZn.js";
-import { t as matchResource } from "../resources-CIi7sw1T.js";
+import { r as dbErrorOf } from "../errors-BVFgt8BZ.js";
+import { o as problemResponse } from "../problem-Bf0cJ7tk.js";
+import { a as unexpectedResponse, c as extendServer, n as flushEvents, s as createServer } from "../adapter-B0b6MXYS.js";
+import { l as snapshotOf, n as toSession } from "../view-C8Ve14ja.js";
+import { a as respond, t as defaultExpose } from "../respond-C3CcOZlA.js";
+import { t as withBetterSupabase } from "../composite-BARuBEDE.js";
+import { i as defineAction, t as defineResource } from "../resource-DV2GC2dB.js";
+import { i as requireCaller } from "../kit-5l-o8RxL.js";
+import { t as matchResource } from "../resources-C02l_YBJ.js";
 import { r as handoffOf } from "../shared-Bf-I13Ht.js";
 import { n as corsConfig } from "../cors-h_v7TPxl.js";
-import { t as rateLimitGate } from "../rate-limit-CXpPm4_l.js";
+import { t as rateLimitGate } from "../rate-limit-BWKGlhTM.js";
 import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { withCors } from "@supabase/middleware/cors";
 import { Hono } from "hono";
@@ -23,7 +23,7 @@ function publishAll(c, ctx) {
 }
 /**
 * The Hono middleware for `entries`. `publish` decides what lands on `c.var`;
-* `createHono` adds `auth` from `ctx.bs`.
+* `createHono` adds `auth` from `ctx.bsb`.
 */
 function honoMiddleware(entries, publish = publishAll) {
 	const run = pipeline(entries, async (_request, ctx) => {
@@ -68,8 +68,8 @@ function toHono(entries) {
 //#endregion
 //#region src/hono/index.ts
 function contextOf(c) {
-	const ctx = c.get("bs");
-	if (!ctx) throw new TypeError("better-supabase: no context on this request; add app.use(bs.middleware()) first");
+	const ctx = c.get("bsb");
+	if (!ctx) throw new TypeError("better-supabase: no context on this request; add app.use(bsb.middleware()) first");
 	return ctx;
 }
 function segmentsOf(path) {
@@ -118,12 +118,13 @@ function createHono(betterSupabase, options = {}) {
 				...middlewareOptions,
 				expose
 			})], (c, ctx) => {
-				const bs = ctx.bs;
+				const bsb = ctx.bsb;
 				const { tenant } = ctx;
-				c.set("bs", bs);
-				c.set("db", bs.db);
-				c.set("auth", bs.auth);
-				c.set("session", toSession(bs.auth));
+				c.set("bsb", bsb);
+				c.set("db", bsb.db);
+				c.set("auth", bsb.auth);
+				c.set("session", toSession(bsb.auth));
+				c.set("snapshot", snapshotOf(bsb.auth));
 				c.set("tenant", tenant);
 			});
 			return async (c, next) => {
@@ -136,7 +137,7 @@ function createHono(betterSupabase, options = {}) {
 		},
 		require: (requireOptions = {}) => async (c, next) => {
 			const ctx = contextOf(c);
-			const caller = await requireCaller(ctx.auth, requireOptions, c.get("tenant"), options.authorizer, ctx);
+			const caller = await requireCaller(ctx.auth, requireOptions, c.get("tenant"), server.authorizer, ctx);
 			if ("kind" in caller) return problemResponse(caller, {
 				instance: new URL(c.req.url).pathname,
 				expose
@@ -168,7 +169,7 @@ function createHono(betterSupabase, options = {}) {
 			};
 		},
 		resource(table, resourceOptions) {
-			const resource = defineResource(betterSupabase, table, resourceOptions, options.authorizer);
+			const resource = defineResource(betterSupabase, table, resourceOptions, server.authorizer);
 			const { keyParam } = resource;
 			const app = new Hono();
 			const serve = (pattern) => async (c) => {
@@ -184,6 +185,7 @@ function createHono(betterSupabase, options = {}) {
 			const patterns = [
 				"/",
 				...resource.plan.actions.map((action) => `/${action.segments.map((segment) => segment.startsWith("{") ? `:${keyParam}` : segment).join("/")}`),
+				...resource.plan.verbs.map((verb) => `/${verb}`),
 				...keyParam ? [`/:${keyParam}`] : [],
 				"/*"
 			];

package/dist/http-7-UvHjQe.js

@@ -0,0 +1,28 @@
+import { n as dbError } from "./errors-BVFgt8BZ.js";
+import { o as problemResponse } from "./problem-Bf0cJ7tk.js";
+import { UI_MESSAGE_STREAM_HEADERS } from "ai";
+//#region src/ai-sdk/http.ts
+/** A 400 problem response for a malformed chat request. */
+function badRequest(message) {
+	return problemResponse(dbError("invalid_request", message, { code: "AI_CHAT_BAD_REQUEST" }));
+}
+/** The JSON body of a request, or `undefined` when it is not JSON. */
+async function readJson(request) {
+	try {
+		return await request.json();
+	} catch {
+		return;
+	}
+}
+/**
+* A UI message stream as a response, with extra headers such as the workflow
+* run id.
+*/
+function sse(stream, headers = {}) {
+	return new Response(stream.pipeThrough(new TextEncoderStream()), { headers: {
+		...UI_MESSAGE_STREAM_HEADERS,
+		...headers
+	} });
+}
+//#endregion
+export { readJson as n, sse as r, badRequest as t };

package/dist/impersonation-DM3oWNoD.js

@@ -0,0 +1,62 @@
+import { n as actorOf } from "./actor-go7p9-CJ.js";
+//#region src/auth/impersonation.ts
+/** The `act` claim for an impersonated session. */
+function actClaim(options) {
+	return {
+		kind: "impersonation",
+		sub: options.actor,
+		reason: options.reason
+	};
+}
+/** The `act` claim that `impersonatorOf` reads back as `impersonator`. */
+function impersonatorClaim(impersonator) {
+	const reason = impersonator.reason === void 0 ? {} : { reason: impersonator.reason };
+	return impersonator.kind === "support" ? {
+		kind: "support",
+		sub: impersonator.id,
+		session_id: impersonator.sessionId,
+		read_only: impersonator.readOnly ?? true,
+		...reason
+	} : {
+		kind: "impersonation",
+		sub: impersonator.id,
+		...reason
+	};
+}
+/**
+* The admin in `claims.act`: a support session or an impersonated session
+* (`actorOf` reads the same level, so the two always agree). `undefined` for a
+* normal session, an OAuth client or agent chain, and an invalid `act`.
+*/
+function impersonatorOf(claims) {
+	const outcome = actorOf(claims);
+	const actor = outcome.ok ? outcome.actor : void 0;
+	if (actor === void 0) return;
+	switch (actor.kind) {
+		case "oauth-client":
+		case "agent": return;
+		case "support":
+		case "impersonation": return { ...actor };
+		default: return actor;
+	}
+}
+/**
+* The repository context of a signed-in user: the actor, with the impersonator
+* from `act`, and the claims. Every adapter builds it here, so plugins see the
+* same actor on the server, in middleware and in the browser.
+*/
+function userContext(user, claims) {
+	const impersonator = impersonatorOf(claims);
+	return {
+		actor: {
+			id: user.id,
+			kind: "user",
+			...user.role ? { role: user.role } : {},
+			...user.email ? { email: user.email } : {},
+			...impersonator ? { impersonator: impersonator.id } : {}
+		},
+		claims
+	};
+}
+//#endregion
+export { userContext as i, impersonatorClaim as n, impersonatorOf as r, actClaim as t };